The CMO should have records documenting the installation (installation qualification) of the equipment. These records will include the specifications and verification of materials, piping, wiring, vacuum, air supplies, and other equipment components as applicable. Records should also include functional and design specifications for automated equipment control. Often called programmable logic controls (PLCs), these computer systems are specifically designed to interface with certain types of manufacturing or packaging equipment. These computers' programs should be subjected to unit-level testing to confirm that they function correctly before they are integrated with the equipment. The connections and wiring between the automation or computer and the equipment should also be documented in wiring diagrams and verified as part of the qualification activities.

The CMO should have documented evidence that the integrated equipment and automation have been tested together and shown to function correctly according to the given specifications. This evidence is often called installation qualification (IQ) and operational qualification (OQ) of the integrated unit. A final check should determine whether the CMO has documented procedures for the ongoing operation, maintenance, and change control of these integrated equipment units. If the CMO has performed these activities and retained the specifications and records, the sponsor can be confident that the CMO's automated equipment is qualified and ready to execute the manufacturing or packaging processes required to produce the sponsor's product.

If the CMO candidate cannot produce the documentation discussed above, the sponsor could be at risk for increased costs. These qualifications will need to be performed to ensure that the sponsor's product will meet specifications and that the records will satisfy regulatory expectations.

Evidence for validation of these types of applications includes a validation plan, requirements specifications, functional specifications, design specifications, configuration specifications, development-level testing, IQ protocols and results, OQ protocols and results, and either user-acceptance testing or performance qualification (PQ) protocols and results. An overview of the mapping between the specifications and testing should be presented in a traceability matrix. Standard operating procedures (SOPs) should exist for the ongoing use, maintenance, and control of these systems. Finally, a summary of the validation activities and evidence created should be presented in a validation summary report.

As it did for the manufacturing-automation assessment, the sponsor should ask the CMO to provide evidence that it has defined processes for validating a manufacturing operation business application system. If the CMO can share with the sponsor a risk-based method for qualification or validation, it will demonstrate that it has achieved a high level of compliance sophistication (2). If the CMO has no documented processes for qualification, validation or ongoing control, this omission may be a source of compliance risk to the sponsor. A CMO with uncontrolled automated manufacturing equipment or systems can jeopardize the acceptance of a clinical study or the approval of a new drug application (NDA) or cause the recall of a commercialized batch of product.

A final, subjective assessment of the manufacturing automation or systems area can be made by simply touring the CMO's manufacturing facility and observing its equipment, automation, and practices. The sponsor can look for some of the following indicators that may be warning signs of regulatory noncompliance, CMO financial instability, or inability of the CMO to meet contractual agreements with the sponsor:

• Obsolete computer equipment
• Automated equipment or computers that are independent and not networked together
• A totally paper-based environment
• Computer workstations that are active and unsecured even when left unattended
• Computer workstations at which operators share one identification code and password
• Automated control systems with unsecured computer code or programs
• Computer equipment in areas that are experiencing environmental extremes (e.g., of temperature, humidity, airborne particulate matter, or water)
• Computer cabling that is dangerously located and subject to damage or electromechanical interference.

The subjective observation criteria can also be applied to the assessment of a CMO's quality-control laboratory, automated laboratory instrumentation, and laboratory systems.