“Only at your customer’s request” — who owns testing scope at a contract manufacturer
483 response filed 17 October 2025 · Citations 21 CFR 211.165(b), 211.192
A contract manufacturer of over-the-counter drug products released a batch with no microbiological release testing. Not because a test failed, and not because anyone forgot — because the customer had not asked for it. That was the standing practice, and the firm said so plainly in its 483 response.
Issue 03 touched this in passing, in a letter where “at the instruction of your customer” kept surfacing. This issue takes it head on. A manufacturer that lets its customers decide which tests get run has outsourced the specification — and the specification is the one thing a contract facility cannot delegate.
The same logic appears twice in this letter, in two unrelated findings, rejected both times for the same reason.
What FDA found
The firm operates as both a contract and own-label manufacturer of OTC drug products. On 4 February 2025 it manufactured a lot without performing microbiological testing for release. The quality unit approved and released it, and it shipped. FDA cited 21 CFR 211.165(b) — the requirement that each batch have the testing necessary to be free of objectionable microorganisms.
The second finding is the more revealing, because it shows what happened when testing was performed. A customer requested microbiological testing; total aerobic counts came back above the limit and the laboratory identified the organism as Bacillus cereus. The firm invalidated the excursion — because the specific pathogens listed on the certificate of analysis had not been detected — attributed it to “environmental contamination during the manufacturing process,” and released the lot. FDA’s assessment ran to one sentence: “You lacked adequate scientific rationale to invalidate this excursion.”
- 4 Feb 2025
- Lot manufactured with no microbiological release testing. Quality unit approves, releases, distributes.
- 22 – 26 Sep 2025
- FDA inspects the Parker, Colorado facility.
- 17 Oct 2025
- Firm responds to the Form FDA 483, confirming testing is performed only when a customer asks.
- 11 Mar 2026
- Warning letter. Both responses found inadequate.
It was not isolated. FDA noted multiple investigations closed as inconclusive or invalidated “with inconsistent approaches,” the risk minimised on the grounds that “product does not support growth.”
What the firm said
The response was not evasive. The firm confirmed the practice and produced the document behind it: a justification memo concluding “no testing required” for total aerobic microbial count, total combined yeasts and moulds, and specified microorganisms, on the basis of the product’s formulation.
“In your response you confirmed that you perform microbiological testing only at your customer’s request.” FDA, Warning Letter 320-26-50, describing the firm’s 483 response
Formulation-based justification for reduced microbiological testing is legitimate, not a dodge — plenty of well-run firms use one. On the investigation finding, the firm committed to evaluating procedures, adding documentation for OOS results, and training employees. Both are the responses most firms write.
Why FDA rejected it
The justification contained its own counter-evidence
FDA read the memo and found the answer inside it: it “reveals microbial growth in your drug products.” A formulation rationale has to survive the firm’s own data. Once growth is on file the premise is not weakened, it is disproven. FDA allowed that proliferation risk may be lower, then closed the door: organisms can persist regardless.
“Eliminating microbial testing of your drug products is unacceptable.” FDA, Warning Letter 320-26-50
A customer request is not a specification
21 CFR 211.165(b) attaches to the batch, not to the commercial arrangement that produced it. FDA repeated its settled position: you are responsible for the quality of the drugs you produce regardless of agreements in place with product owners. A customer can specify what it wants tested. It cannot specify what does not need to be.
A certificate of analysis does not define “objectionable”
Bacillus cereus was identified, then dismissed because it was not on the CoA’s pathogen list. But a CoA describes what was agreed to be tested. What counts as objectionable is set by the product, its route of administration, and the population using it. An organism absent from the list is not absent from the risk.
Nothing bounded what had already shipped
The commitments were prospective: better procedures, documentation, training. FDA asked for retain-sample testing across every batch within expiry, a risk assessment on distributed product, and complete investigations into every excursion “whether or not later invalidated or inconclusive.” If the scope was wrong, it was wrong for everything already shipped. The response never asked how much that was.
The pattern worth carrying forward
Both failures share one shape. In each, a document written for a commercial relationship — a customer’s testing request, a certificate of analysis — was allowed to answer a scientific question. The request decided whether a test was necessary; the CoA decided which organisms mattered. Neither was written by anyone assessing the product’s microbiological risk.
This is structural rather than careless, which is why it survives so long inside otherwise competent firms. Nobody decides to skip testing. The decision is made once, by omission, when scope becomes something the customer specifies rather than something the manufacturer determines — and after that it is simply what the firm does. It takes an inspection to surface, because internally there is no failure to detect. Nothing is measured, so nothing goes wrong.
- Who decided this test was unnecessary, and on what evidence? If the answer traces back to a customer request, a purchase specification, or an inherited certificate of analysis, you have a commercial decision wearing a scientific one’s clothes.
- Does your justification document contain data that contradicts it? A formulation rationale must survive your own results. If the same file shows growth or contamination history, the rationale is already falsified — and FDA reads the whole document, not the conclusion.
- If this test had been run and failed, would you have found out? A panel that omits the organisms your process is capable of producing does not deliver a passing result. It delivers no result.
A defensible response would have rebuilt the specification from the product outward — formulation, route of administration, patient population, contamination history — then tested retain samples across everything within expiry. The memo could have been the first page of that work. It was written to end the question instead.
Your customer decides what it wants to buy. Your specification decides what is safe to sell. Those have never been the same document.
Veritas Quality Consultants works with pharmaceutical, medical device, and biologics manufacturers on Form 483 responses, root cause analysis, and CAPA development — built to FDA expectations inside the 15-day window.
Request a consultation