CMO Qualification Audits Under Canada GMP: What to Verify Before You Outsource Manufacturing

About one-third of deficiency observations issued following Health Canada GMP inspections involve failures in third-party oversight — inadequate qualification of contract manufacturers, quality agreements that exist on paper but don’t reflect actual operations, or change-control gaps that neither party owns clearly. We see it repeatedly across client files: the outsourcing decision gets made, the contract gets signed, and the qualification audit gets deprioritized because there’s a launch timeline to hit.

That’s expensive. Health Canada’s Compliance and Enforcement Directorate doesn’t distinguish between your failures and your CMO’s failures. If their facility produces a non-conforming batch, your Establishment Licence is at risk.

Here’s what a CMO qualification program actually needs to look like under Canada GMP — and where most sponsors quietly cut corners.

Why Health Canada GMP Makes CMO Qualification Non-Negotiable

Under Part C, Division 2 of the Food and Drug Regulations — the statutory backbone of Canada GMP — the Establishment Licence (EL) holder bears responsibility for all manufacturing activities associated with their drug products, regardless of where those activities physically occur. Section C.02.014 specifically addresses situations where a fabricator relies on contract operations: the obligations don’t transfer just because you’ve outsourced the work.

GUI-0001, Health Canada’s GMP Guidance Document for Human Pharmaceuticals and Biologics, reinforces this through its requirements for written agreements covering responsibilities, quality standards, and the contract acceptor’s compliance obligations. An EL alone doesn’t satisfy the requirement — inspectors want to see evidence that you evaluated the contractor before engaging them and continue to monitor their performance.

The practical implication: “they have an EL” is not a qualification. It’s a starting point.

The Pre-Audit Documentation Package

Before anyone books a flight to the CMO’s facility, you need a clear picture of their regulatory standing. Assembling the pre-audit documentation package is not optional administrative busywork — it directly shapes your audit scope and risk focus. At minimum, collect:

1. Current Establishment Licence — Verify it’s active and that it covers the specific dosage forms and activities you’re contracting (fabrication, packaging, testing, storage). Health Canada’s EL registry is publicly searchable. CMOs sometimes operate under licences that don’t cover the exact activity you’ve scoped, and neither party catches it until an inspector does.

2. Most recent GMP Compliance Report or Inspection Report — Health Canada publishes inspection outcomes. A facility rated “Compliant” presents a different risk profile than one carrying “Acceptable with Recommendations” — and a facility that hasn’t had a documented inspection in 4+ years is an unknown quantity, not a clean slate.

3. Quality Management System overview — Request their QMS index, a list of current SOPs covering your intended activities, and recent internal audit summaries. You’re not reviewing every SOP at this stage; you’re assessing whether a functioning system exists.

4. Batch failure and deviation history — Three years of batch rejection data, along with their most common deviation categories, tells you more about operational discipline than any site tour. A reputable CMO won’t push back on this request. One that does is telling you something.

5. Current quality agreement template — Review their template before the audit so you arrive with a marked-up version. Scope gaps are far easier to negotiate during document review than on the final afternoon of a two-day site visit.

Collecting this package typically takes 2–3 weeks if the CMO is cooperative. If it takes longer, that’s informative on its own.

On-Site Audit Execution: The Six Areas That Actually Determine Risk

A CMO qualification audit isn’t the same as a supplier qualification visit for a raw material vendor. You’re evaluating whether this organization can produce your product under GMP — and whether their compliance culture holds on a day they’re not expecting scrutiny.

Plan for a minimum of 2 full days on-site. Three days is more realistic if you’re qualifying sterile or biologics manufacturing. Focus on these six areas:

1. Change Control — Review 18–24 months of change control records for equipment, facility, and process changes. Health Canada inspectors consistently flag inadequate change control among their top major observations. Ask specifically: how does the CMO notify contract customers of changes affecting their products? If the answer involves anything approximating “we update the master formula and let you know eventually,” treat that as a significant finding.

2. Deviation Management and CAPA — Pull 10–15 deviation records from the last 12 months. Assess whether root cause analysis is genuinely analytical or templated boilerplate. Closed CAPAs that reopened within 6 months of closure are a signal of systemic problems, not isolated events.

3. Batch Record Review — Review 3–5 executed batch records from the product family most similar to yours. Look at completion quality, in-process results, yield reconciliation, and variance. A CMO producing consistently at 99–100% theoretical yield with zero documented anomalies isn’t demonstrating GMP rigor — they’re demonstrating inadequate in-process monitoring.

4. Laboratory Controls — Verify that the QC laboratory holds valid ISO 17025 accreditation from the Standards Council of Canada (SCC), or that out-of-house testing is contracted to an accredited facility. Review OOS and OOT investigation records. Health Canada’s GUI-0028 and ICH Q2(R1) set the bar for method validation — confirm that your analytical methods are on their method qualification list before your product enters production.

5. Environmental Monitoring (for sterile or semi-sterile products) — Review 12 months of EM trend data, including alert and action level excursions. Ask how excursions are classified and what investigation is triggered at each level. Facilities that have never exceeded an alert level in 12 months aren’t running a clean facility — they’re running inadequate monitoring.

6. Personnel Qualifications — Request training records for the key operators assigned to your batches. High staff turnover in a contract manufacturing environment is a quality risk that doesn’t appear in any published compliance report, and it disproportionately affects smaller CMOs chasing volume.

Risk Classification and the Requalification Cadence

Not every CMO carries equal risk, and your requalification program should reflect that. A risk-based approach — consistent with ICH Q9(R1), which Health Canada formally adopted in 2023 — weighs dosage form complexity, batch criticality, distribution volume, and the CMO’s historical compliance record.

A practical three-tier structure:

Risk Tier	Examples	Requalification Frequency
High	Sterile injectable, biologic, narrow therapeutic index	Every 12–18 months
Medium	Non-sterile liquids, semi-solids, modified-release OSD	Every 24–30 months
Low	Packaging/labelling only, contract storage	Every 36–48 months

Health Canada inspectors reviewing your CMO oversight program will look at whether your requalification triggers are risk-justified. If your sterile fill-finish CMO sits on a 4-year audit cycle, you’ll need more than a good relationship to defend that choice in writing.

Regardless of risk tier: trigger an unscheduled qualification review any time a CMO receives a Health Canada warning letter, a GMP non-compliance rating, or notifies you of a significant facility, equipment, or process change.

The Quality Agreement: Where Most Outsourcing Relationships Actually Break Down

A quality agreement is the legal and technical backbone of a Canada GMP-compliant CMO relationship. Health Canada expects to see one that clearly assigns responsibility for every GMP activity performed at the contract site. Commercial contracts don’t substitute for it.

Common gaps we encounter when reviewing quality agreements for clients:

• Change notification timelines are undefined. “Timely notification” isn’t a specification. Define it explicitly: 30 calendar days prior for planned changes, 5 business days for emergency changes with retroactive documentation.
• Batch disposition authority is ambiguous. Your Qualified Person (QP) or authorized designate must retain final release authority. Contracts that allow the CMO to ship product without explicit sign-off from your quality unit create a direct compliance gap.
• Annual product review responsibilities aren’t assigned. Both parties contribute data; someone must compile and review it. That someone needs to be named, with a timeline attached.
• Regulatory inspection response is unaddressed. If Health Canada arrives at the CMO’s facility, you need notification within 24 hours — not after the inspection closes. This clause is worth pushing hard for in negotiations.

Review the quality agreement annually at minimum, and update it whenever the manufacturing scope changes. A quality agreement that was accurate three product launches ago is not protecting you.

---

Qualifying a CMO properly takes roughly 6–10 weeks from initial documentation request to audit closure — longer if you’re negotiating a quality agreement from scratch or if the CMO’s documentation response is slow. Build that timeline into your outsourcing decision from the start, not as an afterthought after the commercial contract is signed. The manufacturers that survive Health Canada GMP inspections with clean records aren’t the ones with the most sophisticated facilities; they’re the ones who documented their oversight and can demonstrate they took it seriously from day one.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Androxa. Learn more about our team

Talk to our team about Health Canada compliance Contact us

Related from our network

• ISO 17025-accredited pharmaceutical and supplement testing for Canadian submissions — Qalitex Laboratories provides contract analytical testing services that support GMP qualification and Health Canada regulatory filings
• EU GMP equivalence and regulatory consulting for manufacturers entering European markets — Care Europe guides pharmaceutical and cosmetic companies through EU regulatory requirements, including REACH and EU 1223/2009 compliance