Your Contractor Is Not Your Quality Unit

Your Contractor Is Not Your Quality Unit

Contractors can do a lot of useful work.

They can manufacture.

Package.

Label.

Test.

Store.

Ship.

They can bring capacity, expertise, equipment, speed, and flexibility.

What they cannot do is become your quality system.

That distinction matters.

FDA's August 2026 warning letter to Safrel Pharmaceuticals LLC is a practical reminder. FDA cited significant CGMP violations, including inadequate quality-unit responsibilities, lack of quality-unit oversight for suppliers and contract manufacturers, missing or inadequate procedures for receiving, quarantine, storage, and release, lack of incoming Certificates of Analysis for bulk and finished OTC drug products, improper warehouse segregation, and inadequate lot-level traceability.

Those are the source facts.

The operator lesson is direct:

Outsourcing work does not outsource responsibility.

A Vendor Network Is Not a Quality System

Using contractors is normal.

Most pharma organizations rely on external partners somewhere in the chain. Contract manufacturers. Packagers. Labelers. Testing labs. Warehouses. Suppliers.

That is not the problem.

The problem starts when the company loses the ability to prove control across that network.

Who owns supplier qualification?

Who reviews incoming product quality?

Who confirms the COA exists and makes sense?

Who verifies that product is quarantined before release?

Who knows which lots went where?

Who can stop distribution?

Who can initiate a recall without needing three people to reconstruct what happened from email threads?

If those answers are fuzzy, the company does not have a controlled contractor network.

It has a set of dependencies with invoices attached.

Quality Agreements Are Not Magic

Quality agreements matter.

They define roles.

They clarify responsibilities.

They help keep supplier, contractor, and sponsor expectations from becoming a guessing game.

But a quality agreement is not a substitute for oversight.

FDA's quality agreements guidance is clear that owners are responsible for approving or rejecting drugs manufactured, processed, packed, or held by contract facilities. FDA also says it regards contractors as extensions of the manufacturer.

In plain language:

The contractor may perform the work.

The company still owns the product.

That means Quality cannot treat the agreement as the control. It has to verify that the agreement is actually reflected in daily work.

COAs are received.

Lots are traceable.

Warehousing status is clear.

Quarantine is real.

Release is documented.

Complaint and recall systems can reach the right product.

If the agreement says one thing and the operation shows another, the operation wins.

Unfortunately.

The Warehouse Can Tell on the Quality System

Warehousing sounds simple until it is not.

Received.

Quarantined.

Released.

Rejected.

Returned.

Expired.

Unlabeled.

Labeled.

Those words need to mean something physically, procedurally, and electronically.

FDA's Safrel letter cites improper segregation of drug products throughout the warehouse to prevent mix-ups and notes the absence of written procedures describing how finished drug products are to be received, quarantined before release, stored under appropriate conditions, and approved for distribution.

That is not just a warehouse housekeeping issue.

It is a quality decision issue.

If unlabeled or status-unclear product can sit in the same general area as released product, the system is asking people to compensate for weak design.

Sometimes they will.

Sometimes they will not.

A good warehouse control system does not depend on everyone remembering the story. It makes status obvious. It makes mistakes harder. It lets Quality see what is happening before the problem turns into distribution risk.

Traceability Is Not Optional Memory

Lot traceability is one of those things everybody agrees matters.

Until the system has to prove it quickly.

FDA's Safrel letter says the firm did not provide sufficient detail to demonstrate that its proposed system would be capable of adequate lot-level traceability.

That is a serious operating issue.

Traceability is not a spreadsheet someone can build after the fact.

It is not institutional memory.

It is not "we can probably figure it out."

Traceability has to work when the room is tense, the clock is running, and the customer or regulator needs an answer.

Which lots were received?

Which lots were released?

Which lots were distributed?

Where did they go?

What product status applied at each step?

What contractor made, packed, labeled, or tested them?

What evidence supports that decision?

If the system cannot answer those questions at lot level, recall readiness is theoretical.

And theoretical recall readiness is not much comfort when you need the real thing.

The Quality Unit Has to See the Whole Chain

A quality unit cannot approve what it cannot see.

It cannot control what it cannot challenge.

It cannot release what it cannot trace.

It cannot investigate what it cannot document.

That is why contractor oversight has to be designed into the quality system, not added later when something goes wrong.

The practical controls are not exotic:

• Written responsibilities for each contractor and supplier
• Quality agreements that match the actual operation
• Supplier and contractor qualification with evidence
• Incoming COA receipt and review where applicable
• Receiving, quarantine, storage, and release procedures
• Physical segregation that prevents mix-ups
• Lot-level distribution traceability
• Batch and related information reviewed before disposition
• Recall paths that can be executed without reconstruction

None of that is consultant theater.

It is basic operating control.

Which is exactly why it gets dangerous when people assume it is already handled.

The Question Is Not Who Did the Work

When FDA asks about product quality, the answer cannot be, "Our contractor handles that."

That may be true operationally.

It is not enough from a responsibility standpoint.

The better question is:

How does our quality system know the contractor handled it correctly?

That question changes the conversation.

It moves the team from trust to evidence.

From assumption to oversight.

From vendor management to quality ownership.

That is the work.

Not louder dashboards.

Not prettier supplier scorecards.

Not a quality agreement nobody looks at until the inspection prep meeting.

The work is building a system where outsourced activity is visible, controlled, documented, and challengeable.

Own the Chain

Contractors can be valuable partners.

They can expand capability.

They can solve real operating problems.

They can help the business move.

But they are not the quality unit.

They are part of the chain.

The company still has to own the chain.

That means knowing what happened, where it happened, who did it, which lot it affected, what evidence supports release, and what action to take if the product needs to be found fast.

If the company cannot answer those questions, the issue is not just contractor management.

It is leadership.

Because quality ownership cannot be subcontracted into existence.

It has to be built, resourced, checked, and used.

Every day.