Contract Manufacturing Oversight: Quality Agreements, Audits and cGMP Accountability in 2026

You can outsource the work. You cannot outsource the responsibility.

This is not a philosophical position. It is the regulatory framework that governs every pharmaceutical manufacturer that uses a contract manufacturing organisation, a contract development and manufacturing organisation, or a contract testing laboratory. 21 CFR 211.22 assigns cGMP accountability to the quality unit without distinguishing between work performed in-house and work performed at a contract facility. The FDA's Quality Agreements Guidance 2016 makes this explicit.

By 2026 that accountability framework is being enforced more aggressively than at any point in the past decade. A 50% jump in contract facility warning letters and five Q1 2026 enforcement actions citing deliberate falsification at contract labs and CROs confirm that FDA is no longer treating contract site failures as a contract site problem alone.

The legal basis for sponsor accountability

21 CFR 211.22 requires the quality unit to approve or reject all components, drug product containers, closures, in-process materials, packaging materials, labelling and drug products. It does not limit this responsibility to materials and products manufactured in-house. The regulation applies to everything that goes into or comes out of the drug product regardless of where the work was performed.

This means a quality agreement with a contract facility does not transfer regulatory accountability. It defines how that accountability will be managed between the parties. If the contract facility fails, FDA holds the application holder responsible even when the violation occurred entirely at the contract site and the sponsor had no direct knowledge of it.

What happened in Q1 2026

Five warning letters issued in the first quarter of 2026 cited deliberate falsification across drug manufacturers, contract testing laboratories and CROs. All five involved overseas operations. The pattern across all five cases is strikingly consistent: systematic and deliberate data manipulation rather than isolated procedural errors.

Facility	Finding	Sponsor impact
Tentamus India	Record destruction, deliberate backdating, systematic OOS investigation failures, delayed investigator access	Any sponsor relying on Tentamus data for product release must assess impact on all affected batches
Patcos Cosmetics	Deliberate alteration of laboratory data to conceal OOS results	Products released based on falsified analytical data
Vedic Lifesciences	Alteration of final study reports to falsely list personnel and facilities	Study data supporting regulatory submissions may be unreliable

In each case FDA held the sponsor accountable for relying on data generated at the contract facility to support product release decisions. The sponsor's accountability does not end with the certificate of analysis. It extends to the quality of the data that produced it.

The quality agreement - what FDA requires

FDA's 2016 Quality Agreements Guidance sets out what a compliant agreement must contain. Absence of a quality agreement with a contract manufacturer or testing laboratory is itself a cGMP observation under 21 CFR 211.22. An agreement that omits critical elements is treated the same as no agreement.

A compliant quality agreement must specify:

• The manufacturing activities covered and the location where they will be performed
• Which party is responsible for each cGMP activity
• The cGMP standards the contract facility must meet
• Change notification requirements including specific timelines for different categories of change
• The right to audit the contract facility
• The process for communicating quality events including OOS results, deviations and complaints
• What happens if the contract facility fails to meet agreed cGMP standards

Responsibilities that cannot be delegated

The quality agreement can assign operational responsibilities to the contract facility but cannot transfer regulatory accountability. Three responsibilities must always remain with the sponsor's Quality Unit regardless of what the quality agreement says:

• Final batch disposition authority - the decision to release or reject a batch must remain with the sponsor's Quality Unit
• Investigation oversight - the sponsor must ensure OOS and deviation investigations at the contract facility meet FDA requirements and must review and approve their adequacy
• Change control approval - any change at the contract facility that could affect the approved product requires sponsor Quality Unit review and approval before implementation

Building a risk-based CMO audit programme

A signed quality agreement is necessary but not sufficient. FDA expects documented evidence that the sponsor actively monitors contractor cGMP performance throughout the supply relationship. The four most common CMO oversight citation patterns from 2024 to 2026 all relate to what happens after the agreement is signed.

Qualification audits - before first use

Before placing a manufacturing or testing order at a new contract facility the sponsor must conduct a qualification audit. The scope must include verification of FDA registration status, review of recent inspection history including any unresolved 483 observations or warning letters, assessment of the quality system including deviation management and OOS investigation procedures, and evaluation of data integrity controls including audit trail verification.

A facility with a recent warning letter or unresolved 483 observations requires escalated assessment before qualification. Proceeding with qualification without reviewing the specific 483 observations and the facility's corrective action responses creates accountability exposure if the same failures recur in work conducted on sponsor products.

Surveillance audits - ongoing monitoring

Audit frequency should be risk-based. API manufacturers and sterile contract manufacturers warrant more frequent audits than non-sterile contract packagers. A minimum of every 2 to 3 years is common for low-risk relationships. High-volume or high-risk operations warrant annual audits.

Surveillance audit scope must include review of any deviations, OOS results and complaints affecting sponsor products since the last audit, CAPA status and effectiveness, any changes to processes, equipment or key personnel, and current regulatory inspection status. For contract testing laboratories the audit must include data integrity assessment covering audit trail review and access controls.

Triggered audits - when events demand immediate response

Certain events require an unscheduled audit regardless of the routine cycle: an FDA warning letter or import alert at the contract facility, a significant deviation affecting sponsor products, OOS results suggesting systemic analytical failure, key quality personnel departures, and merger or ownership changes at the contractor.

Data integrity oversight of contract testing laboratories

The Tentamus India March 2026 warning letter illustrates how catastrophically contract laboratory data integrity failure can affect sponsors. The firm destroyed analytical records, backdated documents and systematically failed to investigate OOS results. Any drug manufacturer that sent products to this facility for analytical testing and relied on those results for product release is now in a materially uncertain position.

During contract laboratory audits, data integrity assessment must include:

• Audit trail review confirming audit trails are enabled on all cGMP software including LIMS and chromatography data systems
• Access controls confirming no shared login credentials among analysts
• Raw data access confirming the sponsor can obtain complete original instrument files for all testing on sponsor products
• OOS invalidation rate review - a rate above 10% of initial results suggests selective reporting or testing into compliance
• Review for any unexplained deletions or modifications to analytical records

When a contract laboratory fails

When a contract laboratory receives an FDA enforcement action the sponsor must act immediately. Suspend new testing orders. Identify all batches within expiry released based on data from this laboratory. Assess whether the data integrity failures could affect the reliability of those test results. If product quality is uncertain for any batch a recall assessment under 21 CFR 210 and 211 is required.

This is not a hypothetical risk. It is the situation that five sponsor organisations found themselves in during Q1 2026.

The four most common CMO oversight citation patterns in 2026

FDA inspectors cite CMO oversight failures with increasing frequency. These four patterns appear most often in 483 observations and warning letters from 2024 to 2026.

1. No quality agreement or agreement missing essential elements

Absence of a written quality agreement with a contract manufacturer or testing laboratory. An agreement that does not specify responsibilities, cGMP standards, change notification requirements or audit rights is treated the same as no agreement. FDA cited this in multiple 2025 and 2026 warning letters involving overseas operations.

2. No documented audit programme

Sponsors that rely on contract facilities without a documented qualification audit or periodic surveillance programme. FDA inspectors ask for audit records during sponsor site inspections. Absence of audits or audits that did not cover data integrity and OOS investigation procedures is cited as inadequate oversight.

3. Relying on certificate of analysis without independent verification

Releasing product based solely on a certificate of analysis from a contract laboratory without any independent verification of data quality. FDA expects sponsors to verify the reliability of contract lab data through audit, data review or periodic confirmatory testing. The Tentamus India 2026 case confirmed that a CoA alone is insufficient when the generating laboratory's data integrity is compromised.

4. Failure to review contract facility investigations

The contract facility investigated a deviation or OOS result affecting the sponsor's products but the sponsor did not review the investigation for adequacy or participate in the root cause determination. FDA expects the sponsor's Quality Unit to review and approve the adequacy of investigations at contract facilities when sponsor products are affected.

What to do right now

If you have not reviewed your contract manufacturer and contract laboratory oversight programme recently, these are the five actions that address the highest current risk:

• Review every quality agreement for completeness against the FDA 2016 guidance requirements - specifically change notification timelines and audit rights
• Confirm your audit programme includes a documented schedule and that the most recent audit covered data integrity controls
• Check whether any of your contract testing laboratories has received FDA enforcement action in the past 12 months - search the FDA warning letter database at fda.gov
• Verify that your change control SOP requires notification to the sponsor before the contract facility implements any change affecting approved products
• Confirm the sponsor Quality Unit reviews and approves OOS investigations at contract facilities for any OOS affecting sponsor products