CDMO Quality Agreements: Defining Who Owns the Audit Trail

Why “Who Owns the Audit Trail” Needs Three Answers

Ask a sponsor’s quality lead who owns the audit trail for a batch made at a CDMO, and the usual answer is “the CDMO, it’s their system.” Ask the same person who is accountable if an inspector finds that a chromatography result was reprocessed without explanation, and the answer changes to “we are.” Both answers are correct, which is exactly why a single ownership sentence in a quality agreement does not work.

An audit trail, as FDA defines it, is “a secure, computer-generated, time-stamped electronic record that allows for reconstruction of the course of events relating to the creation, modification, or deletion of an electronic record.”² That record comes into existence inside a specific system, under that system’s configuration. It becomes useful only when a qualified person reads it in context. And it has to survive, readable, for as long as the underlying batch record must be kept. Those are three different activities, and at a CDMO they are rarely done by the same people.

Accountability Does Not Move With the System

The regulatory starting point is simple. Under 21 CFR 200.10(b), FDA “regards extramural facilities as an extension of the manufacturer’s own facility.”³ FDA’s quality agreement guidance goes further: “It is important to note that quality agreements cannot be used to delegate statutory or regulatory responsibilities to comply with CGMP.”¹ The guidance also says the owner’s quality unit is responsible for approving or rejecting drugs made by the contract facility, including for final release, while the contract facility remains responsible for its own CGMP compliance.

In the EU, Chapter 7 of the GMP Guide makes the contract giver “ultimately responsible to ensure processes are in place to assure the control of outsourced activities,” and states that the contract giver should be responsible for reviewing and assessing the records and results related to the outsourced activities.⁶

So the sponsor cannot hand off accountability. What it can do is assign work: who configures, who reviews, who stores, who produces. The quality agreement is the place to write that assignment down.

Three Jobs Hidden in One Word

We find it useful to break “ownership” into the following jobs before drafting a single clause. Each one has a different natural owner and a different way to fail.

We list “produce” separately from “retain” on purpose. Plenty of organizations keep data they cannot find. Section 6 describes an FDA warning letter where exactly that happened at a contract laboratory.

What US and EU Rules Assign to Each Party

Before negotiating, it helps to know which responsibilities are fixed by regulation and which are open for the parties to allocate. The fixed ones cannot be moved by contract. The open ones must be allocated, or they default to whoever an inspector happens to ask.

United States

Review is a quality unit duty. FDA’s data integrity guidance says that personnel responsible for record review under CGMP “should review the audit trails that capture changes to data associated with the record as they review the rest of the record.” It adds that all production and control records, which include audit trails, must be reviewed and approved by the quality unit under 21 CFR 211.192.² The same answer points readers to the quality agreement guidance for information about auditing contract facilities. FDA explicitly connected audit trail review to contract oversight, even though the quality agreement guidance itself never uses the term.

Frequency follows the record. Where CGMP regulations set a review frequency for the data, the audit trail review follows the same frequency. FDA’s examples are review after each significant step in manufacture under 211.188(b) and data review before batch release under 211.22. Where no frequency is set, the firm should decide based on a risk assessment covering data criticality, control mechanisms, and impact on product quality.²

Retention of the audit trail matches retention of the record. Under 21 CFR 11.10(e), audit trail documentation “shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying.”⁵ For drug product batch records, 21 CFR 211.180(a) sets that period at no less than one year after the batch’s expiration date. Section 211.180(c) requires records to be readily available for authorized inspection at the establishment where the activities occurred, and treats records that can be immediately retrieved from another location by electronic means as meeting that requirement.⁴

The quality agreement should cover records and systems. FDA’s guidance recommends that the quality agreement define which party validates processes and qualifies and maintains equipment and applicable systems, naming “information technology and automated control systems” among them. Under documentation, it recommends defining each party’s role in making and maintaining original documents or true copies and explaining how those records will be made readily available for inspection. It also says the agreement “should indicate that electronic records will be stored in accordance with CGMP and will be immediately retrievable during the required record-keeping time frames established in applicable regulations.”¹

European Union and PIC/S

Records must be kept by, or available to, the contract giver. EU GMP Chapter 7, in operation since 31 January 2013, states that all records related to outsourced activities, such as manufacturing, analytical, and distribution records, “should be kept by, or be available to, the Contract Giver.”⁶ It also says the contract acceptor should not subcontract any of the work without the contract giver’s prior evaluation and approval, and that information must flow down the chain the same way.

Third parties running computerized systems need formal agreements. The current EU Annex 11 (2011) says that where third parties provide, configure, maintain, or retain a computerized system or related service, formal agreements must exist and “should include clear statements of the responsibilities of the third party.” Its audit trail clause says audit trails “need to be available and convertible to a generally intelligible form and regularly reviewed.”⁸

The draft Annex 11 is more specific, but it is still a draft. The European Commission ran a stakeholder consultation on revised Chapter 4, revised Annex 11, and a new Annex 22 from 7 July to 7 October 2025. As of this writing, the EudraLex Volume 4 page still lists the January 2011 Annex 11 as the current text, and no final revision or date of coming into operation has been published. The draft’s section on supplier and service management says a regulated user relying on a service provider’s operation of a system “remains fully responsible” based on the risk to product quality, patient safety, and data integrity. Its audit trail section proposes independent review by personnel not directly involved in the activity, review before batch release unless later detection can be justified, and the ability to obtain a complete electronic copy of system data including audit trails, noting that “Flat and locked files are not acceptable.”⁹ Treat these as a strong signal of inspector thinking, not as requirements in force.

PIC/S addresses the contract relationship directly. The PIC/S data integrity guidance PI 041-1, in force since 1 July 2021, has a full section on outsourced activities. It says quality agreements should include specific provisions for data integrity across the supply chain, including a requirement to notify the contract giver “of any data integrity failures identified at the contract acceptor site.” It expects contract acceptors to “provide reasonable access to data generated on behalf of the contract giver during audits,” and says audits and routine surveillance should include verification of source electronic data and metadata by the contract giver’s quality unit, using a risk-based approach.¹⁰

Two patterns stand out. First, no source lets the sponsor opt out of review. Second, almost every source is silent on the mechanics: what the sponsor sees, how quickly, in what format, and who keeps the data when the contract ends. The quality agreement has to supply those details.

Configuration Ownership: Who Controls the Audit Trail Settings

Most quality agreement discussions about audit trails start with review. We think they should start one step earlier. An audit trail review is only as good as the configuration behind it. If the system does not capture reprocessing events, or if an analyst with administrator rights can disable logging, then a clean review proves very little.

Who Can Turn It Off

PIC/S says audit trail functions “should be enabled and locked at all times” and that if administrative users can deactivate, delete, or modify the function, an automatic entry should record that it happened.¹⁰ The draft Annex 11 adds that only a system administrator not involved in GMP activities should be able to make such changes.⁹

At a CDMO, the sponsor rarely has any visibility into who holds those rights. The FDA warning letter to the Center for Instrumental Analysis of China Pharmaceutical University, a contract testing laboratory, illustrates the risk. FDA found that the NMR equipment used for customer testing was also used for academic teaching and research, and that it appeared various users shared one login ID with full administrative access.¹² Any audit trail from that system could not reliably show who did what, because the user identity was shared.

The quality agreement should require the CDMO to state, for each GMP system used on the sponsor’s product, who holds administrator rights, whether those people perform GMP work in the same system, and how audit trail configuration changes are themselves logged. This does not need to be a long list. It needs to be accurate and current.

Validation Evidence for the Audit Trail Function

PIC/S expects audit trail functions to be verified during validation, and it expects regulated users to assess the different audit trails in each system to decide which are relevant to GMP and how they are configured.¹⁰ For a CDMO system, that assessment exists at the CDMO, not at the sponsor.

A reasonable allocation is that the CDMO performs and owns the validation and the audit trail assessment, and the sponsor has the right to review both during qualification audits and after major changes. What the sponsor is looking for is simple: which events are captured, which audit trails the CDMO has classed as critical, and why the others are not reviewed routinely.

Changes to the Audit Trail Itself

FDA’s guidance says the quality agreement should define which changes the owner must approve in advance and which the contract facility can make without notice, and it lists items such as testing procedures and major manufacturing equipment.¹ Software upgrades and configuration changes to GMP systems are not named in that list, and they are often left out of the change notification schedule.

We recommend adding a specific category: changes that affect what a GMP system records in its audit trail, who can alter audit trail settings, or how audit trail data is stored or exported. A new version of a chromatography data system can change audit trail fields or export formats. A migration to a new LIMS can split an audit trail across two systems. The sponsor should hear about these before they happen, not at the next audit.

Review Ownership: Tying Audit Trail Review to Decision Points

The most common quality agreement failure we see is a sentence such as “The Contractor shall perform audit trail review in accordance with its procedures.” It is not wrong. It is incomplete. It does not say which audit trails, before which decision, by whom, or what the sponsor receives to show the review took place.

The fix is to anchor every audit trail review to a decision point in the batch life cycle. FDA’s guidance links review frequency to the frequency of the underlying record review, including review before batch release.² PIC/S says critical audit trails related to each operation should be independently reviewed with the other records for that operation, before the operation is closed out, for example before batch release, and that this review should be done by the originating department and verified by the quality unit where necessary.¹⁰

The CDMO Reviews First, Before Its Own Disposition

The CDMO’s quality unit approves or rejects the results of its own operations. FDA’s guidance says contract facilities are responsible for approving or rejecting the product or results of their manufacturing operations, such as test results, finished dosage forms, or in-process materials.¹ Audit trail review for the records behind those results belongs with the CDMO, before the CDMO signs off. The sponsor is not in a position to do this review in real time, and should not try.

What the sponsor should require is that the review happen before the CDMO’s disposition, that it be documented as part of the batch or test record, and that the review record show who reviewed, when, what was in scope, and what was found. A statement such as “audit trails reviewed, no issues” with no scope or signature is not useful evidence.

What the Sponsor Reviews Before Final Release

The sponsor’s quality unit, or in the EU the Qualified Person, makes the final release decision. The PIC/S guidance is realistic here: “It is often not practical for the contract giver to review all raw data relating to reported results.”¹⁰ Instead, it places weight on qualification and risk-based verification.

For most batches, the sponsor’s pre-release review should cover evidence that the CDMO’s audit trail review was completed for each in-scope system, a summary of any findings and how they were resolved, and a link to any deviation or investigation that came from the review. The draft Annex 11 proposes that audit trail reviews with direct impact on product release should be available to the QP at the time of batch release.⁹ Even while that text is a draft, it describes a reasonable expectation to write into the agreement now.

Which Systems, Which Review Point

Not every system needs the same treatment. The table below is a starting point we use when mapping audit trail review for a CDMO arrangement. Adjust it to your product and the CDMO’s actual system landscape.

The Review of the Review

A sponsor’s most valuable audit trail activity is often not reading audit trails. It is checking whether the CDMO’s reviews work. We describe this as a review of the review, done on a schedule and scaled to risk.

In practice, this means that during each qualification or periodic audit, the sponsor’s auditor picks a small set of completed batches or test results, pulls the underlying audit trails with the CDMO’s help, and checks whether the CDMO’s reviewer caught what an independent reader would catch. PIC/S describes this kind of verification of source electronic data and metadata by the contract giver’s quality unit as part of audits and routine surveillance.¹⁰ If the CDMO’s reviews keep missing things, the sponsor increases its own direct review until that is fixed. If they hold up over time, the sponsor can rely more on the summaries.

The FDA warning letter to Shiva Analyticals, a contract testing laboratory, shows why this matters. During evaluation of audit trail review for the lab’s MassLynx software, FDA’s investigator documented hundreds of entries by analysts related to “Add/Modify/Delete peaks” and “Alter existing file on disk” user privileges between January 16, 2022, and January 23, 2025. FDA noted that customers rely on the integrity of the lab’s data to make decisions about drug quality.¹¹ A sponsor that only received “audit trails reviewed” statements from a lab like this would have had no way to know.

Sponsor Access: What You Can See, When, and How

Access is the part of the negotiation where CDMOs push back hardest, and often for fair reasons. They run shared systems, they have confidentiality duties to other clients, and they cannot give every sponsor a login to production systems. A useful quality agreement accepts those limits and sets out tiers of access instead of an open-ended right.

Three Tiers of Access

The for-cause tier is where “format” matters most. A PDF of an audit trail report is better than nothing, but it cannot be sorted or searched, and it may not show everything. The draft Annex 11’s statement that flat and locked files are not acceptable for a complete electronic copy points the same way.⁹ Ask for an export the CDMO’s system can produce natively in a structured, searchable format, and agree what that is before you need it.

Remote Review Without Giving the Sponsor Write Access

PIC/S describes an arrangement where the contract giver offers the contract facility use of its own hardware and software system, deployed over a wide area network, and monitors data quality in real time. It adds a clear condition: segregation of duties so that the contract giver’s monitoring does not allow it to amend data generated by the contract acceptor.¹⁰

Few sponsors will go that far, but the principle applies to any remote access. Read-only means read-only. A 2019 article in Outsourced Pharma by a quality consultant made a similar case from the audit side: CDMOs should give sponsor quality groups time-limited, read-only portal access to GMP records, with redaction for client confidentiality and controls against copying, downloading, and printing.¹⁵ Whichever form you choose, the agreement should state who grants and removes access, how long access lasts, and how the sponsor’s own access is logged.

Confidentiality Is a Design Problem, Not a Refusal

CDMOs sometimes decline to share full audit trails because the same audit trail contains entries for other clients’ products. That concern is legitimate. PIC/S offers a practical answer: the contract giver and contract acceptor can work together to encode client-confidential information so that clients are de-identified, which allows review of source electronic data and metadata without breaking confidentiality obligations. PIC/S notes that reviewing a larger data set this way supports a better assessment of the contract acceptor’s data governance and allows a search for signs of data integrity failure, such as repeated data sets or data that lacks expected variability.¹⁰

Subcontractors and the Chain of Access

Many CDMOs send some testing to a contract laboratory. EU GMP Chapter 7 says the contract acceptor should not subcontract work without the contract giver’s prior evaluation and approval, and that arrangements with the third party should make information available in the same way as between the original parties.⁶ For audit trails, that means the sponsor’s access rights and the CDMO’s review obligations should flow down to any subcontracted laboratory in writing. If the CDMO’s agreement with its subcontract lab does not include audit trail access, the sponsor’s agreement with the CDMO cannot deliver it.

Retention and Custody Over the Full Record Life

Retention is where the time span creates the most risk for the sponsor. A commercial supply agreement may run five years. A batch record may need to be kept for a year past expiry in the US, and longer in the EU. The supporting validation and stability raw data may need to be kept for as long as the marketing authorization stands. Over that span, the CDMO may upgrade its software, change owners, close a site, or stop working with you.

Retention Periods Follow the Record, Not the Contract

EU GMP Chapter 4 also says that for investigational medicinal products, batch documentation must be kept for at least five years after completion or formal discontinuation of the last clinical trial in which the batch was used. It adds that critical documentation, including raw data supporting information in the marketing authorization, such as validation or stability data, should be retained while the authorization remains in force.⁷ Because audit trails are part of the electronic record, the same retention periods apply to them.

This is especially relevant for biotech sponsors whose CDMO relationships begin in clinical supply. FDA’s quality agreement guidance does not explicitly apply to investigational material, but it says that many of its principles “could be applied in pre-commercial stages of the pharmaceutical life cycle.”¹ A sponsor that sets up its audit trail allocation at Phase 1 avoids renegotiating it under time pressure before a pre-approval inspection.

Readable, Not Just Stored

The current Annex 11 says archived data should be checked for accessibility, readability, and integrity, and that when relevant system changes are made, the ability to retrieve the data should be ensured and tested.⁸ FDA’s data integrity guidance makes a related point about dynamic records: a printout or static record does not preserve the dynamic record format that is part of the complete original record for certain laboratory instruments.² An audit trail exported to PDF and stored in a document system may satisfy a filing checklist while failing to support reconstruction of what happened.

The draft Annex 11 would tighten this further, with GMP data and metadata, including audit trails, protected from deletion and change throughout the retention period, and data integrity verified, for example by checksum, when data is moved to an archive.⁹ Again, that text is not final. But a quality agreement that asks the CDMO to show how it keeps your audit trails readable through its next two software upgrades will satisfy either version.

When Stored Data Cannot Be Found

The warning letter to the Center for Instrumental Analysis of China Pharmaceutical University is a clear example of retention without production. The lab told FDA investigators that its NMR testing data from before November 2023 was stored on external hard drives, that it might be difficult to locate the data because there were many archived drives, and that only archiving personnel could retrieve it. The lab did not provide any CGMP data from those drives during the inspection. FDA also recorded that the lab’s director said the firm was not involved in CGMP activities, while its customers used its data for CGMP purposes.¹²

Every sponsor that used that lab’s results was relying on records that could not be produced when a regulator asked for them. That is the “produce” job failing, and it is the reason we separate it from “retain.”

Contract End, Acquisition, and Site Closure

The quality agreement should state what happens to the sponsor’s records, including audit trails, in each of these cases:

• Normal contract end. Either the CDMO keeps the records for the full retention period and agrees to produce them on request, or it transfers a complete electronic copy, including audit trails and the metadata needed to read them, to the sponsor or a named archive. The agreement should say which, and who pays for the storage.
• System retirement at the CDMO. The CDMO notifies the sponsor before retiring a system that holds the sponsor’s data, and either migrates the data with its audit trails in a validated way or preserves the ability to read the old data.
• Change of CDMO ownership. Record retention and production obligations survive a change of control, and the new owner is bound by them.
• Site closure or insolvency. The sponsor has a right to receive its records before the site closes, and the CDMO commits to give notice early enough for that transfer to happen.

PIC/S notes that records can be retained internally or through an outside storage service subject to quality agreements, that the data center locations should be identified, and that a risk assessment should show the retention arrangement is suitable.¹⁰ If the CDMO uses a hosted archive, the sponsor should know where it is and who runs it.

Inspection Expectations: Who Answers the Investigator

An inspector can arrive at either site. The questions differ, but both sites need to give answers that match.

At the CDMO

At the CDMO, the inspector will look at audit trail configuration, access control, and whether the CDMO’s reviews are real. EU GMP Chapter 7 states plainly that the contract acceptor should understand that outsourced activities, including contract analysis, may be subject to inspection by the competent authorities.⁶ FDA’s quality agreement guidance recommends that the agreement set expectations about FDA inspections and include agreed provisions for communicating inspection observations and findings, as well as relevant FDA actions and correspondence.¹

For audit trails specifically, the agreement should require the CDMO to tell the sponsor promptly about any inspection observation involving data integrity, audit trails, or access control in a system used for the sponsor’s product, whether or not the observation names the sponsor’s product. The FDA guidance notes that because contract facilities serve many owners, the agreement should address when, how, and what the contractor will report about objectionable conditions found in inspections and audits.¹ The Shiva Analyticals letter reinforces this, telling the contract lab that it has a responsibility to inform all of its customers or clients of significant problems encountered during testing of their drugs.¹¹

At the Sponsor

At the sponsor, the inspector’s question is oversight: how did you know the CDMO’s data was reliable? FDA’s guidance says that after finding problems at a contract facility, FDA might decide to inspect the owner, and the owner could be in violation of CGMP for failing to oversee the contract facility.¹

The warning letter to AACE Pharmaceuticals shows that sequence. FDA inspected AACE in November 2024 after an inspection of its contract manufacturer, which made ophthalmic products for AACE, revealed violations including fabrication of microbiology laboratory records. FDA found that AACE had identified CGMP deficiencies at the contract manufacturer in September 2020, including a failure to maintain raw testing data, but qualified it anyway, and then requalified it in 2023 without evaluating whether the corrective actions had worked. FDA wrote that comparing a certificate of analysis from a contract manufacturer to pre-approved specifications “does not overcome your responsibility to evaluate, qualify, audit, and monitor your contract manufacturers.”¹³

The lesson for audit trails is direct. A sponsor that finds a data problem at a CDMO and records it in an audit report owns that knowledge. If the quality agreement has no mechanism to verify the fix, including a follow-up review of the relevant audit trails, the sponsor’s own records become evidence against it.

Records Without an Inspection

FDA does not always need to be on site. In a June 2026 warning letter to Shantou Qiwei Industry, an OTC drug manufacturer, FDA’s findings came from records and other information the firm submitted in response to an August 2025 request under section 704(a)(4) of the FD&C Act.¹⁴ The subject of that letter was component testing, not audit trails, but the method matters. When a regulator can request records in advance of or in lieu of an inspection, the ability to retrieve complete, readable records quickly, from wherever they are held, becomes part of inspection readiness. For a sponsor whose records are held at a CDMO, that means knowing in advance how fast the CDMO can produce a complete audit trail export for a given batch.

An Audit Trail Schedule for Your Quality Agreement

Rather than scattering audit trail language across sections on documentation, laboratory controls, and change control, we recommend a single schedule or appendix dedicated to audit trails and related electronic records. It is easier to negotiate, easier to update when systems change, and easier to show an inspector. FDA’s guidance supports this kind of structure, noting that quality agreements may use charts, matrices, narratives, or a combination, as long as they clearly document which party is responsible for specific activities.¹

What the Schedule Should Contain

Metrics Worth Trending

A schedule without follow-up tends to be ignored. A small set of measures, reviewed at each quality business review with the CDMO, keeps it alive:

• Share of release packages that arrive with a complete audit trail review summary for all in-scope systems.
• Number of audit trail findings reported by the CDMO, by system. A long run of zero findings in a busy chromatography lab is a question, not a comfort.
• Results of the sponsor’s review of the review: how many items the sponsor’s check found that the CDMO’s review did not.
• Turnaround time for for-cause audit trail requests, against the agreed limit.
• Open actions from data integrity findings, with age.

The draft Annex 11 proposes that a regulated user relying on a service provider exercise oversight through agreed service level agreements and key performance indicators.⁹ Whether or not that text becomes final in its current form, metrics like these give the sponsor something concrete to show an inspector who asks how oversight works.

Where to Start With Existing CDMOs

Few sponsors can renegotiate every quality agreement at once. We suggest a simple order of work:

1. Rank CDMOs by exposure. Start with those that run chromatography or other data-heavy testing for commercial product, then those supporting products near a pre-approval inspection.
2. Read the current agreement against the schedule above. Mark each element as covered, partly covered, or missing. Most gaps will be in configuration, review evidence, for-cause turnaround, and exit.
3. Close gaps through the schedule, not the whole agreement. Adding or replacing an audit trail appendix is a smaller negotiation than reopening the full document.
4. Run the drill. Test the new terms once with each critical CDMO within six months of signing, and adjust based on what you learn.

Conclusion

The question “who owns the audit trail?” has no single answer when a CDMO runs the systems. The CDMO generates and configures it, reviews it first, and usually holds it for years. The sponsor is accountable for all of it, reviews the evidence before release, checks that the CDMO’s reviews work, and must be able to produce the records when a regulator asks. US regulations, EU GMP, and PIC/S all agree that the sponsor cannot contract its way out of that accountability. None of them tells the parties exactly how to divide the work. That is the job of the quality agreement, and it works best as a dedicated schedule with named parties, decision points, formats, and timelines, backed by a small set of metrics and an annual retrieval drill.

Sakara Digital works with pharma and biotech organizations on the data governance and oversight side of outsourced manufacturing and testing, including how audit trail responsibilities are divided, reviewed, and proven. If you are revising a CDMO quality agreement or preparing for an inspection that will test your oversight of contract sites, and you want an independent view of where your gaps are, we are happy to have that conversation.

For Further Reading