A quality agreement is supposed to define who does what when a drug is manufactured at a contract site. In practice, FDA inspectors use the quality agreement as a diagnostic tool: if the agreement is vague, outdated, or missing, the inspection team already knows where to look for systemic quality failures. FDA's November 2016 guidance, Contract Manufacturing Arrangements for Drugs: Quality Agreements (FDA-2013-D-0558), states the agency's expectation explicitly, and enforcement data through 2025 confirm that quality-agreement deficiencies remain one of the most common escalation paths from a Form 483 observation to a Warning Letter.
This article is for quality leads, CDMO oversight managers, and regulatory affairs professionals responsible for contract manufacturing relationships. It identifies the specific quality-agreement red flags that show up most often in FDA inspection findings, links each to the relevant 21 CFR citation, and describes the corrective action sponsors should demand.
FDA's enforcement posture on contract manufacturing
Both parties are responsible
FDA's guidance is unambiguous: quality agreements cannot delegate statutory or regulatory responsibilities. Both the owner (sponsor) and the contracted facility are responsible for CGMP compliance under 21 CFR parts 210 and 211. In a 2017 Warning Letter, FDA told a contract manufacturer directly: "You are responsible for the quality of combination products you produce as a contract facility, regardless of agreements in place with [the customer] or with any of your suppliers."
Inspection intensity is increasing
FDA issued 303 drug and biologics Warning Letters in FY 2025, compared with 190 in FY 2024, an increase of 113 letters driven partly by concentrated enforcement actions. For-cause inspections of human drug and biologics sites increased nearly 250% above baseline in 2025. Quality Control Unit responsibilities remain the number-one most cited inspection issue for the fifth consecutive year.
The owner cannot outsource accountability
FDA treats the CDMO as an extension of the sponsor's own facility. FDA inspectors have traced deficiencies back to the sponsor's failure to monitor or intervene in CMO operations, particularly when quality issues arise in shared facilities or during scale-up. In 2025, warning letters show sponsors being held accountable for CMO actions even when they claim no direct involvement in day-to-day manufacturing.
Red flag 1: Absent or incomplete quality agreement
What the guidance requires
FDA's 2016 guidance recommends that quality agreements be executed before any contracted activity begins. The agreement must cover every CGMP activity within the contracted scope and assign unambiguous responsibilities to a named party. An absence finding is among the most likely to escalate from a 483 observation to a Warning Letter because it signals that the organization has not established even the foundational structure for GMP oversight.
What the inspector finds
When FDA arrives at a contract facility and no quality agreement exists between the owner and the CDMO, or the agreement does not cover the specific products being manufactured, inspectors cite 21 CFR 211.22(a) (quality unit authority) and 21 CFR 211.22(d) (written procedures). The Oasis Medical Warning Letter (July 2025) cited the firm for insufficient oversight of contract services and failure to conduct annual product reviews since 2018.
Corrective action
Sponsors should maintain a register of all quality agreements, with execution dates and scope confirmations that map to specific product listings in the facility registration. Before any manufacturing campaign, confirm that the quality agreement scope matches the actual contracted activities, including any recently added products or processes.
Red flag 2: Vague or ambiguous responsibility language
The three failure patterns
FDA inspectors look for three specific language patterns in quality agreements:
| Failure pattern | Inspection finding | CFR citation |
|---|---|---|
| Responsibility assigned to "both parties" or "as agreed" | No single party accountable for deviation investigation, change control, or batch release | 21 CFR 211.22(a), 211.160(a) |
| Manufacturing activities not individually enumerated | Gap between what the agreement covers and what the CDMO actually performs | 21 CFR 211.22(d) |
| Change-control responsibilities undefined or deferred | CDMO makes equipment, process, or supplier changes without sponsor notification | 21 CFR 211.100(a), 211.22(e) |
The deviation-investigation gap
One of the most cited inspection findings is that deviation investigations at the CDMO are incomplete, root causes are attributed to "operator error" without supporting data, and the sponsor's quality unit was never informed. The 2016 guidance requires the quality agreement to specify a communication plan for deviations, including who investigates, who approves the investigation, and timelines for notification. FDA Warning Letters to generic manufacturers in India (2024-2025 composite) repeatedly cite the sponsor for failing to exercise oversight when the CDMO repeatedly failed to thoroughly investigate out-of-specification assay results.
Corrective action
Every CGMP activity in the manufacturing process must map to a single responsible party in the quality agreement. The agreement should include a responsibility matrix that covers: raw material release, in-process testing, batch record review, deviation investigation, CAPA, change control, annual product review, and final batch release. Final product release for distribution must be carried out by the owner and cannot be delegated.
Red flag 3: Quality agreement not updated after operational changes
The currency problem
FDA's guidance requires quality agreements to include provisions for lifecycle management and revisions. In practice, CDMOs change equipment, processes, personnel, and suppliers between inspections. If the quality agreement was executed three years ago and the CDMO has since added a new mixing vessel, changed an API supplier, or shifted a fill line to handle a non-pharmaceutical product, the agreement is stale and the sponsor is exposed.
Shared equipment: the 2024-2025 focus
In 2024, FDA issued eight Warning Letters to companies manufacturing drugs with the same equipment used for industrial chemicals, detergents, and automotive brake cleaner. FDA inspectors found CDMOs running injectable products on lines shared with non-pharmaceutical manufacturing. The sponsors were cited for failing to exercise oversight of their contract facilities.
The Intuition Labs enforcement tracker (2024-2026) documents multiple cases where sponsors were ordered to retrospectively analyze product quality results and certify in writing the integrity of all batches produced during periods when undisclosed equipment changes were in effect.
Corrective action
The quality agreement should require the CDMO to notify the sponsor before any change to equipment, processes, materials, or site operations that could affect product quality. The sponsor's change-control procedure must include a reassessment of the quality agreement scope whenever a CDMO change notification is received. Sponsors should audit CDMO facilities at least annually and after any significant operational change, not just on the inspection cycle.
Red flag 4: Quality unit oversight gaps at the CDMO
The most cited issue
Quality Control Unit responsibilities have been the number-one FDA inspection finding for five consecutive years. At CDMOs, this manifests as:
- QU failing to review and approve investigations before batch release
- QU lacking authority to reject materials or stop production
- QU staff insufficiently trained or resourced for the contracted scope
- Annual product reviews not conducted or completed
The Exela Pharma Sciences Warning Letter (July 2025) and the Inopak Warning Letter (December 2023) both cite the quality unit's failure to provide adequate oversight of drug manufacturing operations, including the absence of written procedures for quality unit responsibilities per 21 CFR 211.22(a) and 211.22(d).
The sponsor's blind spot
Sponsors often assume that the CDMO's quality unit functions independently. FDA disagrees. The sponsor's quality unit must exercise oversight of the CDMO's quality unit, including reviewing and approving investigation reports, verifying that annual product reviews are conducted, and confirming that the CDMO's QU has the authority and resources to function effectively.
Corrective action
The quality agreement should specify the sponsor's right to audit CDMO quality records, including deviation reports, CAPA logs, and annual product reviews. Sponsors should require quarterly quality performance reports from the CDMO, covering deviation rates, CAPA closure timelines, out-of-specification results, and complaint trends. If the CDMO's QU cannot demonstrate independence and authority, the sponsor should escalate contractually or qualify an alternate site.
Red flag 5: Inadequate supplier and material oversight
The COA reliance problem
FDA continues to cite firms for relying on supplier Certificates of Analysis without independent verification, especially for APIs and excipients sourced from abroad. In 2025, FDA reported issuing more than 120 new import alerts, often targeting foreign contract manufacturing irregularities. China and India remain key areas of focus.
Quality agreement gap
The quality agreement should specify who is responsible for: qualifying suppliers, performing identity testing on incoming materials, approving changes to API or excipient suppliers, and maintaining the approved supplier list. If the CDMO sources an API from a new supplier without notifying the sponsor, and that supplier has an undisclosed quality problem, both the CDMO and the sponsor will receive a 483.
Corrective action
Sponsors should require the CDMO to maintain a current approved supplier list as an appendix to the quality agreement. Any proposed supplier change must be communicated to the sponsor's quality unit before implementation. Independent identity testing must be performed on every incoming lot of API, regardless of the supplier's COA.
Quality agreement checklist for CDMO oversight
| Element | Must be specified in the agreement | Common gap |
|---|---|---|
| Scope and purpose | Products, processes, and facilities covered | Scope does not match current operations |
| Responsibility matrix | Single accountable party for each CGMP activity | "Jointly responsible" language |
| Change control | Notification requirements, approval authority, timelines | CDMO makes changes unilaterally |
| Deviation management | Who investigates, who approves, notification deadlines | Sponsor not informed of deviations |
| Batch release | Owner retains final release; CDMO performs intermediate release | Final release delegated to CDMO |
| Annual product review | Who conducts, who reviews, deadline | Reviews not conducted |
| Supplier qualification | Who qualifies, who approves changes, identity testing requirements | COA reliance without verification |
| Communication plan | Named contacts, escalation path, meeting cadence | No structured communication |
| Agreement lifecycle | Review schedule, revision trigger events, version control | Agreement not updated for years |
| Audit rights | Sponsor's right to audit, frequency, access to records | No audit provisions |
What to monitor next
- FDA's anticipated final guidance updating the 2016 Quality Agreement guidance, expected to emphasize risk-based oversight and clear accountability
- Import alert trends for foreign CDMO sites, which accelerated in 2025
- For-cause inspection triggers: complaints, post-market safety signals, field alerts, and prior 483 history
- Section 704(a)(4) remote record review requests, which FDA is using more frequently for overseas contract facilities
- AI-related quality failures: FDA's 2025 Warning Letter to Purolea Cosmetics Lab for relying on AI-generated specifications and procedures without Quality Unit review, cited under 21 CFR 211.22(c) and 211.100
Sources
- FDA. Contract Manufacturing Arrangements for Drugs: Quality Agreements. Guidance for Industry. November 2016. fda.gov/media/86193/download
- FDA. Report on the State of Pharmaceutical Quality FY2024. fda.gov/media/188153/download
- FDA. Warning Letter to Oasis Medical, Inc. (WL 320-25-93, July 15, 2025). fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/oasis-medical-inc-707198-07152025
- FDA. Warning Letter to Exela Pharma Sciences, LLC (WL 320-25-88, July 2, 2025). fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/exela-pharma-sciences-llc-709859-07022025
- FDA. Warning Letter to Inopak, Ltd. (WL 667411, December 15, 2023). fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/inopak-ltd-667411-12152023
- 21 CFR Parts 210 and 211. Current Good Manufacturing Practice for Finished Pharmaceuticals.
- Reed Smith. FDA Inspections in 2025: Heightened Rigor, Data-Driven Targeting, and Increased Surveillance. reedsmith.com/articles/fda-inspections-in-2025
- Redica Systems. FDA Increased For-Cause Inspections Almost 250% in 2025. November 12, 2025. redica.com/fda-increased-for-cause-inspections-almost-250-in-2025
- Pharmaceutical Online. Trends in FDA FY 2025 Warning Letters. pharmaceuticalonline.com/doc/trends-in-fda-fy-2025-warning-letters-0001
- Epista. FDA Inspections 2024-2025: Key Insights to Keep You Compliant. epista.com/knowledge/fda-inspections-2024-2025
- Hogan Lovells. FDA Medical Device Inspections in 2025. hoganlovells.com/en/publications/fda-medical-device-inspections-in-2025
- FDA. Warning Letter to Purolea Cosmetics Lab (FEI 3011669383). ispe.org/pharmaceutical-engineering/ispeak/what-youre-not-told-ai-and-consequences
