Are Biopharma Companies Outsourcing Their Ability To Think?

By Irwin Hirsh, Q-Specialists AB

Biopharma companies outsource for excellent strategic reasons. External partners provide specialist expertise, manufacturing capacity, analytical technologies, and geographic flexibility that would be difficult or uneconomic to maintain internally. A well-designed outsourcing model accelerates development, allowing smaller companies to build complex products that would otherwise remain beyond their technical or financial reach.

However, outsourcing creates a deep operational paradox. While gaining immediate access to external capability, a sponsor can gradually lose the foundational understanding required to govern that capability. The sponsor owns the product dossier and commercial contract while retaining ultimate regulatory accountability. Operationally, however, the CDMO accumulates much of the hands-on understanding of the manufacturing process. This shift can leave the accountable sponsor increasingly dependent on the CDMO to explain the behavior of its own product.

This is not only an operational concern. ICH Q8(R2), Q9(R1) and Q10 provide the framework for product and process understanding, risk-based oversight and lifecycle knowledge management. EU GMP Chapter 7 makes the outsourcing expectation more explicit by requiring written arrangements that define responsibilities and communication processes, including knowledge management and technology transfer. Taken together, these principles mean that activities may be outsourced, but the sponsor cannot assume that accountability or understanding transfers with the work.

This outcome is not inevitable. A well-integrated CDMO relationship can expand the sponsor’s knowledge through access to platform experience, specialist capabilities, and learning across products. The risk arises when the sponsor does not deliberately absorb, connect, and retain that learning.

Outsourcing Work Is Not The Same As Outsourcing Accountability

In an outsourced operating model, the sponsor no longer performs many of the activities that generate practical knowledge. The CDMO runs the equipment, develops the method, observes the batch, investigates the deviation, and experiences the recurring difficulties.

Over time, the CDMO accumulates:

• process history,
• operational judgment,
• awareness of recurring failure modes,
• knowledge of site-specific constraints,
• understanding of what the written procedure does not fully explain,
• context behind earlier decisions, and
• tacit knowledge held by scientists, engineers, and operators.

The sponsor may receive reports, meeting minutes, and investigation conclusions, but receiving information is not the same as building organizational knowledge. Because accountability remains with the sponsor, it must retain enough internal technical competence to interpret evidence, assess risk, challenge CDMO conclusions, and make informed decisions.

Product and process understanding describes what the organization knows. Internal technical competence describes the ability of its people to interpret and use that knowledge. Both are necessary for effective sponsor oversight.

Where Do We Lose The Knowledge Connection?

The knowledge gap often begins before work starts. It rarely results from a single missing clause. Instead, it emerges across the contracting process, where each document governs part of the relationship, but none defines how knowledge should flow between the parties.

Contracting point	What it normally defines	What may remain implicit
Request for proposal	Services, technical requirements, timelines, costs, and expected outputs	The knowledge to be created, assumptions to be made, unsuccessful approaches, residual uncertainty, and what must remain portable
Due diligence	Whether the CDMO has the facilities, systems, expertise, and compliance record required to perform the service	Whether the sponsor retains enough capability to oversee intelligently, challenge conclusions, and avoid creating an unrecognized dependency
Master services agreement and statement of work	Intellectual property, confidentiality, audit rights, data ownership, records, liability, deliverables, and milestones	The rationale behind choices, context around anomalies, alternatives considered, evidence strength, and uncertainty remaining at the time of a decision
Quality agreement	Responsibilities for deviations, changes, investigations, batch documentation, audits, complaints, and regulatory notifications	The broader context needed to distinguish an isolated event from recurrence, drift, a wrong development assumption, or a change in the CDMO operating environment

 

Taken together, these documents can control the work, data, and allocation of responsibilities without ensuring that the sponsor retains the product and process understanding needed to govern the product. Data ownership secures access, and the quality agreement defines who does what, but neither necessarily specifies what each party must know, transfer, retain, and revisit.

The knowledge interface is the operating connection through which critical knowledge flows between sponsor and CDMO. The knowledge agreement makes the responsibilities for that interface explicit.

 

The Deeper Risk: Erosion Of Sponsor Understanding

The most serious risks take shape when the sponsor gradually loses the ability to recognize which knowledge is missing.

Stage	What happens	Resulting risk
1. Outsource to access capability	Work is transferred because the sponsor lacks capacity or specialist expertise.	Sponsor personnel gain less direct exposure to the process.
2. Practical knowledge accumulates externally	The CDMO develops hands-on judgment while the sponsor receives summaries and conclusions.	Important context becomes harder for the sponsor to see or test.
3. Challenge capability erodes	Internal experts become less able to challenge the CDMO's interpretation.	Future contracts ask for less because the sponsor no longer knows what to request.
4. Oversight narrows	Oversight increasingly depends on the CDMO's definition of what matters.	The absence of visible problems may be interpreted as evidence of control.

 

Ultimately, this represents a loss of the sponsor's ability to absorb and use external knowledge. Oversight activities such as meetings and document approvals can become administrative rituals if the internal team lacks enough independent understanding to ask probing questions.

The Knowledge Requirement Already Exists

The regulatory expectation is therefore clear. The practical gap is not the absence of requirements, but their translation into specific arrangements for what knowledge must move, when it must move, what context must accompany it and how the sponsor will retain and use it. Sponsors may assume that development reports convey sufficient rationale, while CDMOs may assume that their obligations end when the contracted data package is delivered. Both parties can comply with the contract while critical knowledge remains fragmented or poorly transferred. The gap lies in translating high-level quality risk management (QRM), quality by design (QbD), and GMP principles into specific expectations for what knowledge must move, when it must move, what context must accompany it, and how the sponsor will retain and use it.

Recent industry work points in the same direction. Boltres et al. (2025), writing in the PDA Letter, recommend defined processes for knowledge access and retention, up-front agreement on critical knowledge, and clarity on how knowledge will support decisions between sponsors and third parties.⁴

The framework below builds on that direction by distinguishing the operating knowledge interface from the knowledge agreement that formalizes its responsibilities.

Element	Role in the operating model
QRM	Identifies which knowledge, uncertainty, and risks matter.
QbD	Connects product and process understanding to design, control strategy, and life cycle learning.
Knowledge interface	Provides the operating connection through which critical knowledge flows between sponsor and CDMO.
Knowledge agreement	Defines the responsibilities required to make the knowledge interface work.
Sponsor knowledge management system	Keeps knowledge connected, current, reusable, and linked to decisions.
Internal technical competence	Allows the sponsor to interpret evidence, challenge conclusions, and act.

 

A Possible Solution: The Knowledge Agreement

The knowledge interface is the operating connection through which critical knowledge flows between sponsor and CDMO. The knowledge agreement defines the responsibilities needed to make that interface work.

It does not need to be a large separate document. The expectations can be embedded in the quality agreement, a contract annex, a project governance plan, or the CDMO oversight plan.

A written agreement is necessary but not sufficient. Tacit knowledge moves through observation, discussion, joint problem-solving, and trusted expert relationships. The knowledge agreement defines the expectation; the knowledge interface must make it work in practice.

Question	Role in the operating model
1. What knowledge is critical?	Identify what the sponsor must retain, what the CDMO must create, and which core capabilities must be preserved.
2. Who owns the knowledge?	Assign named owners to create, validate, interpret, and maintain critical knowledge and its supporting evidence, with decision rights that continue beyond report approval.
3. When must knowledge be transferred?	Map exact life cycle transfer points from CDMO selection and technology transfer through to validation and final exit.
4. What context must accompany conclusions?	Document the rationale, assumptions, and uncertainties so future teams understand exactly how a conclusion was reached.
5. Which signals require renewed discussion?	Define specific triggers, such as repeated deviations, material drift, or regulatory changes, that should prompt review of earlier decisions.
6. How will knowledge remain portable?	Require structured summaries and accessible data formats so the work can move without rebuilding years of history.

 

The Integration Strategy

The six questions do not require a massive stand-alone document. They can be embedded across existing operational infrastructure using a knowledge agreement framework.

1. Quality agreement:
   Defines knowledge ownership and requires significant analytical and process conclusions to include their scientific rationale, assumptions, and remaining uncertainty.

Answers: Question 2 (Who) and Question 4 (Context)

2. Contract annex:
   Requires critical data, supporting context, and agreed intellectual property to be delivered in accessible, transferable formats.

Answers: Question 1 (What) and Question 6 (How)

3. CDMO oversight plan:
   Defines life cycle transfer points and monitors operational signals, such as process drift, staff changes, or capacity constraints, that should prompt renewed review.

Answers: Question 3 (When) and Question 5 (Signals).

The Sponsor Still Needs Its Own Knowledge System

A knowledge agreement must be supported by a sponsor knowledge management system built around QRM and QbD logic. This system should connect CDMO signals to internal risk libraries, critical quality attributes, control strategy decisions, and continued process verification (CPV) trends. Rather than storing static deliverables, the sponsor should link new evidence to existing product and process understanding and test whether earlier assumptions remain valid.

A sponsor knowledge management system does not necessarily mean one new digital platform or repository. It is the connected set of records, ownership responsibilities and review routines that keeps product knowledge current, traceable and available for decisions. Practical tools may include a product knowledge file, decision log, risk register, control strategy history and process knowledge map.

A robust lifecycle strategy begins with a clear knowledge baseline before outsourcing, captures decision rationale during execution and updates the product and risk picture as new evidence emerges. The tools do not need to duplicate existing controlled records. Their purpose is to connect those records, preserve their context and ensure that important learning remains visible across the product lifecycle.

Life stage	What the sponsor should do	Practical tool/record
Before outsourcing	Document current product and process understanding, uncertainty, assumptions, previous decisions, critical dependencies, gaps the CDMO is expected to address and capabilities that must remain internal.	Product Knowledge File baseline, Process Knowledge Map and retained-capability assessment.
During execution	Capture significant decisions, supporting evidence, rationale, assumptions, uncertainty, accountable owners, expected outcomes and review triggers.	Decision Log linked to its supporting evidence and source records.
Ongoing oversight	Connect CDMO signals with deviations, product and process risks, raw-material and supplier changes, development assumptions, control strategies, CPV trends and changes at the CDMO.	Risk Register supported by a signal, issue or trend log.
Periodic review	Challenge which assumptions remain valid, what routine manufacturing has revealed, whether the control strategy reflects current understanding and whether earlier decisions should change.	Updated Product Knowledge File, Control Strategy History, and relevant CPV and APR/PQR review outputs.
Reuse and exit	Apply verified learning to future CDMO selection, contracts, Quality Agreements, technology-transfer plans, risk libraries, training, standard work and future product design. Confirm that another site or CDMO could continue the work.	Transfer Readiness Pack, reusable lessons library and updated agreement or oversight templates.

 

These tools and records must not become another collection of disconnected documents.

• The product knowledge file can provide the current product narrative and act as an index to supporting evidence.
• The decision log preserves why important choices were made.
• The risk register connects new signals to existing uncertainty.
• The control strategy history shows how controls evolved.
• process knowledge map identifies where critical knowledge resides and who owns it.

The names and systems may vary, but each tool should have a defined owner, review trigger and connection to its source evidence.

Knowledge Agreements Cannot Replace Internal Competence

Systems and contracts have natural limits. They cannot substitute for internal technical competence. Sponsors do not need to duplicate every CDMO capability, but they must retain sufficient knowledge control. A sponsor can possess full contractual rights, complete document access, and formal governance forums while still lacking the product and process understanding needed to exercise meaningful control.

Level of control	What the sponsor possesses
Contractual control	Rights, obligations, and remedies
Documentary control	Access to reports, records, and data
Governance control	Forums, thresholds, and decision rights
Knowledge control	Sufficient product and process understanding to interpret evidence, challenge conclusions, and make informed decisions

 

The Real Test Of An Outsourced Operating Model

Outsourcing should expand operational capability, not erode product and process understanding. Quality Agreements remain essential, but regulatory accountability without sufficient understanding creates a fragile operating model. Meaningful oversight requires explicit knowledge expectations, supported by a Knowledge Agreement, an active sponsor Knowledge Management system and strong internal technical competence.

The ultimate test is not only whether the CDMO can execute. It is whether the sponsor understands enough to govern.  In increasingly asset-light operating models, competitive advantage may depend less on owning manufacturing assets and more on retaining the scientific and engineering understanding needed to remain an intelligent product owner throughout the lifecycle.

References:

1. ICH Q8(R2): Pharmaceutical DevelopmentInternational Council for Harmonisation.
2. International Council for Harmonisation. ICH Q9(R1): Quality Risk Management, particularly Annex II.2(c), Oversight of Outsourced Activities and Suppliers.
3. ICH Q10: Pharmaceutical Quality System, particularly Sections 1.6 and 2.7.
4. European Commission. EU GMP Guide, Part I, Chapter 7: Outsourced Activities, particularly Sections 7.14-7.16.
5. Boltres, B., Brown, D., Haas, B., Lipa, M., Sundberg, R. and Thomas, J. (2025). Expert Perspectives in KM Between Sponsors and Third Parties. PDA Letter, published April 16, 2025.

About The Author:

Irwin Hirsh has 30 years of pharma experience with a background in CMC encompassing discovery, development, manufacturing, quality systems, QRM, and process validation. In 2008, Irwin joined Novo Nordisk, focusing on quality roles and spearheading initiatives related to QRM and life cycle approaches to validation. Subsequently, he transitioned to the Merck (DE) Healthcare division, where he held director roles within the biosimilars and biopharma business units. In 2018, he became a consultant concentrating on enhancing business efficiency and effectiveness. His primary focus involves building process-oriented systems within CMC and quality departments along with implementing digital tools for knowledge management and sharing.