ICH Q10 keeps outsourced work inside the quality system

Outsourcing changes the performer, not the quality boundary

The direct answer in ICH Q10 is that an outsourced activity remains inside the pharmaceutical company's quality-system responsibility. Section 2.7 says the company is ultimately responsible for ensuring that processes are in place to control outsourced activities and the quality of purchased materials. The contract acceptor may perform the work, and a supplier may provide the material, but the company still needs an intelligible basis for selection, oversight, review, and action.

A quality platform should preserve the product, process, material, site, supplier or contract acceptor, intended use, specification, quality risk, approved scope, responsible internal function, and source evidence as connected records. A supplier-approved status alone does not show which work was assessed, for which facility or product, under which agreement, or for what period. Changes in that context should trigger a scoped reassessment rather than silently inherit the broad status.

Suitability is assessed before the work is placed

ICH Q10 calls for assessing the suitability and competence of the other party before outsourcing operations or selecting material suppliers. The assessment is tied to the defined supply chain and the work to be performed. It is not a generic conclusion that the company is qualified for every activity, product, dosage form, technology, test, market, or site.

The decision record should retain the proposed activity or material, technical and regulatory requirements, evaluation criteria, evidence reviewed, qualified reviewers, gaps, conditions, approval, effective date, and reassessment trigger. Where the source record is incomplete or the capability has not been demonstrated at the relevant scale, the uncertainty should remain visible. A completed questionnaire or current certificate can be evidence without becoming the entire suitability conclusion.

The written agreement needs an operating counterpart

The guideline says responsibilities and communication processes for quality-related activities should be defined in a written agreement between the contract giver and contract acceptor. The operational model should connect those agreed responsibilities to actual workflows: specifications, changes, deviations, investigations, complaints, records, audits, release support, escalation, continuity, and termination where applicable.

A stored agreement does not by itself show that the defined handoffs occur. Systems should map the governed obligation to an owner, record type, due event, evidence source, communication path, exception, and retained disposition. When an agreement changes, the platform should preserve the prior version and identify which open batches, studies, materials, deviations, or commitments remain under the earlier terms. Contract metadata should support quality oversight rather than replace it.

Monitoring should connect performance to improvement

ICH Q10 directs the company to monitor and review the performance of the contract acceptor and the quality of purchased materials and to identify and implement needed improvement. Monitoring therefore needs a defined population, period, evidence, thresholds or evaluation criteria, accountable reviewer, conclusions, and actions. Counts of late events or deviations are not meaningful without product, process, volume, severity, reporting, and comparability context.

A buyer should test whether a system can trace a supplier or acceptor issue through affected material or work, investigation, risk assessment, communication, decision, corrective action, change, and effectiveness review. This guideline is a quality-system model and must be applied with applicable regional requirements and product context. It does not prescribe one software design or establish that a supplier, contract acceptor, process, material, or pharmaceutical quality system is acceptable.

Enterprise buyer test

Translate this change into the exact population, record type, workflow stage, decision owner, effective date, and evidence that could be affected. Ask current or prospective providers to demonstrate the named workflow with representative data and an exception—not a polished feature tour. Record what official documentation establishes, what a provider states, what the team observes, and what remains unresolved.

A defensible review also identifies the dependency outside the product. Authority interpretation, policy configuration, data quality, integrations, human judgment, approval rights, release governance, training, and retained evidence may remain customer or service responsibilities. The evaluation should preserve those boundaries instead of treating a technology claim as the complete operating model.

What we will watch next

RegQuality Review will watch the named source and affected market records for later evidence that changes status, scope, availability, implementation timing, workflow consequence, or the limits of the initial report. A later announcement does not silently overwrite this dated account; the change ledger preserves the sequence.