Risk Management Plans 
to Mitigate the Potential 
for Drug Shortages 
Guidance for Industry 
 
 
 
DRAFT GUIDANCE
 
 
  This guidance document is being distributed for comment purposes only. 
 
Comments and suggestions regarding this draft document should be submitted within 60 days of 
publication in the Federal Register of the notice announcing the availability of the draft 
guidance.  Submit electronic comments to https://www.regulations.gov.  Submit written 
comments to the Dockets Management Staff (HFA-305), Food and Drug Administration, 5630 
Fishers Lane, Rm. 1061, Rockville, MD  20852.  All comments should be identified with the 
docket number listed in the notice of availability that publishes in the Federal Register. 
 
For questions regarding this draft document, contact (CDER) Karen Takahashi at 301-796-3191 
or (CBER) the Office of Communication, Outreach, and Development at 800-835-4709 or 240-
402-8010.  
 
 
 
 
 
 
U.S. Department of Health and Human Services 
Food and Drug Administration 
Center for Drug Evaluation and Research (CDER) 
Center for Biologics Evaluation and Research (CBER) 
 
May 2022 
Pharmaceutical Quality/Manufacturing Standards (CGMP) 
 
25370417dft_RiskManagementPlans.docx 
04/26/22   
Risk Management Plans 
to Mitigate the Potential 
for Drug Shortages 
 
Guidance for Industry 
 
 
 
Additional copies are available from: 
 
Office of Communications, Division of Drug Information 
Center for Drug Evaluation and Research 
Food and Drug Administration 
10001 New Hampshire Ave., Hillandale Bldg., 4th Floor  
Silver Spring, MD  20993-0002  
Phone: 855-543-3784 or 301-796-3400; Fax: 301-431-6353; Email: druginfo@fda.hhs.gov 
https://www.fda.gov/drugs/guidance-compliance-regulatory-information/guidances-drugs 
 
and/or 
 
Office of Communication, Outreach, and Development  
Center for Biologics Evaluation and Research 
Food and Drug Administration 
10903 New Hampshire Ave., Bldg. 71, Room 3128 
Silver Spring, MD  20993-0002 
Phone: 800-835-4709 or 240-402-8010; Email: ocod@fda.hhs.gov 
https://www.fda.gov/vaccines-blood-biologics/guidance-compliance-regulatory-information-biologics/biologics-
guidances 
 
 
 
 
 
U.S. Department of Health and Human Services 
Food and Drug Administration 
Center for Drug Evaluation and Research (CDER) 
Center for Biologics Evaluation and Research (CBER) 
 
May 2022 
Pharmaceutical Quality/Manufacturing Standards (CGMP) 
 
   
TABLE OF CONTENTS 
 
I.  INTRODUCTION............................................................................................................. 1 
II.  BACKGROUND ............................................................................................................... 2 
III.  RISK MANAGEMENT PLANS:  STAKEHOLDERS AND PRODUCTS ................ 4 
A.  Stakeholders in the Manufacturing Supply Chain ..................................................................... 4 
B.  Products for Which RMPs Are Required .................................................................................... 5 
C.  Products for Which RMPs Are Recommended .......................................................................... 7 
IV.  RMP FRAMEWORK AND DEVELOPMENT STRATEGY ...................................... 9 
A.  Stakeholder RMP Development Strategy .................................................................................... 9 
B.  Quality Risk Management Process Framework ....................................................................... 10 
1. Initiating an RMP .......................................................................................................................... 11 
2. Risk Assessment ............................................................................................................................. 11 
3. Risk Control ................................................................................................................................... 12 
4. Risk Review:  Review Events .......................................................................................................... 13 
5. Risk Communication ...................................................................................................................... 13 
6. Risk Management Tools ................................................................................................................. 14 
APPENDIX:  RISK CONSIDERATIONS FOR SPECIFIC RMPS ...................................... 15 
  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
1  Risk Management Plans to  
2  Mitigate the Potential for Drug Shortages 
3  Guidance for Industry1 
4   
5   
6   
7   
8  This draft guidance, when finalized, will represent the current thinking of the Food and Drug 
9  Administration (FDA or Agency) on this topic.  It does not establish any rights for any person and is not 
10  binding on FDA or the public.  You can use an alternative approach if it satisfies the requirements of the 
11  applicable statutes and regulations.  To discuss an alternative approach, contact the FDA staff responsible 
12  for this guidance as listed on the title page. 
13   
14   
15   
16   
17  I.  INTRODUCTION  
18   
19  This guidance is intended to help stakeholders2 develop, maintain, and implement risk 
20  management plans (RMPs) to proactively assist in the prevention of human drug product and 
21  biological product shortages.3  RMPs can provide stakeholders with a framework to proactively 
22  identify, prioritize, and implement strategies to mitigate hazards that can cause a supply 
23  disruption.  Such a supply disruption may lead to a drug shortage.  Effective quality risk 
24  management can facilitate better, more informed decisions; can provide FDA with greater 
25  assurance that stakeholders understand and can manage the associated risks; and can potentially 
 
1 This guidance has been prepared by the Office of Pharmaceutical Quality (OPQ) in the Center for Drug Evaluation 
and Research (CDER) in cooperation with the Center for Biologics Evaluation and Research (CBER) at the Food 
and Drug Administration.  In preparing this guidance, OPQ has also consulted with the Center for Devices and 
Radiological Health and the Office of Combination Products. 
2 For the purposes of this guidance, the term stakeholder includes each manufacturer of a drug described in section 
506C(a) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) (21 U.S.C. 356c(a)) or of any active 
pharmaceutical ingredient (API) included in such drugs.  (See generally section 506C(j) of the FD&C Act.)  The 
term stakeholder also broadly includes any person or entity who has oversight and control over the manufacture of 
drugs to ensure quality or owns or operates an establishment (as defined in 21 CFR 207.1 and 21 CFR 600.3) that 
manufactures a drug or biological product.  Examples of stakeholders include:  contract facilities as referenced in 
21 CFR 200.10(b); applicants with an approved new drug application, abbreviated new drug application, or an 
approved biologics license application; manufacturers of drug products marketed without an approved application; 
manufacturers of components, including APIs, intended for use in the manufacture of drug products; and 
manufacturers of drug-led, drug-device or biologic-led, biologic-device combination products (as defined in 21 CFR 
3.2(e)) regulated by CDER or CBER.  This guidance references specific stakeholders individually where appropriate 
(e.g., if a specific section of the guidance is relevant to specific stakeholders only); otherwise, recommendations that 
refer to the manufacture of drugs are generally relevant to all stakeholders with the roles described above with 
respect to human drug and biological products.   
3 Drug shortage or shortage means a period of time when the demand or projected demand for the drug within the 
United States exceeds the supply of the drug (see section 506C(h)(2) of the FD&C Act).  For the purposes of this 
guidance, drug or drug product refers to human drugs and biological products (see section 201(g)(1) of the FD&C 
Act).   
  1  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
26  affect the extent and level of direct regulatory oversight.4  Based on recent publications and 
27  reports, the majority of drug shortages are associated with quality issues.5,6,7,8  This guidance 
28  describes a framework for stakeholders to consider when developing RMPs that aligns with 
29  principles stated in the International Council for Harmonisation (ICH) guidance for industry 
30  Q9 Quality Risk Management (June 2006).  In addition, FDA also recommends risk factors to 
31  consider when developing the content of the RMPs.   
32   
33  The contents of this document do not have the force and effect of law and are not meant to bind 
34  the public in any way, unless specifically incorporated into a contract.  This document is 
35  intended only to provide clarity to the public regarding existing requirements under the law.  
36  FDA guidance documents, including this guidance, should be viewed only as recommendations, 
37  unless specific regulatory or statutory requirements are cited.  The use of the word should in 
38  Agency guidance means that something is suggested or recommended, but not required. 
39   
40   
41  II.  BACKGROUND 
42   
43  FDA recognizes that drug shortages pose a significant public health threat because they can 
44  delay, and in some cases even deny, critically needed care for patients.  Recent publications have 
45  explained that proactively assessing risks to drug manufacturing processes and supply chains, 
46  coupled with an understanding of market vulnerabilities, have enabled stakeholders to support 
47  robust manufacturing operations that help to maintain the availability of a high-quality drug 
48  through the drugs life cycle.9  The publications further explain that proactive risk assessment 
49  has also enabled some stakeholders to predict and prevent supply disruptions that could 
50  potentially lead to a drug shortage.10   
 
4 See section VI., Integration of Quality Risk Management Into Industry and Regulatory Operations, in the ICH 
guidance for industry Q9 Quality Risk Management (June 2006).  We update guidances periodically.  For the most 
recent version of a guidance, check the FDA guidance web page at https://www.fda.gov/regulatory-
information/search-fda-guidance-documents.  Note that appropriate use of quality risk management does not obviate 
industrys obligation to comply with regulatory requirements.   
5 The term quality is defined in ICH Q9 as The degree to which a set of inherent properties of a product, system, or 
process fulfills requirements. 
6 The International Society for Pharmaceutical Engineerings (ISPEs) Report on the ISPE Drug Shortages Survey 
(June 2013) (https://ispe.org/initiatives/drug-shortages/publications-tools) shows that issues associated with the 
quality system, or the system that assures overall compliance with current good manufacturing practices and internal 
procedures and specifications, was the most common cause of drug shortages. 
7 See the FDA report Drug Shortages:  Root Causes and Potential Solutions (2019), p. 33 and Appendix F, at 
https://www.fda.gov/media/131130/download. 
8 Chapman, S, G Dedet, and R Lopert, 2022, Shortages of Medicines in OECD Countries, OECD Health Working 
Papers, No. 137, OECD Publishing, Paris, https://doi.org/10.1787/b5d9e15d-en. 
9 See the ISPE and The Pew Charitable Trusts report Drug Shortages:  An Exploration of the Relationship Between 
U.S. Market Forces and Sterile Injectable Pharmaceutical Drugs:  Interviews With 10 Pharmaceutical Companies 
(January 2017) at https://www.pewtrusts.org/-/media/assets/2017/01/drug_shortages.pdf.  See also the final report 
by the inter-associations team with representatives from the European Federation of Pharmaceutical Industries and 
Associations, Medicines for Europe (formerly European Generics Association), Association of the European Self-
Medication Industry, Plasma Protein Therapeutics Association, ISPE, and Parenteral Drug Association Prevention 
of Drug Shortages Based on Quality and Manufacturing Issues (December 2014) at 
https://www.pda.org/docs/default-source/website-document-library/scientific-and-regulatory-affairs/drug-
shortage/interrupted-supply-inter-association-summary-final-report-2014.pdf?sfvrsn=4. 
10 Ibid. 
  2  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
51   
52  In July 2012, with the enactment of the Food and Drug Administration Safety and Innovation 
53  Act (FDASIA), Congress empowered FDA with tools to work in collaboration with industry to 
54  help prevent or mitigate drug supply disruptions and drug shortages, and clarified current good 
55  manufacturing practice requirements relevant to the oversight and controls over the manufacture 
56  of drugs to ensure quality.11  In 2011 and 2012, FDA assisted in mitigating 368 new drug 
57  shortages and preventing 473 drug shortages.  In contrast, in the 6-year span after FDASIA was 
58  enacted, FDA assisted in mitigating 222 new drug shortages and preventing 806 drug 
59  shortages.12  Although the number of new drug shortages has declined significantly since the 
60  peak in 2011, reaching a low in 2015 and 2016, this downward trend did not continue in 
61  subsequent years.  Drug shortages continue to occur and at roughly the same levels since 2018.  
62  Further, drug shortages have grown more persistent (i.e., increased length of active drug 
63  shortages).13  Many of the reasons for drug shortages are, for example, issues related to drug 
64  quality, disruptions to supply chain manufacturing operations (e.g., caused by natural disaster or 
65  discontinuation of components by suppliers), limitations in forecasting future demand, and 
66  market withdrawals of drug products.14  Additionally, in recent years, FDA has observed a rise in 
67  number of cyberattacks on drug manufacturers and is increasingly concerned about the effect of 
68  such attacks on the drug supply chain.15 
69   
70  In March 2020, with the enactment of the Coronavirus Aid, Relief, and Economic Security Act 
71  (CARES Act), Congress added section 506C(j) to the Federal Food, Drug, and Cosmetic Act 
72  (FD&C Act),16 which requires certain manufacturers to develop, maintain, and implement, as 
73  appropriate, a redundancy risk management plan that identifies and evaluates risks to the supply 
74  of the drug, as applicable, for each establishment in which such drug or active pharmaceutical 
75  ingredient of such drug is manufactured.  Section 506C(j) became effective on September 23, 
76  2020 (see section III. in this guidance).   
77   
 
11 Generally, section 506C(a) of the FD&C Act, as amended by FDASIA (Public Law 112-144) and the Coronavirus 
Aid, Relief, and Economic Security Act (Public Law 116-136), requires certain applicants and manufacturers to 
notify the Agency of:  (1) a permanent discontinuance in the manufacture of certain drug products; (2) an 
interruption in manufacturing of certain drug products that is likely to lead to a meaningful disruption in the supply 
of such products in the United States; (3) a permanent discontinuance in the manufacture of the API of certain drug 
products; and (4) an interruption in the manufacture of the API of certain drug products that is likely to lead to a 
meaningful disruption in the supply of the API of those products.  Notifications under section 506C(a) must include 
disclosure of the reasons for such discontinuance or interruption.  Section 506E of the FD&C Act (21 U.S.C. 356e) 
requires FDA to maintain an up-to-date list of drugs that are determined by FDA to be in shortage in the United 
States.  Section 711 of FDASIA amended section 501 of the FD&C Act (21 U.S.C. 351) to clarify that, for purposes 
of section 501(a)(2)(B), the term current good manufacturing practice includes the implementation of oversight and 
controls over the manufacture of drugs to ensure quality, including managing the risk of and establishing the safety 
of raw materials, materials used in the manufacturing of drugs, and finished drug products.  
12 See the Drug Shortages Infographic web page (https://www.fda.gov/drugs/drug-shortages/drug-shortages-
infographic).  These statistics refer to shortages tracked by CDER. 
13 See Slides 35 and 36 from the November 28, 2018, conference Identifying the Root Causes of Drug Shortages 
and Finding Enduring Solutions at Duke Universitys Margolis Center for Health Policy (accessed July 21, 2020, 
https://healthpolicy.duke.edu/sites/default/files/2020-02/presentation_slides__0.pdf). 
14 See footnote 7. 
15 Millar, A, 2021, Five Pharma Cybersecurity Breaches to Know and Learn From, Pharmaceutical Technology, 
accessed October 15, 2021, https://www.pharmaceutical-technology.com/features/pharma-cyber-attacks/. 
16 See Public Law 116-136.   
  3  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
78  FDA believes that its efforts in navigating drug shortage issues through the statutory and 
79  regulatory framework and its partnership with stakeholders have contributed to the reduction in 
80  the number of new drug shortages as well as a reduction in the time to resolve existing drug 
81  shortages.  However, the Agency acknowledges that shortages and shortage mitigation efforts 
82  pose a significant financial and resource burden on stakeholders and FDA.  FDA views RMPs as 
83  an important mechanism that stakeholders can use to proactively identify, assess, and mitigate 
84  the risks that might lead to a disruption in the supply of drug products, and thus preemptively 
85  reduce the financial and resource burden associated with resolving a shortage and problems that 
86  may lead to a shortage.   
87   
88  RMPs involve the systematic application of quality management policies, procedures, and 
89  practices to the tasks of assessing, controlling, communicating, and reviewing risk.  These 
90  approaches and techniques are commonly used by multiple industries to manage a broad range of 
91  risks that have the potential to adversely affect their businesses.  For the pharmaceutical industry, 
92  drug manufacturers use quality risk management, a systematic process for the assessment, 
93  control, communication, and review of risks to drug product quality, across the drugs life cycle.  
94  Quality risk management is based on two principles:17   
95   
96  (1) The assessment of the risk to quality should be based on scientific knowledge and 
97  ultimately link to the protection of the patient  
98   
99  (2) The level of effort, formality, and documentation of the quality risk management process 
100  should be commensurate with the level of risk 
101   
102  The pharmaceutical industry has taken incremental steps to implement quality risk management 
103  principles since the publication of ICH Q9 in 2006.  As a result, the Agency believes that many 
104  stakeholders have already established processes and procedures to proactively identify, assess, 
105  and mitigate the effect of a broad spectrum of risks to their business processes using these risk 
106  management principles.  The Agency encourages the use of these approaches to proactively 
107  manage the risk of supply disruptions that may lead to drug shortages.   
108   
109   
110  III.  RISK MANAGEMENT PLANS:  STAKEHOLDERS AND PRODUCTS  
111   
112  This section defines stakeholders in the manufacturing supply chain for drugs and describes 
113  those products for which an RMP is required under section 506C(j) of the FD&C Act, as well as 
114  those products for which an RMP is recommended.   
115   
116  A.  Stakeholders in the Manufacturing Supply Chain 
117   
118  The content of an RMP, including the steps needed to reduce risks of a disruption in drug supply, 
119  may vary among the different stakeholders in the supply chain for a given drug product.  For the 
120  purposes of this guidance, stakeholders in the drug supply chain are categorized as follows. 
121   
 
17 See ICH Q9. 
  4  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
122    Primary Stakeholder.18  The primary stakeholder is generally the entity that determines 
123  which materials and services are necessary to produce a drug product.  This knowledge 
124  results in greater understanding of the entire supply chain for a drug product, and 
125  therefore, makes the primary stakeholder best positioned to manage many of the risks of 
126  supply chain disruption.  Primary stakeholders include:  
127   
128    For drug products with approved applications, the holder of the new drug application, 
129  abbreviated new drug application, or biologics license application  
130   
131    For drug products without an application, the entity with understanding of and 
132  capability to make changes to the supply chain (e.g., add a redundant active 
133  pharmaceutical ingredient (API) source or mitigate a disruption in the supply of drug 
134  product containers) for the finished drug product   
135   
136    Secondary Stakeholders.19  Secondary stakeholders are entities that are expected to 
137  have more detailed insight into specific segments of the supply chain for a drug product 
138  but may not have an understanding of its entirety.  Secondary stakeholders include: 
139   
140    Finished product manufacturers that are not primary stakeholders, including any such 
141  manufacturers that operate establishments involved in physically manipulating the 
142  drug product (e.g., blending, tableting) and any such manufacturers of a drug-led, 
143  drug-device combination product or biologic-led, biologic-device combination 
144  product regulated by the Center for Drug Evaluation and Research (CDER) or the 
145  Center for Biologics Evaluation and Research (CBER).20,21 
146   
147    API manufacturers, as well as those manufacturers that physically process (e.g., 
148  milling, coating) or package the API. 
149   
150    Other stakeholders.  Other stakeholders in the supply chain for drugs that are not 
151  primary or secondary stakeholders, such as inactive ingredient manufacturers, packagers, 
152  and distributors.   
153   
154  B.  Products for Which RMPs Are Required 
155   
156  As described in the Background section of this guidance, the CARES Act added section 506C(j) 
157  to the FD&C Act, which requires certain manufacturers to develop, maintain, and implement, as 
158  appropriate, a redundancy risk management plan that identifies and evaluates risks to the supply 
 
18 See the Appendix for risk factors for primary and secondary stakeholders to consider when developing an RMP. 
19 Ibid. 
20 This does not include establishments that only perform testing, relabeling, or repackaging operations.  
21 This category includes persons that operate establishments that manufacture drug-led, drug-device or biologic-led, 
biologic-device combination products (i.e., single entity, co-packaged, and cross-labeled combination products, as 
defined in 21 CFR 3.2(e)) but does not include persons that operate establishments that only manufacture the device 
constituent part of such a combination product (e.g., an establishment that only manufactures the device constituent 
part of a cross-labeled combination product). 
  5  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
159  of the drug, as applicable, for each establishment in which such drug or active pharmaceutical 
160  ingredient of such drug is manufactured.22,23   
161   
162  Each manufacturer of the following drug products, APIs, and associated medical devices must 
163  develop, maintain, and implement, as appropriate, an RMP that identifies and evaluates risks to 
164  the supply of the drug product, as applicable, for each establishment in which such drug product 
165  or API of such drug product is manufactured:24 
166   
167    Prescription drug products that are:25 
168   
169    Life-supporting26 
170   
171    Life-sustaining27 
172   
173    Intended for use in the prevention or treatment of a debilitating disease or condition,28 
174  including any such drug used in emergency medical care or during surgery29 or any 
175  such drug that is critical to the public health during a public health emergency declared 
176  by the Secretary under section 319 of the Public Health Service Act30  
177   
178    Any API included in the prescription drug products described above 
179   
180    Any associated medical device used for preparation or administration included with the 
181  prescription drug products described above, namely, any device constituent part of drug-
 
22 The identification and evaluation of risk specified in section 506C(j) are elements of the risk assessment step of an 
RMP (this concept is further illustrated in Figure 1, Recommended Risk Management Plan Steps Using the ICH Q9 
Framework).  Redundancy (e.g., more than one supplier) is an example of a risk control strategy that may help 
reduce risk identified during the risk assessment step but is not the only possible approach to risk control.  For the 
purposes of this guidance risk management plan is the same as redundancy risk management plan.  
23 Through rulemaking, FDA applied section 506C of the FD&C Act to all biological products, including 
recombinant therapeutic proteins, monoclonal antibody products, vaccines, allergenic products, plasma-derived 
products and their recombinant analogs, blood or blood components, and cellular and gene therapy products (see 
80 FR 38918, July 8, 2015; 21 CFR 600.82; and section 506C(h)(1), (i)(3) of the FD&C Act).  Therefore, section 
506C(j) is applicable to all biological products.  Section 506C(a) applies only to applicants of blood or blood 
components for transfusion that manufacture a significant percentage of the U.S. blood supply (see 21 CFR 600.82; 
80 FR 38926). 
24 See section 506C(j) of the FD&C Act. 
25 Excluding radiopharmaceutical drug products and any other product as designated by the Secretary (see section 
506C(a)(2) of the FD&C Act). 
26 See 21 CFR 314.81(b)(3)(iii)(f) and 21 CFR 600.82(f). 
27 Ibid. 
28 Ibid. 
29 See section 506C(a)(1) of the FD&C Act. 
30 Ibid. 
  6  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
182  led, drug-device combination product or biologic-led, biologic-device combination 
183  product manufactured by the establishment and regulated by CDER or CBER.31,32   
184   
185  FDA considers the manufacturers that are subject to this requirement under section 506C(j) of 
186  the FD&C Act to include primary and secondary stakeholders as defined in section III.A. of this 
187  guidance. 
188   
189  C.  Products for Which RMPs Are Recommended 
190   
191  Certain types of drug products33 and APIs not included in the requirement under section 506C(j) 
192  of the FD&C Act,34 if subject to a supply disruption and shortage, would be of particular concern 
193  to the Agency because of the potential effect on patient care.  In addition, FDA has found that 
194  certain drug products, such as those with less redundancy in their supply chains, are at higher 
195  risk of shortage.  The products listed in this section may or may not be products for which 
196  manufacturers must develop, maintain, and implement RMPs under section 506C(j).  For 
197  example, drug products intended to treat rare diseases or conditions may or may not also be drug 
198  products for which RMPs must be developed, maintained, and implemented under section 
199  506C(j).  To the extent drug products or APIs incorporated in those products fall within a 
200  category described in the following list but are not drug products described in section 506C(a) of 
201  the FD&C Act or APIs included in such drug products, FDA nevertheless recommends that 
202  stakeholders develop, maintain, and implement RMPs for such products, as appropriate, to 
203  provide reliability of supply:  
204   
205    Drug products intended to treat rare diseases or conditions35 
206   
207    Drug products that lack appropriate alternatives  
208   
209    Medical countermeasures used in the event of a potential public health emergency 
210  stemming from a terrorist attack with a biological, chemical, or radiological/nuclear 
 
31 Manufacturers of an associated medical device used for preparation or administration included in the prescription 
drug products described above include persons that operate establishments that manufacture drug-led, drug-device 
or biologic-led, biologic-device combination products (i.e., single entity, co-packaged, and cross-labeled 
combination products, as defined in 21 CFR 3.2(e)) but does not include persons that operate establishments that 
only manufacture the device constituent part of such a combination product (e.g., an establishment that only 
manufactures the device constituent part of a cross-labeled combination product). 
32 An RMP developed by such a manufacturer should address the risks associated with sourcing of the device 
constituent part. 
33 These considerations also apply to drug-led, drug-device and biologic-led, biologic-device combination products 
regulated by CDER or CBER subject to the requirement in section 506C(a) of the FD&C Act but for which 
availability of the device constituent parts could be a reason for, or a risk factor in, the supply disruption or shortage 
of the combination product. 
34 See section III.B. of this guidance. 
35 See section 526(a)(2) of the FD&C Act. 
  7  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
211  material, or a naturally occurring emerging disease36 and other threat agents (i.e., 
212  essential to national security)37 
213   
214    Sole source products38  
215   
216    Drug products with only one API manufacturer in the products supply chain that has 
217  been appropriately qualified by the quality unit of the finished dosage form (FDF) 
218  establishment39,40  
219   
220    Drug products with only one FDF manufacturer in the products supply chain41  
221   
222    Drug products that are manufactured in a facility (including packaging facilities and 
223  laboratories) with an inspection in the last 5 years that was classified as official action 
224  indicated (OAI)42 and there is no other manufacturing facility that is qualified in the 
225  products supply chain to conduct that operation43 
226   
227  RMPs are a useful tool to facilitate compliance with a firms regulatory requirements.44  As a 
228  general matter, the Agency believes that RMPs are a good practice to help ensure reliability of 
229  supply of drug products and APIs.  Therefore, FDA recommends that stakeholders consider 
230  developing, maintaining, and implementing RMPs for their drug products or APIs that are not 
231  subject to the requirement in section 506C(j) of the FD&C Act, in addition to those that are 
232  subject to that requirement, as described earlier.    
233   
234   
 
36 The term medical countermeasures means items that meet the definition of qualified countermeasure in 
42 U.S.C. 247d6a(a)(2)(A); qualified pandemic or epidemic product in 42 U.S.C. 247d6d(i)(7); security 
countermeasure in 42 U.S.C. 247d6b(c)(1)(B); or personal protective equipment described in 29 CFR part 1910. 
37 See Section 7. Facilitate Development of Medical Countermeasures to Protect Against Threats to U.S. and Global 
Health and Security:  Strategic Plan for Regulatory Science at https://www.fda.gov/science-research/advancing-
regulatory-science/section-7-facilitate-development-medical-countermeasures-protect-against-threats-us-and-global. 
38 For the purposes of this guidance, a sole source product is a drug product of a specific strength, dosage form, or 
route of administration manufactured by only one entity for sale in the United States.  MAPP 5240.3 Rev. 5 
Prioritization of the Review of Original ANDAs, Amendments, and Supplements describes criteria to help 
manufacturers evaluate whether a product is a sole source product.  MAPPs can be found on the Manual of Policies 
and Procedures web page at https://www.fda.gov/about-fda/center-drug-evaluation-and-research/cder-manual-
policies-procedures-mapp. 
39 See 21 CFR 211.84. 
40 Additionally, for application products, the API establishment(s) are named in the approved application.  
41 Additionally, for application products, the FDF establishment(s) are named in the approved application. 
42 The term official action indicated (OAI) generally refers to a classification made following an inspection when a 
facility is observed to be in an unacceptable state of compliance and regulatory action may be warranted.   
43 For application products, it is also expected that any other manufacturing facility is named in the approved 
application.  
44 See generally the recommendations in ICH Q9, which describes the scope of the guidance on risk management 
principles for processes throughout the life cycle of drug substances, drug products, biological and biotechnological 
products (including the use of raw materials, solvents, excipients, packaging and labeling materials in drug products, 
and biological and biotechnological products).   
  8  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
235  IV.  RMP FRAMEWORK AND DEVELOPMENT STRATEGY 
236   
237  FDA recommends using the quality risk management process and principles described in ICH 
238  Q9 as the framework to develop an effective RMP.  This guidance is intended to add to the 
239  elements of the framework described in ICH Q9, to describe considerations for stakeholder 
240  oversight for RMPs, and to assist with the interpretation of the quality risk management process 
241  within the context of developing RMPs.45  Further, stakeholders may benefit by integrating the 
242  RMP with other aspects of their operations.     
243   
244  A.  Stakeholder RMP Development Strategy 
245   
246  RMPs help to ensure that risks with the potential to disrupt the drug manufacturing process and 
247  the drug supply chain have been identified, assessed, and mitigated.  An individual stakeholders 
248  role in developing and implementing an RMP varies with that stakeholders level of involvement 
249  with the drug manufacturing process or supply chain.  Nonetheless, FDA believes that risk 
250  management principles should be applied throughout the drug supply chain to help mitigate the 
251  risk of drug shortages.   
252   
253  A primary stakeholder RMP should contain a broader strategy that establishes overarching 
254  approaches to consistently identify, assess, and mitigate risk across the organization or a 
255  subsector of the organization.  This approach is consistent with institutionalized quality 
256  management maturity46 that results in understanding the risk of supply disruptions that may lead 
257  to shortages across the supply chain, integrates redundancy into the supply chain, improves the 
258  forecasting of demand changes at all stages of production, maintains sustainable compliance, 
259  improves overall incentives between purchasers and manufacturers, and fosters collaboration 
260  with regulators.  FDA recommends that the primary stakeholder RMP also include plans to 
261  repair the supply chain after a disruption, as appropriate.  Further, FDA recommends that the 
262  primary stakeholder initiate RMP development as early as possible in the drug products 
263  regulatory life cycle. 
264   
265  The Agency recommends that the primary stakeholder share as much of its RMP as possible with 
266  secondary and other stakeholders of the drug product to enable secondary and other stakeholders 
267  to incorporate the broad strategies of the primary stakeholders RMP into their own plans and 
268  also contextualize the risks identified in the primary stakeholders RMP, specifically for the 
269  manufacturing facility.  Sharing the primary stakeholders RMPs with secondary and other 
 
45 Similarly, for combination products, this guidance would also serve to augment a risk management program based 
on ISO 14971 Application of risk management to medical devices (2019).  With regard to combination products, 
either ICH Q9 or ISO 14971/ISO TR 24971 Guidance on the application of ISO 14971 (2020) could serve as a basis 
for developing a suitable framework for risk management, and reference to both can be helpful in developing such a 
framework.  For combination products that include a device constituent part, use of an ISO 14971/24971-based 
framework, incorporating relevant considerations from ICH Q9, is recommended to ensure a sufficiently robust risk 
management process consistent with current best practices and global regulatory trends and norms.  See, for 
example, AAMI TIR 105 2020, Risk Management for Combination Products. 
46 See the FDA report Drug Shortages:  Root Causes and Potential Solutions (2019) (available at 
https://www.fda.gov/media/131130/download).  More advanced levels of quality management maturity aim to 
robustly detect vulnerabilities and address them to prevent the occurrence of problems as well as establishing a 
culture that rewards process and system improvements. 
  9  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
270  stakeholders may also further refine the mitigation and avoidance strategies specific to the 
271  individual drug, or its unique manufacturing process.  For example, if a primary stakeholders 
272  RMP already addresses availability of raw materials, it may be appropriate for this risk factor not 
273  to be addressed in a contract manufacturers RMP.  However, in such a situation, FDA 
274  recommends that the contract manufacturers RMP still address general and product-specific 
275  facility risks, such as maintaining process control, manufacturing equipment robustness, and 
276  product-specific utility requirements. 
277   
278  The stakeholders that are involved in the supply chain for a particular drug product should work 
279  together to address RMP development and implementation.  The Appendix of this guidance 
280  provides risk factors for stakeholders to consider when developing an RMP strategy. 
281   
282  B.  Quality Risk Management Process Framework 
283   
284  FDA recommends the following process for developing RMPs based on the quality risk 
285  management framework in ICH Q9, as shown in Figure 1.  Each process step is detailed in the 
286  following subsections. 
287   
  10  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
288  Figure 1:  Recommended Risk Management Plan Steps Using the ICH Q9 Framework 
289   
290   
Initiate Risk Management Plan to Mitigate the  
Potential for Drug Shortages 
Risk Assessment 
Risk Identification  identify the risks with a potential to cause drug shortage. 
Risk Analysis  identify near misses in terms of drug shortages that were avoided.  
Consider past circumstances or practices associated with the risk.  
 
Risk Evaluation  identify probability of a drug shortage occurring.  Identify the impact  unacceptable
of a drug shortage event. 
 n  Ris
tio Risk Control  k M
a
c a
ni n
mu Rfuistku rRee idmupcaticotn.   A sidseesnst irfeys cidourrael crtisivke.  and preventive actions to mitigate current and  age
m m
o e
C n
Risk  Risk Acceptance  identify risks that an organization decides to accept or absorb.  t Too
ls
 
Risk Management Plan Report 
Risk Review 
Review Events - Periodically assess and review current risks to evaluate whether 
mitigation strategies need to be updated.  Evaluate drug shortages (actual and near 
misses) to identify, assess, and mitigate any new risks, using this algorithm. 
291   
292  1.  Initiating an RMP  
293   
294  The purpose of initiating an RMP is to allow a stakeholder to proactively assess the risks of a 
295  drug supply disruption, rather than wait for an actual disruption to occur.  Cross-cutting 
296  coordination and collaboration is critical to development, implementation, and maintenance of an 
297  effective RMP. 
298   
299  2.  Risk Assessment  
300   
301  The risk assessment involves identifying the associated hazards, evaluating the risk of each 
302  hazard, and evaluating the risk of a drug supply disruption based on:  (1) what might go wrong; 
303  (2) what is the likelihood (probability) it will go wrong; and (3) what are the consequences 
304  (severity).  
  11  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
305   
306    Risk Identification  This involves identifying the hazards, including critical 
307  operations or processes, that have the potential to cause a drug supply disruption.  
308  Potential hazards can be identified through:  historical data analysis; theoretical analysis; 
309  informed opinions; relationships with suppliers, vendors, and contractors; audits; market 
310  forces that may affect the availability or reliability of raw materials; and overall 
311  manufacturing process stability and reliability.47,48,49  
312   
313    Risk Analysis  This involves estimating the risk associated with the identified hazards 
314  and effects50 considering the likelihood of occurrence, severity of harm, and detectability.  
315  That is, is there an increased potential for supply disruption of the finished drug product 
316  based on the hazards (e.g., location of manufacturing, source of components)?  This 
317  analysis may include historical information, such as if there were one or more near-miss 
318  situations where a shortage was narrowly avoided.  
319   
320    Risk Evaluation  Based on the risk analysis, the probability of each risk resulting in 
321  patient impact or a supply disruption should be systematically evaluated.  
322   
323  At the end of the Risk Assessment step, the hazards should have been identified, analyzed, and 
324  evaluated, and a determination should have been made as to which hazards are considered a 
325  higher risk to drug supply disruption than others. 
326   
327  3.  Risk Control  
328   
329  The Risk Control step is intended to reduce risks of a disruption in supply to an acceptable level 
330  and/or accept these risks.   
331   
332    Risk Reduction  This involves identifying strategies that can be used to potentially 
333  mitigate or avoid the identified risks.  This can include building redundancy into 
334  manufacturing operations, establishing adequate controls on the supply chain, 
335  strengthening relationships with suppliers (e.g., contract manufacturers, ingredient 
336  suppliers), and/or identifying alternative suppliers.51  Once the applicable strategies are 
337  implemented, the risk assessment should be periodically re-evaluated to determine if 
 
47 With regard to market disruption for combination products, this would include appropriate engagement of 
personnel with requisite expertise and responsibility to understand risks associated with sourcing of device 
constituent parts, which include components of device constituent parts, that might cause disruption to manufacture 
of the combination product including development and management of associated purchasing controls (see 21 CFR 
part 4, 21 CFR 820.50). 
48 Since 2013, FDA has been encouraging manufacturers to implement and improve quality metrics and quality 
culture programs in support of overall manufacturing process stability and reliability.  The Quality Metrics Program 
is also part of the long-term strategy to mitigate drug shortages by addressing the robustness of quality oversight, 
given that quality issues have been found to be the most common underlying cause of shortages.   
49 See also the Appendix:  Risk Considerations for Specific RMPs. 
50 See the ISPE/Pew Report mentioned in footnote 9 at p. 11, which identifies potential patient effects of stakeholder 
decisions to remain in the market or invest in new facilities or equipment to mitigate the risk of creating a drug 
shortage. 
51 See the requirements for making changes to the conditions established in an approved application under 21 CFR 
314.70 and 21 CFR 601.12. 
  12  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
338  additional hazards are present.  Risk control strategies also can account for residual risk 
339  arising after a mitigation strategy is implemented.  
340   
341    Risk Acceptance  This involves identifying if the remaining risk is acceptable52 or if 
342  the risk should be further reduced through additional risk reduction strategies.   
343   
344  At the end of the Risk Control step, a report should be developed to document the risk 
345  assessment and risk control strategies. 
346   
347  4.  Risk Review:  Review Events 
348   
349  The Agency recommends at least an annual, internal review and revision of an RMP throughout 
350  the life cycle of a drug.  RMP review and revision should include lessons learned, including the 
351  root cause of new and near-miss supply disruptions.  In some instances, it may be useful to 
352  quickly integrate the additional identified risks and mitigation strategies into the RMP rather than 
353  waiting for the next annual review cycle.  This review also can include an assessment of 
354  communication with regulators and whether the communication should be improved.  
355   
356  5.  Risk Communication 
357   
358  FDA encourages stakeholders to engage in proactive communication of their RMPs with 
359  organizations within their drug supply chains, and where appropriate, with external stakeholders 
360  and regulators throughout the process.    
361   
362  Certain stakeholders are required to submit notifications to the Agency about drug product and 
363  API permanent discontinuances and certain manufacturing interruptions under section 506C of 
364  the FD&C Act.53,54  For the notifications received, FDA works with the stakeholder to assess the 
365  situation and prevent or mitigate any shortage that may result, when possible.  Stakeholders that 
366  are covered by the notification requirement under section 506C must submit certain information 
367  to FDA as part of the notification.55  Along with the information that is required to be submitted, 
368  the Agency recommends that manufacturers provide additional information that may assist the 
369  Agency in addressing the situation.  FDA has published a list of questions for manufacturers to 
370  consider as they evaluate the situation and prepare to notify FDA, including whether the 
371  manufacturer has a proposal for FDA to review to expedite availability of a product.56  This 
372  information would likely be contained in an RMP.  A stakeholder can leverage an RMP to 
 
52 See ICH Q9. 
53 For more information, see section 506C(a) of the FD&C Act and FDAs implementing regulations at 21 CFR 
310.306, 21 CFR 314.81(b)(3)(iii), and 21 CFR 600.82, which address, among other things, which persons and drug 
and biological products are covered by the notification requirement, what information must be submitted in a 
notification, and when notifications must be submitted.   
54 Under section 506J of the FD&C Act, certain medical device manufacturers are required to notify the Agency 
about permanent discontinuances or interruptions in manufacturing likely to lead to a meaningful disruption of the 
supply of the device in the United States.  Such notifications are outside the scope of this guidance.  For more 
information about device notifications, see section 506J of the FD&C Act. 
55 See footnote 53. 
56 See the guidance for industry Notifying FDA of a Permanent Discontinuance or Interruption in Manufacturing 
Under Section 506C of the FD&C Act (March 2020); see also 80 FR 38915 at 38922 (July 8, 2015). 
  13  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
373  communicate and quickly share information with the Agency to prevent or mitigate a shortage.  
374  Additionally, an established RMP can serve to support stakeholders during these times when 
375  their resources are typically strained with numerous internal and external requests.   
376   
377  RMPs that are developed, maintained, and implemented by stakeholders pursuant to the 
378  requirement in section 506C(j) of the FD&C Act are subject to inspection and copying pursuant 
379  to an FDA inspection or a request under section 704(a)(4) of the FD&C Act (21 U.S.C. 374).57  
380  RMPs, or elements of an RMP, need not be submitted as part of a biologics license application, 
381  new drug application, abbreviated new drug application, or drug master file.  
382   
383  6.  Risk Management Tools 
384   
385  There are a variety of off-the-shelf and customizable risk management tools that may be helpful 
386  when developing and maintaining an RMP.  The Agency believes the recommendations in this 
387  guidance can be applied regardless of the format or tool used. 
388   
 
57 See section 506C(j) of the FD&C Act. 
  14  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
389  APPENDIX: 
390  RISK CONSIDERATIONS FOR SPECIFIC RMPS 
391   
392  The following risk factors should be considered when developing specific risk management 
393  plans (RMPs) to mitigate the potential for drug shortages. 
394   
395  All RMPs  Each drug has product-specific characteristics (e.g., dosage form, active 
396  pharmaceutical ingredient source, manufacturing and test methods) that may be used to help 
397  determine instances when the products supply may fluctuate.  At a high level, the following list 
398  identifies some risk factors that may be considered together with a drugs product-specific 
399  characteristics to help manufacturers uncover weaknesses that may impact product supply: 
400   
401    Determine which drugs, including components, manufactured at the facility are 
402  vulnerable to a supply disruption 
403   
404    Identify weaknesses in manufacturing process specific to individual drugs1 
405   
406    Determine whether any of the suppliers of drug product container-closure systems or 
407  device constituent parts, which include components of device constituent parts, are a sole 
408  source provider 
409    
410    Identify weaknesses in inventory management at the manufacturing facility, including 
411  understanding market forecast for a drug, to ensure that supply is able to meet anticipated 
412  demand 
413   
414    Ascertain whether the drug manufacturing relies on incapable or unreliable equipment, 
415  such as older equipment or equipment that breaks down frequently where maintenance is 
416  difficult or parts are not easily replaced or available (incapable equipment may also 
417  include equipment that relies on software or other technologies that are not able to be 
418  updated (i.e., patched), which increases such equipments susceptibility to cybersecurity 
419  threats) 
420   
421    Identify the normal capacity and surge capacity of the manufacturing facility to 
422  manufacture a drug or its components that are vulnerable to shortage 
423   
424    Evaluate the drugs stability data, including finished product and components, to 
425  determine whether the data demonstrate safety and efficacy beyond the labeled expiry 
426  date or retest date and, if needed, reassess the drugs stability program  
427   
428    Be aware of and implement changes and alterations to requirements for relevant articles 
429  in the United States Pharmacopeia or National Formulary 
430   
 
1 A Quality Metrics Program, as referenced in footnote 48 of the guidance, is intended to measure different key 
performance indicators to assist in identifying which manufacturing processes are weaker than others, in order to 
identify improvement projects and certain products that could be targeted for improvement.   
  15  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
431  Primary Stakeholders RMP  The following list provides risk factors for a primary 
432  stakeholder to consider when developing an RMP to ensure that it provides an overarching 
433  strategy to consistently identify, assess, and mitigate risk across multiple manufacturing facilities 
434  and drugs from an oversight perspective.  This RMP often can include product-specific concerns, 
435  which in turn should result in further extrapolation at the facility level.  The risk factors (not an 
436  exhaustive list) for a primary stakeholder to consider when developing an RMP include:   
437   
438    Geographic risk factors, including potential for natural disasters, as well as political 
439  instability and regulatory uncertainty, that can affect the overall ability to consistently 
440  manufacture a drug. 
441   
442    Supply chain vulnerabilities, such as sole source manufacturers of critical components in 
443  a drug product, including active pharmaceutical ingredient, and sole source 
444  manufacturers of a drug product. 
445   
446    Manufacturing vulnerabilities, including lack of manufacturing capacity to meet an 
447  unexpected surge in demand, inadequate backup manufacturing capability, lack of 
448  availability of contract manufacturers or other alternate sources, lack of availability of 
449  laboratory services to support manufacturing, and inadequacy of management oversight.  
450   
451    Distribution vulnerabilities, including the complexity of distribution or transportation of 
452  components, drug product containers and closures, and drug products. 
453   
454    Whether the equipment or systems used in manufacturing or distribution could be 
455  susceptible to cybersecurity threats  
456   
457    Emergency situations that reduce staff or facility availability to continue manufacturing. 
458   
459    Whether the drug is life-supporting, life-sustaining, intended for use in the prevention or 
460  treatment of a debilitating disease or condition, including any such drug used in 
461  emergency medical care or during surgery or any such drug that is critical to the public 
462  health during a public health emergency declared by the Secretary under section 319 of 
463  the Public Health Service Act, intended to treat rare diseases or conditions, a drug that 
464  lacks appropriate alternatives, used as a medical countermeasure in the event of potential 
465  public health emergency, or critical in response to specific targeted threat agents 
466  (essential to national security). 
467   
468    The capability and historical record of the facilities in the supply chain, including 
469  whether there is a history of sustained current good manufacturing practice (CGMP) 
470  compliance.  This should include inspectional findings at the headquarters unit that 
471  provides global quality oversight and all facilities in the supply chain that might affect the 
472  availability of the drug, and details relating to the presence or recurrence of quality 
473  issues, CGMP violations, recalls, and lapses in quality management oversight. 
474   
  16  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
475    Compliance with applicable regulatory reporting requirements, including:  notifications 
476  under section 506C or section 506I of the Federal Food, Drug, and Cosmetic Act (FD&C 
477  Act),2 postmarketing safety reports,3 and field alert reports.4  
478   
479    Communication vulnerabilities with secondary and other stakeholders within the supply 
480  chain that might hinder timely distribution or receipt of quality-related information (e.g., 
481  agreements with contract manufacturers that prohibit disclosure of information at other 
482  contract facilities). 
483   
484  RMPs for Secondary Stakeholders and Other Stakeholders  When a stakeholder that is not 
485  the primary stakeholder (i.e., a secondary or other stakeholder) develops its RMP, it typically 
486  should interpret the broader risks identified in the primary stakeholders RMP within the context 
487  of a specific manufacturing facility, and address unique risks at a manufacturing facility that are 
488  unlikely to be identified by the primary stakeholder.  Furthermore, many of the risks might have 
489  specific implications to the drugs manufactured at a facility (e.g., environmental controls might 
490  affect a sterile, parenteral drug more than a solid, oral dosage drug).  The RMP for stakeholders 
491  that are not the primary stakeholder should consider the effect of identified risks on the 
492  manufacturing facility as well as on the drugs manufactured at that facility.  The following non-
493  exhaustive list provides risk factors for such stakeholders to consider as part of developing an 
494  RMP.  Some of these risk factors may also be useful to the primary stakeholder, depending on 
495  the responsibilities of the primary stakeholder. 
496   
497    Identify vulnerabilities in the supply chain for each drug product vulnerable to supply 
498  disruptions.  Consider limitations in supply for raw materials, intermediates, components, 
499  and drug product containers and closures. 
500   
501    Ensure that appropriate communication with contract manufacturing facilities and 
502  component suppliers is established to proactively address risks that might lead to 
503  meaningful drug supply disruptions.5 
504   
505    Identify weaknesses in the infrastructure and utilities; water systems; heating, ventilation, 
506  air conditioning, and environmental control; and the proximity of support services such 
507  as laboratory testing.   
508   
 
2 See section 506C(a) of the FD&C Act.  
3 See generally the requirements contained in 21 CFR 310.305 (marketed prescription drug products without 
approved new drug applications (NDAs) or abbreviated new drug applications (ANDAs)), 21 CFR 314.80 (drug 
products with approved NDAs), 21 CFR 314.98 (drug products with approved ANDAs), 21 CFR 600.80 (biological 
products with approved biologics license applications), section 760 of the FD&C Act (marketed nonprescription 
drug products without approved NDAs or ANDAs), and 21 CFR part 4, subpart B (combination products and 
constituent parts). 
4 See 21 CFR 314.81 (drug products with approved NDAs and ANDAs) and 21 CFR part 4, subpart B (combination 
products and constituent parts). 
5 See the guidance for industry Contract Manufacturing Arrangements for Drugs:  Quality Agreements (November 
2016).  We update guidances periodically.  For the most recent version of a guidance, check the FDA guidance web 
page at https://www.fda.gov/regulatory-information/search-fda-guidance-documents. 
  17  Contains Nonbinding Recommendations 
Draft  Not for Implementation 
509    Ascertain whether the manufacturing facility has incapable or unreliable equipment, such 
510  as equipment that is unsuitable for its intended use, legacy equipment that breaks down 
511  frequently, or equipment with parts that are not easily replaced or available.  
512   
513    Identify challenges and weaknesses in monitoring vulnerable equipment. 
514   
515    Identify equipment that operates with limited down time, which could be prone to 
516  accelerated wear and tear. 
517   
518    Identify the normal capacity and surge capacity of the facility to manufacture a drug that 
519  is vulnerable to shortage. 
520   
521    Ascertain whether the equipment or systems used in manufacturing or distribution could 
522  be susceptible to cybersecurity threats. 
523   
524    Assess the suitability and competence of potential contractors before outsourcing 
525  operations or selecting material suppliers.   
526   
527    Assess the reliability of potential contractors to deliver operations or materials on time 
528  and of good quality to meet manufacturer deadlines and to avoid interruptions in 
529  processing. 
530   
531    Assess the record of CGMP performance, including the presence or recurrence of quality 
532  issues, CGMP violations, potential for major defects and recalls, inspectional findings at 
533  the facilities in the supply chain, and adequacy of quality management oversight, that 
534  might affect the availability of the drug. 
535   
  18