Section 1: Firm Management & Quality Unit Representatives
FDA Terms: 'Firm management' - 'Responsible individuals' - 'Quality control unit' — 21 CFR 211.22 · IOM 2025, §5.5.12
This section covers the responsibilities of firm management and the quality control unit during an FDA inspection. The FDA uses the terms 'firm management,' 'responsible individuals,' and 'quality control unit' (21 CFR 211.22). In this guide, every DO and DON'T is expressed once only — if a concept is about what TO DO, it is in the DO column and not repeated as a DON'T.
An investigator must present Form FDA 482, the official Notice of Inspection, at the start. This form states who the investigator is, which FDA district they represent, and the authority for the inspection. Record this information with the date and exact time of arrival.
Refusing to allow an inspection is a prohibited act under FD&C Act §301(f). Section 704(a) of the FD&C Act authorizes FDA to inspect all records, files, papers, processes, controls, and facilities related to drug manufacturing. FDA has published a separate guidance specifically about what constitutes refusal: 'Circumstances that Constitute Delaying, Denying, Limiting, or Refusing a Drug Inspection.'
The firm may designate a representative to accompany the FDA investigator. IOM 2025, §5.5.9.3 specifically addresses 'Representatives Invited by the Firm to View the Inspection.' This person ensures the firm has a complete record of everything the investigator observes, questions asked, and records requested.
- ★ This person should be from the quality control unit (21 CFR 211.22) — they have the authority and knowledge to manage document requests and respond to scope questions
- ★ The firm's representative must not interfere with the inspection — their role is to accompany, facilitate document access, and maintain internal records of the inspection activities
- ★ If the designated representative must leave, arrange a qualified replacement before stepping away — the investigator should not be left unaccompanied at any point
- ★ Maintain a written internal record of all areas visited, all questions asked, and all responses given — this record is your starting point for the Form FDA 483 written response
Everything said to an FDA investigator is documented in the Establishment Inspection Report (EIR) under 'Individual Responsibility and Persons Interviewed' (IOM §5.7.1.4.6). Inaccurate statements or contradictory answers across different personnel are recorded as inconsistencies and may form the basis for observations.
FDA conducts different types of inspections: pre-approval, surveillance, for-cause, and directed inspections (IOM 2025, §5.1.6). The scope determines which records, products, and personnel are relevant.
- ★ Ask the investigator to confirm the inspection scope at the start — record the answer word for word
- ★ If the scope expands during the inspection, note the date, time, and exact nature of the expansion in your internal records
- ★ Based on the confirmed scope, identify the qualified personnel responsible for each area under 21 CFR 211.25 — these are the people authorized to answer questions for their specific functions
Inspection classification — No Action Indicated (NAI), Voluntary Action Indicated (VAI), or Official Action Indicated (OAI) is determined by the FDA District Office after reviewing the complete Establishment Inspection Report (EIR). This happens after the inspection ends, not during it.
- ★ IOM §5.7.5.2 describes the criteria used to classify inspections — this assessment happens at the district level after the EIR is completed
- ★ Telling your team 'this is just routine' creates a false sense of security and reduces operational vigilance — treat every inspection with the same level of preparedness
21 CFR 211.22(a) gives the quality control unit the authority and responsibility for approving or rejecting all records and materials. Quality unit leadership must be available and involved from the moment an inspection begins.
- ★ Quality unit leadership needs to be involved from the first moment — they control records access and have authority over batch disposition decisions that the investigator may ask about
- ★ IBP: Many firms also notify legal counsel at this point. This is a reasonable operational step but is not described in FDA regulations as a requirement
All cGMP regulations require that records and information be accurate. When a spoken statement to the investigator contradicts a written record, the investigator documents this as an inconsistency in the EIR. It is always better to retrieve and verify a record than to answer from memory.
When a firm makes verbal commitments during an inspection, the investigator documents them in the EIR under 'Voluntary Corrections' (IOM §5.7.1.4.17). If those commitments are not met by the time of the next inspection or Warning Letter, the gap becomes an additional finding. The March 2026 FDA draft guidance states: 'Partially implemented, or promised, corrective actions are not sufficient to preclude regulatory action.'
The investigator prepares an Establishment Inspection Report (EIR) documenting all persons interviewed and discussions with management (IOM §5.7.1.4.6 and §5.7.1.4.14). Your firm needs its own parallel internal record — without it, you cannot prepare an accurate written response to Form FDA 483.
When two or more people answer the same question and their answers differ even slightly, the investigator documents this as a factual inconsistency. This inconsistency becomes part of the EIR and can contribute to observations — regardless of which person gave the correct answer.
Section 704(a) of the FD&C Act defines the scope of an inspection. If the investigator asks about one specific batch, your answer covers that batch. Volunteering information about other batches, other products, or past issues that were not asked about can expand the scope of the inspection.
The firm's right to protect confidential and trade secret information is recognized in IOM §5.1.5. Voluntarily providing records beyond the requested scope expands what the investigator can examine and may create new lines of inquiry that would not otherwise have existed.
FDA's March 2026 draft guidance on Form 483 responses explicitly states: 'Scientific or technical disagreements should be raised with investigators during the inspection; if unresolved, they should be addressed in the written response with supporting data and regulatory citations.'
FD&C Act §704(a) authorizes inspection of 'all things therein (including records, files, papers, processes, controls, and facilities).' 21 CFR 211.180(c) requires that cGMP records be 'readily available for authorized inspection during the retention period.' For electronic records, FDA's Data Integrity Guidance (December 2018, Q&A #17) confirms: 'All records required under cGMP are subject to FDA inspection. This applies to records generated and maintained on computerized systems.'
21 CFR 211.68(b) requires that records be maintained 'secure from alteration.' FDA Data Integrity Guidance (December 2018, Q&A #15): 'Regardless of intent or how or from whom the information was received, suspected or known falsification or alteration of records required under parts 210, 211, and 212 must be fully investigated under the cGMP quality system.' Any modification to a record after it has been requested is falsification.
IOM §5.6.11.3 requires investigators to maintain a 'Listing of Records.' The firm should maintain a parallel internal record. Without this, you cannot know exactly what the investigator has reviewed when preparing the Form FDA 483 written response.
Destroying records during an active federal inspection may constitute an offense under 18 U.S.C. §1519 (falsification or destruction of records in a federal investigation). 21 CFR 211.180 specifies the minimum retention periods — records must be available for the full period.
21 CFR 211.22(a) gives the quality control unit the authority and responsibility to review production and control records. This review responsibility exists continuously — not just during inspections. Applying this review before providing a record is consistent with existing cGMP requirements.
FDA Data Integrity Guidance (December 2018, Q&A #13): 'Transparency is necessary. All data — including obvious errors and failing, passing, and suspect data — must be in the cGMP records that are retained and subject to review and oversight.' 21 CFR 211.194(a) requires 'complete data derived from all tests.'
IOM §5.5.12.2 establishes the closing meeting where the investigator issues the Form FDA 483. This form lists inspectional observations — conditions the investigator believes may constitute cGMP violations. The March 2026 FDA draft guidance confirms: 'A Form 483 lists inspectional observations but does not represent FDA's final findings or conclusions about an establishment's compliance with cGMP requirements.'
IOM §5.7.1.4.17 documents 'Voluntary Corrections' made during inspections in the EIR. The March 2026 FDA draft guidance states: 'Partially implemented, or promised, corrective actions are not sufficient to preclude regulatory action.' Verbal commitments that are not met become additional findings in subsequent inspections or Warning Letters.
FDA March 2026 draft guidance: 'FDA recommends submitting a written response within 15 business days of the issuance of the Form 483. Responses received after this timeframe will be considered untimely and the agency may not consider them when it classifies the inspection and determines whether to pursue compliance action, such as a warning letter and/or import alert.'
FDA March 2026 draft guidance: 'Scientific or technical disagreements should be raised with investigators during the inspection.' If a disagreement was not raised during the inspection, the closing meeting is still an appropriate place to raise it — but only with specific evidence. Simply rejecting an observation without evidence is counterproductive and is noted in the EIR.
IOM §5.5.10.5 (Signature Policy) establishes the context for Form FDA 483 signatures. The firm's signature acknowledges receipt of the document. It does not constitute agreement with any observation listed on it.
Section 2: Quality Control Unit — Document Review
FDA Terms: 'Quality control unit' — 21 CFR 211.22 · Records review — 21 CFR 211.192 · ALCOA — FDA Data Integrity Guidance Dec 2018
This section covers the quality control unit's responsibilities for reviewing records and maintaining data integrity during an inspection. The data integrity requirements in this section are grounded in the FDA's Data Integrity Guidance (December 2018) and the specific 21 CFR provisions it cites.
21 CFR 211.192 requires that 'any unexplained discrepancy or the failure of a batch or any of its components to meet any of its specifications shall be thoroughly investigated.' This requirement applies to discrepancies found during the quality unit's normal review — not only to production failures. A discrepancy discovered during inspection must be escalated and investigated, not hidden.
FDA Data Integrity Guidance (December 2018, Q&A #15): 'Regardless of intent or how or from whom the information was received, suspected or known falsification or alteration of records required under parts 210, 211, and 212 must be fully investigated under the cGMP quality system.' Modifying a record after a request has been received for it is falsification — intent does not matter.
21 CFR 211.188 specifies the required contents of batch production and control records. A batch record missing required elements is an incomplete record — providing it as-is will likely generate an observation under 21 CFR 211.188 and 211.192.
FDA Data Integrity Guidance (December 2018) ALCOA framework — 'C = Contemporaneously recorded.' 21 CFR 211.100(b) and 211.160(a) explicitly require that activities be 'documented at the time of performance.' Retroactive documentation is a direct violation of this requirement and is the most common basis for criminal referrals in FDA pharmaceutical enforcement actions.
21 CFR 211.100(a) requires that written procedures be 'approved by the quality control unit.' If the version in use does not match the currently approved version in the document management system, providing the wrong version generates a direct 21 CFR 211.100(a) observation.
Destroying records during an active federal inspection may constitute an offense under 18 U.S.C. §1519. 21 CFR 211.180 requires that records be retained and available for the full retention period. Both requirements apply simultaneously during an inspection.
FDA Data Integrity Guidance (December 2018, Q&A #7): 'Audit trail review is similar to assessing cross-outs on paper when reviewing data. Personnel responsible for record review under cGMP should review the audit trails that capture changes to data associated with the record as they review the rest of the record.'
21 CFR 211.68(b) requires that backup data be 'secure from alteration.' 21 CFR Part 11.10(e) requires audit trails to be 'computer-generated, time-stamped electronic records.' Modifying the systems that generate and protect audit trails during an inspection is a direct Part 11 violation.
This is an internal pre-inspection preparedness practice — it is not a regulatory requirement. It is listed as IBP because FDA investigators are authorized to review all electronic records (FDA Data Integrity Guidance Q&A #17), and informal records found on shared drives may generate observations.
FDA Data Integrity Guidance (December 2018, Background section) establishes ALCOA as the framework for cGMP data integrity. Each element is grounded in specific regulatory citations: Attributable (§§ 211.101(d), 211.188(b)(11)); Legible (§§ 211.180(e)); Contemporaneously recorded (§§ 211.100(b), 211.160(a)); Original or a true copy (§§ 211.180, 211.194(a)); Accurate (§§ 211.22(a), 211.68, 211.188).
FDA Data Integrity Guidance (December 2018, Q&A #13): 'FDA prohibits sampling and testing with the goal of achieving a specific result or to overcome an unacceptable result (e.g., testing different samples until the desired passing result is obtained). This practice, also referred to as testing into compliance, is not consistent with cGMP.'
FDA Data Integrity Guidance (December 2018, Q&A #5): 'When login credentials are shared, a unique individual cannot be identified through the login and the system would not conform to the cGMP requirements in parts 211 and 212.' Individual attribution is required by 21 CFR 211.194(a)(7) (laboratory records must include the initials or signature of the person who performs each test).
FDA Data Integrity Guidance (December 2018, Q&A #14): 'If chromatography is reprocessed, written procedures must be established and followed and each result retained for review (see §§ 211.160, 211.165(c), 211.194(a)(4), and 212.60(a)). FDA requires complete data in laboratory records.'
FDA Data Integrity Guidance (December 2018) ALCOA 'Legible' element: data must be readable and permanent. The correct method for correcting a paper entry is: draw a single horizontal line through the error (original entry must remain readable), write the correct information, add the corrector's initials and date, and state the reason for the correction.
Section 3: Production & Laboratory Personnel
FDA Terms: 'Personnel engaged in manufacture' — 21 CFR 211.25 · 211.28 · Batch records — 211.188 · Lab records — 211.194
This section covers requirements for production operators, laboratory analysts, and other personnel performing GMP functions. The FDA uses the terms 'personnel engaged in the manufacture, processing, packing, or holding' (21 CFR 211.28) and requires that all such personnel have training commensurate with their assigned functions (21 CFR 211.25).
21 CFR 211.182 requires that written records be maintained for major equipment cleaning, maintenance, calibration, and use. The equipment status label is the visible, point-of-use representation of that logged status. An unlabeled piece of equipment or an expired status label means the equipment's actual condition is unknown.
If an investigator observes personnel rapidly correcting a condition as the investigator approaches, this sequence — non-compliant condition present → investigator approaches → condition immediately corrected — is documented in the EIR under 'Objectionable Conditions and Management's Response' (IOM §5.7.1.4.12). It indicates that the non-compliant condition was routinely present during normal operations.
21 CFR 211.28 sets out the personal hygiene and clothing requirements for personnel involved in drug manufacturing. An investigator observing personnel with incorrect gowning documents this as a direct potential observation under 21 CFR 211.28.
21 CFR 211.28(b): 'Personnel engaged in manufacturing, processing, packing, or holding of drug products shall not eat food, drink beverages, or use tobacco products in areas where drug products may be adversely affected.' This is a direct, unambiguous cGMP requirement — violations observed during an inspection are cited under this section.
21 CFR 211.100(a) requires that written production and process control procedures be approved by the quality control unit and followed. Using a superseded version at the point of work means a procedure is being followed that is no longer approved — a direct 21 CFR 211.100(a) observation.
21 CFR 211.100(a) requires that written procedures be documented and approved by the quality control unit. Handwritten reminder notes, informal adhesive labels, and whiteboard instructions that are not part of the approved documentation system are unapproved procedures.
21 CFR 211.68(a) requires that all automatic, mechanical, and electronic equipment be 'routinely calibrated, inspected, or checked according to a written program.' Environmental monitoring instruments are subject to this requirement. 21 CFR 211.160(b)(4) specifies calibration requirements for laboratory instruments.
21 CFR 211.101(c)(2) requires that each container of component dispensed to manufacturing be examined visually for correct labeling and compliance with established specifications. 21 CFR 211.122 addresses labeling requirements. A material without a complete label cannot be verified as the correct material for the process.
21 CFR 211.25 requires that each person performing manufacturing, processing, packing, or holding functions have the education, training, and experience needed for their assigned function. An answer given to an investigator should reflect direct, personal knowledge of the respondent's own assigned tasks — not general knowledge of other areas.
IOM §5.3.1.3 specifically addresses 'Interacting with Hostile and Uncooperative Interviewees' and instructs investigators how to document and respond to behavior that appears designed to suppress information or coordinate responses. Any visible attempt to alert or coordinate with colleagues while the investigator is present is documented in the EIR.
21 CFR 211.100(b): 'Written production and process control procedures shall be followed in the execution of the various production and process control functions.' A live demonstration is a real-time compliance test. Any deviation from the written procedure — even a minor shortcut — is a direct 21 CFR 211.100(b) observation at the moment it occurs.
All statements made to the investigator are documented in the EIR by name and title. Answering questions about functions you are not responsible for creates inaccurate testimony risk — even well-intentioned answers that are factually wrong or partially right become documented inconsistencies.
There is no cGMP violation for not knowing the answer to a question outside your direct function. There are significant consequences — inconsistencies in the EIR — for providing an inaccurate answer. Honest referral to the correct person is the right response.
21 CFR 211.100(a) requires that all production and process control procedures be documented, approved, and scientifically justified. A practice that cannot be traced to an approved written procedure or validated rationale is not a cGMP-compliant practice — regardless of how long it has been done that way.
21 CFR 211.100(b): 'Written production and process control procedures shall be followed in the execution of the various production and process control functions and shall be documented at the time of performance.' FDA Data Integrity Guidance ALCOA 'C' = Contemporaneous: 'documented at the time of performance — see §§ 211.100(b) and 211.160(a).' This is the single most fundamental documentation requirement in cGMP.
21 CFR 211.100(b) requires documentation 'at the time of performance.' An investigator who observes an operator completing batch record entries for steps that occurred hours or days earlier has direct visual evidence of retrospective documentation — this is a real-time data integrity finding.
21 CFR 211.192: 'Any unexplained discrepancy... or the failure of a batch or any of its components to meet any of its specifications shall be thoroughly investigated.' An investigator who observes a deviation that is not recorded in the batch record has found two violations: the deviation itself AND the failure to document it. The documentation failure is often more serious.
21 CFR 211.100(b) requires that written procedures 'be followed in the execution of the various production and process control functions.' This requirement applies equally whether or not an investigator is present. However, nervousness-induced shortcuts during observation are among the most commonly documented investigator findings during production floor walkthroughs.
21 CFR 211.101(c)(2): 'Each container of component dispensed to manufacturing shall be examined visually for correct labeling and compliance with established specifications.' If a material is not listed in the approved batch record, it has not been reviewed and approved by the quality control unit for that use.
FDA Data Integrity Guidance (December 2018, Q&A #12 and Q&A #6): Data must be captured directly in the permanent, controlled GMP record. Unofficial records — personal notebooks, scratch paper, electronic notes on a personal phone — are uncontrolled documents that create parallel, uncontrolled data streams.
21 CFR 211.188 requires that batch records document each significant step in sequence. 21 CFR 211.101(c)(1) requires that each component addition be verified by a second person before the next step proceeds. Starting a later step before an earlier step is formally closed and recorded is a deviation from the approved process sequence.
21 CFR 211.194(a) specifies exactly what a complete laboratory record must contain. An incomplete laboratory record is a direct violation of this regulation. This is one of the most frequently observed findings in pharmaceutical cGMP inspections.
21 CFR 211.192 requires thorough investigation of any unexplained discrepancy or failure. FDA Data Integrity Guidance Q&A #13: 'FDA prohibits sampling and testing with the goal of achieving a specific result or to overcome an unacceptable result.' Any retesting before a formal OOS is initiated is 'testing into compliance' — a direct cGMP violation.
21 CFR 211.194(a)(7) requires individual attribution for every test. 21 CFR Part 11.300 requires that identification codes and passwords be unique to each individual. FDA Data Integrity Guidance Q&A #5: when credentials are shared, 'a unique individual cannot be identified through the login and the system would not conform to the cGMP requirements in parts 211 and 212.'
FDA Data Integrity Guidance (December 2018, Q&A #13): 'FDA considers it a violative practice to use an actual sample in test, prep, or equilibration runs as a means of disguising testing into compliance.' Every instrument action creates an audit trail entry — unofficial runs without a documented analytical purpose are unexplained entries in the audit trail, which are a defined data integrity indicator.
21 CFR 211.68(a): Instruments 'shall be routinely calibrated, inspected, or checked according to a written program.' 21 CFR 211.160(b)(4): Instruments 'shall be calibrated at suitable intervals in accordance with an established written program containing specific directions, schedules, limits for accuracy and precision, and provisions for remedial action.' Using an out-of-calibration instrument invalidates all results generated by it.
FDA Data Integrity Guidance (December 2018, Q&A #14): 'If chromatography is reprocessed, written procedures must be established and followed and each result retained for review.' 21 CFR 211.194(a) requires 'complete data derived from all tests.'
21 CFR 211.194(a)(2) requires that laboratory records include 'a statement of each method used in the testing of the sample.' If the method version in the instrument software does not match the approved version in the document management system, the analysis is not being performed per the approved method.
FDA Data Integrity Guidance (December 2018, Q&A #10): 'Electronic records from certain types of laboratory instruments — whether stand-alone or networked — are dynamic, and a printout or static record does not preserve the dynamic record format that is part of the complete original record.' 21 CFR 211.180(d) requires that original records or true copies be retained.