Even though pharmaceutical quality teams are working harder than ever, they are still operating with incomplete information. Audits live in one system and FDA inspection outcomes in another,  meanwhile recall history, adverse event data, and delivery performance each occupy their own silo. The result is a quality function that spends the majority of its time assembling a picture rather than acting on one.

Our newest case study examines what happens when organizations are finally able to move beyond that fragmentation, and what we found will be instructive for any quality or supply chain leader managing a multi-site CMO or API portfolio.

A Score Without Context Is Not Intelligence

One of the more striking findings from the research was that a site with a composite risk score of 89.3 carried only 45% data completeness. In practical terms, that high score reflected a partial view of that site's risk profile, but not a clean one. Meanwhile, the portfolio's lowest-scoring site, at 59.8, had 92% data completeness, making its score far more reliable and actionable.

This is a distinction that changes how resources should be prioritized. A high score with low completeness is not reassuring; it actually represents a gap in visibility. Quality teams need to account not just for what is measured, but for what might be missing.

Internal and External Signals Reveal Different Risks

When internal audit findings were cross-referenced against FDA inspection outcomes at the same facilities, it became clear that the two data sources did not overlap perfectly. Critical aseptic manufacturing findings that came up in internal audits were invisible in external regulatory data, and Class I recalls visible in external data were absent from internal quality records entirely.

What this proves is that neither source is sufficient on its own. Integrating both across five risk dimensions produces a significantly more holistic picture of site risk than either is capable of delivering indidivudally. This saves teams time, errors, and headache!

Leading Indicators Are More Valuable Than Lagging Scores

Composite scores tell you where a site stands today, but they aren’t able to give insight into where risk is heading. The research identifies several forward-looking signals that most often precede formal enforcement action, such as repeat 483 observations across consecutive inspections, audit findings in areas FDA is currently prioritizing, inspection gaps of three or more years, and sites inspected within 12 months of a Class I recall.

These signals do not wait for a warning letter to become visible. Organizations that integrate them into their oversight workflow have time to act before a disruption reaches patients or supply commitments.

Data Gaps Are a Risk Category, Not a Technical Problem

Across the 20-site portfolio examined in the study, Manufacturing and OTIF data was available for less than half of all sites. Postmarket data was available for only half, and several sites had no quality events on record at all.

The absence of data is not a neutral finding, as one could mistakenly assume. Lack of information doesn’t mean the risk is zero, it means the risk is unknown. Treating data completeness as a first-class risk signal, alongside inspection outcomes and audit findings, is one of the more significant operational shifts the research recommends teams adopt.

Connecting the Signals

The organizations that manage supplier risk most effectively are not necessarily those with the most data, but the ones who have connected the right data, across quality events, regulatory intelligence, postmarket signals, and supply performance, into a coherent view that allows for proactive decisions (instead of reactive responses).

Download the full case study, From Fragmented Data to Predictive Quality: Integrating Internal and External Signals to Predict Supply Chain Risk, for a closer look at how predictive risk intelligence works in the real world, and what it could surface across your own portfolio.