“We initiated supplier qualification activities” — the CAPA that names a programme, not a number
483 response filed 25 March 2026 · Citations 21 CFR 211.84(d)(1), 211.84(d)(2), 211.165(b), 211.192, 211.22
A four-day inspection of a small OTC contract manufacturer in Gilbert, Arizona found incoming components — including the active ingredient — accepted on supplier paperwork alone, a release method that had never been validated, and an in-house utility system running over its microbial limit and used anyway. Eighteen days after the investigators left, the firm started a supplier qualification programme, and two days later filed its response.
FDA rejected all three answers, and the rejections rhyme. None says the firm did the wrong thing. Each says the same thing about the paperwork: there are no numbers in it. A 483 response is graded on the specifications and results it contains, not the systems it announces.
Earlier issues asked how far a corrective action must reach. This one asks what is inside it.
What FDA found
Suretec Innovations, LLC contract-manufactures OTC products for private-label distributors. On components, the firm “failed to conduct adequate identity testing of incoming components, including the API,” and “relied on your suppliers’ certificates of analyses (COA) without establishing the reliability of each of your component suppliers’ analyses at appropriate intervals.” On finished product, the non-compendial microbiological method used to release every batch “lacked appropriate incubation times, lacked appropriate method suitability, and lacked positive and negative controls” — and was never validated.
Then the finding underneath both. An in-house system supplies a component used in manufacturing — both redacted in the letter, monitoring reported in colony-forming units per millilitre. Counts repeatedly exceeded the firm’s limit, and the quality unit did not investigate. The firm “continued to use [the component] from this system with out-of-limit (OOL) test results to manufacture drug products that were ultimately released, distributing potentially contaminated drug products to market.”
- 2–5 Mar 2026
- FDA inspects the Gilbert, Arizona site.
- 23 Mar 2026
- Supplier qualification begins — eighteen days after the inspection closed.
- 25 Mar 2026
- 483 response filed, enclosing the new procedures and CAPA-2026-005.
- 13 Aug 2026
- Warning letter. Every response inadequate; consultant recommended.
A fourth citation collects the rest under 21 CFR 211.22: no stability programme, no procedures defining quality unit responsibilities, no qualification of that system.
What the firm said
The firm moved quickly, and the response reflects real work. Within three weeks it had opened a CAPA, written a Supplier Qualification and Approval Program procedure, issued laboratory-control and system-monitoring procedures, and engaged a contract laboratory to validate USP <61> and <62> methods. FDA’s summary of the components answer:
“You state that you initiated supplier qualification activities on March 23, 2026, and you provided your Supplier Qualification and Approval Program procedure. You also provided references to supplier qualification activities.” FDA, summarising the firm’s 483 response
Read as deliverables, a creditable fortnight. Read as evidence, a set of empty containers — a programme, a procedure, a start date, a CAPA number — none saying what is tested, against what limit, by what method.
Why FDA rejected it
A start date is an activity, not a control
“Initiated on March 23, 2026” says something true about the firm and nothing about the material. What closes the finding is the specification the component now has to meet.
“your response failed to include documentation establishing component-specific acceptance criteria, defined identity testing specifications and methods … or results of any retrospective confirmatory testing.” FDA, Warning Letter 320-26-114
A monitoring procedure with no limits in it
FDA’s objection is not that monitoring is the wrong remedy — it is that, of the two documents enclosed, “neither document addresses specific microbiological alert or action limits, sampling frequencies, or acceptance criteria.” A procedure that never says when to act could not have prevented what it was written about: the firm already had the results.
“Future release testing” leaves the past untouched
The method validation was scoped, in the firm’s framing, to future release testing. FDA reads that boundary as the gap: the response “does not demonstrate adequate corrective actions to ensure that distributed product was appropriately tested prior to release, nor does it include a retrospective assessment of product quality.”
One CAPA number, two findings
CAPA-2026-005 appears in FDA’s discussion of both the microbiological testing finding and the utility-system finding. One record answering two distinct failures means the response was written at the level of the programme, not the problem — and FDA rejects it twice.
The pattern worth carrying forward
The fifteen-day window rewards whatever you can produce fastest, and procedures are the fastest artefact there is. You can write an SOP in a weekend; you cannot validate a method or test a year of retains in one. So the response fills with governance, because that is what fits.
FDA grades the other column. Look at what it asked for next: the specifications used to release each incoming lot, results from COA-verification testing, a plan for testing retains of distributed lots within expiry. A procedure is the instrument; the reviewer wants the reading. Sending the instrument alone is not bad faith — it is the honest output of a short window — but it leaves nothing to evaluate.
- Does it contain a number that wasn’t there before? An acceptance criterion, an action limit, a sampling frequency, a named method. If a reviewer can read it end to end and still not know what counts as a failure, it is a commitment, not a control.
- What does it do for product already made? Every forward-dated fix needs a backward-looking twin: retrospective confirmatory testing, retain testing, or a risk assessment of distributed lots. Name it in the same paragraph, or FDA will name the omission.
- Is one CAPA carrying more than one finding? If the same record answers two observations, it is pitched above both. Split it, and let each finding own the specification that closes it.
A defensible response would have run in two columns. On the left, what is now required: the identity test each incoming lot must pass, the count that takes the utility system out of service, the validated method and its acceptance criteria. On the right, what has been found: the first verification tests against supplier COAs, and retain testing on distributed lots. The procedures belong in an appendix, as the mechanism behind the left column.
An SOP tells FDA what you intend to measure. The response is graded on what you measured.
Veritas Quality Consultants works with pharmaceutical, medical device, and biologics manufacturers on Form 483 responses, root cause analysis, and CAPA development — built to FDA expectations inside the 15-day window.
Request a consultation