What should you expect during an FDA inspection of a drug manufacturer?

1Why FDA inspects, and how a site is chosen.

Section 704 of the FD&C Act lets FDA staff, on presenting credentials and a written notice, enter a drug establishment at reasonable times and inspect it “within reasonable limits and in a reasonable manner”. For prescription and human nonprescription drugs, the inspection extends to “all things therein (including records, files, papers, processes, controls, and facilities)” bearing on whether drugs are adulterated or misbranded. It does not extend to financial data, sales data other than shipment data, pricing data, personnel data other than the qualifications of technical and professional staff, or research data other than data on new drugs and other products subject to FDA reporting rules.¹

FDA describes four types of inspection: surveillance inspections of products on the market, for-cause inspections when it has reason to believe a facility has quality problems, application-based inspections as part of an application review, and follow-up inspections after earlier violations or agency action.² For surveillance, FDA prioritises sites by facility type, compliance history, including whether the site has been inspected in the last four years, hazard signals such as recalls, the inherent risk of the product and whether a foreign regulatory partner has inspected the site.³

2Whether you will be told in advance.

The FD&C Act does not require FDA to pre-announce drug inspections, and FDA usually does not pre-announce for-cause and routine surveillance drug inspections. Its general practice is to contact the firm before pre-approval and pre-license inspections and most inspections of foreign drug facilities.⁴ When FDA pre-announces a domestic inspection, it should generally do so no less than five calendar days ahead and tell the establishment the purpose, estimated duration and number of FDA staff. The purpose is to make sure the right records and people are available; FDA’s manual tells investigators not to call it an “appointment”, and a pre-announced inspection does not limit the investigator’s authority.⁵ An unreasonable delay in agreeing a date can cause the site’s drugs to be deemed adulterated under section 501(j).⁴

3The first hour: credentials, Form FDA 482 and the walk-through.

On arrival the investigator finds the owner, operator or agent in charge, normally the top management official on site, shows credentials and hands over a signed Form FDA 482, Notice of Inspection. Management may examine the credentials and record their number but may not photocopy them. Form FDA 482 is not issued on inspections outside the United States, though credentials are still shown.⁵ The investigator explains the purpose of the visit and should “readily accept” an offer of a company representative to accompany them.⁵

A walk-through of the premises comes as early as possible, to learn the products and processes, find the sources of manufacturing records and plan the depth of the inspection.⁵ Investigators follow the firm’s gowning and sanitation practices, and rarely need to enter sterile rooms. They are not authorised to sign waivers, confidentiality letters or other non-FDA documents, but may sign in and out and follow site security measures.⁵

4What the investigator examines.

Compliance Program 7356.002 groups drug CGMP work into six systems, each mapped to subparts of 21 CFR part 211.⁶

A full inspection normally covers at least four systems and an abbreviated one at least two; the quality system must be one of them. FDA selects the full option for the first inspection of a newly registered site, for sites that move in and out of compliance and after significant changes, and the abbreviated option for sites with sustained acceptable compliance.⁶ To find problem products, the manual suggests reviewing complaint files early, visiting quarantine, returned and rejected product areas, and reviewing laboratory data, out-of-specification investigations and the annual record reviews under 21 CFR 211.180(e).⁵

Investigators take photographs without asking permission, because FDA treats photography as part of its inspection authority.⁵ Impeding necessary photography, or delaying production of records without a reasonable explanation, may count as limiting or delaying the inspection. FDA accepts reasonable explanations, such as records needing translation, records in use in a running operation, a large volume to compile, or photography that would harm product quality.⁴

5How findings are discussed and the inspection closes.

The investigator should meet firm management at least once each inspection day to discuss findings likely to become observations, and should not give advice or consultation.⁵ At the close, the investigator meets the most responsible individual available, issues Form FDA 483, Inspectional Observations, and explains each observation. Observations of questionable significance are not listed but are discussed and recorded in the establishment inspection report (EIR) as discussion items, and may be followed up at the next inspection.⁵ For drug inspections the programme division decides whether to annotate the 483 with the firm’s corrective action status, such as “Promised to correct”; annotation is voluntary for the firm.⁵

A Form 483 does not list every possible deviation, and it is not FDA’s final determination of a violation. FDA considers it alongside the EIR, the evidence collected and the company’s response.⁷ The investigator tells management that an adequate response received within 15 business days of the end of the inspection may affect whether FDA takes further action.⁵

6What happens after the inspection.

FDA classifies each inspection as No Action Indicated (NAI), Voluntary Action Indicated (VAI), meaning objectionable conditions were found but FDA is not prepared to take or recommend action, or Official Action Indicated (OAI), meaning regulatory or administrative action is recommended. The firm’s response and its proposed or completed corrective actions are considered.⁸ For surveillance inspections under Compliance Program 7356.002, an NAI or VAI outcome is confirmed in a letter within 90 calendar days of the close. An initial OAI goes to CDER’s Office of Manufacturing Quality, which issues a decisional letter within 90 days of the close and, if the final classification is OAI, takes an appropriate action within 90 days of that letter.⁶

Once FDA considers the inspection closed, it sends the firm a redacted copy of the narrative part of the EIR, within 45 calendar days of that determination; attachments and exhibits are not included.⁹ Where an inspection finds CGMP failures, FDA’s tools include warning letters, import alerts, injunctions, seizures and civil money penalties, and it often meets manufacturers to discuss findings.¹⁰

7How long an inspection takes.

The law sets no fixed length: each inspection “shall be commenced and completed with reasonable promptness”.¹ Investigators should inspect on consecutive business days where possible and, if there will be breaks, tell management promptly when the inspection will resume.⁵ Not every inspection is a full one: Compliance Program 7356.002 says it is not anticipated that full inspections, covering four to six systems, can be conducted every time.⁶

8How it runs in Seal.

Much of an inspection is requests: a batch record, the training of the people who made the batch, the calibration of the instruments they used. In Seal those records are linked, so inspection readiness opens a requested batch record with its steps, signatures and deviations, and evaluates training and calibration status for the date of the work. Each request keeps its verbatim wording, agreed interpretation, owner and the evidence delivered, and a delivered package keeps its source record versions, so the team can show later exactly what the investigator was given. Observations become commitments linked to CAPA and verification.

Neil can answer an audit evidence request by assembling the records behind the question and making missing evidence explicit; your audit owner checks scope and completeness before anything is shared. Audit management runs internal, supplier and client audits on the same records, with each finding linked to its assessment, change and verification.