The contract was signed, the price agreed, the liability capped. Six months in, a quality drift appeared at the contract manufacturer — and the buying team discovered they had no routine right to walk the line, no say in the process change that caused it, and no visibility into which sub-supplier made the failing part. The paper said partner. The governance said customer of record.
The contract is not the governance
A CM agreement covers commercial terms. It does not answer the question that decides outcomes day to day: how much control does the buyer keep over the process, the quality system, and the supply below the CM? That answer is the governance model — and it is a choice, not a default.
Three models show up in practice.
Model 1 — Arms-length
The buyer specifies the output and walks away. The CM owns process, sub-suppliers, and most decisions. This is cheapest and fastest to stand up, and it works when the product is standard, the CM is mature, and the spec is stable. It fails the moment something changes — a design tweak, a quality event, a capacity squeeze — because the buyer has no lever inside the process.
Model 2 — Managed
The buyer sets key process parameters, audits the line, and approves sub-suppliers, but the CM runs daily operations. This is the common middle ground for differentiated products. It costs more in oversight but keeps the buyer able to steer when needed. The risk is oversight theater: audits that check boxes but never reach the sub-tier where the real risk lives.
Model 3 — Embedded
The buyer places people, systems, or shared control inside the CM's operation — common for strategic, high-complexity, or IP-sensitive work. Most control, highest cost, and real dependence risk if the CM becomes a single point of failure. Reserve this for where the capability is genuinely core.
The model is not "more control is better." It is "match the control to what the product actually requires."
Picking the model
Three questions decide:
- How differentiated and changing is the product? Stable and standard → arms-length. Evolving and specific → managed or embedded.
- How much IP or process knowledge must stay with the buyer? High → managed or embedded.
- How mature and trusted is the CM? Weak → more oversight. Strong → you can relax.
A team that runs everything as "managed" burns oversight cost on stable categories. A team that runs everything "arms-length" loses control exactly where it matters. The governance model should vary by category, not by habit.
The sub-tier blind spot
Whatever the model, the most common gap is visibility below the CM. The CM is one entity; its supply base is many, and the failing part usually comes from one of them. Managed and embedded models earn their cost only when the buyer can see — and influence — that sub-tier. An arms-length model should at least map it.
The line to remember
A contract manufacturing deal buys capacity. The governance model decides whether you can actually use it. Choose the model by the product's needs, and never let the paper substitute for the lever.