US FDA Data integrity findings

Failure of your quality unit to exercise its responsibility to ensure the API and intermediates manufactured at your facility are in compliance with CGMP. Your Quality Unit failed to ensure adequate control over paper and electronic records. On January 29, 2026, our FDA investigator observed original laboratory records inside the shred bins maintained in your laboratory. For example, we found an original pH meter printout slip, indicating a pH reading of (b)(4) ; an original analytical balance printout slip, with a value of (b)(4) grams; and reviewer-signed Analytical Data Review Checklists. Your response states that there was negligible impact from these discrepancies; however, your response lacks evidence to support the conclusion of negligible impact for discarding these records. Your firm could not identify who generated the pH meter printout on December 19, 2025, and why they were discarded. Your analyst discarded a balance printout weight slip dated January 25, 2026, but did not document why this balance printout slip was discarded. Furthermore, you were unable to make batch associations with the discarded original sourced documents (for example, specific batch testing). Without attribution of the discarded records to defined test analyses, the conclusion of negligible impact lacks an adequate evidentiary basis. Although procedure SOP-RLS-000346 was updated to require the use of instrument logbooks, your quality unit failed to investigate why the generated records were discarded in the shred bins, indicating a lack of adequate oversight. The full scope of this traceability gap is not adequately included in your response. Additionally, our investigators found in the shred bin an excessive number of photocopies of your laboratory notebook pages, with CGMP activities documented. Your laboratory personnel reviewed photocopies of the original data rather than the original records, and subsequently they signed off on the original analyst notebooks without verifying any changes to the underlying data. Your response acknowledges that the photocopy review practice was a direct violation of your procedure SOP-RLS-000456, requiring that all electronic primary data be reviewed and verified against the analyst's notebook. In addition, your procedure RLS-SOP-PW-0047 GMP, “Document Storage, Control, and Retention,” requires that paper records pertaining to batch analysis be maintained. Your quality unit failed to ensure that all production control records were retained in accordance with this established procedure and failed to implement adequate controls to ensure the integrity of data generated at your facility. We acknowledge you removed (b)(4) shred bins from the locations in building (b)(4) and transferred them under the QU control. However, your response is inadequate. Your review of shred bin data appears not to include an analysis of the contents of all the shred bins identified during the inspection. Your protocol “Review of Shred Bin Contents” identified a bin that was not included in your summary report and did not provide an explanation for this omission. Your firm had indicated that the (b)(4) bins are collected (b)(4) by a third-party service provider for off-site destruction. You are unable to determine the scope of prior discarded material from the previous document destructions. Your quality system does not adequately ensure the accuracy and integrity of data to support the safety, effectiveness, and quality of the drug substances you manufacture. See FDA's guidance document Data Integrity and Compliance with Drug CGMP at https://www.fda.gov/media/119267/download. In response to this letter, provide the following: A determination of how long the shred bin disposal of GMP documents has been occurring at your facility. A retrospective assessment of the scope and potential effect of the absence of instrument-use logbooks for all QC laboratory equipment over the applicable record-retention period, including an evaluation of whether any GMP testing results may be unattributable or unverifiable as a result. A retrospective assessment of the potential scope of records that may have been improperly destroyed before the inspection, given that shred bins were collected (b)(4) with no QA review. A broader data-integrity assessment, including a retrospective review of your QC laboratory operations to determine the extent to which uncontrolled documentation practices may have affected the integrity of GMP records. The complete final investigation report(s) regarding documents found in all shred bins. Include classification of documents, associated effect on product and manufacturing processes, and any deviation generated from the final assessment. A detailed, comprehensive data-integrity investigation protocol describing how your third-party consultants will evaluate electronic data. A comprehensive investigation into the extent of the inaccuracies and inconsistencies in data, records, and reporting. Your investigation should include: o A detailed investigation protocol and methodology; a summary of all laboratories, manufacturing operations, and systems to be covered by the assessment; and a justification for any part of your operation that you propose to exclude. o Interviews of current and former employees to identify the nature, scope, and root cause of data inaccuracies. We recommend that these interviews be conducted by a qualified third party. o An assessment of the extent of data-integrity deficiencies at your facility. Identify omissions, alterations, deletions, record destruction, non-contemporaneous record completion, and other deficiencies. Describe all parts of your facility’s operations in which you discovered data-integrity deficiencies. o A comprehensive, retrospective evaluation of the nature of testing data-integrity deficiencies.…

Your firm failed to ensure that laboratory records included complete data derived from all tests necessary to ensure compliance with established specifications and standards (21 CFR 211.194(a)). Inaccurate Microbiology Laboratory Records You failed to accurately document microbiology testing results. Specifically, multiple environmental monitoring and (b)(4) samples were documented in logbooks as collected and incubated; however, the corresponding plates could not be located in incubators during the inspection. Colony forming unit (cfus) counts had been recorded as if incubation was actively in progress. In interviews conducted by your management, your analysts confirmed these samples were not collected. In addition, your Laboratory Information Management System (LIMS) did not include a dilution factor to calculate the number of cfus per gram or milliliter of product for microbial limit test results, as required by your own procedures and applicable compendial methods. By releasing drug products based solely on raw plate count averages entered into your LIMS without applying the required dilution factor, you lack scientific evidence that each batch conforms to predetermined specifications prior to distribution. Appropriate testing is an essential part of ensuring that the drug products you manufacture conform to CGMP. Collectively, these deficiencies indicate a significant risk of systematic underreporting of microbial findings, which directly undermines your firm's ability to ensure the safety and quality of drug products distributed to patients. Reliability of data is fundamentally compromised when there is a failure to record data or to maintain complete and accurate records of test results. Furthermore, the lack of reliable data compromises the ability of your quality unit (QU) to exercise its function of ensuring compliance to applicable standards and deprives you of the ability to adequately investigate deviations. Inadequate Electronic Records Controls Your firm did not have adequate controls to prevent the deletion or overwriting of (b)(4) integrity testing electronic data. Specifically, reports were not saved with unique file names, resulting in data being overwritten after every (b)(4) tests. In addition, (b)(4) integrity testing was not performed for Plant (b)(4) . Therefore, your firm has no means of tracking or retrieving records of failed leak tests. The lack of adequate electronic records controls undermines the reliability and integrity of your laboratory data. (b)(4) integrity is critical to preventing product contamination. Routine (b)(4) integrity tests should be performed. The monitoring and maintenance program should identify and eliminate any (b)(4) lacking integrity and minimize the possibility of placing a sterile product at risk. All data must be complete, accurate and retained to enable appropriate assessment and decisions by the QU. The lack of control over the integrity of your data raises questions about the authenticity and reliability of your analytical data and the quality of your drug products. Your response states “the unaccounted samples may have been misplaced”. This explanation is contradictory as it does not address the fact that your own analysts confirmed during management interviews that the microbiological samples were never collected, nor does it address the broader pattern of inaccurate recordkeeping identified during the inspection. Your response indicates your commitment to hiring third parties to conduct a data integrity remediation plan, risk assessment, and product impact assessment. Your response is inadequate. You do not provide sufficient detail including specific timelines and deliverables on your data integrity remediation plan, risk assessment and product assessment. Furthermore, your response does not define the scope of third-party oversight responsibilities or establish accountability measures for the remediation effort. Additionally, you acknowledge deficiencies in your “ (b)(4) integrity testing controls” and conducted a retrospective review. Your response is inadequate because although you conclude there is, “no evidence of product contamination attributable to (b)(4) failure”, the thoroughness of this review cannot fully support a definitive risk-based conclusion since you acknowledge that “historical traceability was incomplete”. We acknowledge your firm’s long-term commitment to improving your manufacturing operation, including, but not limited to, hiring additional microbiological laboratory staff and building a larger microbiological laboratory. Your quality system does not adequately ensure the accuracy and integrity of data to support the safety, effectiveness, and quality of the drugs you manufacture. See FDA’s guidance document Data Integrity and Compliance With Drug CGMP: Questions and Answers for guidance on establishing and following CGMP compliant data integrity practices at https://www.fda.gov/media/119267/download. We acknowledge that you are using independent third-party consultants to audit your operation and assist in meeting FDA requirements. In response to this letter, provide: A comprehensive investigation into the extent of the inaccuracies in data records and reporting. Your investigation should include: o A detailed investigation protocol and methodology; a summary of all laboratories, manufacturing operations, and systems to be covered by the assessment; and a justification for any part of your operation that you propose to exclude. o Interviews of current and former employees to identify the nature, scope, and root cause of data inaccuracies. We recommend that these interviews be conducted by a qualified third party. o An assessment of the extent of data integrity deficiencies at your facility. Identify omissions, alterations, deletions, record destruction, non-contemporaneous record completion, and other deficiencies.…

Your firm failed to ensure that laboratory records included complete data derived from all tests necessary to ensure compliance with established specifications and standards (21 CFR 211.194(a)). Your firm is a contract testing laboratory that conducts testing of various application and nonapplication drug products for the US market. Your laboratory records lacked complete and original data demonstrating that you performed the required testing. You did not accurately complete laboratory records contemporaneously at the time you performed the laboratory activities. Our investigator observed (b)(4) microbial test samples that lacked complete documentation on raw data test sheets (e.g., the test sheets had blank spaces where entries should have been recorded). While your summary reports included final plate counts, your raw data test sheets for some of the samples covered in these reports lacked complete documentation of plate counts. In your response, you stated these samples were not from drug products intended for the U.S. market. However, your firm maintains one quality system and has one set of procedures for testing U.S. and non-U.S. drug products. Thus, the quality unit (QU) failure is applicable to all drug products you test. Additionally in your response, you identify the documentation deficiencies to be “consistent with an institutional procedural and cultural gap rather than individual misconduct or a coordinated effort to conceal or falsify results.” This indicates that these violative practices are used for all drugs you test, including those for the U.S. market. We acknowledge that your response indicated you will increase the QU presence during testing until procedural improvements, training effectiveness verification, and compliance monitoring demonstrate sustained adherence. Your response is inadequate because it does not include an assessment of your paper-based documentation system to identify and correct vulnerabilities in your current controls. Additionally, you did not provide evidence that you performed a retrospective review to identify any additional instances of incomplete or non-contemporaneous documentation. Microbial testing, an essential quality control step, is integral in preventing distribution of unsafe products. Integrity of data is fundamentally compromised when there is a failure to record or maintain complete and accurate records of test results or conditions associated with drug testing. Furthermore, the lack of reliable data compromises the QU’s ability to exercise its function of ensuring compliance with applicable standards. Your quality system does not adequately ensure the accuracy and integrity of data to support the safety, effectiveness, and quality of the drugs you manufacture. See FDA’s guidance document Data Integrity and Compliance With Drug CGMP for guidance on establishing and following CGMP compliant data integrity practices at https://www.fda.gov/media/119267/download. In response to this letter, provide: A comprehensive, independent assessment of your laboratory practices, procedures, methods, equipment, documentation, and analyst competencies. Based on this review, provide a detailed plan to remediate and evaluate the effectiveness of your laboratory system. A comprehensive assessment of documentation systems used throughout your laboratory operations to determine where documentation practices are insufficient. Include a detailed corrective action and preventive action (CAPA) plan that comprehensively remediates your firm’s documentation practices to ensure you retain attributable, legible, complete, original, accurate, contemporaneous (ALCOA) records throughout your operation. A comprehensive CAPA, overseen by a qualified consultant, for handling microbiological sampling media to ensure robust and reliable data. Establish a system that ensures uninterrupted custody and full reconciliation of all microbiological samples, including but not limited to: o unique labeling of each sample o signatures of all staff who handle the sample o complete tracking of sample integrity and custody o date and time of each activity (e.g., sample collection, delivery, incubation, removal from incubator) o digital time-stamped photos of all plates o signatures of personnel performing reading of microbial counts o provisions for verifications and routine quality assurance oversight.

Your firm failed to establish an adequate quality unit, and the responsibilities and procedures applicable to the quality control unit are not in writing and fully followed (21 CFR 211.22(a) and (d)). Your quality unit (QU) failed to establish and exercise its authority to adequately oversee the manufacture, packing, holding, review, and release of your (b)(4) over-the-counter (OTC) drug products, such as (b)(4) . Your firm’s inadequate quality oversight resulted in significant deficiencies in documentation practices, batch record review, investigations, and quality system controls to ensure compliance with CGMP requirements. For example, your QU failed to ensure: Investigation of any unexplained discrepancy or failure of a batch or any of its components to meet any specifications (21 CFR 211.192). Establishment of suitable quality oversight procedures (e.g., raw material handling, review of production records, and recalls) (21 CFR 211.22(a)). Batch production and control records that include documentation of the accomplishment of each significant step in the manufacture, processing, packing, or holding of the batch, for each batch of drug product (21 CFR 211.188(b)). Establishment of written procedures describing the handling of all written and oral complaints regarding a drug product (21 CFR 211.198(a)). In your response, you commit to procedural changes related to batch records, such as discontinuing the use of correction fluid (white-out) and improved temperature monitoring practices. However, your response is inadequate because it does not adequately acknowledge or address the QU’s failure to exercise its responsibility and authority to ensure the accuracy, integrity, review, and approval of CGMP records. Specifically, your response fails to address significant data integrity lapses documented at your facility which include backdating of quality release labels, entry of temperature data when the thermometer was inoperable, and lack of batch records to document manufacturing activities for drug products. Your firm’s quality systems are inadequate. For help implementing quality systems and risk management approaches to meet the requirements of CGMP regulations 21 CFR parts 210 and 211, see FDA’s guidance documents: Quality Systems Approach to Pharmaceutical CGMP Regulations at https://www.fda.gov/media/71023/download Q9(R1) Quality Risk Management at https://www.fda.gov/media/167721/download ICH Q10 Pharmaceutical Quality System at https://www.fda.gov/media/71553/download In response to this letter provide: A comprehensive assessment of documentation systems used throughout your manufacturing and laboratory operations to determine where documentation practices are insufficient. Include a detailed corrective action and preventive action (CAPA) plan that comprehensively remediates your firm’s documentation practices to ensure you retain attributable, legible, complete, original, accurate, and contemporaneous records throughout your operation. A comprehensive assessment and remediation plan to ensure your QU is given the authority and resources to effectively function. The assessment should also include, but not be limited to: o A determination of whether procedures used by your firm are robust and appropriate. o Provisions for QU oversight throughout your operations to evaluate adherence to appropriate practices. o A complete and final review of each batch and its related information before the QU disposition decision. o Oversight and approval of investigations and discharging of all other QU duties to ensure identity, strength, quality, and purity of all products. A comprehensive assessment of your overall system for investigating deviations, discrepancies, complaints, out-of-specification (OOS) results, and failures. Provide a detailed action plan to remediate this system. Your action plan should include, but not be limited to, significant improvements in investigation competencies, scope determination, root cause evaluation, CAPA effectiveness, quality unit oversight, and written procedures. Address how your firm will ensure all phases of investigations are appropriately conducted.

Your firm failed to clean, maintain, and, as appropriate for the nature of the drug, sanitize and/or sterilize equipment and utensils at appropriate intervals to prevent malfunctions or contamination that would alter the safety, identity, strength, quality, or purity of the drug product beyond the official or other established requirements (21 CFR 211.67(a)). Your firm failed to adequately clean and maintain non-dedicated drug manufacturing equipment used to fill OTC drug products. For example, our investigator observed stagnant (b)(4) product residue inside the tubing on the filling line with residue accumulating in crevices and on surfaces that come into direct contact with the drug product. In your response, you state that you developed a comprehensive cleaning procedure and implemented a cleaning validation program. However, your response is inadequate because you fail to address the impact of your inadequate cleaning practices on drug products that remain in distribution. In addition, your response does not address how you will document cleaning in your batch record. It is your responsibility to ensure that you use only appropriately designed and maintained equipment in the manufacture of your drug products. In response to this letter, provide: A comprehensive, independent retrospective assessment of your cleaning effectiveness to evaluate the scope of cross-contamination hazards. Include the identity of residues, other manufacturing equipment that may have been improperly cleaned, and an assessment whether cross-contaminated products may have been released for distribution. The assessment should identify any inadequacies of cleaning procedures and practices and encompass each piece of manufacturing equipment used to manufacture more than one product. A CAPA plan, based on the retrospective assessment of your cleaning program, that includes appropriate remediations to your cleaning processes and practices and timelines for completion. Include the following as part of the assessment and CAPA plan: o a detailed summary of vulnerabilities in your process for lifecycle management of equipment cleaning. o a list of improvements with an explanation how each will enhance cleaning effectiveness. o improved ongoing verification of proper cleaning execution for all products and equipment. o any other needed remediations. Your CAPA plan to implement routine, vigilant operations management oversight of facilities and equipment. This plan should incorporate oversight from a qualified independent consultant and ensure, among other things, prompt detection of equipment/facilities performance issues, effective execution of repairs, adherence to appropriate preventive maintenance schedules, timely technological upgrades to the equipment/facility infrastructure, and improved systems for ongoing management review. Inadequate Microbiological Testing of Finished Drug Product Additionally, we observed deficient microbiological testing specifications and test methods for your finished non-sterile OTC (b)(4) drug products. We noted that you limited microbiological testing to aerobic plate counts only and used a method intended for non-pharmaceutical use. Test methods must be validated to show that they are suitable for their intended use and are equivalent to or better than applicable USP compendial methods. The reproducibility of your test methods is essential to determine if your drug products meet established specifications. Data Integrity Remediation Your quality system does not adequately ensure the integrity of data to support the safety, effectiveness, and quality of the drugs you manufacture. See FDA’s guidance document Data Integrity and Compliance With Drug CGMP: Questions and Answers (https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers) for guidance on establishing and following CGMP compliant data integrity practices at https://www.fda.gov/media/119267/download. We strongly recommend that you retain a qualified consultant to assist in your remediation. In response to this letter, provide: A comprehensive investigation into the extent of the inaccuracies and inconsistencies in data, records, and reporting including results of the data review for drugs distributed in the United States. Include a detailed description of the scope and root causes of all data integrity deviations. A retrospective risk assessment of the potential effects of each observed deviation on the quality of your drugs. Your assessment should include analyses of the risks to patients caused by the release of drugs affected by each occurrence of a data integrity event. The assessment should also determine risks posed by current operational conditions, and any needed interim measures. A management strategy for your firm that includes the details of your global corrective action and preventive action plan to implement attributable, legible, complete, original, accurate, and contemporaneous records throughout your operation. The detailed corrective action plan should describe how you intend to ensure the reliability and completeness of all data, including microbiological and analytical data, manufacturing records, and all data submitted to FDA.

Input to and output from the electronic records and data are not checked for accuracy.