This is a ready-to-use matrix for a sponsor that outsources some or all of its manufacturing, stating clearly which GxP-relevant system or activity is governed by the sponsor’s own Validation Master Plan and which is governed by the CDMO’s, so neither program is left assuming the other one covers a gap. Replace every <<FILL: ...>> placeholder with your own specifics. A filled specimen follows.
Document control header
| Field | Entry |
|---|---|
| Document title | Sponsor-CDMO VMP Scope Boundary Matrix for <<FILL: program / product>> |
| Document number | <<FILL>> |
| Version | <<FILL>> |
| Effective date | <<FILL>> |
| CDMO(s) covered | <<FILL: name each CDMO and the activity it performs>> |
| Linked quality agreement(s) | <<FILL: agreement number, version>> |
| Owner | <<FILL: e.g. Head of Validation or Quality>> |
1. Purpose
This matrix states, system by system and activity by activity, whether the sponsor’s own Validation Master Plan or the CDMO’s site Validation Master Plan governs a given GxP-relevant item, tracing each assignment back to the quality agreement clause that supports it. It exists so a sponsor with no owned manufacturing facility can state its VMP’s actual scope accurately, neither claiming ownership of what the CDMO already governs nor silently assuming the CDMO covers something the sponsor itself remains accountable for.
2. Scope
Applies to <<FILL: product / program>>, covering every GxP-relevant system, process, or activity connected to its manufacture, testing, or release, across the sponsor’s own operations and every CDMO named above.
3. Method
For every system or activity in scope, ask two questions in order. First, does it create, modify, store, or affect data or decisions bearing on product quality, patient safety, or data integrity; anything that clears this test proceeds to the second question, anything that does not is out of scope for both parties’ VMPs and is recorded as such. Second, which party is accountable for it under the quality agreement: the CDMO, because the activity happens inside its own qualified facility and quality system, or the sponsor, because the activity is the sponsor’s own oversight function, a system the sponsor itself owns, or an activity the quality agreement specifically reserves to the sponsor. Record the quality agreement clause supporting the assignment; an assignment with no clause behind it is a finding, not a completed row.
4. Boundary matrix
| # | System / activity | GxP impact | Governing VMP | Quality agreement clause | Notes |
|---|---|---|---|---|---|
| 1 | <<FILL: e.g. drug substance manufacturing suite and utilities>> | <<FILL: Yes/No>> | <<FILL: CDMO / Sponsor>> | <<FILL>> | <<FILL>> |
| 2 | <<FILL: e.g. person-in-plant oversight program>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| 3 | <<FILL: e.g. chain-of-identity / chain-of-custody tracking system>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| 4 | <<FILL: e.g. analytical release method, sponsor lab>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| 5 | <<FILL: e.g. computerized system validation of the CDMO's MES>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Add one row per system or activity; a program using two or more CDMOs across different manufacturing steps typically needs a separate set of rows per CDMO relationship.
5. Gap check
| Finding | Description | Resolution owner |
|---|---|---|
<<FILL: e.g. no clause in the quality agreement assigns computerized system validation of the CDMO's MES to either party explicitly>> | <<FILL>> | <<FILL>> |
An item with GxP impact and no governing VMP assigned by either party is the finding this matrix exists to prevent; resolve it by amending the quality agreement or the sponsor’s VMP scope statement before treating the boundary as closed.
6. Disposition
| Field | Entry |
|---|---|
| Total items reviewed | <<FILL>> |
| Items with an unresolved governance gap | <<FILL>> |
| Recommendation | Boundary confirmed current / Hold pending resolution of item(s) <<FILL>> |
7. References
See the paired article, Validation Master Planning for a Clinical-Stage Biotech, for the reasoning behind scoping a VMP when manufacturing is outsourced. ICH Q10, Pharmaceutical Quality System, Section 2.7, on outsourced activities and the sponsor’s retained accountability. FDA guidance, “Contract Manufacturing Arrangements for Drugs: Quality Agreements” (2016).
8. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL>> | <<FILL>> | Initial issue. |
9. Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Author (Quality / Validation) | <<FILL>> | ||
| Approver (Quality Assurance) | <<FILL>> |
Filled specimen
Extract for an illustrative virtual autologous cell therapy sponsor working with one drug substance CDMO and a separate fill-finish CDMO. Company and CDMO names are illustrative.
| # | System / activity | GxP impact | Governing VMP | Quality agreement clause | Notes |
|---|---|---|---|---|---|
| 1 | Drug substance manufacturing suite, utilities, and process equipment | Yes | CDMO (drug substance) | QA-2026-014, Section 4.1 | CDMO’s own site VMP covers IQ/OQ/PQ and utility qualification; sponsor confirms currency annually per the CDMO technical assessment cycle |
| 2 | Fill-finish suite and equipment | Yes | CDMO (fill-finish) | QA-2026-021, Section 4.1 | Separate CDMO, separate quality agreement, separate VMP; not covered by the drug substance CDMO’s program |
| 3 | Person-in-plant oversight program at both CDMOs | Yes | Sponsor | QA-2026-014 Section 6.2; QA-2026-021 Section 6.2 | Sponsor’s own VMP governs the PIP program itself, including training, escalation authority, and periodic review of the program |
| 4 | Chain-of-identity and chain-of-custody tracking system, apheresis collection through infusion | Yes | Sponsor | QA-2026-014, Section 8.3 | System is sponsor-owned and spans both CDMOs plus the logistics partner; neither CDMO’s VMP has visibility into the full chain |
| 5 | Potency release assay, run at a sponsor-contracted analytical lab | Yes | Sponsor | QA-2026-014, Section 5.4 | Method validated and held by the sponsor’s analytical lab, not either manufacturing CDMO |
Gap check finding: item 3’s escalation authority for a Class III observation (the CDMO’s internal severity tier for the most serious floor-level finding) was not explicitly stated in either quality agreement, only implied by the PIP program’s own SOP. Resolution: amended QA-2026-014 Section 6.2 to state the escalation path and authority explicitly, closing the gap between what the PIP SOP assumed and what the quality agreement actually granted.
Common findings this matrix prevents
- No sponsor-side VMP at all, on the unstated assumption that the CDMO’s own VMP already covers the sponsor’s retained accountability.
- A GxP-relevant activity, most often the sponsor’s own oversight or a sponsor-owned computerized system, left ungoverned by either party’s VMP because neither document names it.
- A boundary assumed rather than traced to an actual quality agreement clause, so the assignment cannot survive a direct inspection question about where the authority for it actually comes from.
- A program using two or more CDMOs where the boundary matrix was built once, for the first CDMO relationship, and never extended when a second CDMO was added.
How to adapt this matrix
- List every GxP-relevant system and activity connected to the product’s manufacture, testing, and release, not only the obvious manufacturing steps.
- Run the two-question method in section 3 for each item, and do not accept “the CDMO probably covers that” as a completed answer; trace it to the actual quality agreement clause.
- Build a separate set of rows for each CDMO relationship if the program uses more than one.
- Re-run this matrix whenever a new CDMO relationship starts, an existing quality agreement is amended, or the VMP periodic review cycle described in Validation Master Planning comes due.