Warning Letter Trends 2025: What Recurring Quality-System Breakdowns Reveal

What a warning letter says that the 483 did not

A CGMP warning letter issued on 4 September 2026 opens the way they all do: it advises the firm of significant violations observed during an FDA inspection, tells it to address them without delay and with appropriate resources, states that the list is not all-inclusive, and warns that failure to address them may result in regulatory or legal action, including seizure and injunction. Two paragraphs later it records that FDA reviewed the firm's written response to the Form 483 "in detail". Then the violations follow, numbered, each with the section of 21 CFR Part 211 it rests on, each followed by the words "In response to this letter, provide:" and a list.

That structure is the difference between the two documents. A Form 483 records what one investigator observed and is, in FDA's own words, not a final agency determination. A warning letter is the agency's conclusion after reading the 483, the Establishment Inspection Report, the evidence collected and the firm's response. Where the response was inadequate, the letter says so and says why. What it asks for is rarely a correction to a single observation; it is an independent, comprehensive review of a program, a risk assessment of product already distributed, a retrospective assessment of the records the inspection found unreliable, and a corrective action plan with evidence. The closing paragraph places responsibility for root cause and for "future and sustained compliance" on the firm, notes that new applications may be withheld and re-inspection may follow, and sets the response window at fifteen business days.

For a trend reader, then, the letters are the confirmation layer and the observations are the data layer. The observations tell you which requirements sites are failing; the letters tell you what FDA considers an adequate answer.

Where the trend data comes from, and what it can and cannot show

FDA publishes, for each fiscal year, a spreadsheet of every area of regulation cited on its system-generated 483s, with a count and the standard observation wording, by program. The FY 2025 file covers inspections ending between 1 October 2024 and 30 September 2025; the FY 2024 file the year before. Placing the two side by side is the only public, quantitative view of what moved.

Three limits apply. The counts cover system-generated 483s only; manually prepared ones are excluded, so the totals are a floor. A section can be cited under several observation templates, so this article sums by section (§211.192 is one line here, where the observation-level companion post shows its five separate templates). And FDA does not publish a per-section tally of warning letters, so any claim about what the letters cite has to be traced back to the observation data and then confirmed by reading letters. Everything below is built that way.

FY 2024 to FY 2025: the citations that moved

The headline is volume. System-generated 483s rose from 4,056 to 4,862, about 20 percent. Drugs rose from 561 to 713 and devices from 672 to 791. Total citations rose less than the number of 483s did, so the average 483 got slightly shorter: 4.3 to 3.9 citations per drug 483, 3.5 to 3.4 per device 483. More inspections were closed with a 483; the lists on them did not lengthen.

Note: the two fastest-growing drug sections, §211.192 (up 36 percent) and §211.68 (up 37 percent), grew faster than the drug 483 count did (27 percent). Those two are the investigation record and the electronic record, and they are the two sections most often quoted back in the letters' requests for retrospective assessments. Laboratory controls (§211.160) and nonconforming product (§820.90) were the only leading sections to fall.

Data integrity: §211.68 is the fastest-growing drug citation

§211.68(b) requires appropriate controls over computers and related systems so that changes to master production and control records, or other records, are made only by authorized personnel; input to and output from the system checked for accuracy; and backup data exact and complete and secure from alteration, erasure or loss. The section as a whole went from 112 citations to 153. §211.194(a), the laboratory-record clause that carries the second-person-review and complete-data observations, is smaller but sits in the same letters.

What the letters add to the observation is the scope of the remedy. Where an inspection found records that could not be relied on, the letter typically asks for a comprehensive investigation into the extent of the inaccuracies, a risk assessment of the potential effect on product quality and on data submitted to the agency, and a management strategy that includes a global corrective action plan, in line with FDA's 2018 guidance on data integrity and compliance with drug CGMP. A site answers that from its audit trail and its record of who held which access when, or it cannot answer it at all. The recurring manifestations have not changed: trails captured but not reviewed, shared accounts that defeat attribution, edits without a recorded reason, original data not retrievable, results held in a spreadsheet while the instrument holds the raw data. PIC/S PI 041-1 (July 2021) sets out the same data integrity expectations for inspectorates outside the United States. Why a captured trail is not yet a reviewable one is the subject of Why audit trails fail even in digital systems.

Investigations and CAPA: the citation that grew most in absolute terms

§211.192 added 63 citations, more than any other drug section. The requirement is short: any unexplained discrepancy or failure to meet specification shall be thoroughly investigated, the investigation shall extend to other batches that may have been associated with it, and a written record shall include the conclusions and follow-up. On the device side §820.100 remained the most-cited section at 342, up from 313.

The letters' language on this point is consistent enough to be quoted as a standard: the firm is "responsible for investigating and determining the root causes of any violations and implementing corrective and preventative measures to ensure future and sustained compliance so that these violations and any others do not occur." Read against the observation data, the failure modes are the familiar ones. The root cause stopped at operator error. The scope was not extended to other batches. The CAPA closed without a defined effectiveness criterion, and the same defect reappeared as a new CAPA. Preventive action was generic. Where the chain from deviation to CAPA to change most often breaks is set out in Deviation, CAPA and change control: why they must stay linked.

The quality unit, its procedures, and the people who follow them

§211.22 stayed the most-cited drug section, 272 to 309; §211.22(d), responsibilities and procedures of the quality control unit not in writing or not fully followed, is the single largest observation template in the data set. §211.100 rose from 157 to 201: written production and process control procedures absent or inadequate under (a), not followed or not documented at the time of performance under (b). §211.25(a), personnel qualifications and training, rose from 60 to 67 at the observation level, and §820.25(b) on the device side from 60 to 68.

These three sections are cited together because they describe one join. The quality unit approves the procedure; the procedure is executed and documented at the time; the person executing it was trained on the revision in force. The letter that follows tends to ask for an assessment of the quality unit's authority and resourcing, a review of all procedures, and evidence that personnel are qualified for the operations they perform. A site whose training records name the revision, and whose document control can show which revision was in use where on a given date, answers that from the record. A site whose training is complete against a title cannot.

Validation and change: design controls and process validation moved on the device side

On the device side the growth was in the design and validation sections: §820.30 design controls from 274 to 315, §820.75 process validation from 124 to 153, §820.50 purchasing controls from 160 to 190. §820.70(i), validation of software used in production or the quality system, fell slightly at the observation level, from 29 to 20. For drugs the same §211.68(b) section carries the computerized-system validation observations, and §211.100(a) carries process changes made without the written procedure being revised and approved. Outside the United States, EU GMP Annex 11 applies the same expectations through its clauses on risk management, suppliers, validation, audit trails and periodic evaluation.

The letters ask for the same chain the observations test: the requirement or intended use, the risk assessment that set the depth of testing, the test evidence, the approved configuration, and every change since with an impact assessment and, where warranted, re-testing. Since 2 February 2026 the device requirements sit at ISO 13485:2016 clause addresses under the QMSR, design controls at 7.3, process validation at 7.5.6 and validation of quality-system software at 4.1.6; FY 2025 is the last full year of observations written against the 1996 sections. The FDA QMSR page and QMSR vs ISO 13485 carry the clause map; the risk-based route through validation is set out in CSA vs CSV in pharma.

Complaints and MDR: steady, not shrinking

§820.198, complaint files, rose from 271 to 286 and stayed the third most-cited device section. §803.17, written Medical Device Reporting procedures, rose from 78 to 82. The four gaps are stable across years: a complaint not evaluated for MDR reportability within the required time; a complaint that met the criteria for investigation and was not investigated, without a documented reason; a returned device or service record never evaluated as a potential complaint; complaint trends never connected to a CAPA decision.

Under the QMSR the requirement sits at clause 8.2.2, with §820.35(a) prescribing the record fields: device name, date received, UDI or UPC, complainant, the nature of the complaint, and the investigation or the documented reason for not investigating. The complaint handling record is expected to show each evaluation and each decision, including the decision not to act.

How to read the trends against your own site

A trend table is a set of questions for the site's own records, in the order the data ranks them.

1. For each of the seven drug sections or six device sections above, name the record at your site that answers the standard observation wording, and the person who can produce it without assembling it.
2. Take the three most recent published warning letters in your product category from FDA's index and read them as if they had been issued to you. For each "In response to this letter, provide:" list, mark which items your records could supply this quarter and which would have to be built.
3. Where a section grew year on year, assume the next inspection will spend more time there. For §211.192 and §211.68 that means one closed investigation and one audit trail review, traced end to end, before the inspection rather than during it.
4. Record the gaps as CAPAs now. The corrective action is the same whether the deadline is set by your quality unit or by a letter.

The exercise is not a substitute for the site's own risk assessment; it is a way of ordering it by what the agency has demonstrably been citing.

Turning the trend into a dated plan

A list of gaps becomes a plan when each item has an owner, a date and a gate. Download the inspection readiness 90-day plan for that structure: three 30-day phases, 33 dated tasks with an owner, a due date and a retrieval-time column, and a pass/fail gate at the end of each phase. Load the trend questions above into the first phase, so the sections that grew this year are the ones tested first, and let the retrieval-time column tell you which records are still being reconstructed from memory.

What this asks of the software you evaluate

A regulated platform should reduce the chance that these recurring patterns survive unnoticed. When evaluating one, ask to be shown, on a real record rather than a demonstration case: the validation evidence the vendor delivers and what the site still owns; an audit trail a reviewer can read and a record of that review; approvals attributable to a named person; the path from a deviation through investigation, CAPA, change and training without an export; and, for a cloud deployment, where the data resides and how the supplier is assessed.

How Complere holds the record the letter asks for

The investigation and its follow-up are one record. In Complere the deviation, the investigation, the cause, the extension to other batches, the corrective action and the evidence of completion stay linked, so the §211.192 question is answered where the investigator looks, not assembled afterwards.

History is attributable and reviewable. Changes to a regulated record leave a history the quality unit can open and review as part of its own record review, with the person and the time, so the retrospective assessment a letter asks for starts from the record rather than from a search.

Procedure, training and change reference each other. When a CAPA drives a procedure revision and the revision drives training, each step names the one before it, and the training record names the revision.

The trend becomes a queue. Owners, due dates and overdue work are visible in the same place as the records behind them, so a 90-day plan built from the trend can be run and evidenced inside the system.

The agency's judgment on the response stays with the agency, and the site's judgment on cause stays with the site. Complere's part is to keep the record between them whole enough that the letter, if it comes, is answered from evidence that already exists.

Related sources

• FDA Warning Letters — every published letter, searchable by date, issuing office and subject; the structure described above is read from a CDER CGMP letter dated 4 September 2026.
• FDA Inspection Observations — the fiscal-year data sets; the FY 2024 and FY 2025 files are the basis for every count in this article.
• FDA Form 483 Frequently Asked Questions — the 483 as an observational document, and how the response is weighed.
• FDA Data Dashboard — Inspections — inspection volumes and classifications by fiscal year.
• 21 CFR §211.192 — Production record review — the investigation requirement.
• 21 CFR §211.68 — Automatic, mechanical, and electronic equipment — controls over computerized systems, input/output checks and backup data.
• 21 CFR §211.22 — Responsibilities of quality control unit — the most-cited drug section.
• Data Integrity and Compliance With Drug CGMP — Questions and Answers — FDA's December 2018 guidance, including how it expects data integrity problems to be addressed.
• PIC/S PI 041-1 — Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments — the PIC/S data-integrity guidance, July 2021.
• 21 CFR Part 820 — Quality Management System Regulation — the current device text: §820.1, §820.3, §820.7, §820.10, §820.35, §820.45.

Related from Complere

• FDA Form 483 Examples
• Inspection Readiness 90-Day Plan
• Why Audit Trails Fail Even in Digital Systems
• FDA QMSR
• Data Integrity & Audit Trails

This page is updated when FDA publishes the next fiscal-year inspection-observation data set. Last reviewed: 2026-09-16 (FY 2025 data). Next review: on publication of the FY 2026 file, expected December 2026.