FDA Form 483 Examples: What Quality Teams Should Learn from Common Observations

What a Form 483 records, and what it does not

FDA's own description of the form is precise: observations are listed on a Form 483 when, in the investigator's judgment, the conditions or practices observed indicate that an FDA-regulated product may be in violation of FDA's requirements. The form is presented and discussed with senior management at the close of the inspection. It is not a final agency determination. FDA considers the 483, the Establishment Inspection Report, the evidence collected on site and the firm's written response before deciding what further action, if any, is appropriate.

Three consequences follow. First, a 483 lists what one investigator saw and judged significant, not an audit of the whole quality system; FDA's FAQ says that conditions of questionable or unknown significance are left off and that other objectionable conditions may exist uncited. Second, because each observation records a judgment against a specific requirement, the requirement is the entry point for reading it. Third, the response is part of the record FDA weighs; a firm that treats it as correspondence rather than evidence has misread what the form is for.

Where the published examples come from, and how to read one

FDA publishes, for each fiscal year, a spreadsheet listing every area of regulation cited on its system-generated 483s, the number of times it was cited, and the standard wording of the observation, split by program area. The FY 2025 data set covers inspections ending between 1 October 2024 and 30 September 2025. It records 4,862 483s in the system in total: 713 for drugs, 791 for devices, 2,719 for foods, 110 for biologics, 160 for bioresearch monitoring, with the remainder across tissue, veterinary and radiological programs. FDA notes that manually prepared 483s are not included, so the counts are a floor, not a census.

Each row of the spreadsheet is an example in the useful sense: the reference number (section and paragraph), a short description, and the long description investigators build the observation from, with bracketed alternatives and a trailing "Specifically, ***" where the firm-specific facts go.

Read a 483 the same way: the cited section first, then the standard wording, then the specifics. The specifics are the firm's; the section and the wording are the pattern, and the pattern is what repeats.

The drug GMP sections cited most in FY 2025

The table lists the FY 2025 drug rows behind the patterns in this article, with the record an investigator expects to find behind each. Where FDA splits one section across several observation templates the rows are shown separately, because the split is informative.

Note: the three §211.192 rows sum to 218 before the two smaller rows on the extent of the investigation and QU review of records are added. Investigations are, by that count, the second most cited area for drugs and the one with the most distinct ways of being cited.

§211.192: an investigation that does not explain the event

The rule is short. Any unexplained discrepancy or failure of a batch to meet its specifications shall be thoroughly investigated; the investigation shall extend to other batches that may have been associated with the failure; a written record shall be made and shall include the conclusions and follow-up. The FY 2025 rows cite each of those clauses separately: failure to investigate thoroughly (164), incomplete written record (32), no written record (22), extent of the investigation (9), QU review of records (9).

What an investigator looks for, in order, is the sequence the rule describes. Was the discrepancy identified and recorded when it occurred? Did the investigation reach a cause that explains the observed facts, or did it stop at "operator error" and a retraining action? Was the scope extended to other batches and products? Are the conclusions written in the record, and is the follow-up (the CAPA) traceable from it? A deviation record that is opened after the batch was released, a root cause that restates the symptom, or a CAPA with no effectiveness criterion each answers one of those questions badly, and each has its own row in the data.

The device equivalent, §820.100(a) procedures for corrective and preventive action, was the single most cited device row of FY 2025 at 279, with a further 63 under §820.100(b) for CAPA activities and results not adequately documented. The pattern does not change between programs; the section number does. Where the chain from deviation to CAPA to change most often breaks is covered in Deviation, CAPA and change control: why they must stay linked.

§211.68(b) and §211.194: records whose history cannot be shown

Two sections carry the data-integrity observations for drugs. §211.68(b) requires appropriate controls over computers and related systems so that changes to master production and control records, or other records, are instituted only by authorized personnel, and that input to and output from the system are checked for accuracy; it also requires backup data to be exact and complete. The FY 2025 rows are 87 for the controls themselves, 10 for input/output verification and 8 for backup data. §211.194(a) requires laboratory records to include complete data from each test, the calculations, and the initials or signature of a second person showing the original records were reviewed; the rows are 14 for complete data, 10 for the (a)(4) complete-record clause and 9 for the (a)(8) second-person review.

The observation wording under §211.68(b) is about control, not about technology. An investigator asks who could change the record, whether the change is attributable to a named person with a system-generated time, whether the original value is still visible after the change, whether the audit trail is reviewed as part of record review rather than merely captured, and whether the records can be retrieved for the retention period. Shared accounts, a spreadsheet holding the reportable result while the instrument holds the raw data, and a trail nobody has opened since validation each produce the same citation.

Note: PIC/S PI 041-1 (July 2021) sets out the same expectations for inspectorates outside the United States, using the ALCOA+ attributes. A site inspected by both should expect the same questions under different citations. Why a captured trail is not yet a reviewable one is the subject of Why audit trails fail even in digital systems.

§211.25 and §211.100(b): the procedure, the training and the practice disagree

§211.25(a) requires each person engaged in manufacture to have the education, training and experience to perform the assigned functions, with training in the particular operations performed and in current GMP, conducted by qualified individuals on a continuing basis. FDA cites it under three templates, 28, 25 and 14 times in FY 2025. §211.100(b) requires written procedures to be followed and documented at the time of performance, with any deviation recorded and justified: 23 citations for procedures not followed or documented and 9 for deviations not recorded and justified. On the device side, §820.25(b) training procedures and records were cited 50 and 18 times.

These are the observations where three records are asked for at once and disagree. The approved procedure says one thing. The training record shows the operator trained on an earlier revision, or trained on the title rather than the revision. The execution record, or the investigator's own observation on the floor, shows a third practice. The citation lands on whichever record is weakest, and the underlying failure is the join between document control and training: a revision became effective without the people who execute it being retrained before use, and the deviation from the written procedure was not recorded because nobody recognised it as one.

Validation and change: the evidence that the system still does what was claimed

Validation observations rarely arrive as a single "not validated" finding. They arrive as a change that was made without the impact being assessed, or as a system whose approved configuration cannot be produced. For drugs the same §211.68(b) rows apply, together with §211.100(a) where a process change was made without the written procedure being revised and approved. For devices, §820.75(a) process validation was cited 93 times, §820.75(c) review and revalidation after process changes 9 times, §820.30(i) design change procedures 48 times, and §820.70(i) validation of software used in production or the quality system 17 times.

The evidence an investigator expects is a chain: the requirement or intended use, the risk assessment that set the depth of testing, the test evidence, the approved configuration, and then every change since, each with an impact assessment and, where warranted, re-testing. A cloud-hosted system does not change that expectation; it moves part of the evidence to the supplier and makes supplier assessment part of the site's own record. How a risk-based route through that chain is built and defended is set out in CSA vs CSV in pharma.

§820.198 and §803.17: complaints, the device-side constant

Complaint handling is the most stable device pattern in the data. In FY 2025, §820.198(a) procedures for receiving, reviewing and evaluating complaints was cited 211 times, with 32 more under a second §820.198(a) template, 16 under §820.198(c) for failure to investigate device failures, and 8 under §820.198(e) for the records of the investigation. §803.17, written Medical Device Reporting procedures, was cited 63 times, and a further 8 for lacking a system to determine whether an event is reportable.

The observations describe the same gap from four angles: a complaint that was not evaluated for MDR reportability within the required time; a complaint that met the criteria for investigation and was not investigated, without a documented reason; a returned device or service record that was never evaluated as a potential complaint; and complaint trends that were never connected to a CAPA decision. The complaint handling record has to show each evaluation and each decision, including the decision not to investigate.

What the device citations look like after 2 February 2026

FY 2025 is the last full year in which device observations were written against the 1996 Part 820. Since 2 February 2026 the Quality Management System Regulation is in force: Part 820 incorporates ISO 13485:2016 by reference and adds a thin FDA layer (§820.3 definitions, §820.10 requirements, §820.35 records, §820.45 labelling). The requirements behind the device patterns did not disappear; they changed address.

How FDA formats the citation on the form itself is for the FY 2026 data set to show; what a post-QMSR observation and an acceptable response look like in practice is covered in FDA is rewriting how you respond to a 483, and the full clause map in QMSR vs ISO 13485: what changes for quality systems. A 483 issued before 2 February 2026 is answered against the regulation in force at the time of the inspection.

What the five patterns share

Read as a set, the FY 2025 rows are not five unrelated problems. Each one is a place where the record between two quality decisions is missing or cannot be produced: between the discrepancy and its cause, between the cause and the corrective action, between the action and the change to a procedure, between the change and the training on it, between the training and the work performed, and between the electronic record and the person who created or altered it.

That is why the same firm tends to collect observations across several sections in one inspection. The investigator starts at one record, follows it to the next, and cites wherever the chain gives way. A site that can produce one deviation, its investigation, its CAPA, the change it drove, the training that followed and the evidence that the action held, in sequence and without reconstructing any step from memory, has answered most of the FY 2025 table in advance. The lesson of the examples is not "document more". It is to keep the chain whole, so that each record already contains the reference to the one before it and the one after.

Answering an observation: the response is a record too

FDA's FAQ says that companies are encouraged to respond to a 483 in writing with their corrective action plan and then implement it expeditiously. Responding is not a statutory duty, but FDA's stated practice since 2009 is to consider a written response received within 15 business days when deciding whether a warning letter is warranted, and the response is weighed alongside the Establishment Inspection Report. The response is therefore evidence, and it is read against the same standard as the investigation records the 483 found wanting.

A response that holds up has the same structure for every observation: the observation transcribed as written; the immediate correction; the root cause from an investigation, not a restatement of the finding; the corrective action with a CAPA reference; the owner, the target date, and the objective evidence that will demonstrate completion. Download the FDA 483 response template for that structure: a two-tab workbook, one row per observation, with the CAPA link, owner, date and evidence columns and a status that totals itself. The point of building the response in rows is that each row can be traced to a CAPA record that outlives the letter.

A protocol for the next inspection

The FY 2025 data set is a protocol in disguise. Run it against your own site in this order.

1. Take the ten highest drug rows (or the ten highest device rows, read at their ISO 13485 clause address) and, for each, name the record that would answer the standard observation wording at your site.
2. Pick one closed deviation from the last twelve months and trace it: identification date, investigation, cause, scope extension, CAPA, change, training, effectiveness evidence. Note every step that had to be assembled from a person's memory or an export.
3. Open the audit trail for one record that was changed after approval. Confirm the person, the system-generated time, the previous value and the reviewer who looked at it.
4. Take one procedure revised in the last six months. Confirm that everyone who executed it after the effective date was trained on that revision before the work.
5. Take one complaint (devices) or one OOS result (drugs). Confirm the evaluation decision, the investigation or the documented reason for not investigating, and the CAPA link.
6. Write the gaps into a response row now, as if the observation had been issued. The corrective action is the same either way; the difference is who set the deadline.

How Complere keeps observation follow-up in one record

The observation and its answer stay together. In Complere the deviation, the investigation, the corrective action and the evidence of completion are one linked record, so the response to an observation is assembled from the record rather than written around it.

The cause carries its evidence. Root cause, scope extension and the decision on other batches sit inside the investigation record, with the reviewer and the date, so the §211.192 questions are answered where the investigator will look.

Correction and change are one history. When a CAPA drives a procedure revision and the revision drives training, each step references the one before it, and the training record names the revision, not just the title.

The reviewer reads what the author wrote. Changes to a regulated record leave a reviewable, attributed history that the quality unit can open during its own record review, before an investigator does.

The judgment on the response remains FDA's; the judgment on the cause remains the site's. Complere's part is the record between them, kept whole enough that neither judgment has to be reconstructed.

Related sources

• FDA Inspection Observations — the fiscal-year data sets of cited areas of regulation on system-generated 483s; the FY 2025 file is the basis for every count in this article.
• FDA Form 483 Frequently Asked Questions — when a 483 is issued, what it is not, and how the response is weighed.
• Inspectional Observations and Citations — how a standard citation is built from the reference number, short and long descriptions.
• FDA Warning Letters — published letters quoting the observations and FDA's evaluation of the firm's response.
• 21 CFR §211.192 — Production record review — the investigation requirement: thorough, extended to other batches, written, with conclusions and follow-up.
• 21 CFR §211.68 — Automatic, mechanical, and electronic equipment — controls over computerized systems, input/output checks and backup data.
• 21 CFR Part 820 — Quality Management System Regulation — the current text: §820.1, §820.3, §820.7, §820.10, §820.35, §820.45.
• PIC/S PI 041-1 — Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments — the PIC/S data-integrity guidance, July 2021.

Related from Complere

• FDA 483 Response Template
• Deviation, CAPA, and Change Control: Why They Must Stay Linked
• Why Audit Trails Fail Even in Digital Systems
• Warning Letter Trends 2025
• Data Integrity & Audit Trails