“The operator didn’t follow procedure” — why that sentence cost one firm a warning letter
483 response filed 12 November 2025 · Citations 21 CFR 211.68(b), 211.194(a), 211.22(a)
FDA inspected an Illinois drug manufacturer in October 2025. The firm responded to its Form 483 within the window. Five months later, FDA rejected essentially every corrective action it had proposed.
The response wasn’t rejected because the firm ignored the observations — it answered all of them. It was rejected because of a single recurring move: the firm attributed each finding to an individual employee who failed to follow procedure.
FDA declined that framing three separate times. Anyone drafting a 483 response should understand why.
What FDA found
The core observation involved “trial injections” — unrecorded HPLC and GC runs performed at designated instrument locations before official analysis.
The mechanics matter. In one documented instance, an analyst ran an in-process sample for content determination and got a result that exceeded specification. A second trial injection was also out. The analyst then repeated the injection at a different GC location, obtained an in-specification result, and reported that one. The out-of-specification results were never recorded, reported, or investigated. The laboratory notebook contained no record of the sample preparations behind them.
The same pattern appeared on the HPLC side for impurity testing: two results, both technically within specification, and the more favorable one reported — with no sample preparation record for the first. FDA’s activity-log review found roughly two years of entries for the trial-injection instrument location, from October 2023 to October 2025.
Alongside this: shared HPLC usernames and passwords, analysts holding administrator rights to modify and delete data, deleted GC sequences sitting in the recycle bin, and an FTIR audit trail showing no activity across a week in which the usage log confirmed testing had occurred.
What the firm said
The response was, in fairness, a normal response. It is the response most firms write.
“The Operator did not record the trial injection, nor did they inform their Supervisor nor QA, violating Company procedure and their training.” Firm’s 483 response, as quoted by FDA
On the deleted sequences, the firm stated that its employee had violated procedure and training, and that a software update had allowed users to bypass access restrictions. On the quality unit performing its own final approval since 2023: this was “likely due to a temporary period of high turnover of these positions.”
Three findings. Three attributions to individual conduct. Three corrective actions built on training and procedure.
Why FDA rejected it
The written procedure directed the behaviour
The firm’s own GC procedure stated that a trial injection “is only for information purposes and is not processed as a part of raw data.” The operator had not violated procedure — the operator had followed it.
“It is particularly concerning that you included these unacceptable practices in written procedures, as they had the effect of directing staff to deviate from basic CGMP requirements.” FDA, Warning Letter 320-26-64
No assessment of scope
Two years of trial injections raises an obvious question — which released batches rest on discarded data? The response didn’t ask it. FDA now requires a five-year independent review of every trial injection performed, with notification if any supported a drug application.
No evidence of effectiveness
FDA noted the absence of “adequate details of management oversight to ensure effectiveness of the corrective actions implemented.” A corrective action asserted is not a corrective action demonstrated.
A local fix for a systemic finding
The firm addressed trial injections as a laboratory documentation lapse. FDA characterised it as evidence that “your laboratory system is not under control,” and escalated to a quality unit citation under 21 CFR 211.22(a).
The pattern worth carrying forward
Attributing a finding to individual error is the most common failure mode in 483 responses, and it is structurally self-defeating. It implies the system worked and one person departed from it — which, if true, means no systemic remediation is warranted. That is precisely the conclusion FDA is testing, and it is the conclusion FDA almost never accepts.
- Does any procedure, form, or established practice permit or encourage the behaviour? If yes, the root cause is documentary, not human.
- Would the quality system have caught this independently? If the finding surfaced only because an investigator opened a recycle bin or cross-referenced an audit trail against a usage log, detection failed — and detection is systemic.
- How long was it happening, and who else does it? A practice running two years across multiple instruments is a norm, not a lapse.
A defensible response addresses the observation, defines the scope with a retrospective review, establishes the product impact, corrects the system that permitted the practice, and specifies how effectiveness will be measured and by whom. Training may appear — but as a supporting element, never as the root cause answer.
The firm here had fifteen working days and a genuine opportunity. The response was timely and responsive to every observation. It still failed, because it answered the wrong question.
Veritas Quality Consultants works with pharmaceutical, medical device, and biologics manufacturers on Form 483 responses, root cause analysis, and CAPA development — built to FDA expectations inside the 15-day window.
Request a consultation