1. What FDA reported

In July 2026, FDA's Center for Drug Evaluation and Research issued a warning letter to a contract manufacturer of over-the-counter drug products following an inspection conducted earlier that year. The letter cited multiple CGMP violations under 21 CFR parts 210 and 211. The first citation is the one worth studying closely.

Under 21 CFR 211.22, FDA found that the quality control unit failed to exercise its responsibility to ensure drug products complied with CGMP. Specifically, the quality unit failed to ensure that CGMP records were retained and available for review. Investigators recovered original data that had been discarded. According to the letter, the recovered documents included executed production batch records, media preparation records, incubation and sterilization cycle logbook pages, finished product sample collection forms, environmental monitoring sample forms, and product complaint and change control log forms.

FDA further found that the firm did not retain original laboratory data supporting the test results used to release commercial batches, and could not make that data available for agency review. Laboratory logbooks had unnumbered pages, lacked reconciliation, and were not completed contemporaneously. FDA cited a specific practice: personnel recorded volume entries in pencil and subsequently overwrote them in ink after the weight check activity was complete.

The firm had already responded to the Form FDA 483. In that response, as characterized by FDA, the firm attributed the destroyed documents to the actions of a former employee, a plant manager, who had made false entries in order to intentionally increase yield. The firm described the matter as an isolated and exceptional incident with no identified impact on approved or controlled documents, and stated that the employee had been terminated.

FDA rejected that account directly. The letter states that the firm's position was contradicted by the evidence provided to investigators, and that the evidence indicated the manager had been repeatedly observed, on multiple occasions, destroying batch production records, destroying laboratory-controlled records, and falsifying production and laboratory data.

FDA concluded the response was inadequate on three grounds. The firm did not address what the agency characterized as persistent data integrity issues. The firm did not provide detailed or systemic remediation. And the firm did not conduct a comprehensive evaluation of manufacturing and laboratory records to determine the impact of the data integrity breaches on the quality of product manufactured for the U.S. market.

FDA then set out what it wanted instead. A comprehensive investigation into the extent of the inaccuracies, with a written protocol and methodology, defined scope, and justification for any operation the firm proposed to exclude. Interviews of current and former employees, conducted by a qualified third party. An assessment identifying omissions, alterations, deletions, record destruction, and non-contemporaneous completion across the facility. A retrospective evaluation by a qualified third party with expertise in the affected areas. A current risk assessment covering both patient risk from released product and risk from ongoing operations. A global corrective and preventive action plan with root causes for each deviation. A statement of whether the individuals responsible remain able to influence CGMP or application data. Interim measures. Long-term measures reaching management oversight and human resources. A commitment to annual third-party audits for at least two years to evaluate CAPA effectiveness. And a statement of whether the firm would appoint a chief integrity officer empowered to receive anonymous employee complaints with authority to ensure prompt investigation.

Two further citations rounded out the picture:

  • FDA cited inadequate process and cleaning validation following commercial scale-up under 21 CFR 211.100, noting that validation had been performed years earlier, before the scale-up occurred.

  • FDA also cited inadequate laboratory controls under 21 CFR 211.160(b), specifically the absence of testing for objectionable microorganisms in a topical product.

Finally, FDA restated a principle that applies to every contract relationship: the agency regards contractors as extensions of the manufacturer, and a firm is responsible for the quality of the drugs it produces as a contract facility regardless of the agreements in place with product owners.

**On sourcing and status.** Every company-specific fact above is drawn from the FDA warning letter and from no other source. The firm is not named here by editorial choice. Regulatory status changes after a warning letter is issued. Firms respond, remediate, and in some cases receive close-out letters; others face escalation including import alert or consent decree. Readers should consult FDA's warning letter database for the current status of any enforcement action. Everything that follows the next section is Bayou Vantage's framework and analysis, not an FDA requirement.

2. Why personnel action is not complete remediation

Removing an individual stops one person from causing further harm. That is a real outcome and it is worth doing quickly. It is also the smallest part of the work.

Termination answers the question "who did this." Regulators, customers, and boards ask four more questions immediately afterward, and none of them are answered by a personnel file.

1. How did this continue?

If a manager destroyed batch records repeatedly, over an extended period, across both production and laboratory systems, then the conduct persisted through many cycles of review, reconciliation, and approval. Records went missing and reconciliation did not surface it. Entries were made non-contemporaneously and review did not catch it. Product was released on laboratory data that could not subsequently be produced, and the disposition decision proceeded anyway. Those are control failures, and terminating a person remediates none of them.

2. Who else knew?

Behavior observed on multiple occasions was observed by someone. What happened next is the finding. Either the observation never escalated, which means the escalation path is broken, or it escalated and produced no action, which means the authority structure is broken. Those are different failures requiring different remediations, and an investigation that does not distinguish between them will produce a CAPA aimed at the wrong layer.

3. What did the data touch?

Personnel action is a forward-looking measure. It does nothing about product already released, decisions already closed, or commitments already filed on the strength of data now known to be unreliable.

4. Why was it worth doing?

Falsifying entries to increase yield is not a random act. Yield pressure originates in targets, incentives, and the consequences attached to missing them. None of those originate with a plant manager.

  1. There is a harder truth underneath this. A termination is frequently the fastest way to make an investigation feel finished, because it supplies a satisfying causal story and a visible consequence. That is precisely why it is dangerous. The organization experiences closure while the conditions that produced the conduct remain fully intact, and the next occurrence is treated as another isolated incident because the first one was classified that way.

3. The four layers of a data integrity investigation

Bayou Vantage structures data integrity investigations in four layers. This is our framework and it is not a regulatory requirement. We use it because investigations that stop at the first layer fail effectiveness review with predictable regularity.

  • Layer one: Individual conduct. What did the person do, over what period, across which systems, products, and record types? Establish the exposure window from evidence rather than from admission, because the admitted window is almost always shorter than the actual one. Determine whether the conduct was opportunistic or method-driven, because a repeatable method implies other people could execute it.

  • Layer two: Failed controls. For each designed control that should have detected or prevented the conduct, determine why it did not fire. Controlled issuance and reconciliation of logbooks and forms. Contemporaneous recording requirements. Record retention, archival, and destruction authorization. Second-person verification. Audit trail review. Batch record review before disposition. Periodic self-inspection. Each control resolves to one of four states, and the distinction matters: the control did not exist; the control existed on paper but was never operationalized; the control operated but was not designed to detect this failure mode; or the control detected the failure and the signal was not acted on. Only the last one is a culture finding. The first three are design findings, and design findings are fixable with engineering rather than exhortation.

  • Layer three: Management environment. What conditions made the conduct achievable, rational, or unremarkable? Production targets and how misses are handled. Staffing levels against the review workload the quality system assumes. Supervisory span of control. Whether raising a problem is treated as diligence or as obstruction. Whether the site had ever practiced escalating a concern about a person with authority. This layer is where most investigations lose their nerve, because it implicates the people commissioning the investigation.

  • Layer four: Quality governance. Did the quality unit have the authority, independence, resourcing, and information required to act? A quality unit without standing to halt release, or without visibility into the records it is accountable for, will produce this outcome regardless of who is employed there. This layer asks whether the quality unit was structurally capable of performing the function the quality system claims it performs. Layers three and four are where durable CAPA lives. They are also the layers most often deferred, and deferring them is the single most reliable predictor that the finding will recur.

4. Assessing product and patient impact

The moment data reliability is in question, every decision that depended on that data becomes provisional. The assessment that follows has to be built on that premise rather than on the hope that most of the data was probably fine.

Start by bounding the scope from access rather than from admission. Identify every system, product, record type, and time period the individual could have touched, then extend the window to the earliest point at which the controls that should have detected the conduct can be demonstrated to have been operating effectively. If that point cannot be established, the window opens to the beginning of the individual's tenure in the role.

Then invert the standard question. The issue is not whether a batch passed. It is whether reliable, retained evidence exists that it passed. Where the original record is gone or unverifiable, the batch does not become failing; it becomes unsupported, and unsupported is its own disposition category requiring its own decision.

Substitute evidence is what closes the gap. Retain sample testing against full chemical and microbiological specifications. Stability data from the affected batches and from bracketing batches. Complaint and adverse event history for the exposure window. Independent analytical verification by a qualified laboratory. Comparison of the affected batches against a period of demonstrated control.

Patient impact analysis follows product impact and is a separate exercise. The relevant exposures depend on the product. For a topical product, microbiological quality, potency, and impurity profile are the primary vectors, and the absence of objectionable organism testing converts a records problem into a patient safety question on the same batch. For a sterile product, the calculus changes entirely, because environmental monitoring and sterilization cycle records are among the most commonly destroyed record types and are also the least substitutable after the fact.

Where impact cannot be excluded, the available actions are customer and distributor notification, additional testing, expanded stability enrollment, enhanced complaint surveillance, market action, and regulatory application review. The decision on each one is a quality decision and should be documented as such, with the evidentiary basis stated. An assessment that concludes "no impact identified" without stating what was examined and what could not be examined will not survive an inspection.

5. Reconstructing decisions made from unreliable data

This is the step most firms skip. It is also the step that determines whether the investigation is complete, because compromised data does not sit still. It flows into decisions, and those decisions flow into other decisions.

Consider what depends on batch and laboratory records:

- Lot disposition and release

- Out-of-specification investigations and result invalidations

- Deviation closure and root cause determinations

- Change control approvals and their effectiveness verifications

- Complaint investigation conclusions and trending

- Annual product review and product quality review conclusions

- Process capability analysis and continued process verification

- Stability program decisions and shelf life justification

- Supplier, laboratory, and contract facility qualification status

- Content of regulatory submissions, commitments, and annual reports

The warning letter under discussion listed complaint log forms and change control log forms among the recovered documents. That detail deserves attention. When the governance records themselves are among the compromised documents, the decision layer is directly implicated rather than merely downstream. The system used to manage change and the system used to detect signal from the field are both operating on a record base of unknown reliability.

A decision reconstruction exercise maps every quality decision made during the exposure window, identifies which ones relied on data now considered unreliable, and re-adjudicates each one against evidence that survives. Three outcomes are possible for each decision. It is confirmed on surviving evidence. It is reversed. Or it cannot be adjudicated, in which case it is documented as unresolvable and carried forward into the risk assessment rather than quietly allowed to stand.

Two second-order effects need explicit treatment. First, invalidated OOS results are a high-yield review target, because invalidation is the mechanism by which an unwelcome result is removed from the disposition decision. Every invalidation in the window should be re-examined against its original justification. Second, any deviation or complaint closed as "no impact" during the window was closed using the record base now in question, and a no-impact conclusion drawn from unreliable data is not a conclusion.

6. Management oversight and Quality independence

The warning letter contains a principle that executive teams should read carefully. FDA stated that engaging a consultant does not relieve the firm of its obligation to comply, and that executive management remains responsible for resolving all deficiencies and systemic flaws.

That is the operative point. Accountability does not transfer outward to a contractor, and it does not transfer downward to the person who was terminated. It stays where the authority sits.

The governance diagnostic is specific and answerable:

Reporting line. Does the quality unit report through a line independent of manufacturing output, delivery schedule, and commercial revenue? If the person who can approve release also carries the yield number, independence exists on the org chart and nowhere else.

Authority to stop. Can quality leadership halt release without negotiation, and is there evidence in the last twenty-four months that this authority was exercised? An authority never used is indistinguishable from an authority that does not exist.

Resourcing against claimed activity. The quality system asserts that certain reviews occur. Compare the hours those reviews require against the hours available to the people assigned to them. A review that is mathematically impossible is a review that is not happening, and the record will eventually show it.

Information quality at management review. Did management review receive accurate data on logbook reconciliation exceptions, record retrieval failures, audit trail review coverage, and late entries? Or did it receive the metrics that were easy to produce? Management cannot act on a signal it never sees, and a management review populated exclusively with green indicators is itself a finding.

Contract relationships in both directions. FDA regards contractors as extensions of the manufacturer. If you are the contract facility, your quality agreement does not reduce your obligation. If you are the product owner, your supplier's data integrity failure becomes your product impact assessment, your customer notification, and your inspection exposure. Data integrity qualification of contract facilities is a distinct exercise from delivery and cost qualification, and most supplier programs do not perform it.

7. Speak-up mechanisms and retaliation risk

The warning letter asked the firm to inform FDA whether it would appoint a chief integrity officer, fully empowered to receive anonymous employee complaints regarding data integrity, with authority to ensure any potential breach is promptly investigated by an independent quality assurance function.

That request reframes what a speak-up system is for. It is not a compliance ornament. In an environment where a person with authority is destroying records, it is the only detection control that does not depend on the record itself.

**The following is Bayou Vantage guidance and does not describe findings at any specific firm.** In our experience, speak-up systems fail for structural reasons far more often than cultural ones:

- Reports route through the same management chain the concern is about, which makes the first escalation step the highest-risk action the reporter can take.

- Anonymity is promised in policy but not protected in architecture, so reporters correctly assume they are identifiable.

- Reporters receive no acknowledgment and no closure, so the system is understood within one cycle to be theater.

- Investigators are drawn from the operation under review, so the outcome is predictable before the investigation begins.

- No mechanism exists to detect retaliation after the fact, which means the deterrent effect of a single retaliation event is permanent and organization-wide. A functioning system has an intake path that bypasses line management entirely, an investigation function independent of the area under review, defined acknowledgment and closure commitments to the reporter, active retaliation monitoring for a defined period following any report, and reporting of volume and disposition to the board or its equivalent.

One measurement note. Zero reports is not a good result and should never be presented as one. It is an unexamined signal, and the two explanations for it are that nothing is wrong or that nobody believes reporting is safe. Only one of those is consistent with a site where records were being destroyed in view of other people.

8. Interim controls during remediation

Comprehensive remediation takes months and product decisions do not pause while it happens.

Interim controls are the bridge. They are deliberately conservative, deliberately temporary, and deliberately documented as interim so they do not quietly harden into the permanent state and then get quietly removed when attention moves on.

A practical interim set:

- Enhanced review of all records in affected areas before disposition, performed by a reviewer outside the affected operation

- Dual verification for critical data entry, with the second signature carrying defined accountability rather than acting as a countersignature

- Controlled issuance, numbering, and reconciliation of every GxP logbook and form, with reconciliation performed on a defined frequency rather than at close-out

- Sequestration of all records associated with the exposure window, with controlled access

- Independent third-party review of release decisions for the duration of remediation

- Formal hold on disposition where the evidentiary base is incomplete, with a defined path to release rather than an indefinite hold

- Elevated complaint and adverse event surveillance for affected product in the field

One control deserves emphasis because FDA asked for it explicitly: a statement of whether the individuals responsible for the breaches remain able to influence CGMP-related or drug application data. Access control is an interim measure with immediate effect and near-zero cost. It applies to every role implicated by the investigation, not only to the individual already removed, and it should be executed on day one rather than at the end of the investigation.

9. Testing whether CAPA is durable

Effectiveness checks that measure completion are not effectiveness checks. Training delivered, SOPs revised, logbooks numbered, and controls implemented are outputs. They confirm the CAPA was executed. They say nothing about whether it works.

Durability testing asks a different question: can the failure mode still occur? Answering it requires designed verification rather than attestation.

- Unannounced logbook and form reconciliation against issuance records

- Audit trail review compared against physical records for the same activity

- Retrospective sampling for contemporaneity, comparing entry timestamps against the activity they describe

- Deliberate verification that a control fires when it should, tested rather than assumed

- Record retrieval exercises under time pressure, which is how an inspection actually tests retention

- Independent review of a sample of quality decisions made after remediation, assessed against the surviving evidence base

The warning letter's request for annual third-party audits for at least two years following execution of the remediation protocol reflects a real pattern. Data integrity CAPA holds while attention is high and decays when attention moves elsewhere. A single effectiveness check at ninety days measures behavior under observation, which is the one condition guaranteed not to persist.

Leading indicators are the other half of durability, because they move before failure becomes visible in product. Logbook reconciliation exception rate. Audit trail review coverage against the population requiring review. Late and non-contemporaneous entry frequency. Record retrieval time during internal audit. Deviation and OOS rates in the affected areas, watching for suppression rather than improvement. Speak-up report volume and disposition. A remediated site where every one of these indicators is perfect within one quarter is a site to look at more closely, not less.

10. Questions for the Executive Quality Council

These are the questions we would put on the agenda. They are diagnostic, they are answerable, and the discomfort of answering them is the point.

1. If a person in a records-critical role began destroying original data tomorrow, which specific control would detect it, and how long would detection take?

2. When did we last verify that control by test rather than by attestation?

3. For every GxP logbook and controlled form currently in use, can we produce issuance and reconciliation records on demand, today?

4. Our most recent data integrity investigation: what did we do at the control layer, the management layer, and the governance layer, and can we point to the documented findings at each?

5. Which quality decisions in the last twenty-four months relied on data we could not reproduce today?

6. Does the quality unit report through a line independent of the yield target and the delivery schedule, and when did quality last stop a release?

7. What happens, structurally and not aspirationally, when an operator reports a concern about a supervisor?

8. How many speak-up reports did we receive last year, and what do we actually believe that number means?

9. Which of our contract facilities have we assessed for data integrity controls rather than for on-time delivery, capacity, and cost?

10. If an investigator asked us today to define the full impact of a compromised data set, how long would it take us to answer, and would we be answering from evidence or from inference?

Where Bayou Vantage fits

Could your organization identify the full impact of compromised GxP data before an investigator asks?

Bayou Vantage's "Digital Quality Readiness Gap Assessment" evaluates documentation controls, investigation governance, Quality authority, and inspection defensibility. We assess whether your data integrity controls would detect a failure, whether your investigation methodology reaches past individual conduct into control design and governance, and whether your Quality function holds the independence required to act on what it finds.

[Start a conversation](/contact)

Supporting regulatory context

FDA, "Data Integrity and Compliance With Drug CGMP: Questions and Answers", Guidance for Industry, December 2018 (Final, Level 1; Docket FDA-2018-D-3984). https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers-guidance-industry

FDA, "ICH Q10 Pharmaceutical Quality System", and "Quality Systems Approach to Pharmaceutical CGMP Regulations", both referenced by FDA in the enforcement action discussed above.

Company-specific facts in this article are drawn solely from a July 2026 FDA warning letter issued by CDER. The firm is not identified here by editorial choice. The four-layer investigation framework, the decision reconstruction methodology, the speak-up system guidance, the interim control set, the durability testing approach, and the Executive Quality Council questions are Bayou Vantage's own analysis and are not FDA requirements.