The role of the contract manufacturing organization/contract development and manufacturing organization (CMO/CDMO) is to partner with the authorized owner of a product in the manufacture of, and sometimes, additionally, the design of, the product. The product, in this case, may be any U.S. Food and Drug Administration (FDA) regulated commodity, food, drug, device, combination product, or biologic, amongst others. The basic principles and concepts of complaint management are the same, regardless of the commodity in question. The specific requirements may differ, particularly when it comes to reporting complaints that are adverse events to the FDA. The intent here is to outline the basic roles and responsibilities of each party, and the FDA, when it comes to proper and effective complaint management.

What is the role of the CMO/CDMO in complaint management? The immediate answer is that the CMO/CDMO is responsible for supporting the Marketing Authorization Holder (MAH) in its complaint investigation. While the MAH most frequently receives complaints, as the product is presented with its brand, the CMO/CDMO is notified of complaints by the MAH. In the instances where product approval is not required, such as monograph OTC drugs or foods, the MAH is equivalent to the product owner.

The CMO/CDMO is required to maintain a quality system compliant with FDA regulations for the commodities that it regulates. Most directly, this means that the CMO/CDMO must have a quality system established for receiving complaints from the MAH and responding in support of investigations in a timely manner. The CMO/CDMO, depending on the contractual agreements, may be responsible for operations as limited as secondary packaging and labeling, or as complex as medical device design, full aseptic drug manufacture, contract sterilization, or laboratory services.

Regardless of the services provided, the CMO/CDMO must maintain its quality system in a manner in which it can help the MAH identify potential root causes of complaints. Areas of responsibility may include review of production records, change controls, deviations/non-conformances, equipment (maintenance, calibration, and qualification), process validation, design control, and materials and supplier management. Additionally, CMO/CDMOs that manufacture medical devices (or combination products which contain a medical device constituent) must collect and analyze quality data as indicators of the overall health and performance of their quality systems. Such data may provide early indications of potential root causes that have led to complaints.

The MAH/owner is responsible for ensuring that the CMO/CDMO maintains a quality system with which it is able to manufacture the product under a state of consistent control. Additionally, the MAH is the entity required to submit reports to the FDA, including Field Alert Reports (FARs) and Medical Device Reports (MDRs). The timeliness of such reports is of critical importance. Often, the time necessary for a CMO/CDMO to support a complaint investigation is not commensurate with timely reporting, leading the MAH to file a report within the required timeframe but without investigative conclusions. Complaints need to be driven to conclusion, and such reports to the FDA will need to be updated.

The MAH is also responsible for any market actions because of complaints. If information indicates that a product may be in violation of the FD&C Act or it may have been misbranded or rendered injurious, ineffective, or adulterated, the MAH, not the CMO/CDMO, is responsible for working with the FDA and the CMO/CDMO to implement a recall action.

Of course, the relationship and interdependency are not as simple as this. Each relationship is unique and has nuances. Quality agreements are key to defining the responsibilities of both parties, the CMO/CDMO and the MAH/owner. The quality agreement should describe in detail the responsible parties for each part of the quality system’s compliance, complaint handling included. When more granular detail is required, the agreement should include parsing of responsibilities.

One such example is control of raw materials. In some instances, the CMO/CDMO sources the raw materials to the MAH’s specifications, but the CMO/CDMO is responsible for qualifying and maintaining the material supplier relationship. Performance of the material supplier may be one area of investigation for determining the potential root cause of a complaint.

A second example relates to the medical device industry. When a device must comply with the requirements of design control, the quality agreement should be noticeably clear as to the responsibilities. Most often, the MAH is responsible for designing the product. However, the CMO/CDMO must participate in process risk management, design transfer, acceptance of the device master record, translation into the device history record, and control of changes and quality data indicators that may impact the design. It is common that complaints related to a medical device can be traced back to the design of the product.

Additionally, risk management is the responsibility of both the CMO/CDMO and the MAH/owner. The MAH must identify the risks associated with the marketed product, and the CMO/CDMO must share its quality data with the MAH so that it can evaluate, and potentially change, the risk management profile of the product. Again, this relationship should be clearly defined in the quality agreement to ensure timely and complete sharing of information by all parties.

Information that the MAH/owner has regarding post market performance of a product is critical to the manufacture of the product. Post market data can provide early signs of design problems as well as material and/or production and process concerns. In some instances, a MAH/owner may have chosen to share only some of the post market information with the CMO/CDMO. A specific example is where a MAH/owner’s internal management process allows each complaint to receive a risk priority, dismissing “low risk” complaints without requiring investigation. Complaints, with very few exceptions, require some level of investigation, even when the products are not returned for examination.

In one case, a MAH/owner had deemed numerous complaints to be low risk and had not required investigation involving the CMO/CDMO’s information, such as batch record review, review and analysis of deviations/non-conformances, or review of materials. A formal field action was taken and, upon discussion, it was discovered that the CMO/CDMO had received only the higher risk complaints; a considerable number of complaints had not been shared. Had the CMO/CDMO had early knowledge of these additional complaints, the sheer number would have stimulated a faster and more robust investigation to determine the root cause.

It is important to prevent conflict before it has the potential to occur. It is expected that complaints will be received. Management of the complaints, reportability, and responsibility are key to maintaining the safety and efficacy of the product and the relationship between the CMO/CDMO and the MAH/owner. Therefore, the quality agreement should clearly define which entity will be responsible for reporting events, such as FARs and MDRs, to the FDA and which will be responsible for communicating with the FDA regarding any field actions, such as product recalls. The question of interaction with regulatory bodies, such as the FDA, can be problematic when it becomes an ethical or moral conundrum.

A specific example of this is when the quality agreement clearly indicates that the MAH/owner shall be the one to interact with the authority, such as the FDA, yet the CMO/CDMO has identified a critical event or occurrence that it feels must be reported or should be discussed with the FDA, at minimum, as a potential field action. This is generally when the legal team is involved. Contractually, it is most often spelled out that the CMO/CDMO shall not make reports to authorities on the behalf of the MAH/owner. However, the MAH/owner must also realize that the CMO/CDMO is subject to inspection as a manufacturer, and instances where reportable events should have been made known to the FDA, and were not, are likely to be discovered. It is a fine balance between the legalities and the responsibility for ensuring that the product remains safe and effective. This area should be clearly defined in the quality agreement.

In one such instance, the CMO/CDMO had it stated, in the quality agreement, that if all reasonable efforts to work in partnership to determine whether events are reportable (or which actions should be taken) have been attempted but the parties have been unable to come to agreement, the CMO/CDMO retains the right to contact the regulatory authorities if and when the product presents a real or potential risk to users.

To be clear, 21 CFR Part 803 states, in pertinent part:

§ 803.1 What does this part cover?

(a) This part establishes the requirements for medical device reporting for device user facilities, manufacturers, importers, and distributors. If you are a device user facility, you must report deaths and serious injuries that a device has or may have caused or contributed to, establish and maintain adverse event files, and submit summary annual reports. If you are a manufacturer or importer, you must report deaths and serious injuries that your device has or may have caused or contributed to, you must report certain device malfunctions, and you must establish and maintain adverse event files. If you are a manufacturer, you must also submit specified follow-up.

There is no distinction between the contract manufacturer and the manufacturer, which is assumed to be the entity that has its name on the label.

On the contrary, 21 CFR 314.81(b)(1) requires that “…NDA and ANDA applicants must submit certain information to FDA about distributed drug products.”

The FDA maintains systems for monitoring post market data, including the filing of FARs, MDRs, and Biological Product Deviation Reports (BPDRs). In addition, the FDA receives thousands of complaints each year regarding the products it regulates. Its two systems of complaint monitoring may trigger an immediate action or a directed action by the FDA. Specifically, complaints of illness or injury that may indicate imminent harm will result in immediate action, such as dispatch of an investigator to the responsible manufacturing site or liaison with other federal, state, or local authorities to ensure that a swift response to the complaint is made. The post market surveillance teams at the FDA may find patterns for concern in reported events through the FAR/MDR/BDPR systems, and those may stimulate a directed inspection specifically targeted at understanding the underlying cause of the post market reports as well as the containment and corrective actions taken by the manufacturer.

To be certain, the FDA will contact the MAH/owner of the product, and will visit the CMO/CDMO as the product’s manufacturer. In instances where the directed inspection or immediate complaint response identifies GMP deficiencies, an FDA-483, Inspectional Observations, may be issued to one or both of the parties (the MAH/owner and/or the CMO/CDMO). Additionally, actions, such as Warning Letters, have been issued to both parties which share responsibility for the safety and efficacy of the product.

With contract manufacturing growing in prevalence across all regulated industries, it is important that the relationships and responsibilities of all parties are well documented and well understood. The FDA has made it clear that the MAH/owner may not abdicate its GMP responsibilities. While some responsibilities may be delegated, oversight for delegated activities remains with the MAH/owner, tying the parties together tightly to ensure not only compliance with regulations but also the safety of the product provided.