Brand owners are legally liable for CMO compliance—FDA enforcement doesn't stop at your contract manufacturer's door. Before signing with any CMO, verify these 10 items. Missing even one creates documented liability exposure.
Under 21 CFR Part 111, a brand owner who outsources manufacturing to a contract manufacturer (CMO) retains full responsibility for GMP compliance. When the FDA inspects your CMO and finds violations, your name on the label is what appears in the Warning Letter.
The FDA's position is unambiguous: outsourcing production doesn't outsource liability. Choosing a CMO without verified GMP certification, without FDA registration, without quality agreements—that's not due diligence. It's undocumented risk that shows up in enforcement actions.
⚠️ FDA enforcement reality: In 2023, over 60% of dietary supplement Warning Letters cited inadequate supplier controls. "We trusted our CMO" is not a GMP control—it's a gap the FDA documents and cites.
The 10-point checklist below covers the minimum verifiable facts you need before signing with any CMO. Enter your name and email to access it free.
Enter your name and email. We'll send it to your inbox and unlock it here immediately. No spam—just the checklist and occasional GMP compliance resources.
Verify each of the following before signing with any contract manufacturer. These aren't aspirational—each item represents a documented FDA enforcement pattern.
Request the actual GMP certificate—not a claim, not a website badge. Verify the issuing body (NSF, UL, SGS, Intertek, or equivalent), the certificate number, expiration date, and scope of certification. A CMO that can't produce a current certificate has no verified GMP status, regardless of what their sales team tells you.
Under 21 CFR Part 111, dietary supplement manufacturers must register with the FDA. Look up the CMO's facility registration directly at fda.gov/food/registration-food-facilities—do not rely on the CMO's self-reported status. Verify the registration is current, not expired, and covers the product categories you're manufacturing.
A signed quality agreement must define: who owns batch record approval, who handles deviations and complaints, who initiates corrective actions, and how change control works. A purchase order is not a quality agreement. If the CMO can't provide a template or won't sign one, that's a disqualifying signal.
Confirm in writing that you, as the brand owner, have the right to review batch records for your products. FDA investigators expect brand owners to have documentation of the manufacturing processes run under their label. A CMO that refuses batch record access is refusing to let you exercise the oversight the FDA requires of you.
Ask specifically: what happens when a consumer complaint comes in? Who is notified, in what timeframe, and what documentation is generated? Under 21 CFR Part 111, consumer complaints must be reviewed to determine if they represent a product quality issue—and that review has to be documented. If your CMO doesn't have a written complaint procedure, you don't either.
You need contractual rights to audit the CMO's facility, records, and quality systems. Verify this right exists in the quality agreement and ask when the CMO last hosted a brand owner audit. If they've never hosted one, or if they're reluctant to commit to an annual audit schedule in writing, proceed carefully—this is the most commonly missing provision in brand owner quality agreements.
Ask for examples of recent CAPAs (Corrective and Preventive Actions). A GMP-compliant CMO generates CAPAs when deviations occur and tracks them to closure—this is standard, documented activity. If the CMO can't show you any CAPAs or treats the request as unusual, it suggests their deviation management is informal, which is a direct GMP compliance gap.
Under 21 CFR 111.83, product shelf life claims must be supported by stability data. Confirm the CMO conducts stability testing (real-time or accelerated) and can provide testing protocols and data for products similar to yours. A CMO that doesn't run stability programs is either not testing or not documenting—either is a label compliance problem.
Ask how the CMO qualifies its raw material and ingredient suppliers. Under 21 CFR Part 111, raw materials must meet specifications, and the FDA expects documented supplier qualification programs. If your CMO can't explain their supplier qualification process or provide a list of approved suppliers, you have no visibility into what's going into your product.
Changes to formulas, raw material sources, manufacturing processes, or packaging can affect product compliance—and you need to know before they happen, not after. Verify the CMO has a documented change control SOP and confirm your quality agreement requires them to notify you before implementing changes that affect your products. Surprise formula changes after signing are a documented enforcement pattern.
These are not hypotheticals. Each pattern below appears repeatedly in FDA Warning Letters issued to brand owners who outsource manufacturing:
GMP Playbook builds the complete compliance documentation package—quality agreements, SOPs, specification sheets, and audit-ready records. Flat-rate pricing, no surprises.
If you've completed this checklist and found gaps—or if you're evaluating a new CMO and want to know where to focus—we can help. GMP Playbook builds the documentation infrastructure that makes your CMO relationship audit-ready.
Request a Free Consultation →