Curia New York, Inc. — FDA Warning Letter Findings

Failure to have laboratory control records that include complete data derived from all laboratory tests conducted to ensure your API and intermediates comply with established specifications and standards. Not all electronic test results are included in your review to determine conformance of your API products. Your laboratory analysts routinely conducted unexplained injections in high-performance liquid chromatography (HPLC) and ultra-performance liquid chromatography (UPLC) without adequate documentation or supervision to ensure that product samples were not being tested. Your laboratory used Empower and TotalChrom software for chromatographic data processing and analysis. Your laboratory analysts performed thousands of unexplained injections using Empower over the last 30 months, and over 70 trial injections using TotalChrom in October 2025 alone. The injections that utilized the Empower software used the “Developer” role rather than the “Operator” role without appropriate documentation. For example: A. Our investigators found chromatograms for testing that was performed on January 14, 2026, on chromatography equipment HPLC 49, which showed four unexplained trial injections that were injected under the “Developer” role. Your analyst confirmed these trial injections could not be traced to any product, sample, or analysis. In your response you attributed the injections to the testing of (b)(4) swab samples. Pages from the associated laboratory notebook 830-7 contained no reference to the four trial injections. Your analyst did not document any rationale for performing the trial injections using the “Developer” role in the laboratory notebook. B. Your analyst conducted testing that showed two unexplained injections on February 1, 2026, on chromatography equipment UPLC 57, using the “Developer” role. Your analyst stated your QC supervisor tested (b)(4) cleaning swab samples that were reported in laboratory notebook 823-6. However, the laboratory notebook did not provide documentation on these unexplained injections. Your response regarding these two examples states that the trial injections were performed as part of a troubleshooting exercise assisted by your quality control supervisor, and that the trial injections had no impact. However, in your retrospective review of all trial injections you identified nine injections that lacked sufficient justification and need further investigations. You also stated in your response that nearly 20 percent of Empower trial injections were acquired or altered in “Developer” mode, which reflects inconsistent training or poor understanding of your procedure, SOP-RLS-000435. Allowing the use of the “Developer” role for analyst activities involving CGMP samples or regulated data fails to prevent analysts from performing unauthorized or undocumented sample analyses. Your response is inadequate because it does not include an investigation of all unexplained injections performed to determine the associated CGMP risk, and because it does not provide an explanation of why these trial injections were performed by analysts using the “Developer” role. We acknowledge your firm’s cessation of all trial injections, the removal of the “Developer” role in Empower, and your commitment to provide an additional retrospective assessment of all trial injections findings from January 2021 to October 2023. In response to this letter, provide the following: A comprehensive, independent investigation report for all trial injections, with supporting documentation showing that the trial injections were not sample injections. If an injection is identified as a sample injection, include a determination of the impact on the distributed API materials. A comprehensive, independent data-integrity assessment for all facilities, covering all computerized systems used in CGMP operations, that is, not limited to Empower and TotalChrom.

Failure to exercise sufficient controls over computerized systems to prevent unauthorized access or changes to data. Our investigators observed significant data-integrity violations at your facility involving the sharing of usernames and passwords that are used to gain access to your electronic computerized system for GMP analysis. For example, your electronic computerized system, (b)(4) , interfaces with laboratory equipment (b)(4) and restricts access through individual, unique usernames and passwords. Despite this control, your laboratory analyst used another analyst's login credentials to conduct (b)(4) calibrations and to perform (b)(4) -sample testing. The sharing of credentials constitutes a serious violation of data-integrity principles and is inconsistent with GMP requirements. Your quality system failed to detect and prevent repeated occurrences of this practice. Your response acknowledges that your written procedure SOP-RLS-000438, “The Use of Computerized Systems for GMP Operations,” prohibited username and password sharing. Your retrospective review under Protocol RQA-P-0560 was limited to 12 stand-alone analytical instruments for the period from February 10, 2025, through February 4, 2026. This review does not encompass all computerized equipment requiring username and password access, nor does it evaluate discrepancies beyond the stated review period. In response to this letter, provide the following: A retrospective review of all computerized equipment for all your facilities, including but not limited to stand-alone systems that require username and password authentication to gain access, and all products for which the equipment was used for testing, limited to distributed products currently within expiry and on the U.S. market. A comprehensive, independent assessment covering all GMP-integrated computerized systems for a three-year period to fully characterize the scope of this data-integrity failure. A management strategy for your firm that includes the details of your global CAPA plan to implement attributable, legible, complete, original, accurate, contemporaneous (ALCOA) records throughout your operation. The detailed corrective action plan should describe how you intend to ensure the reliability and completeness of all data, including microbiological and analytical data, manufacturing records, and all data submitted to FDA. A comprehensive, independent assessment of your laboratory practices, procedures, methods, equipment, documentation, and analyst competencies. Based on this review, provide a detailed plan to remediate and evaluate the effectiveness of your laboratory system.

Failure of your quality unit to exercise its responsibility to ensure the API and intermediates manufactured at your facility are in compliance with CGMP. Your Quality Unit failed to ensure adequate control over paper and electronic records. On January 29, 2026, our FDA investigator observed original laboratory records inside the shred bins maintained in your laboratory. For example, we found an original pH meter printout slip, indicating a pH reading of (b)(4) ; an original analytical balance printout slip, with a value of (b)(4) grams; and reviewer-signed Analytical Data Review Checklists. Your response states that there was negligible impact from these discrepancies; however, your response lacks evidence to support the conclusion of negligible impact for discarding these records. Your firm could not identify who generated the pH meter printout on December 19, 2025, and why they were discarded. Your analyst discarded a balance printout weight slip dated January 25, 2026, but did not document why this balance printout slip was discarded. Furthermore, you were unable to make batch associations with the discarded original sourced documents (for example, specific batch testing). Without attribution of the discarded records to defined test analyses, the conclusion of negligible impact lacks an adequate evidentiary basis. Although procedure SOP-RLS-000346 was updated to require the use of instrument logbooks, your quality unit failed to investigate why the generated records were discarded in the shred bins, indicating a lack of adequate oversight. The full scope of this traceability gap is not adequately included in your response. Additionally, our investigators found in the shred bin an excessive number of photocopies of your laboratory notebook pages, with CGMP activities documented. Your laboratory personnel reviewed photocopies of the original data rather than the original records, and subsequently they signed off on the original analyst notebooks without verifying any changes to the underlying data. Your response acknowledges that the photocopy review practice was a direct violation of your procedure SOP-RLS-000456, requiring that all electronic primary data be reviewed and verified against the analyst's notebook. In addition, your procedure RLS-SOP-PW-0047 GMP, “Document Storage, Control, and Retention,” requires that paper records pertaining to batch analysis be maintained. Your quality unit failed to ensure that all production control records were retained in accordance with this established procedure and failed to implement adequate controls to ensure the integrity of data generated at your facility. We acknowledge you removed (b)(4) shred bins from the locations in building (b)(4) and transferred them under the QU control. However, your response is inadequate. Your review of shred bin data appears not to include an analysis of the contents of all the shred bins identified during the inspection. Your protocol “Review of Shred Bin Contents” identified a bin that was not included in your summary report and did not provide an explanation for this omission. Your firm had indicated that the (b)(4) bins are collected (b)(4) by a third-party service provider for off-site destruction. You are unable to determine the scope of prior discarded material from the previous document destructions. Your quality system does not adequately ensure the accuracy and integrity of data to support the safety, effectiveness, and quality of the drug substances you manufacture. See FDA's guidance document Data Integrity and Compliance with Drug CGMP at https://www.fda.gov/media/119267/download. In response to this letter, provide the following: A determination of how long the shred bin disposal of GMP documents has been occurring at your facility. A retrospective assessment of the scope and potential effect of the absence of instrument-use logbooks for all QC laboratory equipment over the applicable record-retention period, including an evaluation of whether any GMP testing results may be unattributable or unverifiable as a result. A retrospective assessment of the potential scope of records that may have been improperly destroyed before the inspection, given that shred bins were collected (b)(4) with no QA review. A broader data-integrity assessment, including a retrospective review of your QC laboratory operations to determine the extent to which uncontrolled documentation practices may have affected the integrity of GMP records. The complete final investigation report(s) regarding documents found in all shred bins. Include classification of documents, associated effect on product and manufacturing processes, and any deviation generated from the final assessment. A detailed, comprehensive data-integrity investigation protocol describing how your third-party consultants will evaluate electronic data. A comprehensive investigation into the extent of the inaccuracies and inconsistencies in data, records, and reporting. Your investigation should include: o A detailed investigation protocol and methodology; a summary of all laboratories, manufacturing operations, and systems to be covered by the assessment; and a justification for any part of your operation that you propose to exclude. o Interviews of current and former employees to identify the nature, scope, and root cause of data inaccuracies. We recommend that these interviews be conducted by a qualified third party. o An assessment of the extent of data-integrity deficiencies at your facility. Identify omissions, alterations, deletions, record destruction, non-contemporaneous record completion, and other deficiencies. Describe all parts of your facility’s operations in which you discovered data-integrity deficiencies. o A comprehensive, retrospective evaluation of the nature of testing data-integrity deficiencies.…