This is a ready-to-use plan for running a CDMO technical due diligence exercise before a contract is signed. It structures the assessment itself, scope, roles, schedule, and acceptance, and hands off into the CDMO Technical Assessment Scorecard for scoring and the disposition register for tracking what the assessment finds. Replace every <<FILL: ...>> placeholder with your own specifics and route the completed plan through your normal document control, review, and approval. A worked filled specimen follows. Verify each cited reference against the current source before you rely on it.
Document control header
| Field | Entry |
|---|---|
| Document title | CDMO Technical Due Diligence Plan for <<FILL: program / product>> |
| Document number | <<FILL: e.g. DD-2026-04>> |
| Version | <<FILL>> |
| Effective date | <<FILL>> |
| CDMO(s) under evaluation | <<FILL: name(s), site(s)>> |
| Plan owner | <<FILL: e.g. Outsourcing / Technical Operations lead>> |
| Target contract signature date | <<FILL>> |
1. Purpose
This plan defines how the technical due diligence of <<FILL: CDMO name(s)>> will be run for <<FILL: program / product>>, so the selection decision rests on a structured, cross-functional assessment with a documented record, rather than a facility tour and a set of sales-driven claims.
2. Scope
| Dimension | Decision |
|---|---|
| Process / service in scope | <<FILL: e.g. drug substance, drug product fill-finish, analytical testing>> |
| Site(s) in scope | <<FILL>> |
| Assessment type | <<FILL: initial selection / periodic reassessment of an incumbent>> |
| Out of scope | <<FILL: e.g. commercial and pricing terms, covered under a separate business review>> |
3. Approach
The assessment runs the technical assessment and the GMP quality audit together wherever schedule allows, sharing one findings list rather than two disconnected reports. Evidence review always outranks a claim: a scored dimension needs a record, a document, or a demonstrated system behind it, not an assertion from the CDMO’s own staff. At least one reference call is arranged independently of the CDMO, not solely through contacts the CDMO selects.
| Assessment activity | Method | Evidence expected |
|---|---|---|
| Capability review | Document review plus technical Q&A with process/manufacturing SMEs | Batch records or campaign summaries from comparable prior work, not a capability slide |
| Capacity review | Direct request for current facility utilization and the specific slot proposed for this program | A named slot with a start date, not a general “we can accommodate you” |
| Equipment fit | Site walkthrough or virtual tour plus an equipment gap-assessment table (scale, single-use vs. stainless, utilities) | Completed gap table with a disposition per row |
| Quality systems | Quality audit, run jointly or in parallel, reviewing deviation, CAPA, and change control records directly | Direct record review, not a summarized metric only |
| Analytical readiness | Review of instrument qualification status, reference standard sourcing, and a proposed method transfer plan | A method-by-method transfer approach, not a blanket assurance |
| Data integrity posture | Direct questions on audit trail configuration and review frequency by data criticality | A named review frequency and role, not “we have an audit trail” |
| Culture / reference check | At least one reference call arranged independently, ideally about a program that had a real problem | Notes from the independent call, kept with the assessment record |
4. Risk basis for depth
The depth of this assessment scales with risk per ICH Q9(R1)‘s formality principle: rigor should track risk, not apply uniformly. State the basis for the depth chosen below.
| Risk factor | This program’s status | Implication for assessment depth |
|---|---|---|
| Modality novelty to this CDMO | <<FILL: e.g. first-in-class for this site / well-established at this site>> | <<FILL>> |
| Sole-source or single-patient-population dependency | <<FILL>> | <<FILL>> |
| Target market GMP expectations (e.g. EU Annex 1 for sterile ATMP product) | <<FILL>> | <<FILL>> |
5. Roles
| Role | Responsibility |
|---|---|
| Plan owner / lead assessor | Runs the assessment to this plan, compiles findings, drafts the decision summary |
| Technical operations / MSAT SME | Scores capability, capacity, and equipment fit with direct evidence |
| Analytical / QC representative | Assesses analytical transfer readiness and reference standard sourcing |
| Quality Assurance | Runs or co-runs the quality audit, scores quality systems and data integrity posture, confirms every red flag is risk-assessed |
| Regulatory / CMC | Confirms the site’s inspection history and regulatory standing |
| Executive sponsor | Approves the plan, receives the decision summary, owns the final selection decision |
6. Schedule
| Milestone | Target date |
|---|---|
| Plan approved | <<FILL>> |
| Document request sent to CDMO | <<FILL>> |
| Site visit / virtual assessment conducted | <<FILL>> |
| Independent reference call(s) completed | <<FILL>> |
| Scorecard and disposition register completed | <<FILL>> |
| Decision summary delivered to executive sponsor | <<FILL>> |
| Target contract signature | <<FILL>> |
7. Deliverables
- A completed CDMO Technical Assessment Scorecard with evidenced scores across every dimension.
- A completed disposition register (see the paired CDMO Finding Disposition Register) covering every finding, with an owner and a target date for each.
- A decision summary stating the recommendation and any conditions.
- Independent reference call notes, retained with the assessment record.
8. Acceptance criteria for the assessment to be considered complete
Every scored dimension in the scorecard carries evidence, not just a number. Every identified red flag carries a documented Quality Assurance risk acceptance or a stated remediation plan with an owner and a date. At least one reference call was arranged independently of the CDMO. The decision summary states a clear recommendation, not an open-ended “further discussion needed.”
9. Handoff into the technical agreement
Findings that are risk-accepted or require remediation feed directly into the technical agreement described in FDA’s 2016 guidance, Contract Manufacturing Arrangements for Drugs: Quality Agreements, and its operational counterpart. No finding is dropped between the assessment record and the agreement; each one is traceable from the disposition register into a specific clause or a specific tracked commitment.
10. References
ICH Q9(R1), Quality Risk Management. ICH Q10, Pharmaceutical Quality System. FDA guidance, “Contract Manufacturing Arrangements for Drugs: Quality Agreements” (November 2016). EU GMP Chapter 7, Outsourced Activities.
Confirm the current version of each reference before issue.
11. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL>> | <<FILL>> | Initial issue. |
12. Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Plan owner | <<FILL>> | ||
| Quality Assurance | <<FILL>> | ||
| Approver (Outsourcing / CMC leadership) | <<FILL>> |
Filled specimen
Extract from a due diligence plan for a fill-finish CDMO for Acme Therapeutics’ ATX-410 lyophilized biologic, a first-in-class modality for the CDMO under evaluation.
| Field | Entry |
|---|---|
| Scope | Drug product fill-finish and lyophilization only; drug substance manufacturing out of scope, handled at a separate site |
| Risk basis | First-in-class modality for this CDMO drives a full-depth assessment across every dimension; target market includes the EU, so Annex 1 contamination control posture is assessed explicitly |
| Schedule | Plan approved week 1; document request and site visit weeks 2 to 4; independent reference call week 4; scorecard and register complete week 5; decision summary to executive sponsor week 6, four weeks ahead of the target signature date |
| Key finding routed to acceptance criteria check | Lyophilizer chamber scale mismatch (see the scorecard specimen) required a bridging engineering run before PPQ; captured in the disposition register with a named owner and target date before the assessment was marked complete |
The specimen shows the pattern that matters: the risk basis set the depth before the assessment started, the schedule left real time before the signature date rather than compressing diligence to fit a date already set, and the one significant finding was tracked to a named owner and date, not left as an unresolved note in the final report.
Common inspection findings this plan prevents
- A CDMO selection decision with no documented plan for how the assessment itself was supposed to run, making it impossible to show an inspector the diligence was systematic.
- A site visit conducted with no prior document request, so the visit becomes a tour rather than an evidence review.
- Reference calls skipped entirely, or arranged only through the CDMO’s chosen contacts.
- A decision summary delivered after the contract is already signed, turning the assessment into a formality.
How to adapt this plan
- Set your document number, program, and CDMO(s) in the header.
- Set the risk basis in section 4 before scoping assessment depth, and document the reasoning, not just the conclusion.
- Confirm the schedule in section 6 leaves real time before the target signature date; do not let the signature date compress the diligence window after the fact.
- Point section 7’s deliverables at your own scorecard and register documents.
- Confirm every reference in section 10 against the current published version before issue.