“People assume that if you have a contract with a CMO, you have a supply chain. You don’t. What you have is a legal agreement — and that’s a very different thing.”
Maria Kounenaki, now Supply Chain Director at Johnson & Johnson Innovative Medicine, spent nearly a decade at Bristol-Myers Squibb overseeing a portfolio exceeding $28 billion in annual revenue, built on a manufacturing network that was almost entirely externalized. She led the integration of BMS’s supply chains following the Celgene acquisition and governed relationships with dozens of CMOs across different capabilities, risk profiles, and maturity levels.
In a recent PharmaSource podcast episode, Maria explains the danger of assuming a signed contract transfers risk, when it only transfers execution in a sponsor-CDMO relationship.
Visibility degrades the moment you cross an organizational boundary; tier two and three suppliers are often a black box, and trust with a manufacturing partner can’t be built in the middle of a crisis, only drawn on. Here’s what she’s learned from her time running one of pharma’s most externalized supply networks, and advising executives across the industry as a consultant.
Externalization Is a Choice, Not a Strategy
A network strategy defines where a company wants to go; externalization is simply one of the choices available to get there. Treating it as the strategy itself, she argues, is where companies can go wrong.
“Externalization is not a strategy. It’s a choice,” Maria says. “And like any choice, it’s only as good as the thinking behind it.”
Flexible capacity, specialized capabilities, and lower capital requirements are the key benefits that come with using CDMO partners, but Maria warns that many organizations externalize without understanding what comes with it:
“What concerns me is that many organizations are taking the decision to externalize without understanding what comes with it. Because they think that they outsource the risk, but you don’t. You outsource the execution, but you must govern the execution, which is a little bit more complicated. The companies doing that well understand that. They invest in integration, infrastructure, governance models, and the capability to manage the partners. The ones struggling are handing it over and stepping back. You cannot do that. You have to be even closer. It’s a change from operating to orchestrating, and orchestrating done well is just as demanding.”
CDMO Integration Deeper Than the Contract
A common mistake Maries sees, is that companies stop at the paperwork. The best ones go much further.
“Most companies integrate at the contract level only. The best ones integrate at the nervous system level, and there is such a big difference,” she says.
She breaks true integration into three simultaneous dimensions.
- Data
- Process
- relationship.
“The data integration means you are not emailing spreadsheets; you have shared planning systems, real-time inventory visibility, joint forecast cycles. The process integration means the CMO is not just receiving your orders, but they are part of your S&OP. They see your demand signals early, and they participate in scenario planning that raises capacity concerns before they become a crisis. The relationship integration means there are executive-level connections on both sides. You don’t just have the account managers and procurement contact, you have partnerships from both parties.”
Why is this so hard to achieve? Maria points to three structural obstacles:
- CDMOs juggling dozens of clients competing for attention
- Companies that under-resource their CMO management function once a contract is signed
- A persistent (and outdated) belief that transparency is a commercial risk
“I show you my supply plan, I’m giving away my leverage,” she says, describing that mindset. “This thinking is so old.”
Multi-Tier Visibility Is No Longer Optional
Single-source dependencies rarely sit with the CMO a company contracts directly. They hide further upstream, and Maria says most pharma companies simply can’t see that far.
“Tier one is your direct partner, the CMO, who manufactures your product. Tier two is who they buy from — API suppliers, excipient manufacturers, packaging material suppliers. Tier three is who those companies buy from — raw material producers, specialty chemical companies — and usually these are concentrated in specific geographies,” she explains.
“Most pharma companies have reasonable visibility into tier one. They audit them, visit them, and have relationships. But when we go to tier two and three, it’s often a black box. And the problem is that’s where many of the most dangerous single-source dependencies sit — specific raw materials, specific chemistries, suppliers with no competitors who happen to be located in geopolitically sensitive regions. That dynamic we saw during COVID. Companies found out in real time that they had critical materials, two or three tiers deep, sourced from a single supplier in a single country with no alternative. You cannot fix that in a crisis.”
Five years ago, Maria says, deep tier visibility felt aspirational. Not anymore: “Today I see it as a non-negotiable, and the companies that are asking for it, I think they’re getting it.” The key, she says, is how you ask. “What I have found works is making it a partnership conversation, not a compliance one. You go to your CMO and say, ‘I want to help you map and strengthen your supply base.’ When you frame it as joint risk management rather than an audit, you get a very different response.”
Network Strategy Is a Living Capability
A network strategy built three years ago can be out of date today, Maria says, because the world doesn’t pause once the planning deck is finished.
“The network strategy that was right three years ago can be very wrong today. The world doesn’t stop changing just because we finished the slide deck. You build a strategy based on a certain demand profile, a certain regulatory landscape, a certain geopolitical map, and then demand shifts, new products launch, a trade corridor closes, or a CMO gets acquired. And your strategy is optimized for a world that no longer exists.”
At BMS, that meant continuously stress-testing network decisions against a shifting portfolio, evolving product lifecycles, and inherited footprints from acquisitions. Her prescription is to treat network design as ongoing work rather than a finished deliverable:
“Treat the network strategy as a living capability, not a project. You don’t do it once and file it. You maintain it, scenario test it, and update it as your business changes. That requires investment in people and tools, but the cost of not doing it is much, much higher.”
In practice, Maria points to four levers:
- Dual-sourcing where the risk justifies the cost
- Building optionality into contracts through flexibility clauses and change-of-scope provisions
- Staging technology transfers so a fallback site is proven before the old one is closed
- Rigorous scenario planning
“What happens if the CMO has a fire? What happens if that API supply goes offline?” she asks. “The companies that respond well to disruptions are not the ones who are faster or smarter in the moment. They are the ones who already thought through that scenario and have a playbook.”
A CDMO Crisis Is a Leadership Problem, Not a Procurement Problem
When something goes wrong with a manufacturing partner, Maria says the instinct to route the response through procurement and quality functions is understandable, but incomplete.
“The biggest mistake I see is that companies default to transactional crisis management when the situation actually requires senior leadership engagement,” she says.
She points to a cyberattack she managed as the clearest example of why relationships built in advance matter more than any contract clause:
“The reason we got through it with minimal disruption was that I was able to pick up the phone and call the CMO directly; not because of the crisis, but because of the relationship that existed before it. We had built it over time, and when the incident happened, I was in their crisis room within 24 hours, directing the response jointly. That’s a fundamentally different dynamic than managing the situation through a contractual lens, from a distance.”
Her advice? Build the relationship before the emergency. “Invest in executive-level CMO relationships when things are going well. That’s the only time you can build them. You cannot create trust during a crisis. You can only draw on it.”
Maria Kounenaki is now Supply Chain Director at Johnson & Johnson Innovative Medicine. At the time of this interview, she was advising pharma and med tech leaders as an independent consultant, drawing on her nearly decade-long tenure as Executive Director of Global Supply Planning at Bristol-Myers Squibb, where she oversaw a portfolio exceeding $28 billion in annual revenue.
