15 Audit Questions That Could Save You From an FDA Warning Letter (Part 2)
More real-world findings from FDA enforcement — and the audit questions every QA team should be asking. Part 2 of 3.
In Part 1 of this series, we broke down the first five audit questions pulled directly from recent FDA warning letters. These questions weren’t theoretical — they were based on real, repeated deficiencies that triggered 483s, import alerts, and in some cases, serious remediation obligations. And they were problems we continue to find in our own audit work for clients, time after time.
We showed how gaps in facility design, process validation, cleaning validation, document controls, and supplier qualification can expose firms to data integrity risks that continue to be among the most common — and most preventable — issues cited by FDA investigators.
In case you missed Part 1, read it here:
Now in Part 2, we’re continuing with five more questions that dig deeper into technical operations — this time focusing on stability programs, aseptic processing, environmental monitoring, batch record documentation, and computer system controls. Again, these areas often reveal issues that fly under the radar until they’re exposed during an inspection.
And once again, these aren’t just generic best practices. Each of these audit questions is drawn from recent enforcement activity and backed by what we see every week in our own audit and remediation work across the industry. If you’re not asking these questions during your internal audits — or you’re unsure of the answers — that’s a signal to take a closer look. Talk to us so we can help you catch and remediate them during an audit, rather than during an actual inspection. We provide audit and mock inspection support for 17 of the top 25 life science companies.
Let’s get into the next five.
6. Does your stability program include appropriate stability-indicating methods and testing for all critical quality attributes, including active ingredient content, throughout the claimed shelf life?
Hangzhou Glamcos failed to establish an adequate stability program, specifically noting they "did not include active ingredient testing as part of [their] stability program."
Aspen Biopharma was cited for not having adequate data to support the retest date for drugs shipped to the United States.
We frequently encounter inadequate stability programs in our auditing work. More specifically:
Stability protocols are missing critical quality attributes (especially active ingredient testing).
Teams using non-stability-indicating analytical methods.
There’s no statistical evaluation of stability results to identify trends.
Stability chambers don’t offer appropriate temperature mapping or backup power.
Companies using insufficient sample sizes to support claimed expiry periods.
There are missing or incomplete stability reports,
Companies decide to extend expiry dates without any or enough supporting data.
Teams don’t include stability samples in commercial packaging configurations.
Patients shouldn’t be at risk of receiving products that may have degraded below specification limits. To address these issues, we typically guide clients to implement comprehensive stability programs with validated stability-indicating methods, appropriate testing intervals, statistical trend analysis, and clearly defined shelf-life acceptance criteria.
For companies with limited resources, we often recommend a staged approach that prioritizes stability studies for high-risk or high-volume products while developing a comprehensive program for the entire product portfolio.
A few best practices we’ve gathered over time to consider here:
Integrate your degradation pathway knowledge early. Many stability programs fail because they don’t leverage forced degradation studies to actually guide method development. Your methods should be stability-indicating because they’ve been challenged to detect likely degradants.
Use trending tools, not just static timepoint reviews. Relying solely on pass/fail at each interval misses gradual decline, which is exactly the kind of decline that tends to happen most frequently. The best fix is implementing regression-based trend analysis (e.g., using ICH Q1E principles) to detect subtle instability patterns that may not yet cross specification limits.
Make sure to account for temperature/humidity excursions. Always include automated alerting and investigation triggers when chamber excursions occur. We find that excursion handling is often poorly documented, leading to questions about data validity. Close this door to inquiry.
Use lifecycle stability planning. Don’t treat stability as a one-time program. Post-approval changes (e.g., new packaging, site transfers, new suppliers) should trigger stability impact assessments. Few companies do this rigorously unless pushed by regulators.
7. Has your firm validated aseptic processing operations through media fills performed under worst-case conditions, and do you have systems to investigate any contamination detected during these studies?
Annovex Pharma's media fills "were not performed under the most challenging or stressful conditions." Additionally, they "continued to produce and distribute drug products intended to be sterile despite positive growth being identified in 10% of filled units during [a] media fill" and "failed to investigate the positive growth and discarded all units that showed signs of microbial contamination."
We often find media fills conducted under ideal rather than worst-case conditions. Another problem: an inadequate number of units to provide statistical confidence.
The most concerning issue we encounter is companies discarding contaminated units rather than investigating them, essentially "hiding" evidence of aseptic processing failures. We’ve helped teams design robust media fill programs that truly challenge the aseptic process by incorporating maximum personnel, extended durations, and all anticipated interventions. Whenever possible, we emphasize how important it is to investigate any contamination, even a single unit, to understand root causes and implement appropriate corrective actions before resuming production.
Also, make sure you’re mapping interventions to actual risk ranking. Way too many media fills don’t adequately model the highest-risk interventions. Build an intervention map that categorizes by frequency and contamination risk, and ensure all are represented in media fills — especially rare but high-risk ones.
A few other quick tips here:
Validate at maximum allowable batch duration and at multiple line speeds (if applicable) to stress the system. This is often omitted but becomes critical when contamination events arise during full-scale production.
Simulate worst-case environmental conditions. Validate under higher bioburden input conditions (e.g., after filter changeout) to test the process’s robustness — not just environmental sterility.