This is a ready-to-use crosswalk for mapping a sponsor’s own deviation severity and impact taxonomy against each contract manufacturer’s local classification scheme, so a partner’s label is never assumed to mean what it sounds like it means. Replace every <<FILL: ...>> placeholder with your own specifics and route the completed crosswalk through your normal document control system, reviewed on the same cadence as the quality agreement audit and whenever a partner revises its own deviation procedure. A filled specimen follows.
Document control header
| Field | Entry |
|---|---|
| Document title | Deviation Severity and Impact Taxonomy Crosswalk for <<FILL: sponsor / network>> |
| Document number | <<FILL: e.g. DSC-2026-03>> |
| Version | <<FILL>> |
| Owner | <<FILL: e.g. Supply Chain Quality lead>> |
| Last reviewed | <<FILL>> |
| Next scheduled review | <<FILL>> |
1. Purpose
This crosswalk maps the sponsor’s own deviation severity and impact taxonomy against every CDMO partner’s local classification scheme, so a partner’s tier label is never relied on at face value and every mapping between a local tier and a sponsor-side consequence, notification clock, escalation path, is explicit and reviewable.
2. Scope
| Dimension | Decision |
|---|---|
| Sponsor entity / program in scope | <<FILL>> |
| CDMO partners in scope | <<FILL: list every site>> |
| Out of scope | <<FILL: e.g. internal sponsor-site deviations, covered under the internal QMS>> |
3. Sponsor reference taxonomy
| Sponsor tier | Definition | CQA impact expectation | Notification clock |
|---|---|---|---|
| Critical | <<FILL>> | <<FILL>> | <<FILL>> |
| Major | <<FILL>> | <<FILL>> | <<FILL>> |
| Minor | <<FILL>> | <<FILL>> | <<FILL>> |
4. Per-CDMO crosswalk
Complete one block per CDMO partner. Do not assume a tier maps cleanly to a single sponsor tier; where a local tier’s true sponsor-side classification depends on a second factor, state that factor explicitly rather than forcing a one-to-one mapping.
| CDMO | Local tier | Local definition | Mapped sponsor tier | Depends on a second factor (Y/N) | Gap flag |
|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL: Y/N, describe if Y>> |
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
5. Gap resolution
For every row flagged with a gap in section 4, state how it is resolved until the underlying quality agreement or local SOP is revised to close it.
| CDMO | Gap | Interim handling | Target resolution date |
|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
6. Review triggers and currency
| Requirement | Status |
|---|---|
| Reviewed on the same cadence as the quality agreement audit | <<FILL: date of last joint review>> |
| Reviewed after any CDMO partner’s internal deviation SOP revision | <<FILL: date / N/A this period>> |
| Reviewed when a new CDMO joins the network | <<FILL: date / N/A this period>> |
| Every local tier in use has an explicit mapped equivalent, no row left blank | <<FILL: yes/no>> |
7. Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Author (Supply Chain Quality) | <<FILL>> | ||
| Regulatory Affairs | <<FILL>> | ||
| Quality Assurance | <<FILL>> |
8. References
FDA guidance, “Contract Manufacturing Arrangements for Drugs: Quality Agreements” (2016). ICH Q10, Pharmaceutical Quality System, Section 2.7, Management of Outsourced Activities and Purchased Materials.
Confirm the current version of each reference before issue.
9. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL>> | <<FILL>> | Initial issue. |
Filled specimen
Extract from Acme Therapeutics’ crosswalk covering its three-CDMO network, CMO Alpha (drug substance), CMO Beta (fill-finish), and CMO Gamma (packaging).
| CDMO | Local tier | Local definition | Mapped sponsor tier | Depends on a second factor | Gap flag |
|---|---|---|---|---|---|
| CMO Alpha | Critical | Direct, confirmed impact to a released batch’s identity, strength, purity, or quality | Critical | N | None |
| CMO Beta | Class II | Any deviation from an approved procedure not immediately resolved by an in-process correction, spanning both CQA-impacting and non-CQA-impacting events | Major or Minor | Y | Yes: CMO Beta’s Class II folds together what Acme’s own taxonomy splits into Major and Minor depending on whether the specific event touched a defined CQA; a Class II event cannot be classified sponsor-side from the label alone and requires the underlying investigation summary before Acme can assign a tier |
| CMO Gamma | Minor | No product quality impact, procedural or documentation deviation only | Minor | N | None |
Gap resolution: for CMO Beta, every Class II notification is reviewed against the event’s stated CQA impact before Acme assigns its own sponsor-side tier and starts the corresponding notification clock, an interim manual step logged until CMO Beta’s next deviation SOP revision, targeted for <<FILL: date>>, splits Class II into two sub-tiers matching Acme’s own taxonomy.
The specimen shows exactly the failure the crosswalk exists to catch: read at the label level, “Class II” sounds like a single, defined severity, but its actual scope crosses two of Acme’s own tiers, and the gap would have stayed invisible until a Class II event with real CQA impact was treated, by label alone, as equivalent to a Class II event that was purely procedural.
Common inspection findings this matrix prevents
- A sponsor treating a CDMO’s tier label as self-explanatory with no documented mapping to the sponsor’s own taxonomy.
- A crosswalk built once at onboarding and never revisited after a partner revised its own deviation SOP.
- A local tier that folds together two sponsor-side consequences, mapped naively as a single equivalent with no record of the second factor that actually determines classification.
- A gap identified in the crosswalk with no interim handling documented, left open until the underlying agreement or SOP is formally revised.
How to adapt this crosswalk
- Populate section 3 with your own organization’s actual severity taxonomy and its real notification-clock and CQA-impact consequences, not a generic critical/major/minor label set with no definitions behind it.
- Complete one block in section 4 per CDMO, reading each partner’s own deviation SOP directly rather than assuming the label translates.
- Where a local tier depends on a second factor to classify correctly, say so explicitly in section 4 rather than forcing a clean one-to-one mapping that does not exist.
- Log every open gap in section 5 with an interim handling method, not just a target resolution date.
- Re-run this crosswalk whenever a partner’s deviation SOP changes, not only on the fixed review cadence.