Why Contamination Control By Design Should Matter To Your CDMO

By Kieran Falvey, Pharmalliance Consulting Ltd.

CDMOs occupy a uniquely pressured position in the pharmaceutical supply chain. They serve multiple sponsors, manufacture across diverse modalities, and must demonstrate contamination control competency for every product, every batch, and every client audit, often simultaneously. Yet most CDMOs still manage contamination control the same way they did a decade ago: procedurally, reactively, and in silos separated by product line or facility zone.

The revised EU GMP Annex 1,¹ which came into force in August 2023, changed the rules. It introduced a formal requirement for a Contamination Control Strategy (CCS), a holistic, documented, and risk-based system that addresses contamination across the entire manufacturing environment. For sterile manufacturers, this is now a regulatory baseline. For CDMOs specifically, it exposes a structural gap: most existing quality systems were not designed with this level of integrated thinking in mind.

While EU GMP Annex 1 (2022) is the only regulation that mandates a documented CCS by name, FDA expectations are substantively equivalent. The FDA Aseptic Processing Guidance (2004) and 21 CFR 211 collectively require manufacturers to demonstrate systematic, documented contamination control across facility design, environmental controls, and microbiological monitoring. FDA is a PIC/S member,² and in practice both agencies are looking for the same underlying logic. For CDMOs serving U.S. and EU clients, a CCS built to Annex 1 satisfies both frameworks simultaneously, one document that answers every question in the room, regardless of which agency is asking it.

This article, the first in a two-part series, explains what Annex 1 actually demands, why CDMOs are disproportionately exposed to its requirements, why traditional contamination control programs fall short of that bar, and what Contamination Control by Design³ (CCbD) is. Part two will address how to apply CCbD in practice and what inspection-ready contamination control looks like in a CDMO context.

What Annex 1 Actually Requires, And Why CDMOs Are Exposed

Section 4.1 of EU GMP Annex 1 (2022) requires that manufacturers establish a CCS that considers all relevant contamination routes and risk factors across the facility’s life cycle. The CCS must be documented, justified, and linked to operational controls, not just referenced in a quality policy.

Critically, it must demonstrate that contamination control has been considered systematically, not assembled from disparate procedures.

For single-product manufacturers, this is manageable. For CDMOs, it is considerably more complex. A typical CDMO may operate multiple product streams through shared cleanroom infrastructure, using common HVAC zones, personnel flows, and material transfer routes. Each product introduces its own contamination risk profile. Each client brings its own expectations, quality agreements, and regulatory obligations. And each regulatory authority, whether the EMA, FDA, MHRA, or TGA, may review the same facility with different emphasis.

The result is that CDMOs cannot satisfy Annex 1's CCS requirement simply by listing their existing environmental monitoring schedules and SOPs. Inspectors want to see evidence that contamination risk has been analyzed across the entire manufacturing environment, including design decisions, process controls, human factors, and monitoring strategy, in a coherent, traceable, and facility-specific way.

Why Traditional Contamination Control Programs Fall Short

Most contamination control programs in operation today were built incrementally: a new SOP here, an updated risk assessment there, an environmental monitoring extension following a deviation. Over time, this creates a patchwork of documentation that is procedurally comprehensive but structurally incoherent. When an inspector asks, "Show me your contamination control strategy and how it links to your facility design decisions," the answer is often a folder of disconnected documents rather than a coherent system.

This question can be difficult for a sponsor to answer and is usually directed to the CDMO site, but it is ultimately the responsibility of the sponsor to ensure that each of its CDMOs is under control and all risks are adequately managed.

Three structural weaknesses appear repeatedly across CDMO contamination control programs:

• Risk assessments that are product-specific but not facility-wide: Individual product quality risk assessments rarely address shared infrastructure, personnel overlap, or campaign scheduling risks that are unique to multi-product environments.
• Design decisions that are undocumented: Cleanroom classifications, pressure differentials, personnel flow routes, and gowning requirements were often set at facility commissioning and never formally linked to contamination risk rationale.
• Environmental monitoring disconnected from risk: Monitoring programs are frequently inherited from validation studies and expanded reactively following deviations, rather than derived from a systematic assessment of contamination routes and control effectiveness.

None of this is unusual, and none of it reflects poorly on the organizations involved. It reflects how quality systems evolved in an era when these requirements did not exist. The challenge now is transitioning from a compliance-by-procedure model to a compliance-by-design model, and doing so without creating an unrealistic documentation burden.

Sponsors are confident in managing external manufacturing CDMOs but are often not assessing CDMO multi-product cross-contamination risks across its network. This can be alleviated by assessing the level of contamination control methodologies that have been incorporated in the CDMO sites.

What CCbD Actually Means

CCbD is not a product, a software platform, or a regulatory term. It is a structured methodology for building contamination control logic into the design layer of a pharmaceutical operation, at the point at which contamination risk is cheapest to address and most durable in its effect.

The CCbD Standard is designed to be applied by any pharmaceutical or CDMO organization regardless of size, modality, or existing quality system maturity, and it can be downloaded without charge at www.ccbd.io.

CCbD operates alongside and complements existing pharmaceutical quality frameworks including Eudralex Volume 4, EU Annex 1, ICH Q7, ICH Q8, ICH Q9, and ICH Q10.^4,5 It does not attempt to replace any of these frameworks; it enhances the approach to contamination control by giving it structural coherence at the design level through ongoing governance.

Applied consistently, a CCbD approach produces a CCS that is not a report assembled for inspection. It is the living documentation of how the facility actually manages contamination risk. That distinction matters significantly when inspectors arrive, and it is the distinction that part two of this series will show you how to build.

References

1. European Commission. EU Guidelines for Good Manufacturing Practice for Medicinal Products for Human and Veterinary Use, Annex 1: Manufacture of Sterile Medicinal Products. August 2022.
2. PIC/S PE 009-17. Guide to Good Manufacturing Practice for Medicinal Products, Annex 1. Pharmaceutical Inspection Co-operation Scheme. 2023.
3. CCbD Standard. Contamination Control by Design: A Structured Framework for Pharmaceutical Manufacturers. Available free at www.ccbd.io.
4. ICH Q9(R1): Quality Risk Management. International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. January 2023.
5. ICH Q10: Pharmaceutical Quality System. International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. June 2008.

About The Author:

Kieran Falvey is managing director of Pharmalliance Consulting Ltd., an Irish consulting practice specializing in GMP compliance, remediation, and contamination control for sterile, non-sterile, ATMP, and CDMO manufacturers. With over two decades of experience in pharmaceutical engineering, quality, and compliance, Kieran works with manufacturers globally to design and implement inspection-ready contamination control programs aligned to FDA, EU GMP Annex 1 (2022), PDA, and ICH guidelines. He can be reached at kfalvey@pharmalliance.ie.