15 Audit Questions That Could Save You From an FDA Warning Letter (Part 1)
Real findings from recent enforcement actions — and the internal audit questions your QA team should be asking right now. Part 1 of 3.
We recently reviewed a series of FDA warning letters that revealed several recurring compliance issues. Now, we’re launching a three-part series that revisits those letters with a sharper focus: highlighting key questions you should be asking during internal audits.
While the deficiencies span various GMP areas, data integrity is the common thread — and it continues to be one of the most frequent triggers for FDA enforcement actions. In fact, data integrity concerns routinely surface in our own client audits. That’s why we’re kicking off this series with 15 essential questions you can use to probe for potential gaps — starting with the first five today.
This guide draws directly from recent FDA warning letters citing data integrity failures:
Use these questions as part of your audit toolkit to help detect and resolve data integrity vulnerabilities — before they show up during an FDA inspection. Talk to us if you don’t know or don’t like your answers to any of these questions. We provide audit and mock inspection support for 17 of the top 25 life science companies.
1. Does your facility design provide adequate separation for manufacturing areas, particularly for products with high pharmacological activity or toxic materials?
The FDA cited Aspen Biopharma for producing higher-risk APIs in a facility that lacked appropriate separation for high pharmacological activity or toxic materials. Its facility was "in a state of disrepair, with manufacturing areas open to the outdoor environment with inadequate protection of materials" and manufactured drugs "under one roof without proper segregation."
Most teams know their facilities should be designed with proper segmentation, but we sometimes come across sites that don’t consider actual product risk profiles in their designs. In our audits of manufacturing sites, we’ve observed inadequate (or more specifically, under-sophisticated) segregation strategies, particularly in older facilities that have expanded operations over time.
A few things we see from time to time:
Facilities handling highly potent compounds using only procedural controls rather than engineering controls for containment.
Cross-contamination risks created by shared HVAC systems between manufacturing areas of different classifications.
Renovation projects without adequate interim containment strategies.
Insufficient airlock systems between areas of different classifications.
Companies with excellent facility designs on paper but poor execution in maintenance, creating gaps in wall panels, ceiling tiles, and door seals.
If you don’t already have one, we recommend implementing a formal, documented zoning strategy with differential pressure cascades between areas, dedicated equipment for high-potency products, and regular facility integrity assessments. These assessments should include visual inspections and environmental monitoring to verify that containment is actually effective.
The strongest programs we see have a quantitative exposure control banding (ECB) strategy aligned with occupational health and safety standards — and it’s fully integrated into facility zoning and equipment selection. These teams perform detailed risk assessments that consider not just the active ingredient’s potency, but also cleaning feasibility, batch sizes, and airborne exposure potential.
Word to the wise if you’re putting such a program in place — we’ve seen firms adopt robust zoning policies but fail to connect them to actual health-based exposure limits (HBELs). Your containment and HVAC design should be linked to toxicological thresholds, not just risk categories. This is often overlooked in cross-functional planning.
2. Has your firm validated all manufacturing processes at commercial scale with appropriate equipment—and are complete validation records readily retrievable?
Aspen Biopharma relied on validation studies conducted on development lot sizes for API intermediates that used different equipment than that used for commercial production. The FDA noted these studies were insufficient to demonstrate that their manufacturing process could reproducibly manufacture an API meeting predetermined quality attributes.
We routinely encounter companies attempting to leverage development-scale validation work for commercial manufacturing. This approach nearly always fails to satisfy regulatory expectations when the actual FDA gets involved.
Here are a few things we find that are problematic:
Validation documents that don't clearly identify the equipment used, making it impossible to confirm whether commercial equipment was employed.
Scale-up parameters that haven't been properly studied to understand their impact on critical quality attributes.
"Copy-paste" validation protocols that don't account for specific process risks.
Missing equipment qualification documentation for commercial equipment.
Validation gaps when processes are transferred between manufacturing sites.
To be clear, a compliant validation program requires complete validation at commercial scale using production equipment. This validation should include thorough documentation of critical process parameters and their acceptable ranges, process capability analysis to demonstrate reproducibility, and ongoing process verification to ensure continued control. When we step in to help with remediation on the points above, we typically start with validation risk assessment to identify the most critical processes requiring immediate attention, followed by a prioritized validation schedule to kick off the needed work projects.
Be sure you’re including material traceability from validation batches through to the final product to prove end-to-end consistency. And use retrospective data from process monitoring to statistically confirm process capability (e.g., Cp, Cpk analysis) across multiple commercial batches.
Regulators often look beyond validation summaries — they want to see if commercial production behaves as predicted. We recommend linking validation studies to actual batch performance data across time, which is often missing or poorly documented.
3. Does your cleaning validation program adequately address worst-case scenarios, including high-potency products, difficult-to-clean residues, and maximum hold times?
The FDA observed manufacturing equipment labeled "Cleaned" at Aspen Biopharma that contained "liquid with a floating substance or residue on product-contact surfaces." The company acknowledged lacking cleaning validation despite previously identifying this need in an internal deviation report.
Cleaning validation has always been one of the most challenging areas for the clients we audit. A few gaps to look for here: