FDA’s Top Ten Drug GMP Inspection Citations FY 2017 and Analysis

By Jerry Chapman, Editor-In-Chief at Xavier Health, and GMP Quality Expert

FDA Logo

Back by popular demand, FDA’s Dell Moller will be returning to FDA/Xavier PharmaLink conference March 12-15, 2019, to discuss FDA’s top ten drug GMP inspection citations for FY 2018.

This past March, FDA’s Moller and Nicholas Paulin shared with the PharmaLink participants FDA’s top ten drug GMP inspection citations for FY2017, and participated in a panel discussion to provide insight into the observations.

Moller is an FDA Supervisory Investigator based in Columbus, Ohio. Paulin is a Drug Specialist and Pre-Approval Manager at FDA’s Cincinnati District Office.

Also on the panel were FDA Division of Pharmaceutical Quality Operations Division 3 Program Director Art Czabaniuk and Elanco Animal Health Senior Consultant Brent Conatser.

Below is the top ten list from Moller and Paulin’s presentation, in descending order. Each finding includes the Code of Federal Regulations (CFR) Title 21 reference and a brief analysis provided by FDA featured on the presentation slides. Additional comments from the panelists follow in italics. The comments are from Paulin unless otherwise noted.

FDA/Xavier PharmaLInk 2020

FDA/Xavier PharmaLink

Pharma for the 21st Century.

Following the top ten analysis is additional discussion regarding inspection trends, other inspection findings, and advice on interacting with FDA investigators: 

10. No written stability program, methods are not stability indicating, or they are not tested when pulled or within a reasonable time (chronically late testing). (21 CFR 211.166 (a))

Analysis: Failure to demonstrate methods are stability indicating. Inadequate or no degradation challenges performed. Stability testing schedules not adhered to. Too many samples for the lab’s capacity. Why did internal audits not capture and correct these issues before the FDA inspection?

“The citation could also be given when the firm has no data to support expiration dating.”

9. Routine calibration or inspection of automatic or electronic equipment is not performed according to a written program designed to assure it is operating properly. (21 CFR 211.68 (a))

Analysis: Not calibrating a piece of equipment on time or performing a requalification/preventive maintenance task on equipment just because it is operating fine or because “we haven’t had any issues with it” is not a good strategy.

“I check calibration stickers during inspections on equipment that is running.”

Moller: “Missing a requalification or periodic review does not negate the validated state of the associated facility, process or equipment, but may call into question the relevance of the validation or the qualification process itself.”

Moller noted that at one company he inspected he was told, “The equipment is working. We do not see any negative trends with the system working or over time. So why do we need to take that piece of equipment out of production to make sure that it is working ok?” 

8. Procedures designed to prevent microbiological contamination of drug products purporting to be sterile are either not established or written or not followed. (21 CFR 211.113 (b))

Analysis: Many times the procedures are solid and well written, but they are not followed. Other time there are gaps in procedures that leave it up to the production associate/employee to decide what to do.

“One example is in a sterile system with a remote access barrier system, or RABS. I have seen tears or pinholes in gloves and the operators are still using them. Another example would be operators opening a RABS barrier door, adjusting it, and removing vials from the line with their bare hands instead of using gloves. It is mostly about poor aseptic practices”

Moller: “It points to the quality culture in the organization and whether management really has control. How does something simple like this happen? Is nobody monitoring? Is it the culture? Senior management can promote or derail a quality culture.”

Conatser: “Do the people who are executing these procedures, who have been trained on them, know why they are doing what they are doing? Do they know the impact of not following that procedure? It has been my experience that when someone is asked why they are doing something, it is because the SOP [standard operating procedure] says so. No. Why do you do that? Do you understand the reason why you are doing it? Training should be ‘read, understand, demonstrate, and execute.’”

Czabaniuk: “In one case I recall, the procedure was too complex, too long, and hard to understand from the operator's point of view. They were trained on it, but there was just too much there. To address it, the firm simplified the procedure and created a work instruction as an addendum, which covered the critical portions of the SOP. It allowed operator to better understand what the critical requirements were. It did solve the problem that we cited.” 

7. Appropriate controls are not exercised over computers or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel. (21 CFR 211.68 (b))

Analysis: Changes to master batch or production batch records or incoming material records, for example, without QA approval or a formal change control process review causes unauthorized changes to the system and no one knows about it. Mixing times adjusted because over time there is production drift and the batch record time isn’t long enough.

“This specifically talks about batch records, but can be carried over into other areas of documentation control. Eventually the product will drift out of spec. This can also include: deletions and alterations of electronic raw data; manipulation of the date and time setting; analysts using shared logins on lab systems; and an HPLC system used for testing with the audit trail turned off.” 

6. Testing and release of drug product for distribution do not include appropriate laboratory determination of satisfactory conformance to the either final specifications or are missing an identity or strength of an active ingredient, prior to release. (21 CFR 211.165 (a))

Analysis: Assuring that the drug product is what it is, that the identity and strength on the label is in the bottle and it is as it is intended to be.

“A firm released product without testing for the identity and strength of the active ingredients. Without that testing the firm has no scientific evidence if it is in spec prior to release.” 

5. Written procedures are not established or followed for the cleaning and maintenance of equipment, including utensils, used in the manufacture, processing, packing or holding of a drug product. (21 CFR 211.67 (b))

Analysis: Often times equipment is not properly cleaned and/or sanitized and there is residue or cleaning solution remaining in the equipment – is this a case of not following the procedure or a procedure that can be written better? Equipment tagged ready to use with some type of residue/solution in that equipment could be an indication of the pre-operative inspections needing more time or expertise to thoroughly conduct.

“I look at equipment tagged as clean. I have found residue of the previous product made on that line still on the equipment that is tagged as clean. The company needs to look at how it was cleaned, and at the analytical method used. The cleaning procedure may be inadequate. Sometimes the cleaning procedures are not well-written as to who is responsible, what the cleaning schedule is, and what the cleaning agents are. Is there a sanitizer used? What is it rinsed with?”

4. No written SOPs for production/process controls designed to assure the drug products meet their necessary attributes. (21 CFR 211.100 (a))

Analysis: A properly written procedure provides sufficient information to assure the activity can be performed consistently and correctly each time and appropriately documented for production, QA and regulatory review, and this also includes what to do if something does not go quite right.

“As an example, I see operators taking note of what they are doing, when they are adding an ingredient.Then I check the procedure or batch record and I do not see where this is called for or recorded.There should be specifications for everything that is added into the batch.Everything should be following a procedure or batch record.”

Moller: “Some of the better procedures I have seen, like for gowning, have fewer words and more pictures in them.” 

3. Failure to thoroughly review any/all unexplained discrepancy or failure of batch/components to meet their specs – WHETHER OR NOT the batch HAS BEEN DISTRIBUTED [emphasis added by the presenter]. (21 CFR 211.192) 

Analysis: The firm is responsible to assure that all deviations are properly investigated and documented and that all affected batches are included in the evaluation but also appropriately dispositioned.

“A firm failed to investigate a stability testing failure concerning a couple of batches of their drug products. The product failures included viscosity and appearance.During stability testing the firm also discovered packaging defects. It did not initiate investigations for these drug quality issues. When the firm did investigate, it failed to review the batch record and failed to identify a root cause or corrective action. FDA wants to see root cause and corrective actions. We would rather see an investigation than find a problem and ask if an investigation was performed and find out that it was not.”

Moller: “For findings three and four, we at the FDA understand that things are not going to go perfectly every single time. What we expect is that you appropriately handle things when they do not go right, every single time. That includes the investigation and the disposition of the product.” 

2. Laboratory controls do not include the establishment of scientifically sound and appropriate specs/standards/sampling plans/methods designed to assure drug products conform to specs/standards, etc. (21 CFR 211.160 (b))

Analysis: The expectation is you rely on good science, so why is this still being observed? This includes laboratory investigations having a sound investigation strategy and not just retesting or testing into compliance, and proper application and use of the outlier test.

“As an example, lab test procedures are not validated. FDA has a guidance document for investigating out of spec test [OOS] results. Whenever we are looking at OOS investigations, we are looking to see if you found the root cause of the OOS. When you reject a batch, you still need to perform an investigation on those rejected batches.”


1. Responsibilities & Procedures for the QA Unit are not in writing or fully followed. (21 CFR 211.22 (d)) 

Analysis: Does QA have the responsibility and authority to carry out their job effectively and efficiently?

“As an example, a firm has not established procedures for numerous functions, including complaints, deviations, change control, supplier qualification, or batch release. If so many are overlooked, that points to the quality unit. Are they really performing their job effectively, efficiently, and to the best of their ability?”

“As another example, when a firm has a quality agreement with their customer they must notify their customer within a certain amount of days if their product is going to have a FAR [field alert report]. We noticed that a firm did not notify their customer within that time frame. There had been multiple complaints on leaky and defective vials. If there is a quality or patient risk, that is also an issue. That points back to the quality unit and whether it was effective in carrying out its duties and responsibilities. The main thing for all these under number 1 is that quality is an umbrella of everything at a pharma company, no matter what system we are covering.”

“Quality should have its hands in everything the firm is doing. They should have oversight of everything going on in their facility. Patient safety is the number one priority. When I perform an inspection, I always ask myself if I would feel safe taking this product, if I would feel safe having my family taking this product. I should always be able to say ‘yes.’”

Czabaniuk: “The people not following procedures are probably doing that because management is not monitoring them, and management is not enforcing the requirements.” 

Little Has Changed Over Time

Moller presented a color-coded illustration of the top five 483 citations issued over the last four fiscal years, along with the same data from FY 2006 for comparison, noting the similarities over time (see illustration below).

Top Five Most Frequent 483 Citations in Recent Years

“What we found,” he said, “were that the same citations are frequently observed from year to year on inspections. The ‘specifically’ or ‘for example’ may be different, but the root citation for these observations often remains the same. While major improvements have been made in industry over the years, we are seeing recurring themes.” 

Which Are Most Egregious?

After the presentation of the top ten 483 findings, Czabaniuk asked, “Of the violations we talked about today, which are the most egregious and could result in some sort of a regulatory action?” He pointed to three findings, which, from his perspective, fit that criterion.

There is nothing more basic to GMP compliance than testing finished products and making sure they meet the specs, Czabaniuk said. “And if you do not have any of the other GMP controls in place, then how comfortable is the agency going to be with the finished product that is in distribution? Not too comfortable. And if it is a narrow therapeutic index drug or a sterile drug, we are going to take action quickly.”

The second serious violation he singled out is not having procedures to prevent microbial contamination. “That is an incredible risk,” he commented. “The manufacturing processes for sterile products are incredibly complex. There are a lot of controls that are required to make sure that the finished product is in fact sterile. That is another observation that would push a case to the violative category.”

Lastly Czabaniuk cited issues with product stability. “If you are doing forced degradation studies and your methods are not stability-indicating, that data is useless. That means that the product that is in distribution is of an unknown quality. We would expect the firm to take prompt action to look at the quality of product in distribution. Our expectation is that they would move quickly to develop stability-indicating methods.”

Moller noted that there is “multi-level review” of each 483 at the agency after the inspection to determine if compliance actions need to be taken. 

Other Common Findings

Other common findings, Moller pointed out, are in the area of data integrity in the laboratory. These include:

  • Computer systems not locked down and users (analysts and reviewers) have the ability to copy, rename or even delete files

  • Data acquisition system settings allowing files to be manually saved to locations by analysts rather than automatically being saved to a specific locked down location with a pre-determined repeatable naming convention

  • Analysts having administrator rights

  • Not having the audit trail turned on

  • The audit trail, for example on lab chromatography equipment, “needs to be functional and utilized,” Moller emphasized. “We have seen where the audit trail is not reviewed at any level in the lab or by QA.”

When the audit trail is turned off, it allows the analyst or the reviewer the potential to either change data, delete data, or move data to a folder that is not reviewed or does not go through the QA process.

Moller said, “We understand in some development processes the analyst needs to have some expanded roles and rights. But as soon as they are done with that, take it away.  Lock it down.  That give you and the analyst a good out. ‘I did not do it. I do not have the rights.’”


Challenge the Investigators

Czabaniuk provided his perspective on interactions with FDA investigators during inspections. 

“Challenge the investigator if you feel that an observation is not correct,” he recommended. “Do not feel like there will be some bad follow-up as a result of challenging the investigator.”

“Our investigators want to be right. We want to be right. We do not want to make mistakes. Engage with the investigator on the observations.”

He noted that the investigator should have close-out meetings with the firm to discuss what has been found, either daily or at some frequency. That provides the opportunity to discuss any concerns.

“I was wrong about some observations early in my career,” Czabaniuk commented. “And I only found that out through those discussions.  It is critical that you engage the investigator and have those conversations.” 

[Editor's Note: For a similar review of the top ten FDA 483 drug GMP observations for FY 2016, click here.]

The PharmaLink conference is one in a series of drugmedical device, and artificial intelligence (AI) conferences sponsored annually by Xavier Health. Read a review of how Xavier’s conferences are unique and engaging written by Rob Wright, Chief Editor, Life Science Leader, here. Read an article detailing Xavier's current AI Initiatives here.