According to the U.S. News & World Report article “FDA Warns Sanofi of Manufacturing Irregularities at Key Facility” (Jan. 23, 2025), the pharmaceutical company Sanofi received a U.S. Food and Drug Administration warning letter “stating that FDA inspectors found irregularities with the facility’s bioreactor, the vessel used to grow organisms and cells.” It adds that 20% of bioreactor runs were rejected due to contamination and other problems.

Many FDA Form 483 inspection findings don’t rise to the level of an actual warning letter but still require attention. A Form 483 observation is “a documented noncompliance issue identified by an FDA investigator during an inspection of a facility,” with noncompliance relating to current good manufacturing practices (cGMP) or regulatory requirements. An FDA warning letter is far more serious; it’s “a formal enforcement action issued when an FDA 483 observation is serious, systemic, or not corrected properly.” It requires a response that should include a corrective action plan within 15 days. The best course of action is to never allow an observation, or even an internal finding, to escalate to this level in the first place.¹

Quality planning should prevent Form 483s

The Automotive Industry Action Group (AIAG) and Verband Der Automobilindustrie’s (VDA, German Association of the Automotive Industry) handbook from 2019 is probably the best failure mode effects analysis (FMEA) reference. There’s not enough room here for all the details, but here are the three key improvements over previous FMEA methods.

1. There is a structured approach to identifying failure modes, failure effects, and failure causes (previously known as failure mechanisms).

2. Occurrence ratings from 1 to 10 (1 is best, lowest risk, and 10 is worst, highest risk) no longer depend on estimates of a failure mode’s frequency of occurrence, which is often difficult to quantify in practice. They depend instead on the nature of the prevention controls that serve to disable the failure mode. The detection rating is similarly based on the nature of the detection controls that keep nonconformances from reaching the next internal or external customer.

3. The risk priority number (RPN) is, as pointed out by Donald Wheeler, the product of three ordinal numbers: the severity (S), occurrence (O), and detection (D) ratings. This has always been problematic; the AIAG/VDA handbook replaces the RPN with an action priority (AP) rating of low, medium, or high. The AP rating gives the most weight to the severity rating, followed by the occurrence rating. Severity ratings are likely to be 9 or 10 in pharmaceutical industries because these ratings would often be for regulatory noncompliance (as reflected by FDA warning letters) and potential harm to customers.

While FMEA will ideally prevent trouble from happening at all, we know in practice that failure modes that weren’t identified by the planning process will arise. That’s why we have corrective and preventive action (CAPA). But inadequate or nonexistent CAPA is itself a leading source of warning letters! A search on the FDA’s website for “CAPA” is highly instructive and, as of April 22, 2025, comes up with 517 entries.

FDA 483 citations from Oct. 1, 2015, through March 31, 2016, show complaints to be the leading source, followed by CAPA. Because complaints should result in CAPA, however, it’s reasonable to combine the two into roughly 330 of the total Form 483s shown in the Pareto chart. That is, if CAPA was used in response to all the complaints and all other issues to which it is applicable, there would have been at least 330 fewer citations.

The FDA Group adds that CAPA is a source of 25% of Form 483s for medical device manufacturers, plus 11% from complaint files and 7% from nonconforming product. Because complaints and nonconforming product should be resolved by CAPA, this comes to about 43%, and CAPA is applicable to some of the other issues cited as well. Writing in Applied Clinical Trials, Laurie Halloran adds, “Your corrective and preventive action (CAPA) program is a critical tool in your response to an FDA Form 483 and can prevent a warning letter.”

The FDA’s Guidance for Industry: Q10 Pharmaceutical Quality System notes, “The pharmaceutical company should have a system for implementing corrective actions and preventive actions resulting from the investigation of complaints, product rejections, nonconformances, recalls, deviations, audits, regulatory inspections and findings, and trends from process performance and product quality monitoring. A structured approach to the investigation process should be used with the objective of determining the root cause.”

For all practical purposes, though, should may as well be shall, because lack of such a process can result in warning letters. The AIAG’s CQI-20, “Effective Problem Solving,” is a structured approach and, as far as I know, the best CAPA process.

Enter corrective and preventive action

U.S. Army Gen. George S. Patton said of people who don’t want to get into professional contests with skunks (professional wasn’t exactly the word he used), “If you don’t kill the first skunk that shows up, he will get under the house, and you will have to burn the house down to get rid of the devils.” (From Porter B. Williamson’s book, Patton’s Principles, Simon and Schuster, 1982.)

Skunks are generally harmless, so we shouldn’t be eager to kill them. Yellow jackets are probably a better example of something that should be eliminated on sight, because they sting without provocation. When the first yellow jacket showed up in the form of a rejected bioreactor batch, this should have initiated a CAPA process.

Here are the nine steps of CQI-20.

1. Become aware of the problem. This can come from the sources depicted by the FDA’s “Guidance for Industry: Q10 Pharmaceutical Quality System” and other sources. Workers can and should report near-misses for quality as well as safety. If, for example, a worker catches himself or herself about to add the wrong material to a batch, the worker should be rewarded for reporting this so prevention controls can be added to make the mistake impossible in the future.

2. Establish an appropriate problem-solving team. A cross-functional team is often required for complex issues, or those in which management of change (MOC) is a consideration. “Guidance for Industry: Q10 Pharmaceutical Quality System” says explicitly (emphasis is mine), “The change management system ensures continual improvement is undertaken in a timely and effective manner. It should provide a high degree of assurance there are no unintended consequences of the change.”

3. Define the problem. The importance of an accurate problem statement can’t be overemphasized.

4. Contain the symptoms. This protects customers from the problem but doesn’t remove the underlying root causes. U.S. Air Force Gen. Curtis LeMay famously said to stop swatting flies (containment) and get rid of the manure pile, i.e., identify and remove the root cause of the fly problem. I killed about a half dozen yellow jackets in my house at the beginning of May, which is only containment; corrective action would mean getting rid of their nest, which I’ve yet to find. Preventive action would ensure they didn’t establish a new nest.

5. Identify the root causes. CQI-20 raises the very important point, which isn’t found in most other approaches, that there are up to three root causes:
• The occurrence root cause, with which we are most familiar, is why the nonconformance happened. It ties in directly with FMEA because it’s the result of inadequate or nonexistent prevention controls.
• The escape root cause is why the nonconforming product reached an internal or external customer, if it did. Escapes result from inadequate or nonexistent detection controls.
• The systemic root cause is why the planning process (such as FMEA) didn’t identify the issue before the problems took place.

6. Select and test corrective actions. Make sure they actually disable the failure causes. Ligia Zubik, Daniel Barreto, and George Kwiecinski reported that 90% of CAPA failures take place when effectiveness of the actions isn’t verified. In addition, when the CAPA is required by an FDA warning letter, the FDA will do its own verification check. Pay attention to the management of change issue to ensure there are no undesirable side effects.²

7. Implement the corrective actions. If they disable the occurrence root causes, they’re new or improved prevention controls and the FMEA and control plan should be updated to reflect them. The same goes for new or improved detection controls that disable escape root causes.

8. Prevent recurrence. Share the lessons learned with similar processes and activities. In a 1938 interview with New York Times magazine, Henry Ford said, “[Experience is] the one thing no one can take away from us.” Failure to share the lessons learned could, in fact, be a systemic root cause as to why a similar issue wasn’t anticipated in advance.

9. Recognize the team. The deliverable of this exercise includes a quality record because (and this is according to an FDA training course) “... if it wasn’t documented, it didn’t occur.” Code of Federal Regulations 820.100 Corrective and preventive action adds, “All activities required under this section, and their results, shall be documented.”

The FDA warning letter

In this case, we’re dealing with the FDA’s Warning Letter 320-25-22 to the aforementioned pharmaceutical company Sanofi. It states, “Because your methods, facilities, or controls for manufacturing, processing, packing, or holding do not conform to CGMP, your APIs are adulterated within the meaning of section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act, 21 U.S.C. 351(a)(2)(B).” Adulteration doesn’t require nefarious intent. Adulteration in the context of FDA warning letters means only that the specified purity of the drug can’t be guaranteed regardless of intent.

The FDA letter cites in part, “Failure to investigate all critical deviations. FDA documented that approximately 20% of bioreactor runs attempted between January 2022 and July 2024 were rejected for contamination or other quality failures. This rate is excessive and calls into question the state of control of your process.”

The warning letter goes on to acknowledge that some CAPA was, in fact, performed. However, it says, “Your response is inadequate. You did not provide the completed investigations alluded to in your response, identify the root cause(s), justify each CAPA, or explain how the effectiveness of the CAPA will be determined. You also did not address the impact of excessive (b)(4) particles in your drug substances potentially reducing the ability of (b)(4) to successfully remove objectional microbiological contamination.”

Step 5 of CQI-20 requires identification of the root causes, and Step 7 requires verification that the actions taken are effective.

The warning letter raised the following additional issues (emphasis is mine):

1.“... Your response is inadequate. There is no indication you initiated an investigation into your deviating from the validated manufacturing process by replacing the (b)(4) filling bags on multiple occasions….”

Know the risks of not following the process. 

Know the risks of not following the process. A well-written process will, for each step, define what is to be done; by whom (job title or function); where, when, and how it is to be done; and why. In addition, each step’s potential failure modes and failure causes will ideally have been addressed by FMEA. If we deviate from the process, we may introduce unknown failure modes and/or causes we haven’t considered. When the severity of a failure mode might easily be 9 or 10 for a regulatory noncompliance or adulteration of a pharmaceutical product, this can be especially risky.

2. “Failure to have equipment of the appropriate design and suitability for their intended use for the manufacture of APIs [active pharmaceutical ingredients]... In response to this letter, provide your CAPA plan to implement routine, vigilant operations management oversight of facilities and equipment.”

3. The letter continues, “Failure of your quality unit to exercise its responsibility to ensure the API manufactured at your facility are in compliance with CGMP.... Your response is inadequate. Although you identified CAPA for each contributing root cause, you did not provide sufficient detail for their implementation.”

Remember that implementation of the corrective actions, and confirmation of their effectiveness, is a key step in the CQI-20 process.

4. Later in the letter, the FDA cites “Failure to ensure all production deviations are reported and evaluated, and that critical deviations are investigated, and the conclusions are recorded. Multiple production deviations went unaddressed until our investigators informed facility personnel of the issues.”

A production deviation should generally initiate CAPA.

Summary

FDA Form 483 observations are problematic enough, and warning letters and enforcement actions are even worse. Most are avoidable through use of well-established and off-the-shelf quality planning methods such as FMEA, as well as a solid CAPA process.

FMEA and CAPA are synergistic, even though FMEA is proactive and CAPA reactive. FMEA seeks to anticipate in advance what can go wrong (the failure mode), why it goes wrong (the failure cause) and the consequences (the failure effect), and deploy prevention and detection controls to address it. These controls appear in the control plan for the process.

We can’t assume, however, that FMEA anticipates everything. That’s why we need CAPA. When we become aware of a problem, it’s generally because FMEA didn’t anticipate it or, if it did, the prevention and/or detection controls failed to keep it from happening. A thorough CAPA will often result in new and/or improved controls that are in turn reflected by an updated FMEA. Always remember to deploy the lessons learned to related processes and activities to avoid having to solve the same problem, or a similar one, again.

Citations

1. Zubik, Ligia; Barreto, Daniel; Kwiecinski, George. “Warning Letters—2025 Lessons Learned.” Presented to ASQ Section 209, April 17, 2025.

2. Zubik, Ligia; Barreto, Daniel; Kwiecinski, George. “Warning Letter.” Global Key Solution Corp. webinar, April 23, 2025.