A contract manufacturer answers to many quality systems at once. Each customer brings its own quality agreement, specs, change rules and audit schedule, and each expects its records to stay private. When those obligations live in shared folders and inboxes, one missed change notice or one wrong file in an audit pack can cost a customer's trust. See customer-segregated quality records at work in a short multi-client QMS demo.
MULTI-CLIENT QMS · CONTRACT MANUFACTURING
Every Customer's Quality Records in One System, Never Mixed
iFactory Multi-Client QMS segregates records by customer, tracks each quality agreement and gives every client a portal and an audit evidence pack built only from their own records. Your team works in one system, and each customer sees only what belongs to them.
Customer workspace · Client BSegregated
Site QA view · records tagged by owner
Client AClient BClient CShared site
Quality agreementv4 · review due Mar 2027
Open change notices2 awaiting approval
Next client audit12 Nov · on-site
Evidence pack38 records ready
CMO QUALITY
One Plant, Many Quality Systems
Contract manufacturing looks different in every industry, but the core problem is the same. You run your own quality system, and each customer's system reaches into it through an agreement. Their specs, approvals and audits sit on top of your procedures, and the evidence must be sorted by customer every time. Compare notes on your own setup with our quality team.
Pharma CMO and CDMO
The owner's quality unit approves or rejectsUnder FDA guidance, the owner's quality unit is responsible for approving or rejecting drug product, while the CMO runs CGMP operations as agreed.Food co-packer
The brand's spec, the co-packer's certificateCo-packers usually hold their own SQF or BRCGS certificate and work to each brand's spec, artwork, approvals and release criteria.Contract electronics and devices
An outsourced process under a written agreementISO 13485 clause 4.1.5 requires device makers to control outsourced processes, and those controls include written quality agreements.
QUALITY AGREEMENTS
What the Rules Say About Quality Agreements
Pharma rules are the most detailed, but food and device schemes point the same way: write down who does what, control it and keep the evidence. FDA's guidance, Contract Manufacturing Arrangements for Drugs: Quality Agreements, was finalised in November 2016. It links back to 21 CFR 211.22(d), which requires quality unit responsibilities and procedures to be in writing. Check your current agreements against these points in a quality agreement review.
FDA
Quality Agreements guidance, 2016Defines owner and contract facility roles, keeps the agreement separate from business terms and says no party may delegate its CGMP responsibilities.
EU 7
EU GMP Chapter 7, Outsourced ActivitiesRequires a written contract stating who does each step. The contract acceptor may not subcontract without the contract giver's prior evaluation and approval.
Q10
ICH Q10 section 2.7The pharmaceutical company stays ultimately responsible. Assess suitability first, define responsibilities in a written agreement, then monitor performance.
13485
ISO 13485:2016 clause 4.1.5Controls over outsourced processes must be proportionate to risk and include written quality agreements. Clause 7.4 covers notice of supplier changes.
SQF
SQF Code Edition 9, 2.3.3Covers contract manufacturers, with Edition 9 setting separate expectations for higher-risk and lower-risk arrangements.
BRCGS
BRCGS Food Safety Issue 9, 3.5.4Outsourced processing must be declared to the customer, approved and monitored, specified in writing and kept traceable.
QUALITY MANAGEMENT CONTRACT MANUFACTURERS TEMPLATE
A RACI Matrix for Your Quality Agreement
The FDA guidance lists what the manufacturing activities section of an agreement should cover, from quality unit activities and materials management to laboratory controls, documentation and change control. A RACI matrix turns that list into named responsibilities. The split below is a typical starting point for a regulated pharma or device arrangement, not a rule. Food co-packers often hold more release authority under the brand's criteria. Agree your own split with our support team.
Reading the letters
R is responsible for doing the work, A is accountable for the decision, C is consulted before it, and I is informed after it. Each row should name a role on both sides, not just a company.
CUSTOMER SPECS SEGREGATION
Three Kinds of Record, Three Kinds of Access
Most CMO records belong to one customer: batch records, specs, deviations, test results and complaints. Some describe the site and matter to every customer, such as calibration, cleaning, training and environmental monitoring. Others are yours alone. Segregation means every record carries its owner, and access follows that tag. Electronic record rules back this up: 21 CFR 11.10(d) calls for limiting system access to authorised individuals, and EU GMP Annex 11 asks for physical or logical controls that restrict access to authorised persons. Plan your access model in a segregation workshop.
Customer-only
One customer and your teamBatch records, specs, COAs, deviations, OOS results, complaints and change noticesShared site
Every customer, other names removedCalibration, cleaning, training, environmental monitoring and site certificatesInternal only
Never shown in a portalOther customers' data, pricing, capacity plans and internal audit notes
Ask About One Customer, Get Only Their Answer
Your QA team can search across customers, but answers name the customer they belong to, and portal users never leave their own records. Change notices, approvals and audit evidence stay sorted by owner.
Site QA lead and iFactory
QA leadWhich open changes affect Client B?
iFactoryTwo. A new desiccant supplier on Line 2 needs Client B's prior approval under their agreement. A label printer swap is notice only.
QA leadDoes the supplier change touch anyone else?
iFactoryClient C also runs on Line 2. Their agreement lists supplier changes as notice only, so a separate notice is drafted for your review.
CUSTOMER SPECS AND CHANGE NOTIFICATION
One Change, Many Customers, Different Rules
A single change on a shared line can touch several customers, and each agreement may treat it differently. One needs prior approval, another only a notice, a third nothing at all. The FDA guidance says some changes should be reviewed and approved by the owner before they are made, and ISO 13485 clause 7.4 expects agreed notice of supplier changes before they are made. Set up your change rules with our support team.
1ProposeChange raised with its line, product and material scope
2Find customersEvery customer whose product or spec is touched
3ClassifyPrior approval, notice or none, per agreement
4NotifyA separate notice to each customer's portal
5ApproveCustomer decisions logged before go-live
6CloseEvidence filed in each customer's record
CLIENT AUDITS
Batch the Audits, Prepare the Evidence Early
Most quality agreements give customers the right to audit, and EU GMP Chapter 7 expects the contract to allow it. A CMO with many customers can host one most weeks, on top of regulator and certification audits. You can't remove that right, but you can plan around it. Group audits into agreed windows, so the same walkthrough, people and shared site records serve several customers, and keep each customer's evidence ready before the auditor asks. Plan your audit calendar in an audit planning session.
AUDITS AS THEY COME
- Dates set by each customer, often at short notice
- Evidence gathered by hand for every visit
- Shared site records sorted and redacted again each time
- Production leads pulled off the floor week after week
BATCHED AUDIT WINDOWS
- Agreed windows each quarter, booked in advance
- Evidence pack ready per customer before arrival
- Shared site evidence prepared once per window
- For-cause audits still handled whenever needed
AUDIT EVIDENCE PACK
What Goes in a Customer Evidence Pack
An evidence pack is a filtered view of your quality system for one customer and one period. Everything in it should come from that customer's records or the redacted shared site records, and nothing else. Ask our support team for a sample pack layout.
Agreement statusCurrent version, signatures, review date
Product recordsBatch records, COAs and release decisions for the period
Deviations and CAPAThis customer's product only, with status
Change historyNotices, approvals and go-live dates
ComplaintsReceived, investigated and closed
Shared site evidenceCalibration, cleaning, training, EM, redacted
CertificatesGMP, ISO 13485, SQF or BRCGS as relevant
Last audit findingsEach finding with proof of closure
CUSTOMER PORTALS
What a Customer Should See When They Log In
A portal replaces the email chain, not the relationship. It should show the customer what they need to oversee your work, let them act on approvals and keep a record of who saw what. Review portal access rules in a portal walkthrough.
Their records onlyBatches, results, deviations and complaints tagged to them
Approvals to act onChange requests, deviations and documents waiting for them
Agreement and specsCurrent versions with review dates and history
Access logWho viewed or downloaded what, and when
QUALITY MANAGEMENT CONTRACT MANUFACTURERS FOR PLANT MANAGERS
Six Measures Worth a Monthly Review
Record a baseline for each before go-live, then review them monthly with QA, production and the account teams that own each customer relationship. Ask our quality specialists to help set the baseline.
Agreements in dateShare of customers with a signed agreement inside its review date
Change notices on timeNotices sent before go-live, as each agreement requires
Audit prep hoursQA hours spent preparing each customer audit
Repeat findingsCustomer audit findings that appeared at the last audit too
Overdue deviationsCustomer-facing deviations open past their due date
Wrong-customer accessRecords seen outside their owner, from access logs. Target zero.
QUALITY MANAGEMENT CONTRACT MANUFACTURERS COST AND ROI
Size the Time Spent on Audits
The measurable part is time. Every input below is assumed, so replace each with your own figures. Keep claims about won or lost customers out of the sum unless your own data supports them. Build the full case with our quality advisors.
Customer audits hosted per year20, assumed
QA hours to prepare each audit today24, assumed
QA hours with ready evidence packs8, assumed
QA hours freed per year20 × (24 − 8) = 320 h
Multiply the hours by your loaded QA rate. Then add fewer late change notices, fewer repeat findings and less time sorting shared site records for each customer.
QUALITY MANAGEMENT CONTRACT MANUFACTURERS BEST PRACTICES
An Implementation Guide in Five Steps
Start with the agreements, because every other rule comes from them. Then tag records and open portals one customer at a time. Our support team can help you order the work.
1
List every agreementCustomer, version, review date, named contacts and change rules.
2
Tag every record with its ownerCustomer, shared site or internal, applied from the moment a record is made.
3
Load each customer's change rulesWhich changes need prior approval, which need notice and how fast.
4
Open portals one customer at a timeStart with the customer that audits most often.
5
Build evidence packs before the next auditThen batch the following audits into agreed windows.
TURNKEY AI DEPLOYMENT
Multi-Client QMS on an NVIDIA Server Inside Your Site
iFactory delivers Multi-Client QMS as a turnkey package. A pre-configured NVIDIA AI server ships racked and ready with customer workspaces, agreement tracking and evidence pack tools pre-loaded, so customer records stay on your own network. You rack it, plug in power and Ethernet, and the AI is live. To scope it for your site, request a turnkey quote.
What's Included
- Pre-configured NVIDIA AI edge server, racked and ready
- Customer workspaces with record tagging and access rules
- Quality agreement register with review dates
- Change notification workflow per customer
- Client portals with full access logs
- Audit evidence pack builder per customer
- 24×7 remote monitoring of models and hardware
Live in 6–12 weeks
Wk 1–4
Agreements and Access
Server installed, agreements loaded, ownership tags and access rules agreed.
Wk 5–8
First Customer Portal
One customer workspace and portal live, first evidence pack built and checked.
Wk 9–12
All Customers Live
Remaining customers moved over, QA trained, monthly measures started.
HOW iFACTORY FITS
One Quality System, a Clean View for Every Customer
iFactory lets a contract manufacturer run one quality system while each customer sees a clean, complete view of their own work. Our support team can walk you through a pilot plan.
1
Segregates records by customer. Every record carries its owner, and access follows the tag.
2
Tracks quality agreements. Versions, review dates, responsibilities and change rules for each customer.
3
Opens client portals. Customers see their records, act on approvals and leave an access trail.
4
Builds audit evidence packs. One pack per customer, filled only from that customer's records.
1000+
Industrial clients running iFactory
99.9%
Platform uptime for multi-shift sites
6-12 wks
From racked server to live customer portals
FREQUENTLY ASKED QUESTIONS
What CMO Quality Leaders Ask
What is a quality agreement in contract manufacturing?
It is a written agreement between the customer and the contract manufacturer that sets out who is responsible for each quality activity: specs, materials, testing, deviations, changes, release, complaints and audits. FDA recommends keeping it separate from the commercial supply contract.
Is a quality agreement required?
It depends on the sector. FDA's 2016 guidance recommends one and ties it to the written quality unit duties in 21 CFR 211.22(d). EU GMP Chapter 7 requires a written contract for outsourced GMP activities. ISO 13485 clause 4.1.5 requires written quality agreements for outsourced processes. Food schemes such as SQF and BRCGS set their own requirements for contract manufacturing and outsourced processing.
Who releases product made by a contract manufacturer?
For US drugs, FDA guidance says the owner's quality unit is responsible for approving or rejecting the product. In the EU, the release route through the Qualified Person is set in the contract. Food co-packers often release against the brand's criteria. Whatever the model, write it into the agreement.
How do we keep one customer's data away from another's?
Tag every record with its owner when it is made: one customer, shared site or internal. Base access on the tag, redact other customers' names from shared records such as cleaning logs, and keep access logs. Avoid shared folders where tags depend on people remembering.
Can we host fewer customer audits?
You usually can't remove a customer's audit right, but you can agree planned audit windows and make each audit shorter with ready evidence packs. Some customers also accept a paper or remote review between on-site visits. For-cause audits should always stay possible.
How do we start?
List every agreement with its version and change rules, then tag records by owner for the customer that audits you most. Open that customer's portal and build their evidence pack before their next visit. Our
support team can plan that first customer with you.
Serve Every Customer Without Mixing a Single Record
Segregate records by customer, track every quality agreement and hand each client a portal and evidence pack of their own. The full system is delivered turnkey and goes live in 6 to 12 weeks.
Example customer view · Client B
Records shownClient B and redacted site records
Quality agreementv4, in date
Change notices2 open, 5 closed
Evidence packReady for the 12 Nov audit
Every view logged by user and time
