Closing the DSCSA Investigation Gap
Suspect-product handling asks distribution and dispensing teams to run the kind of investigation a GMP quality unit runs every day. On that side of the industry, the muscle often isn't there yet.
The stabilization period is over, and most of the industry is now inside the enhanced DSCSA requirements.
Manufacturers, repackagers, wholesale distributors, and dispensers with 26 or more full-time pharmacy employees have now passed the expiration dates for FDA’s temporary exemptions from certain enhanced tracing requirements. Small dispensers (defined for this exemption based on the company that owned the dispenser having 25 or fewer full-time pharmacists and qualified pharmacy technicians as of November 27, 2024) remain exempt from those specified requirements until November 27, 2026.
(Those exemptions don’t suspend the separate DSCSA requirements for handling suspect and illegitimate product.)
Most of the attention we’ve seen here has gone to serialization and interoperable data exchange. That is the visible, expensive, IT-heavy part, and it deserves the attention it gets. The part that gets less of it is what a trading partner actually has to do when a product looks wrong. That’s an investigation, and it looks a lot more like GMP work than distribution work.
We broke down the verification-systems guidance when it was finalized way back in 2023. Today, we wanted to talk about the operational reality underneath it since it’s come up in multiple conversations we’ve had with experts and industry teams.
What the law asks you to do with a suspect product
Under section 582 of the FD&C Act, manufacturers, repackagers, wholesale distributors, and dispensers must have systems to identify suspect product and handle it. A suspect product is one for which there is reason to believe it may be counterfeit, diverted, stolen, the subject of a fraudulent transaction, intentionally adulterated in a way that would cause serious adverse health consequences or death, or otherwise unfit for distribution with similarly serious consequences.
The FDA spells out how it reads each of those terms in its Definitions of Suspect Product and Illegitimate Product guidance.
When something meets that bar, the steps are specific.
Quarantine it from distribution using physical separation, effective electronic controls, or both.
Investigate in coordination with your trading partners, which includes validating any applicable transaction history and transaction information in the trading partner’s possession and conducting the required product-identifier verification.
Then decide.
The workflow is laid out in FDA’s Verification Systems guidance and summarized cleanly in the Partnership for DSCSA Governance’s report on suspect-product investigations.
Two outcomes branch from there:
If the investigation clears the product and it was the subject of an FDA request to verify the identifier, you file a cleared product notification that states why the product was suspect and summarizes the investigation that cleared it.
If the investigation shows the product is illegitimate, the clock starts. You have 24 hours to notify FDA and the immediate trading partners you have reason to believe may have received the product. The FDA says it prefers submission through the 3911 platform in CDER NextGen, although a completed Form FDA 3911 may also be submitted by email.
Why this is GMP muscle
You might notice that this reads more like a deviation investigation than typical distribution work.
Distribution and dispensing operations are built to move product accurately and fast. When a case comes up short or a scan won’t reconcile, the reflex is to fix the count and keep the line moving. That reflex is efficient, but under DSCSA it’s also the wrong one, because a short case or a mismatched identifier can be the first sign of theft, diversion, or a counterfeit finding its way into the chain.
The discipline the law is asking for here already exists on the manufacturing side. It lives in 21 CFR 211.192. That rule tells a quality unit:
that any unexplained discrepancy or specification failure has to be thoroughly investigated, whether or not the batch already shipped,
that the investigation has to extend to other batches or products that might be affected, and
that a written record has to capture the conclusions and follow-up. In practice, that means establishing the cause, defining the scope, documenting the conclusions, and completing appropriate follow-up.
A GMP investigator does this without thinking about it. That’s the posture DSCSA requires, and that the enhanced system makes increasingly difficult to avoid.
When investigations get treated as paperwork instead of real work, root causes get named and closed without support, and the record falls apart under scrutiny. We wrote about how that plays out under 211.192: teams that don’t take clear notes, discrepancies miscategorized at the start, root causes labeled “to be determined” and never resolved.
Where the gap shows up
Here are a few of the places this tends to break (and therefore where you should devote your attention):
No written definition of suspect versus illegitimate that a floor supervisor can actually apply, so the judgment call gets made inconsistently or not at all.
No named owner for the 24-hour notification, so the clock is already running before anyone realizes a 3911 has to go out.
Investigations that record what happened but not why, with no follow-up. That is the classic 211.192 finding, moved into a new setting.
Quarantine that isn’t immediate, or isn’t controlled tightly enough to prove the product went nowhere.
Records that aren’t held for the full six years.
None of these are particularly unusual or new. They’re the predictable result of asking an operation built for throughput to behave, on short notice, like a quality unit.
What to consider putting in place
If you run distribution or dispensing, or you support a client who does, these are a few things to consider (not a full list of course and certainly subject to context):
Write your SOPs around FDA’s own definitions. The Definitions guidance gives you the language, so take it and turn it into triggers that a warehouse or pharmacy team can apply without a deep RA background.
Borrow the GMP investigation structure. Problem statement, scope and extension to related product, product-identifier verification, transaction-history validation, root cause, disposition, conclusions, follow-up. If your quality unit already has a deviation template, most of it transfers with (probably) light editing.
Name the owner and rehearse the 24-hour path. Someone has to own the call that a product is illegitimate and the filing that follows it! Set up CDER NextGen access before you need it, and run a drill, so the first real 3911 isn’t the first time anyone in the building has seen the form.
Make quarantine real. Physical or electronic, immediate, and documented well enough to hold up in an inspection.
Hold the records for six years. Investigations, cleared product notifications, dispositions, all of it!
Train the floor, not just the binder. The people most likely to catch the first signal, a damaged case, a short count, an identifier that won’t verify, are the ones handling product, not the ones writing procedures.
The firms that come through the next round of inspections cleanly won’t be the ones with the most expensive serialization stack. They’ll be the ones who treated suspect-product handling as an investigation from day one and documented it like one.
If you’re not confident your operation could pass that test, that’s the kind of gap we help close. Talk to us.
Who is The FDA Group?
The FDA Group helps life science organizations rapidly access the industry's best consultants, contractors, and candidates. Our resources assist in every stage of the product lifecycle, from clinical development to commercialization, with a focus on Quality Assurance, Regulatory Affairs, and Clinical Operations.
With thousands of resources worldwide, hundreds of whom are former FDA, we meet your precise resourcing needs through a fast, convenient talent selection process supported by a Total Quality Guarantee. Learn more and schedule a call with us to see if we’re a fit to help you access specialized professionals and execute your projects on time and on budget.