Focus on pharmaceutical outsourcing

This piece first went up in 2018, and one of the certifications it recommended has since been scrapped altogether. That is a good reason to look again at how medicines actually get made, because almost none of it happens where the name on the box would suggest.

What actually gets handed over, stage by stage

Outsourcing in this industry is rarely all-or-nothing. A company decides, stage by stage, what it can run in-house and what it would rather rent, and the contract follows that decision. The usual sequence looks like this.

1. Drug substance development. Synthesising and scaling up the active pharmaceutical ingredient, which is the part that does the therapeutic work.
2. Formulation and galenic development. Turning that ingredient into something a patient can take: a tablet, a cream, a sterile injectable. Injectables are the demanding end, because they need dedicated fill-finish lines and staff qualified to work in them.
3. Analytical development and stability testing. Building the methods that prove what is in the vial, then storing samples for months to see what happens to them.
4. Clinical trial supply. Small, awkward batches, often blinded and labelled in several languages at once.
5. Commercial manufacturing, then packaging, coding and distribution release.

The commercial logic behind that list has not changed since 2018. A company running a modest batch alongside its core business avoids buying a production line and hiring a team to staff it. Several projects can be pushed forward at the same time rather than queuing for one internal facility. What has changed is the regulatory backdrop those batches move through.

The approvals that decide whether a site can make your product

A contract manufacturer is only useful if its site is cleared by the regulator of the market the medicine is heading for. These are separate inspections, not one global stamp, which is why an outsourcing decision is partly a map exercise.

The standard the original article recommended no longer exists

OHSAS 18001 was withdrawn on 31 March 2021 and superseded by ISO 45001:2018, the international standard for occupational health and safety management. Certification bodies gave organisations a migration window, extended by six months to the end of September 2021 because of the pandemic; after that, anyone still holding an OHSAS certificate had to start the process again from scratch. ISO 14001, the environmental management standard also named in the 2018 version, remains current.

Worth separating the two families, because they are routinely quoted in the same breath and they do not do the same job. ISO 45001 and ISO 14001 describe how a company manages safety and environmental impact. Neither says anything about whether the medicine coming off the line is fit to give a patient. That question is settled only by GMP inspection.

Serialisation, and the point where the UK and the EU split

Serialisation means giving every individual pack a unique identifier, so it can be checked against a central database before it reaches a patient. In the European Union this comes from Delegated Regulation (EU) 2016/161, which supplements the Falsified Medicines Directive and came into force on 9 February 2019. It requires two things on the pack: a two-dimensional barcode carrying the unique identifier, and an anti-tampering device.

Following the UK’s departure from the EU, that Delegated Regulation no longer applies in Great Britain, and MHRA guidance now governs what appears on a British pack. Northern Ireland followed a different path, under a derogation that ran to the end of December 2024. For a contract manufacturer packing for several markets, that divergence is a practical coding and labelling problem rather than a philosophical one, and it is the sort of thing outsourcing partners now get chosen for.

Sterile manufacturing was rewritten in 2023

The revised EU GMP Annex 1, covering sterile medicinal products, came into effect on 25 August 2023 after a complete rewrite involving the EU, PIC/S and WHO, with FDA participation. Its central idea is the contamination control strategy: instead of relying on end-of-line testing and fixed particle limits, a site has to document how cleanroom design, air handling, personnel behaviour, cleaning and monitoring work together to keep contamination out.

That shift raised the entry price for injectables considerably, and it is one reason a company with an injectable in development is more likely to rent a qualified fill-finish line than build one.

Stability studies, and why they get outsourced first

Stability testing is the least glamorous item on the list and often the first to leave the building, because it needs controlled chambers sitting occupied for a year or more. Under ICH Q1A(R2), long-term studies for most markets run at 25 °C and 60% relative humidity for at least 12 months, with accelerated studies at 40 °C and 75% relative humidity over six months.

Those conditions are currently being folded into a single consolidated ICH Q1 guideline covering both synthetic and biological products. The draft reached public consultation on 11 April 2025 and has not yet been finalised, so the existing Q1A to Q1E guidelines remain the ones that apply.

What this means if you are reading as a patient rather than a manufacturer

Chiefly that the name on the carton tells you who is legally answerable for the medicine, not who physically made it, and that the two are frequently different companies in different countries. The marketing authorisation holder carries the responsibility regardless, which is why the inspection regime above exists in the form it does.

The same outsourcing logic runs through the cosmetic and dermatology side of this blog, where specialist laboratories test formulas that brands never handle themselves. There is a closer look at one of them in the piece on how skin pigmentation is studied before a product reaches a shelf.

Originally published in April 2018. Fully rewritten and fact-checked on 14 August 2026. This article is general information about how the pharmaceutical industry is organised; it is not advice about any medicine. Questions about a specific treatment belong with a pharmacist or doctor.

Sources: BSI, withdrawal of BS OHSAS 18001 and migration to ISO 45001; Commission Delegated Regulation (EU) 2016/161 and MHRA guidance on safety features; EudraLex Volume 4, Annex 1, Manufacture of Sterile Medicinal Products, effective 25 August 2023; ICH Q1A(R2), Stability Testing of New Drug Substances and Products, and the consolidated ICH Q1 draft at Step 2b, 11 April 2025.