Drug Substance vs Drug Product CDMOs: Dividing the Scope of Work

A sponsor that outsources both the active ingredient and the finished dosage form—often to two different contract development and manufacturing organizations (CDMOs)—has to decide, before quality agreements are signed and before Module 3 is assembled, which development, manufacturing, testing, filing and change-control tasks belong to the drug substance CDMO, which belong to the drug product CDMO, and which stay with its own quality unit. Vendor content on the question tends to define the two terms and then recommend the vendor’s own model. The more useful answer is that the regulatory documents already draw most of the line.

Divide the work along that line. Drug substance manufacture follows ICH Q7, the harmonized GMP guide for active pharmaceutical ingredients, under the statutory CGMP requirement in section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act; finished dosage manufacture is also subject to 21 CFR Parts 210 and 211, as FDA’s quality-agreements guidance spells out. The application mirrors the split in CTD sections 3.2.S and 3.2.P (ICH M4Q). What remains for the sponsor is to allocate the activities around that boundary—development, analytical methods, reference standards, release, stability, storage and shipping, incoming testing, deviations and change control—in writing, in quality agreements that match the application, while keeping final release with its own quality unit under 21 CFR 211.22(a).

Where the boundary actually sits: definitions that decide the scope

The vocabulary comes from 21 CFR 210.3(b):

• Drug product, (b)(4): “a finished dosage form, for example, tablet, capsule, solution, etc., that contains an active drug ingredient generally, but not necessarily, in association with inactive ingredients.” The term also covers a placebo dosage form.

• Active ingredient, (b)(7): “any component that is intended to furnish pharmacological activity or other direct effect in the diagnosis, cure, mitigation, treatment, or prevention of disease, or to affect the structure or any function of the body of man or other animals.” It includes components that change chemically during manufacture and are present in the drug product in a modified form.

• Component, (b)(3): “any ingredient intended for use in the manufacture of a drug product, including those that may not appear in such drug product.”

• Inactive ingredient, (b)(8): “any component other than an active ingredient.”

Part 210 says “active ingredient”; the CTD and ICH say “drug substance.” The glossary in section 20 of ICH Q7 joins the two in a single entry, “Active Pharmaceutical Ingredient (API) (or Drug Substance)”:

“Any substance or mixture of substances intended to be used in the manufacture of a drug (medicinal) product and that, when used in the production of a drug, becomes an active ingredient of the drug product. Such substances are intended to furnish pharmacological activity or other direct effect in the diagnosis, cure, mitigation, treatment, or prevention of disease or to affect the structure and function of the body.”

FDA’s April 2004 changes guidance does the same in its glossary entry for “Active Ingredient/Drug Substance” and adds a detail that matters for contracts: the term does not include intermediates used in the synthesis of the ingredient.

For the split manufacturing model used here, the definitions provide a practical handoff: the DS CDMO supplies released API, packed and labelled for shipment. At the DP CDMO the same material is a component, and 21 CFR 211.22(a) gives the DP site’s quality control unit the authority to approve or reject all components before use. Formulation, processing into the dosage form, primary packaging and labelling are drug product activities. That allocation does not mean DP development waits for a commercial API shipment, or that API physical processing must occur at the DS contractor.

Three edges of the boundary are easy to leave out of a contract:

• Where the DS scope starts. For synthetic APIs, ICH Q7 section 1.3 applies appropriate GMP from introduction of the designated API starting material; the company should document the rationale for that point. Other processes need a case-specific rationale. Record the designation and each contractor’s actual operations separately. Q7 section 1.1 expressly does not define registration or filing requirements, so its GMP starting point does not by itself determine how much process information belongs in 3.2.S.

• Physical processing. ICH Q7 says physical processing of APIs, “such as granulation, coating or physical manipulation of particle size (e.g. milling, micronizing), should be conducted at least to the standards of this Guide.” If micronization happens at the DP CDMO or at a third site, the agreement should say so and say which standard governs it.

• Sterile APIs and biologics. ICH Q7 covers sterile APIs only up to the point immediately before they are rendered sterile; sterilization and aseptic processing follow drug product GMP. It covers cell culture and fermentation APIs in section 18 but excludes vaccines, whole cells, whole blood and plasma, plasma derivatives and gene therapy APIs.

The application already divides the work: 3.2.S versus 3.2.P

ICH M4Q, published by FDA as guidance in August 2001, organizes the quality module into two parallel blocks. The drug substance block is titled by substance and manufacturer; the drug product block by product and dosage form:

• 3.2.S Drug Substance [name, manufacturer]: S.1 General Information, S.2 Manufacture, S.3 Characterization, S.4 Control of Drug Substance, S.5 Reference Standards or Materials, S.6 Container Closure System, S.7 Stability.

• 3.2.P Drug Product [name, dosage form]: P.1 Description and Composition, P.2 Pharmaceutical Development, P.3 Manufacture, P.4 Control of Excipients, P.5 Control of Drug Product, P.6 Reference Standards or Materials, P.7 Container Closure System, P.8 Stability.

The two manufacturer sections use identical wording. Sections 3.2.S.2.1 and 3.2.P.3.1 each ask for “the name, address, and responsibility of each manufacturer, including contractors, and each proposed production site or facility involved in manufacturing and testing.” The scope division is therefore also information in the proposed or approved application. A contract laboratory running release or stability tests belongs in the relevant listing. For an approved application, reassignment to a different manufacturing or testing site needs assessment under the applicable change-reporting framework. FDA’s quality-agreements guidance asks for the same information on the contract side: the agreement should identify each site where the contract facility will operate, “including the address of and specific services to be provided at each site.”

Two subsections cross the boundary and deserve their own rows in the scope record:

• 3.2.P.2.1.1, drug substance in pharmaceutical development. M4Q recommends discussing DS characteristics that influence DP performance, including water content, solubility, particle size distribution and solid form. Both CDMOs should share the relevant attribute list and its development rationale. The sponsor then justifies which attributes are controlled through specifications or other process controls; M4Q does not say every development attribute must become a separate DS release test.

• 3.2.S.6, container closure for the drug substance. The DS container closure description covers materials of construction, specifications and suitability, including compatibility, sorption and leaching. For biotech drug substances, M4Q also asks the 3.2.S.2.2 process description to cover filling, storage and shipping conditions. The bulk container and its shipping conditions are DS-side content that the DP site has to live with.

A typical allocation of authorship looks like this:

The allocation is suggested, not mandated. M4Q describes how the application is organized; the applicant is responsible for its content whoever generates the data.

When the DS process sits in a drug master file

A DS CDMO that will not disclose its process can file a drug master file (DMF) and authorize the sponsor to reference it. Under 21 CFR 314.420(a), a DMF lets the holder “authorize other persons to rely on the information to support a submission to FDA without the holder having to disclose the information to the person.” The drug substance category covers “drug substance, drug substance intermediate, and materials used in their preparation, or drug product.” The mechanics are narrow:

• The holder must authorize incorporation by reference in writing, and each incorporation must identify the material by name, reference number, volume and page (314.420(b)).

• When the holder adds, changes or deletes information in the file, it “shall notify in writing, each person authorized to reference that information” (314.420(c)).

• The DMF must list everyone currently authorized to reference it (314.420(d)).

• FDA ordinarily neither reviews DMFs independently nor approves or disapproves them; it reviews the information in the context of an application.

A DMF changes what the sponsor can see, not what the sponsor is responsible for. The sponsor’s quality unit still approves or rejects the API used in its product, so the quality agreement should say what the DS CDMO shares outside the DMF—certificates of analysis, deviations that affect released lots, and advance notice of changes. The regulation sets no lead time for the holder’s notice, so the agreement has to. How that notification and letter-of-authorization chain breaks down in practice is covered in DMF letter-of-authorization and notification traps. For the supply-strategy side of DMF reliance, see DMF strategy for API supply chains; for why a facility file is not a substitute for CGMP oversight of a CDMO, see the Type V facility DMF analysis.

The scope-division record: a responsibility matrix you can audit

FDA’s November 2016 guidance, Contract Manufacturing Arrangements for Drugs: Quality Agreements, recommends that owners and contract facilities put their CGMP roles in a written quality agreement that “should clearly state which party — the owner or the contract facility or both — carries out specific CGMP activities.” The guidance accepts “charts, matrices, narratives, or a combination,” and lists the topics to cover: quality unit activities, facilities and equipment, materials management, product-specific considerations, laboratory controls and documentation (section IV.B.1), plus change control (section IV.B.2). It is guidance, but it rests on a regulation: 21 CFR 211.22(d) requires the quality unit’s responsibilities and procedures to be in writing and followed.

On release the guidance is explicit. Contract facilities approve or reject “the product or results of their manufacturing operations,” and owners approve or reject drugs manufactured by the contract facility, “including for final release.” Quality agreements “cannot be used to delegate statutory or regulatory responsibilities to comply with CGMP.” ICH Q7 says the same on the API side: the quality unit’s main responsibilities—including releasing or rejecting all APIs and approving API contract manufacturers—should not be delegated (section 2.22). In FDA’s illustrative scenarios, the agency notes that it could cite owners for failing to evaluate, qualify, audit and monitor their contract facilities. The agreement weaknesses that turn into inspection findings are covered in CDMO quality agreement red flags.

The matrix below suggests an allocation for separate DS and DP CDMOs. The sponsor column records owner oversight and contractual approval; it does not replace either CDMO’s independent quality-unit duties. “Performs” and “approves” are kept apart, and each source anchor identifies the allocation question rather than mandating the proposed answer.

Three checks before signing. First, every handoff row—shipment, receipt and identity testing, cross-site deviations, change notification—should appear in both agreements with the same wording, so neither agreement is silent where the other assumes coverage. Second, keep commercial terms out. FDA recommends that quality agreements not cover pricing, delivery terms, confidentiality or limits on liability, and that they be separate from, or severable from, supply and master services agreements. Title transfer and freight terms belong in the commercial contract; responsibility for the condition of the material in transit belongs in the quality agreement. Third, address subcontractors. ICH Q7 section 16.14 recommends that the API contractor not pass entrusted work to a third party without the contract giver’s prior evaluation and approval. Identify the subcontracted operation, its site, its data and record access, and its communication path in the same responsibility record; a laboratory engaged by the DS CDMO should not disappear from the sponsor’s oversight.

Plan, program, and product-specific conditions: what to decide once versus per product

The matrix answers who does what. A second question is how often each answer has to be decided. Mixing the two produces product-by-product negotiation over terms that should be fixed once, and templates that are silent on product details exactly where handoffs fail. Three levels are useful:

• Plan level: the sourcing model. One integrated CDMO or separate DS and DP CDMOs; single or dual sourcing for each step; whether the DS process goes into the open part of the application or a DMF; and the geographic footprint of the supply chain. These decisions change rarely and set how many quality agreements and audits the program carries. Policy pressure on that footprint is covered in our BIOSECURE and API supply analysis.

• Program level: governance for every product with a partner. The quality-agreement template and its standard matrix; definitions; dispute resolution; how deviations are reported, investigated and resolved; which classes of change need owner approval before implementation and which a contractor may implement without notice; routine and for-cause audits; and how FDA inspection observations and correspondence are shared. FDA’s guidance names each of these as quality-agreement content. Audit frequency is the sponsor’s choice, but it has to be followed: in one of FDA’s illustrative scenarios an owner’s own procedure required a contract-site audit every two years, and the owner had never audited the laboratory.

• Product level: what changes with the molecule and dosage form. FDA’s guidance lists what a product-specific appendix may hold: product and component specifications; defined manufacturing operations, including batch numbering; responsibilities for expiration or retest dating, storage and shipment, and lot disposition; process validation responsibilities; and owner access to the facility. A split program adds the cross-boundary attribute list from 3.2.P.2.1.1, the DS container closure and shipping conditions, and the DMF reference and its scope.

The diagram shows how the levels cascade:

flowchart TD
    subgraph PLAN["Plan level: sourcing model, decided rarely"]
        P1["One integrated CDMO or separate DS and DP CDMOs"]
        P2["Single or dual sourcing for each step"]
        P3["DS process in the application or in a DMF"]
    end
    subgraph PROGRAM["Program level: governance, decided once per partner"]
        G1["Quality agreement template and standard matrix"]
        G2["Definitions and dispute resolution"]
        G3["Deviation reporting and change-approval classes"]
        G4["Routine and for-cause audits, inspection communication"]
    end
    subgraph PRODUCT["Product level: per molecule and dosage form"]
        R1["DS and DP specifications: 3.2.S.4 and 3.2.P.5"]
        R2["Cross-boundary DS attributes: 3.2.P.2.1.1"]
        R3["DS container closure and shipping conditions"]
        R4["Retest period, shelf life and lot disposition"]
        R5["DMF reference and authorization scope"]
    end
    PLAN --> PROGRAM
    PROGRAM --> PRODUCT

When the levels blur—deviation-notification terms renegotiated product by product, or a template that says nothing about how a specific bulk API is shipped—the agreements drift apart across a portfolio. FDA notes that quality agreements may be reviewed during inspections, so the inconsistency is visible to an investigator as well as to the sponsor’s own auditors.

Worked record example: an illustrative tablet program

The program is a small-molecule, immediate-release, film-coated tablet under an NDA. The DS CDMO runs the synthesis, crystallization and micronization and releases the API. A separate DP CDMO granulates, compresses, coats and bottles the tablets and runs DP release and stability testing. The sponsor files the DS process in the open part of the application rather than relying on a DMF.

A completed record of this kind can be checked mechanically: no row leaves the performer or the approver blank, rows with two actors state where one party’s task ends and the other’s begins, every handoff row appears in both quality agreements, and every site named in the record appears in 3.2.S.2.1 or 3.2.P.3.1. Moving the program to a new site starts from the same record; the transfer-package side of that move is covered in tech-transfer package gaps for a second site.

Biologics variant: bulk drug substance under a BLA

For a licensed biologic—say, a monoclonal antibody whose bulk drug substance ships to a separate fill-finish CDMO—the same record applies with four differences:

• The DS process description in 3.2.S.2.2 is expected to run from the cell bank through cell culture, harvest and purification to “filling, storage, and shipping conditions,” so the bulk container and shipping conditions are part of the registered DS content.

• ICH Q7 section 18 covers APIs made by cell culture or fermentation, while sterilization and aseptic processing fall outside Q7 and follow drug product GMP. The fill-finish side, including contamination control, is covered in our sterile fill-finish CDMO analysis.

• Changes route through 21 CFR 601.12 rather than 21 CFR 314.70, discussed in the change section below.

• A vendor describes the split model. 53Biologics, a DS-side provider, describes biotech companies using separate DS and fill-finish partners. Its account is a vendor perspective, not a measured estimate of how often sponsors split manufacturing; the sponsor-oversight point is grounded above in FDA’s guidance.

The handoff: bulk substance transport, storage, and incoming testing

The seam between the two CDMOs is the part of a split program that neither CDMO owns by default. FDA’s quality-agreements guidance addresses it in the materials-management section (IV.B.1.c): the agreement “should define responsibility for physical control of materials at different points in the manufacturing process,” should cover “proper conditions for storing and transporting or shipping materials,” and should define each party’s roles in storage and transport, “whether from the contract facility back to the owner or to another contract facility for further operations. This includes defining activities for monitoring or validating shipping conditions as appropriate.”

ICH Q7 sets the DS-side duties in section 10.2: APIs should be transported in a manner that does not adversely affect their quality (10.21); special transport or storage conditions should be stated on the label (10.22); and the manufacturer should ensure that its transport contractor knows and follows those conditions (10.23). Section 10.20 adds a constraint that affects scheduling: APIs should be released by the quality unit before distribution to third parties, and transfer under quarantine is contemplated only to another unit under the company’s own control. Plan API release before shipment to an independent DP CDMO; the controlled intra-company quarantine-transfer provision should not be assumed to cover that third-party handoff.

At minimum, the two agreements should fix the following at the seam:

• Lane qualification. Who writes and approves the shipping qualification for each lane, and when it must be repeated.

• Labelled conditions and monitoring. Which storage and transport conditions appear on the label, how they are monitored in transit, and who reviews the records.

• Carrier instructions. Which party instructs the transport contractor, and how the DP site confirms the instructions were followed.

• Excursions. That an excursion triggers quarantine at receipt, which party investigates, and that the sponsor’s quality unit decides disposition.

• Tamper evidence and chain of custody. How containers are sealed and how the DP site checks seals and quantities against the shipping documents. Shipping methods and tamper-evidence features are both on FDA’s list of changes the agreement should address.

The receipt decision belongs in the DP quality system. 21 CFR 211.22(a) and (c) give the quality control unit authority over component approval and procedures or specifications affecting product quality. FDA’s quality-agreements guidance, sections IV.B.1.c and IV.B.1.e, recommends assigning component specifications, supplier qualification, required sampling and testing, method transfer and laboratory-result communication. In the scope record, name who samples and tests incoming API, who evaluates the DS certificate of analysis, and who approves the component for use. For the separate identity-testing and supplier-certificate decision, see why a supplier COA is not component identity testing.

Knowledge has to cross the seam as well as material. FDA’s guidance says the agreement should indicate how owners transfer product and process knowledge to contract facilities and how contract facilities share product quality information gained over the product life cycle. In a split program that includes the DS impurity and degradant profile the DP site needs for its own risk assessments—see nitrosamine risk assessments that depend on supplier data—and the solid-form history behind the cross-boundary attribute list.

When something changes: reporting categories on both sides

Because both CDMOs’ sites are registered in the application, a change at either one can be a change to the approved application. For NDAs and ANDAs, section 506A of the FD&C Act and 21 CFR 314.70 set four reporting categories, which FDA’s April 2004 guidance, Changes to an Approved NDA or ANDA, applies to specific changes:

• Prior approval supplement (major change). Substantial potential for an adverse effect on identity, strength, quality, purity or potency; FDA must approve the supplement before product made with the change is distributed.

• Changes being effected in 30 days, CBE-30 (moderate change). The supplement must reach FDA at least 30 days before distribution. If FDA says within that period that prior approval is required, distribution cannot proceed; if FDA identifies missing information, distribution must wait until the supplement is amended to supply it.

• Changes being effected, CBE (moderate change). For certain moderate changes FDA identifies, distribution can begin when FDA receives the supplement.

• Annual report (minor change). Minimal potential for adverse effect; described in the next annual report.

The guidance’s site section makes the scope point directly: CDER must be notified when a manufacturer changes to a site not specified in the approved application, and sites include those used to manufacture or process drug products, in-process materials, drug substances or drug substance intermediates, to package or label drug products, and to test materials—including stability testing—whether the site is owned by the applicant or is a contract site. The table maps typical boundary changes to the guidance’s recommended categories and to what the quality agreement should make happen first.

The table covers selected examples from the April 2004 guidance, not every possible change or a complete current filing assessment. Its general site categories apply only where the guidance does not classify the operation elsewhere. In particular, a modified-release solid oral primary-packaging move is CBE-30 under VI.C.1.c, while the manufacturing move may be prior approval; aseptic transfers outside VI.B.4 can be CBE-30 under VI.C.1.b. Three further qualifications travel with the table. If the new site lacks a satisfactory CGMP inspection for the type of operation, FDA recommends filing moderate and minor site changes as prior approval supplements, except for drug substance intermediate sites. If the applicant’s assessment shows an adverse effect on identity, strength, quality, purity or potency, FDA recommends a prior approval supplement whatever the listed category. And a site move combined with process or equipment changes is evaluated as a multiple related change. Comparability protocols approved under 21 CFR 314.70(e) can lower the category for specified changes. Process validation at a new site is its own workstream; see equipment qualification versus PPQ.

For licensed biologics, 21 CFR 601.12 uses the same three tiers: prior approval supplements for changes with a substantial potential for adverse effect, CBE-30 or CBE supplements for moderate changes, and annual reports, due within 60 days of the approval anniversary, for minor ones. Supplements and annual reports must identify the manufacturing sites or areas affected. The regulation’s own examples differ from the small-molecule guidance: changes in the specifications in the approved application (with listed exceptions), in virus or adventitious-agent removal or inactivation, in source material or cell line, a new master cell bank or seed, and changes that may affect sterility assurance are listed as major, while replacing equipment with equipment of similar but not identical design that does not affect process methodology or operating parameters is listed as moderate. The April 2004 guidance does not apply to specified biotechnology products, so a biologic’s site and process changes need a product-specific classification rather than a lookup in the table above.

The common contract gap is timing. Both 21 CFR 314.70 and 601.12 require the applicant to assess the effect of a change before distributing product made with it, and the filing category decides when distribution can start. If a CDMO may implement a change and tell the sponsor afterward, the sponsor can learn of a CBE-30- or prior-approval-level change only once product made with it is already in its supply chain. FDA’s guidance expects the agreement to separate changes that the owner should review and approve before implementation from those the contractor may make without notice, and expects both parties to know which changes need an FDA submission. ICH Q7 is stricter for API contractors: changes in process, equipment, test methods, specifications or other contractual requirements should not be made unless the contract giver is informed and approves (section 16.16), and dosage-form manufacturers should be notified of changes that can affect API quality (section 13.17). A workable rule is that anything touching registered content needs sponsor approval before execution. The DMF holder’s written notice under 314.420(c) is a backstop, not a substitute.

When one integrated CDMO is the better answer

The retained integration arguments come from vendors. They identify plausible coordination problems that a sponsor can test against its own program:

• Lonza: a solid-form scientist describes poor communication between DS and DP groups, including when a small biotech uses different CDMOs. The example is a polymorph change affecting solubility or stability that the teams recognize late. The account argues for a bridging function and integrated solid-form services; it also places the communication problem inside a single CDMO. It is a vendor example, not a quantified comparison of outsourcing models.

• Patheon (Thermo Fisher): describes potential raw-material or manufacturing-method misalignment when development is separated. It argues that coordination across DS and DP can reduce handoff and tech-transfer delays. This is a qualitative integration argument, without a measured delay or a guarantee that one provider will be faster.

• Piramal Pharma Solutions: defines the two terms and closes on the value of an experienced CDMO partner; it cites no regulation, CTD section or quality-agreement guidance.

Mapped to the source documents, the polymorph example is exactly what 3.2.P.2.1.1 asks the DP section to discuss, and the handoff delays are the method transfers, shipping qualification, second quality agreement and second audit that a split adds. A single provider can reduce external interfaces, but multiple sites or teams may still need method transfers, shipping qualification and oversight. Integration does not remove the need to write responsibilities down. An integrated CDMO still lists its DS and DP sites in 3.2.S.2.1 and 3.2.P.3.1, and its internal DS and DP groups still need the same attribute list and change rules.

These sources do not establish that either model is inherently safer. The defensible choice is the one whose responsibilities are written into the agreements and match the application. For a split, that means one matrix used in both quality agreements, a qualified shipping lane with a named owner, identity testing at receipt, and a change rule that brings both CDMOs’ changes to the sponsor before they happen.

Sources

Regulations and guidance are cited as the binding or recommended layer; vendor posts are cited only to characterize industry positions.

• 21 CFR 210.3 — Current good manufacturing practice: definitions. Electronic Code of Federal Regulations, rendered by the Legal Information Institute, Cornell Law School.

• 21 CFR 211.22 — Responsibilities of quality control unit. Electronic Code of Federal Regulations, rendered by the Legal Information Institute, Cornell Law School.

• 21 CFR 314.420 — Drug master files. Electronic Code of Federal Regulations, rendered by the Legal Information Institute, Cornell Law School.

• 21 CFR 601.12 — Changes to an approved application. Electronic Code of Federal Regulations, rendered by the Legal Information Institute, Cornell Law School.

• Contract Manufacturing Arrangements for Drugs: Quality Agreements — Guidance for Industry. U.S. Food and Drug Administration (CDER, CBER, CVM), November 2016.

• ICH Q7 — Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients. International Council for Harmonisation, Step 4, 10 November 2000.

• Guidance for Industry M4Q: The CTD — Quality. U.S. Food and Drug Administration (ICH), August 2001.

• Guidance for Industry: Changes to an Approved NDA or ANDA. U.S. Food and Drug Administration (CDER), April 2004.

• Bridging the Gap Between Drug Substance and Drug Product. Lonza blog, 10 March 2022 (vendor perspective).

• Integrating drug substance and drug product development. Patheon / Thermo Fisher Scientific blog (vendor perspective).

• Drug Substance vs. Drug Product: Key Differences Guide. Piramal Pharma Solutions blog (vendor perspective).

• Understanding the Manufacturing Responsibilities for Drug Substances and Drug Products. 53Biologics blog (vendor perspective).