What CMC and Regulatory Due Diligence Actually Uncovers Before a Deal Closes
Most pharma deals are built on a data room, a management presentation, and a few weeks of technical review squeezed into an already tight transaction timeline.
The commercial and legal teams tend to get the scrutiny they expect. CMC and regulatory affairs often get less, partly because the questions are more technical, and partly because a well-organised data room can look complete without actually being sound. That gap is where deal value gets lost, either at signing, when a discovered issue reprices the transaction, or after close, when the buyer inherits a problem nobody flagged.
This article sets out what a genuine CMC and regulatory due diligence review actually checks, and the issues that most often surface once someone starts asking the second and third question, not just the first.
What CMC and regulatory due diligence is actually checking
A CMC and regulatory review is not a document count. Counting how many SOPs exist, how many filings have been made, or how many stability studies are in progress tells you almost nothing about whether the underlying programme is sound.
A real review tests whether the manufacturing process is genuinely validated at the scale it needs to run at, not just at the scale it was originally developed. It checks whether the analytical methods behind every release specification are validated and fit for purpose, not just present in a file. It traces the regulatory filing history across every market the product is registered in, checking that what was actually approved matches what is actually being manufactured and sold today, because drift between the two is one of the most common and most expensive findings in any review.
It also looks at what has not been said. Open commitments to regulators that were made and never closed. Deviations that were resolved operationally but never fully reflected in the regulatory file. Supply chain dependencies on a single site or supplier that the data room summary glosses over in a sentence.
What a CMC and RA due diligence review should cover
• Process validation status at commercial scale, not just development or pilot scale
• Analytical method validation and fitness for purpose behind every release specification
• Consistency between what is approved, what is manufactured, and what is actually filed in each market
• Open regulatory commitments and their current status, not just their existence
• Single points of failure in the supply chain, sole-source materials, single manufacturing sites, dependent CMOs
Where deals actually go wrong
The issues that derail deals or force a price renegotiation are rarely dramatic. They are usually a steady accumulation of small inconsistencies that, taken together, indicate the CMC and regulatory function has been managed reactively rather than deliberately.
A process change implemented at the manufacturing site that was never filed as a variation in every market where the product is registered. A stability programme with gaps in coverage for a market the commercial plan depends on. A key raw material or intermediate sourced from a single supplier with no qualified backup, discovered only when someone asks the direct question rather than reading the summary slide.
None of these individually kills a deal. Collectively, and combined with how they are handled when raised, they tell a buyer a great deal about how the target manages regulatory risk day to day, and that assessment shapes both price and deal structure.
TDP delivers rapid, structured CMC and regulatory due diligence, testing the substance behind the data room, not just its completeness.
Why this matters more for advanced therapies
The stakes are higher again for cell and gene therapies, biologics, and other advanced modalities. These products often carry manufacturing processes that are still evolving even after approval, analytical methods that are inherently more complex to validate, and supply chains built around highly specialised, sometimes single-source, materials and facilities.
A generic small-molecule asset with a mature, well-documented process and a diversified supply chain can tolerate a lighter-touch review. An advanced therapy asset, where the manufacturing process is part of the value being acquired and where a single facility or supplier disruption can halt supply entirely, needs a reviewer who understands what normal looks like for that modality, not a generalist working from a standard checklist.
Buyers who apply the same review depth to both product types either waste time over-scrutinising a straightforward asset, or, more dangerously, under-scrutinise a complex one because the checklist did not flag anything unusual.
Common red flags a proper review surfaces
1. Unfiled process or site changes. Manufacturing evolves faster than regulatory filings keep pace in many organisations. A change validated internally but never submitted as a variation in every relevant market is one of the most frequent and most costly findings.
2. Stability data gaps against the commercial plan. A stability programme built for the original launch market may not support the shelf life or storage claims needed for markets added later. This surfaces late, and is expensive to close quickly.
3. Single points of failure in sourcing. A sole-source raw material, intermediate, or CMO with no qualified alternative is a risk that rarely appears in a summary deck, but materially affects supply continuity and therefore deal value.
4. Open commitments to regulators. Post-approval commitments, CAPA items tied to inspection findings, or agreed follow-up studies that are still open represent both cost and risk that needs to be priced into the transaction, not discovered after close.
5. Inconsistent global registration status. A product registered and manufactured differently across markets, without a clear rationale or documented bridging strategy, raises questions about how rigorously the regulatory function has managed the portfolio as it scaled internationally.
What a rapid, structured review actually delivers
Deal timelines rarely allow for a slow, exhaustive review. The value of a CMC and regulatory due diligence exercise depends on getting a technically credible answer to the questions that actually matter within the window the transaction allows, not producing an exhaustive report that arrives after the decision has already been made.
That means focusing the review on the areas most likely to carry material risk for the specific deal in question, rather than working through a generic checklist with equal weight given to every item. A rare disease asset with a single manufacturing site warrants a different emphasis than a portfolio of established generics with a mature, diversified supply chain.
The output needs to be usable directly by the deal team: a clear, prioritised view of what was found, what it means for value and risk, and what would need to be resolved before or after close, not a document that restates the data room back at greater length.
Speed and rigour are not in tension here if the review is scoped correctly from the outset. A focused review that goes deep on the two or three areas most likely to carry material risk delivers more usable insight, faster, than a broad review that spreads the same amount of effort evenly across a checklist regardless of where the actual risk sits.
Questions worth asking before you sign
• Has every manufacturing or site change actually been filed as a variation in every market where the product is registered?
• Does the stability data support the shelf life and storage claims needed for the markets in the commercial plan?
• Are there single points of failure in sourcing or manufacturing that the data room summary has not surfaced?
• What regulatory commitments remain open, and what is their realistic path and cost to close?
• Has anyone independently traced consistency between what is approved, what is filed, and what is actually being made?
Know what you are buying before you buy it
A complete-looking data room is not the same as a sound CMC and regulatory position. The difference only becomes visible when someone asks the second and third question, traces the detail behind the summary, and is willing to flag what does not hold up.
The deals that go wrong after close are rarely the ones where diligence found a problem. They are the ones where diligence never really looked hard enough to find it.
Whichever side of the transaction you are on, the same principle holds. A seller who commissions a genuine CMC and regulatory review before going to market can identify and address issues on their own timeline, rather than having them surfaced by a buyer's team under deal pressure, where the same finding costs more in price and trust than it would have cost to fix in advance.
TDP's CMC and regulatory due diligence is built for deal timelines, prioritised around the risks that actually affect value, and delivered in a form your deal team can use directly.
Speak to us before your next CMC or regulatory review