The Decision Rights Matrix: Making Sponsor-CDMO Governance Enforceable

By Devanshi Doshi and Sagi Nahum, CellVira

A quality target product profile (QTPP) defines what quality means for a specific product. A quality agreement states that the sponsor retains oversight. Neither document, on its own, answers the question that actually determines whether a sponsor-CDMO relationship holds together under pressure: who decides what, by when, and who owns the change when something goes differently than planned. A decision rights matrix (DRM) is the document that answers it.

The value of a DRM becomes evident during an out-of-specification (OOS) result. Without a matrix, the CDMO investigates using its own SOPs, reaches its own disposition conclusion, and the sponsor finds out what was decided whenever the CDMO gets around to saying so. That is not a hypothetical failure mode. It is what happens by default when nobody has written down who needs to know what, and by when. With a matrix in place, the same event triggers a defined sequence: CDMO notifies the sponsor within a stated window, the CDMO investigates and documents the findings, and the sponsor quality function approves disposition before the batch moves forward — same event and same underlying investigation. The difference is entirely whether the sponsor participates in the decision or receives the outcome.

That gap compounds in decentralized manufacturing environments, where the same product may be running at multiple sites, under multiple CDMO relationships, across multiple regulatory jurisdictions at once. In those settings, a DRM is the governance infrastructure that keeps a distributed network coherent.

Why Shared Principles Are Not Enough

The obligation to govern outsourced manufacturing starts with ICH Q10,¹ which requires clearly defined agreements, responsibilities, communication flows, and escalation paths when manufacturing is delegated to a contract organization. What the FDA and EMA require in practice, however, diverges in ways that must be reflected in any matrix built for a global program. Under the FDA, quality unit responsibilities and batch release authority flow from 21 CFR 211.22² and 211.192,³ with change classification governed by the January 2020 CMC GT IND guidance.⁴ Under the EMA, batch release for ATMPs requires qualified person (QP) certification per EU GMP Annex 16,⁵ with ATMP-specific quality expectations in EMA/CAT/80183/2014⁶ and the 2025 investigational ATMP guideline.⁷

A sponsor filing in both jurisdictions must build a matrix that satisfies both frameworks simultaneously. The shared principle, defined decision rights, does not do that work on its own.

A quality agreement clause stating that "the sponsor must approve any change to a CQA acceptance criterion" is unenforceable in practice unless those acceptance criteria are explicitly defined in sponsor-controlled documentation. The QTPP and the DRM are designed to work together: one defines what is being governed, the other names who governs it.

What A Real Decision Rights Matrix Looks Like

A DRM must define three elements for each decision category generated throughout the LVV manufacturing life cycle: the final approval authority, the notification window, and the change control owner. Without all three, a quality agreement clause that assigns approval authority without a notification trigger is one unreported event away from a governance failure.

The purpose of a DRM is not to anticipate every possible scenario but to ensure that all meaningful manufacturing, analytical, quality, and regulatory decisions have a predefined governance pathway. The table below illustrates the level of specificity a real matrix needs to reach and the range of decision categories a sponsor must consider throughout a program. Although decision ownership may differ depending on product complexity, risk profile, and regulatory strategy, the fundamental requirement remains the same: every critical decision must have a predefined owner, approval authority, and notification pathway before it occurs. A matrix is only effective when it covers the full life cycle of the sponsor-CDMO relationship, not just the issues identified at the beginning of development.

 

Decision or Event	Final Approval Authority	Notification Window	Change Control Owner
Change to a CQA acceptance criterion	Sponsor quality unit	Prior sponsor approval required before implementation	Sponsor
Confirmed out-of-specification (OOS) result	Sponsor quality unit reviews and approves disposition	CDMO notifies; sponsor within 24 hours of confirmation	CDMO investigates; sponsor approves closure
Deviation from the approved batch record	Sponsor quality unit	CDMO notifies sponsor within 24 to 48 hours	CDMO documents investigation; sponsor approves closure
Change to a CQA-linked analytical method	Sponsor quality unit	CDMO notifies sponsor before implementation	Sponsor
Change to a non-CQA-linked administrative procedure	CDMO, per pre-agreed scope	CDMO notifies sponsor at next scheduled governance review	CDMO
Batch release	Sponsor (QP per EU GMP Annex 16 or designated QU per 21 CFR 211.22)	Release cannot occur without sponsor sign-off	Sponsor
Change to plasmid ratio or other core process parameter	Sponsor, informed by construct-specific data	CDMO notifies sponsor before implementing any change	Sponsor
Technology transfer to a new site or laboratory	Sponsor quality and regulatory, jointly	CDMO notifies sponsor at first indication a transfer is contemplated	Sponsor

 

Several rows in the table deserve specific commentary.

OOS notification window. A 24-hour notification window is the difference between a sponsor quality team weighing in on an investigation while the batch, reagents, and personnel involved are all still available, versus finding out about a problem after the CDMO has moved on to the next lot. Time, in this context, is the resource that determines whether a gap is fixable or permanent.

Batch release. In FDA-regulated programs, quality unit responsibilities and batch record review requirements are established under 21 CFR 211.22 and 211.192. In EU ATMP programs, release requires certification by a designated QP under EU GMP Annex 16, with legal responsibility assigned to the individual QP. For programs operating in both jurisdictions, batch release cannot appear as a single generic row. It must appear as two rows, each naming a specific individual or function and referencing the applicable regulatory authority.

Change classification and regulatory notification. FDA's CMC GT IND guidance⁴ classifies manufacturing changes into prior approval supplement, CBE-30, and annual report tiers, each with different permissible implementation timelines. These tiers are the regulatory basis for the notification windows in the matrix. A 24-hour internal notification and a CBE-30 filing with FDA are not the same action, and the matrix must name both where applicable.

Technology transfer. ICH Q5E⁸ governs comparability when manufacturing changes or transfers between sites. A named approval authority and a defined notification trigger are necessary conditions for governance of a technology transfer, but they are not sufficient. The underlying comparability protocol must also exist. The matrix row is where the sponsor documents that prior approval is required before any transfer proceeds, and the comparability protocol is what gives that approval requirement technical content.

Decentralized Manufacturing Amplifies Every Gap

A DRM built for a single sponsor-CDMO pair is a governance document. A DRM built for a decentralized manufacturing network becomes operational infrastructure. Recent frameworks for decentralized CGT manufacturing have proposed a centralized control site model, in which a central quality function maintains master files and provides QP and QA oversight across all distributed sites.^9,10 For that model to function, the decision rights governing each site must derive from the same master framework rather than being negotiated independently per site.

The QC and release governance challenges specific to decentralized networks, including compressed release timelines, harmonized analytical methods, and multi-jurisdiction QP obligations,⁹ all resolve to the same underlying question: who decides, with what information, and within what time constraint? The matrix answers that question once, consistently, for all sites, or it does not answer it at all.

When manufacturing is distributed across multiple sites, the notification windows and approval authorities in the matrix must account for time zone differences, jurisdiction, specific QP obligations, and parallel batch progression at multiple locations simultaneously. A 24-hour OOS notification requirement may be achievable in a single CDMO relationship but may fail in a decentralized network without predefined escalation pathways, clear communication routes to the central quality function, designated QP responsibilities, and procedures for managing concurrent quality events across multiple sites.

What Changes When Both Documents Exist

Once a DRM exists and is directly referenced in the quality agreement alongside the QTPP, the two documents together close what is typically the real source of sponsor-CDMO friction: the absence of a named approver, a bounded notification window, and a named change control owner for every category of decision the relationship generates.

Without this structure, statements such as “the sponsor retains oversight” describe responsibility in principle but do not define how that oversight is exercised. Most sponsor-CDMO conflicts arise from ambiguity. In the absence of predefined decision pathways, CDMOs may rely on internal procedures and interpretations, while sponsors may only become aware of critical decisions after implementation, by which point remediation options are limited. A QTPP and a DRM, built and referenced together before the first batch is manufactured, turn governance from aspiration into operating procedure. Both parties can point to them when a decision is needed, rather than interpreting general oversight language differently when a problem arises.

For sponsors building toward multi-site or decentralized manufacturing, that discipline is the minimum precondition for holding a distributed network together under a single regulatory strategy.

References:

1. ICH. Pharmaceutical Quality System Q10. Step 4, June 2008. https://www.fda.gov/media/71553/download
2. 21 CFR §211.22. Responsibilities of Quality Control Unit. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-B/section-211.22
3. 21 CFR §211.192. Production Record Review. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-J/section-211.192
4. FDA. Chemistry, Manufacturing, and Control (CMC) Information for Human Gene Therapy Investigational New Drug Applications (INDs). Guidance for Industry. January 2020. https://www.fda.gov/media/113760/download
5. EU GMP Annex 16. Certification by a Qualified Person and Batch Release. European Commission, 2015. https://www.gmp-compliance.org/files/guidemgr/v4_an16_201510_en.pdf
6. EMA/CAT/80183/2014. Guideline on the Quality, Non-clinical and Clinical Aspects of Gene Therapy Medicinal Products. EMA Committee for Advanced Therapies, March 2018.  https://www.ema.europa.eu/en/documents/scientific-guideline/guideline-quality-non-clinical-and-clinical-aspects-gene-therapy-medicinal-products_en.pdf
7. EMA/CAT/22473/2025. Guideline on Quality, Non-clinical and Clinical Requirements for Investigational Advanced Therapy Medicinal Products in Clinical Trials. EMA Committee for Advanced Therapies, January 2025. https://www.ema.europa.eu/en/documents/scientific-guideline/guideline-quality-non-clinical-clinical-requirements-investigational-advanced-therapy-medicinal-products-clinical-trials_en.pdf
8. ICH. Comparability of Biotechnological/Biological Products Subject to Changes in Their Manufacturing Process Q5E. Step 4, November 2004. https://database.ich.org/sites/default/files/Q5E%20Guideline.pdf
9. Nahum S, Doshi D, Kosnik C, Jeffries E, Nishida K, Caplan V, von der Leyen H. From production to bedside: A tiered QC framework for regulatory alignment and analytical comparability in decentralized CGT. Regenerative Therapy. 2026;32. https://www.sciencedirect.com/science/article/pii/S2352320426000532
10. von der Leyen H, Delgado J, Mazouz C, Schmitt M, Caplan V. Implementation of a quality management system for decentralized manufacturing of cell and gene therapy products: technical and regulatory considerations. Frontiers in Medicine. 2025;12:1591751. https://doi.org/10.3389/fmed.2025.1591751

About The Authors:

Devanshi Doshi is a GMP quality control manager at CellVira specializing in cell and gene therapy manufacturing, analytical development, and regulatory compliance. She has extensive experience in assay qualification, technology transfer, QC data review, and eQMS implementation within cGMP environments. Through her work across biotech organizations, she has helped establish robust QC frameworks, improve operational efficiency, and strengthen regulatory readiness for advanced therapies. She holds an M.S. in Biological Sciences from the Florida Institute of Technology and is dedicated to advancing scalable and compliant approaches for next-generation cell therapies.

Sagi Nahum, Ph.D., leads Global Analytical Sciences and CMC activities at CellVira, where he focuses on analytical solutions for cell and gene therapies in point-of-care settings, as well as the decentralized manufacturing of advanced cell and gene therapy products. Prior to joining CellVira, he led the Innovation Lab at Cognate BioServices, where he developed and validated high-throughput assays. He has been a member of ISO Technical Committee 276 (Biotechnology) and has authored or co-authored several publications in the fields of plant and human genetics, as well as biological assay development and technology transfer.