My June 2025 article, “How to Avoid FDA Warning Letters,” points out that inadequate corrective and preventive action (CAPA) is a major reason for warning letters, and also introduces the role of failure mode effects analysis (FMEA) in preventing trouble in the first place. The U.S. Food and Drug Administration’s keyword-searchable warning letter database, however, shows only five entries for FMEA vs. 574 for CAPA. One reason might be that while CAPA is required according to the Code of Federal Regulations (21 CFR 820.100—“Corrective and preventive action”), FMEA is apparently not—and FDA inspectors work according to the CFR. This article will take an actual FDA warning letter and show how it might have been avoided through use of FMEA.

The automotive sector is far more prescriptive

I’ve found the Automotive Industry Action Group (AIAG) to be among the best sources for hands-on quality management techniques. IATF 16949:2016 expands substantially on ISO 9001:2015, and most of its material is applicable to all product and service realization processes as opposed to just automotive. Clause 8.3.5.2— “Manufacturing process design output,” which isn’t found in ISO 9001, says “the manufacturing process design output shall include but is not limited to the following... (g), manufacturing process FMEA... (f), control plan (see Annex A).”

Clause 8.5.1.1—“Control Plan,” isn’t found in ISO 9001:2015, either, and it cites FMEA as a manufacturing process risk analysis output. Users of ISO 9001 should purchase IATF 16949:2016 to determine which clauses are applicable to their own operations, and implement them accordingly. FMEA is among the AIAG’s core tools for quality planning.

Enter the AIAG/VDA FMEA Handbook. No more excuses.

Some people dislike having to perform FMEA at all, for two very good reasons.

First, the occurrence rating, on a 1–10 scale with 1 being best and 10 being worst, once required an estimate of the frequency of a failure mode, such as 1 in 20, 1 in 1,000, or whatever. However, failure causes, formerly known as failure mechanisms, are by definition special or assignable cause problems—and we can’t estimate the frequency of assignable cause nonconformances from the performance index.

Second, Donald Wheeler points out what all of us should have noticed long ago: The risk priority number (RPN) is the product of three ordinal numbers, the severity (S), occurrence (O), and detection (D) ratings.

Consider two failure modes. One has a severity of 10 (endangers safety or risks regulatory noncompliance, and this applies to the content of FDA warning letters), an occurrence of 4, and detection of 4. The other has S = 4, O = 4, D = 10. Both have RPNs of 160.

The second, which is likely to annoy the customer, happens as frequently as the first but won’t be detected if it happens because the detection controls are grossly inadequate or even nonexistent. The first, which can kill the customer, happens just as frequently as the second, but there’s a reasonably good chance of catching it before it goes out the door. The first is obviously a much higher priority problem than the second.

The AIAG & VDA FMEA Handbook has addressed both of the issues discussed above, so there are no more excuses for not using FMEA.

First, the occurrence and detection ratings are both based on the nature of the prevention and detection controls rather than estimates of the likelihood of occurrence and nondetection, respectively. Engineering controls such as error-proofing (poka-yoke) generally earn far better ratings than administrative controls that rely on vigilance and compliance.

Second, the action priority (AP) of low, medium, or high replaces the problematic risk priority number. It assigns the most weight to the severity, followed by the occurrence rating. Recall our two failure modes, both of which have RPN = 160: The one with S = 10, O = 4, D = 4 would, per the handbook, have a high action priority, while S = 4, O = 4, D = 10 would have a medium action priority.

However, the user must purchase the handbook to use the Action Priority table. Given the amount of aggravation this will prevent, such as having to estimate occurrence and nondetection rates and attempt to prioritize RPNs, this is nonetheless a good investment. If it saves even a few hours and, more importantly, delivers a much better output than the older method, it pays for itself many times over.

Application of FMEA to a real FDA warning letter

It’s necessary to purchase the AIAG/VDA reference for all the details, but we can apply the key aspects of its seven-step process to this FDA warning letter. I found it with a search on “wrong ingredient,” an obvious special or assignable cause that shouldn’t happen.

The warning letter states “Under ‘HAZARD ANALYSIS OF PROCESSING STEPS’ in the (b)(4) steps, you identified toxicity from adding the wrong ingredient as a known or reasonably foreseeable food safety hazard. Your hazard analysis further states this hazard does not require a preventive control as you rely on your prerequisite programs to manage the hazard of vitamin D toxicity in food for dogs.” The “(b)(4)” in the text means redacted.

The warning letter adds, “However, the findings of elevated levels of vitamin D in several lots of your AA Diet preblend indicate your prerequisite programs were insufficient or you failed to implement them adequately to ensure the inclusion of vitamin D did not result in a nutrient toxicity.”

A prerequisite program consists of “Procedures, including Good Manufacturing Practices, that address operational conditions providing the foundation for the HACCP [hazard analysis critical control point] system.”

Here are the seven steps of the AIAG/VDA manual, and their application to the warning letter in question. However, none of the following constitutes engineering advice. The right people to come up with an actual solution are the company’s own subject matter experts who are intimately familiar with the process.

1. Planning and preparation

Deliverables include scope, baseline FMEA, and FMEA headers.

2. Structure analysis

The deliverable is a structure tree that depicts the process steps and the process work elements. The latter are factors such as manpower, machine, materials, method, measurement, and environment that affect the process, so this is consistent with the thought process behind the cause and effect diagram.

1. The process item is what the process is supposed to accomplish. In this case, ingredients are to be mixed in the right proportions and with the right consistency to produce wholesome dog food. Operations (steps) such as mixing, baking, drying, or grinding also would be identified during structure analysis.

2. The process steps are generally depicted by boxes in a process flowchart. In this case, we’ll focus on the mixing or blending step.

3. The failure modes (identified in Step 4, Failure analysis) take place in the process steps. 

3. Function analysis

This identifies what each process step is supposed to do. The negative of the process step (i.e., it doesn’t do what it’s supposed to do) is the failure mode.

1. The process step is also treated as the focus element, or the location of the failure mode. The bad output reflects the failure effect. In this case, the process step consists of selection and measurement (weight or volume) of the ingredients. The process step (mixing or blending) is supposed to deliver a product that a) is uniform in composition; and b) contains, within a specified range, the correct concentrations of vitamin D and other vitamins and supplements.

2. Function analysis also identifies the product characteristics, such as specifications that must be met. In this case, there’s probably a specified range of acceptable fractions of vitamin D and probably other components in the dog food. These are generally subject to detection controls that keep nonconforming work from leaving a workstation or equivalent, because they involve measurement or inspection after the item has been produced. However, this isn’t a hard and fast rule, because some product characteristics are measurable during the realization process, and feedback control can be provided to ensure good outputs.

3. Process characteristics such as tool speeds, temperatures, pressures, and so on are generally handled by prevention controls that keep nonconformances from happening. But in this case, controls might consist of measuring the ingredients and error-proofing the measurement process. The control plan will later enumerate the critical-to-quality features and how they are controlled.

4. A parameter diagram includes information related to the process and its requirements, such as bills of material, product and process characteristics, and potential noise factors that can affect quality.

4. Failure analysis

Failure analysis identifies the failure modes, failure causes, and failure effects. In this particular example, failure analysis would address the following issues.

1. Addition of the wrong ingredient or, by implication, the wrong quantity of the right ingredient, is a potential failure mode. Yet another could be inadequate mixing of the right ingredients, so the batch contains dangerous concentrations of vitamin D in some portions and inadequate concentrations in others. MXD Process explains, “Poor mixing doesn’t just affect product performance—it leads to dosage variability that can compromise therapeutic efficacy, stability issues that reduce shelf life and potency, and regulatory violations that can shut down production and cost millions in remediation.” Here, in fact, is an FDA warning letter that cites this very issue. “You distributed drug products with intra-batch potency variability, which indicated inadequate controls for mixing to ensure uniformity.”

2. The failure effect is the consequence to the process item, such as nonconformances—“what happens that shouldn’t.” The effect consists of a product that is actually toxic to dogs.

3. The failure causes (previously known as failure mechanisms) come from the process work elements—“how it happens.” These we don’t know, but a team might well use the same tools that we associate with corrective and preventive action, such as the cause-and-effect diagram and fault-tree diagram, to identify potential failure causes. There’s a close connection between the failure causes and corrective and preventive action (CAPA), which is why FMEA can be described as proactive CAPA. That is, instead of waiting for a problem to occur and performing CAPA, we enumerate the potential failure modes, pretend they have occurred, and implement controls to disable them as much as possible.  AIAG’s CQI-20—“Effective problem-solving guideline”—depicts these root causes:
a) The occurrence root cause is why the failure happens, and is generally disabled by the prevention controls. Why was the wrong ingredient, or the wrong amount of the right ingredient, used? If the product wasn’t uniform in composition, why were mixing and blending inadequate?
b) The escape root cause is why the nonconformance reached the next internal or external customer, if it did. Escapes are stopped by the detection controls. If the composition of the dog food, including vitamins and minerals, is assessed after production, this is a detection control.
c) The systemic root cause relates to why the planning process didn’t anticipate the problem in advance. In this case, the FDA complains, “Your prerequisite programs were insufficient or you failed to implement them adequately,” which sounds like a systemic root cause.

5. Risk analysis

This assigns the severity, occurrence, and detection ratings. The deliverable is not the problematic RPN, but rather an action priority of high, medium, or low as determined from the table in the AIAG/VDA reference.

1. Because excess vitamin D is toxic to dogs (the customers), the severity rating is likely to be 9 or 10, the worst possible, on a 1 to 10 scale.

2. Occurrence and detection ratings now depend on the nature of the controls rather than probability estimates. If, for example, the prevention control depends entirely on vigilance and compliance, the occurrence rating can be as bad as 9, with 10 denoting no control at all.

Remember that the following is an academic exercise based on the general content of the FDA warning letter, rather than actual recommendations for a process for which we don’t know the details:
• Prevention controls might relate to the composition of the ingredients (such as certificates of analysis), controls on quantity measurements prior to mixing, and the mixing or blending process itself to avoid intra-batch potency variability.
• High-performance liquid chromatography (HPLC); tandem mass spectrometry is a potential detection control that can quantify the vitamin D content, but it looks like samples must be taken to an external or, preferably, onsite laboratory for analysis. This looks like it will be slower than in-line measurements that give the immediate feedback that manufacturers prefer, but there’s at least a way to do the job. If intra-batch potency variability is present, a single sample won’t represent the condition of the entire lot, so our purported detection control will be very poor, regardless of its technological sophistication. If there’s substantial variation between samples taken from different parts of the lot, though, we’re likely to detect the problem in question.

3. The Action Priority table gives the greatest weight to the severity rating, followed by the occurrence rating, with the detection rating being last, as illustrated. If S = 9 or 10, and O is 8 or more, the Action Priority (pp. 116–117 of the AIAG/VDA manual) is high regardless of the detection rating, even if it’s 1.  If, on the other hand, the prevention control disables the failure mode completely, the occurrence rating is 1, and the Action Priority is low regardless of the severity and detection ratings—even if S = 10 and D = 10. Automated detection controls will similarly earn very good ratings, while an inspection that “should” detect a problem will be rated 7 or 8—but, as shown above, detection now carries the least weight in the action priority calculation.

6. Optimization

Optimization is the selection and verification of actions to reduce risks.

1. Elimination of the failure effect, such as through redesign of the product, is most effective. This doesn’t look practical here because it’s difficult to envision redesign of dog food to ensure the right content of all the vitamins and minerals.

2. Improve the occurrence rating with better prevention controls. Ask how we know the concentration of the vitamin D we’re receiving. How do we ensure that the right quantity is used? How do we ensure that batches are mixed adequately?

3. Improve the detection rating with better detection controls, such as replacing inspections that depend on judgment with automated inspections. In this case, offline laboratory analysis could at least detect a problem before the lot gets shipped to pet stores or distributors. Be sure the sampling plan represents the entire lot and not just a portion of it.

4. Make sure the selected actions really work (verification).

7. Results documentation

The FMEA is a quality record that supports organizational knowledge.

Summary

There’s no question that FDA-regulated industries use risk identification, analysis, and mitigation processes. But FMEA is apparently not universal, despite its proven ability to prevent trouble when it’s used properly. The relatively new (2019) AIAG/VDA approach removes the two principal objections—the need to quantify a failure mode’s frequency and the problematic Risk Priority Number—and is thus far easier to use and also much more effective than the past approaches. Pharmaceutical companies and other FDA-regulated industries should therefore put it to work for them.