A QMS That Anticipates Cell And Gene Therapy Quality Challenges

A conversation between Andrew Cieri at Regeneron and Life Science Connect's Jon O'Connell

When acquiring a clinical-phase cell and gene company, or even just a clinical-phase asset, you might be tempted to try forcing the product into your own quality management system (QMS). On the other hand, if the inbound candidate is further along, or at least has a more robust quality profile, the obvious solution might appear to be simply adopting its QMS as your own.

The one-way approach has holes in it for several reasons. It's a scenario like the one that played out at Regeneron when the company acquired and absorbed a clinical Phase 1 company and set about integrating quality systems. Building a QMS for an early-phase product presents its own intrinsic challenges, starting with the stark scarcity of clinical and process data. The complexity is amplified when trying to do that with a product whose quality journey was interrupted, transferred, and now you're the one trying to restart it.

Andrew Cieri, Regeneron’s executive director of quality within its Cell Medicines unit, proposes a simple test that begins with effects on patients. He's unpacking the acquired company case study in October at the 2026 ISPE Annual Meeting & Expo. He agreed to give us a preview of his talk by answering a few of our questions.

Cell and gene therapy trials at Phase 1 seem like boat-building while at sea. Traditional phase-appropriate QA frameworks don't necessarily account for limited and patient-specific starting material plus a merciless margin for error. How do you think about establishing QA at Phase 1?

Cieri: I actually think that image is right and it shows why a generic phase-appropriate template can't just be bolted onto an autologous program. At Phase 1, quality isn't a guardrail added on after the fact. It can be an accelerator, built into the system from day one.

One approach is to map every quality system element, from deviations to supplier qualification, and ask explicitly what's required at Phase 1 versus what's required at commercial scale, then document the control strategy and rationale for that choice.

A handful of things should never be negotiable regardless of phase:

• aseptic processing and contamination control given direct patient risk,
• chain of identity and chain of custody from the very first draw, and
• traceability from donor to product to patient.

Everything else can be scaled to risk. That may mean benchmarking against internal and external regulatory expectations early, designing in commercial inspection readiness from the start, and treating Phase 1 as the foundation it will eventually have to bear the weight of.

How do you decide which critical quality attributes warrant rigid control versus something you leave flexible because locking it down too early would be premature?

Cieri: The decision can be anchored on patient and product impact. Anything tied to patient safety or a quality attribute with a direct line to release testing should get rigid, nonnegotiable control. Aseptic technique, data integrity and good documentation practice, chain of identity, and traceability fall squarely in that bucket, and those shouldn't be dialed down no matter how early the phase.

For everything else, a severity-by-likelihood risk matrix can help: if a process change is expected to have minimal impact on a quality attribute or on process performance, and it's unlikely to occur, it may be reasonable to leave it flexible rather than freezing a specification that isn't yet well enough understood to defend.

Process risk assessments and dry runs of the process flow, done before a process is ever run live, can help surface the handful of steps that truly need tight oversight. That combination, a documented risk framework, plus deliberately testing the process before committing controls, can help avoid over-engineering attributes that are still evolving while still building genuine evidence-based confidence anywhere it matters for the patient.

In your company acquisition example, what quality system conflicts came up when merging two approaches to a live Phase 1 CGT program? What factors decided whose approach won?

Cieri: Integration touched the full quality management system, inclusive of computer systems, procedures, and training. As part of the transition into Regeneron, the cell medicines unit came in with a mature, commercial-grade quality system built for approved products, while the actual programs in scope of the acquisition were still Phase 1. The instinct in any merger can be to lean on whichever system is more built out but applying a fully commercial-grade system wholesale to a Phase 1 program can create unnecessary friction without a proportional patient safety benefit, just as a Phase 1-only system may underserve a program that needs to be inspection-ready sooner than expected.

A thorough evaluation across procedures, training, and systems helped resolve conflicts like these by returning to a phase-appropriate lens for each quality element individually rather than adopting one company's wholesale approach. For a given activity, one might ask: "What is actually required to protect the patient and the data at this stage?” while weighing the needs of the ongoing and soon-to-start clinical trials alongside the broader needs of the development and operations organization and letting that answer decide the control strategy, rather than defaulting to whichever legacy process happened to already be in place.

Patient safety and defensibility to regulators tend to be the tie-breakers, not organizational precedent.

Going a step further, how did you address the unwritten cultural side of that integration, things like documentation habits and risk tolerance?

Cieri: Systems can be mapped on a spreadsheet; culture can't, and that's usually where integrations succeed or fail. A combined team can be grounded in explicit leadership principles and expected to lead in their respective areas, align on shared goals, and remain accountable to each other and the project. QA can also be present on the floor during critical manufacturing steps, allowing legacy terms to build trust through shared experience. Pre-run training and post-run debriefs together, along with cross-functional onboarding into each other's habits, can reinforce that further.

Documenting the rationale behind every risk-based decision can do double duty. It satisfies regulators, and it gives teams with different risk tolerances a shared written record to calibrate against instead of relying on tribal knowledge. That vision may need to be revisited and refined regularly, since a merged culture that stops adapting can quickly revert to the stickiest legacy.

For early-stage, patient-specific products, what does risk-based quality assurance look like day to day? Do you prioritize incoming material controls, oversight of manual manufacturing steps, or something else?

Cieri: Honestly, it's both, but incoming material variability can be the harder problem because you can't standardize your way out of patient-specific starting material. One approach is to review historical data to spot trends in variability by patient profile, then set flexible acceptance criteria and risk flags based on things like cell phenotype rather than a single rigid specification that could fail patients who don't fit the average.

Layered on top of that, real-time floor presence is important. QA can be present and available throughout the manufacturing campaign, not just at scheduled checkpoints, with rapid deviation resolution and impact assessment so a manual-step issue can be triaged in hours rather than days. Daily stand-ups during a campaign and structured leadership debriefs afterward, asking what worked, what didn't, and what to start, stop, or continue, can help, and operators may be requalified between runs. The common thread is that both the material and the manual steps can benefit from continuous proactive attention rather than periodic sampling.

Since a batch failure often means a patient goes untreated, how does the irreversibility change how conservative or aggressive you can be with a risk-based approach at Phase 1?

Cieri: It changes where you're conservative. Irreversibility means a program can't afford to be flexible on the handful of true non-negotiables (aseptic processing, chain of identity, data integrity), because a failure there isn't recoverable for that patient. But irreversibility cuts the other way, too. Overcontrolling everything in the name of caution can slow the process down and cost a patient their treatment window, which is its own irreversible harm.

So, the risk-based approach must be precise rather than uniformly conservative or uniformly aggressive. Decision trees and pre-assessed pink-sheet scenarios for known manufacturing deviations can be built in advance, so that when something goes off-script during a live run, the team can execute a preapproved, risk-reviewed response immediately rather than defaulting to either panic-driven over-caution or unreviewed improvisation in the moment. Preparation like this is what allows a team to be risk-based instead of just risk-averse, which is enormously important when there's no second batch to fall back on.

Can you give an example of a quality decision from this program where you had to accept elevated risk because the alternative, overcontrolling a Phase 1 process, would have been worse for getting the therapy to its patient on time?

Cieri: A good example of this kind of trade-off is sterility release. Traditional compendial sterility testing takes about two weeks, which can be incompatible with a patient's clinical timeline in an aggressive oncology setting where the patient may already be conditioned for infusion. Rapid QC testing (sterility, endotoxin, and mycoplasma) can be performed internally to support a risk-based control strategy that allows interim, rapid method results to enable earlier shipping and initiation of lymphodepletion, ahead of the full confirmatory result.

That is, by definition, accepting elevated risk relative to waiting for the traditional endpoint. But the alternative, holding the product until the slower method resolves, carries its own serious risk to the patient given how time-sensitive these therapies are.

An approach like this requires a documented risk assessment and monitoring to catch a discordant result quickly if one occurs. The result can be a meaningfully faster turnaround with no compromise on the underlying safety standard, just a different evidence-based path to it.

In our case, this kind of approach has shown up in the data. Through the first 10 runs since our internal facility stood up, we tracked continuous improvement lot to lot, including a reduction in both minor and major deviations per batch, which is a good indicator that a risk-based decision made this way doesn't have to trade away product quality for speed.

Looking back at the acquisition integration specifically, what are the biggest quality system integration mistakes that you'd advise another company, earlier along in the acquisition process, to avoid?

Cieri: One of the biggest mistakes to avoid is letting the change control system absorb the transition itself, treating an acquisition or carve-out as just another change control record and using it as a de facto project management tool. Change control is built for validated systems, not for orchestrating an entire organizational transition, and forcing it into that role can bury the real work in a system that isn't designed to track it.

Dedicated, layered transition plans, a master plan for overall governance and priorities, with supporting control plans tracking impact across quality, IT, and manufacturing documentation, can help keep the QMS itself intact while the transition happens around it.

Second, it's worth not assuming either legacy system automatically wins by default just because it's larger or more built out. Every quality element should be reevaluated against what's appropriate for the current phase of the program, not against organizational precedent.

Finally, the cultural integration deserves as much deliberate investment as the systems inventory. Documentation habits and risk tolerance don't merge themselves, and a team that only maps systems on a spreadsheet may find itself resolving culture clashes reactively for years after the systems side is technically done.

About The Expert:

Andrew Cieri is an executive director of quality at Regeneron, where he focuses on quality systems, operations, and strategy within the recently formed Regeneron Cell Medicines unit. He has more than 20 years of experience managing quality assurance, validation, and manufacturing in GxP environments. He earned an M.Sc. in engineering management at Tufts University.