4 minute read
ISO 22716
By Robert Low, Lead Management System Specialist
Section 12 of ISO 22716 covers subcontracting — what happens when manufacturing, packaging, analysis, cleaning, pest control, or maintenance is performed by someone other than the company whose name appears on the finished product. This matters more than it might first appear, because GMP responsibility does not transfer away simply because the work has been outsourced.
This post is part of a series working through ISO 22716 section by section. The series summary with links to every section is available at the end.
A written contract or agreement needs establishing between the contract giver and contract acceptor, mutually confirmed and controlled, covering the subcontracted activities. The explicit objective is obtaining a product or service that complies with the contract giver’s defined requirements — the standard is clear that outsourcing the activity does not outsource the responsibility for its quality.
Types of subcontracting. The clause explicitly covers manufacturing, packaging, analysis, cleaning and sanitisation of premises, pest control, and equipment and premises maintenance — a broad scope that goes well beyond what most people initially think of as “subcontracting.”
Contract giver responsibilities. The contract giver needs to assess the contract acceptor’s ability and capacity to actually perform the contracted operations, including their ability to comply with relevant GMP guidelines. The contract giver also needs to provide the contract acceptor with all the information genuinely needed to carry out the work correctly — incomplete or outdated information passed to a subcontractor is the contract giver’s failure, not just the acceptor’s.
Contract acceptor responsibilities. The acceptor needs the means, experience, and competent personnel to actually meet the contract requirements. They cannot pass any part of the work to a further third party without the original contract giver’s prior written approval — and if that approval is given, the same standard of information flow needs to apply to the new arrangement. The acceptor also needs to facilitate any checks or audits the contract giver has defined, and proactively inform the giver of any changes that might affect quality before those changes are implemented.
Contract content. The written contract needs to specify each party’s respective duties and responsibilities clearly, and all relevant data needs to be kept or made available to the contract giver.
The most common gap is a subcontracting relationship that exists informally — a verbal understanding, or a basic commercial agreement that covers price and delivery but says nothing about GMP compliance, quality standards, or audit rights. The standard requires a genuine quality-focused contract, not just a commercial one.
The second common gap is contract givers failing to actually exercise their assessment and oversight responsibilities after the initial contract is signed. An audit clause sitting unused in a contract for years, with no actual audits ever performed, does not satisfy the standard’s intent — the right to audit needs to translate into actually auditing, at a frequency proportionate to risk.
Subcontracting connects directly to supplier management, since a contract manufacturer or contract laboratory is functionally a supplier and needs equivalent approval, monitoring, and performance tracking. It also connects to document control, since the information the contract giver provides to the acceptor — specifications, procedures, formulas — needs to be the current, approved version, not an outdated copy that was never updated when the master document changed.
This post is part of the Cornerstone ISO 22716 series. See the full series summary with links to all 16 sections.
Back to all
