How Should You Respond to FDA 483 Observations?

Connoisseurs and recipients of Food and Drug Administration (FDA) warning letters will be familiar with the phrase “Your response is inadequate,” as companies’ proposed resolution(s) to the noncompliances contained in the dreaded FDA Form 483 Inspectional Observations focus on just the observations rather than taking a systematic approach.

In March, the Agency published a draft guidance on Responding to FDA Form 483 Observations.¹ We will discuss it from a laboratory perspective, covering:

• A brief overview of the FDA GMP/Surveillance inspections process
• An outline of how to respond to Form 483 based on Section IV Recommendations for addressing FDA 483 Observations ¹
• Using an example of a recent Form 483 observation for a chromatography data system (CDS), we will examine possible ways to investigate and resolve the observation.

The FDA recommends setting up a multidisciplinary team to investigate the observations, adequately funded by and reporting to senior management (line 275-277).¹ The FDA needs continued communication (such as progress updates) and the Corrective and Preventive Action (CAPA) timeline. We exclude the format of the FDA response and what happens if there is a scientific disagreement from our discussion.

FDA Inspection Overview

To put Form 483 into perspective, we consider a brief overview of the FDA inspection process shown in Figure 1; see also Form 483 FAQ on the FDA web site.²

• All US inspections are started with an investigator presenting their credentials and a copy of FDA Form 482 Notice of Inspection.
• During the inspection, an investigator may observe objectionable conditions that are noted that may be discussed with the company.
• At the closing meeting, a copy of FDA Form 483 is presented to the company (preferably, senior management, such as the general manager or site head, are present) and discussed. The firm can and should respond to the FDA Form 483 during the discussion with the investigator.³ The response would not include all the details, since some CAPAs would need to be put in place after the fact, but a high-level plan is recommended as part of the close-out discussion.
• If product samples are taken by an investigator, a copy of FDA Form 484 is left.
• If the Form 483 is prepared using TurboEIR, an FDA application, the citations are collated and published annually on the FDA website,⁴ which goes back to 2006.
• The FDA has a set timeline of 90 days from the end of an inspection to review a response to Form 483.
• An establishment inspection report (EIR) is written by the investigator that details the personnel seen, facilities visited (onsite/remote), and data and records inspected, as well as any observations. This report provides details for future inspections.
• Inspections are classified as one of three types⁵:
  1. OAI (Official Action Indicated): Regulatory or administrative actions are recommended (i.e., warning or untitled letter may be issued; potential import alert for foreign companies). This could also lead to a regulatory meeting with the FDA.
  2. VAI (Voluntary Action Indicated): Objectionable conditions or practices were found, but the Agency is not prepared to take or recommend any administrative or regulatory action.
  3. NAI (No Action Indicated): No objectionable conditions or practices were found during the inspection.
• For major violations of Current Good Manufacturing Practice (CGMP), further measures taken by the FDA include product recalls, import alerts for foreign companies, withdrawal of product licences, or consent decrees of permanent injunction.

See the FDA website for more information. There is a 15-day response time for both warning letters and Form 483 observations. The change in the response time for the latter was discussed in a 2009 “Focus on Quality” column.⁶

Overview of Responding to a Form 483

The guidance recommendations for how to respond to Form 483 observations is shown in Figure 2.⁷ The key is to not just focus on the specific observation, but to take a systemwide approach. Remember audits and inspections are only a sample and a snapshot in time, as we will discuss when looking at the Form 483 example in the next section.

Senior management must be actively involved in the process, providing the resources to a multidisciplinary team to understand and assess observations; plan and conduct investigations; and develop, implement, and evaluate effective CAPA. The FDA must be kept informed of the investigation progress through routine updates. Update frequency is typically communicated in the first 483 response to the FDA.

Investigating a CDS Form 483 Observation

Our guinea pig… sorry, case study example, is a recent Form 483 issued in February 2026 to Staska Pharmaceuticals,⁷ a contract manufacturing organization (CMO), with the focus on observation 2 for a CDS (see also Figure 3):

Laboratory controls do not include the establishment of scientifically sound and appropriate specifications, standards, sampling plans, and test procedures designed to assure that components, in-process materials, and drug products conform to appropriate standards of identity, strength, quality, and purity.

Specifically,

Your firm lacks adequate controls to ensure the integrity and reliability of analytical data generated by high-performance liquid chromatography (HPLC) systems used for release testing of sterile drug products.

A. Your firm does not have a written procedure requiring review of electronic raw data, audit trails, and system-generated records from HPLC analyses prior to batch release. Your quality control (QC) pharmacist reviews only printed reports and manually verifies calculations, but does not review:

• Electronic raw chromatograms
• Integration events and manual integrations
• Injection sequences and any deleted or repeated injections
• Audit trails showing user activities, including data modifications or deletions
• Metadata (e.g., user IDs, system configuration changes) …

B. One chemist performs the majority of HPLC analysis for product release without independent verification of the electronic data by the Quality Unit. This practice does not provide adequate oversight to detect:

• Unauthorized reintegration of peaks
• Deletion of failed injection or out-of-specification (OOS) results
• Selective reporting of data
• Manipulation of integration parameters to achieve passing results
• System suitability failures that were not investigated …

C. <Redacted> employees authorized to perform HPLC analysis have administrative user roles in the <redacted> CDS. Administrator privileges in <redacted> allow these users to:

• Modify integration parameters after data acquisition
• Reprocess chromatographic data
• Modify or disable audit trail settings
• Change system configuration and methods
• Adding and removing users …

The observation focuses on using a printed HPLC summary report to release product with the exclusion of electronic record review by all, including QA. We do not have a lot of details; the citation discusses possible data integrity violations, but there are no specific examples presented where data were manipulated or falsified, which is unusual with such a citation. There is no mention of IT support, raising the question: “Were the investigators sufficiently knowledgeable about computerized systems?” We also don’t know if the CDS is one of several standalone installations or a networked system.

How should a laboratory focus on the investigation? The framework in the draft guidance shown in Figure 2 can be supplemented, if required, by the FDA Application Integrity Policy⁸ mentioned in Q18 of the FDA DI guidance.⁹

Involvement of a Consultant/Qualified Third Party

The role of an independent consultant/qualified third party is consistently discussed among FDA and PIC/S guidance documents for the following areas:

1. Preparing an investigation plan (Line 113-114¹)
2. Staff interviews (Section 12.1.1¹⁰)
3. CAPA development, specifically when dealing with DI 483 observations (Line 217-220¹ and Section 6.7.1¹⁰)
4. CAPA effectiveness check as an independent view to ensure follow-up actions have fully resolved all the violations (Section 12.2.1.4¹⁰).

It is also mentioned in more serious GMP or data integrity warning letters.

Areas for Investigation

Suggested areas for the investigation team for the CDS Observation 2 are shown in Figure 4 and discussed below. Owing to limited space, we have omitted discussing the review of the analytical process, as the focus is on systems and people.

Data Governance (DG), Data Integrity (DI), and Data Management (DM)

Although not mentioned in Observation 2, there is a critical requirement for assessment of DG, DI, and DM controls and associated training throughout this noncompliance. What policies and procedures are in the QMS? If these are available, what is the current effectiveness framework and maturity level? How has training been conducted?

Focus Only on the CDS?

A common mistake in responding to a Form 483 is to just focus on the items listed in the citation (the CDS). Line 211-215 of the guidance states:

FDA 483 observations are not an exhaustive list of all deficiencies … the establishment should take appropriate corrective action within its quality management system to address any non-cited objectionable conditions that might exist. ¹

Line 196 also mentions a systematic approach¹, which is consistent with the ICHQ10 definition of quality risk management (QRM).¹¹ Therefore, it is crucial to ask questions such as what other computerized systems, including spreadsheets, are used in the laboratory? Is there segregation of duties? Although an investigation could extend into production and QA/QMS systems, our focus is on the laboratory.

1. The up-to-date system inventory¹² should list all GMP systems and spreadsheets.
2. Determine if paper printouts are the only GMP record. Is there a focus solely on paper printouts for all systems?
3. For spreadsheets, are the files saved? Is there a link between the printout and the spreadsheet file, as per 21 CFR 11.70? ¹³
4. For each computerized system, is there segregation of duties, or do all users have administrator rights? Has a data integrity risk assessment (DIRA) been performed?^{11, 14,15} Are there standard operating procedures (SOPs) for acquisition and interpretation of data?
5. Are risks evaluated, documented, and kept current across products, equipment, and sites?

Regulatory Knowledge and Not Keeping Current

The primacy of electronic records over paper printouts has been clear since the Able Laboratories fraud case in 2005, which was the first 483 citation for failing to review audit trails.^16,17 It appears the company has not kept up to date with regulatory knowledge, but the clue is in the title CURRENT Good Manufacturing Practice (CGMP). The FDA has a webpage explaining that systems and processes, including quality systems, must be current.¹⁸ Why was regulatory knowledge not kept current to reflect the change in interpretation of regulations? The company apparently ignored the publication of the 2018 FDA DI Guidance, especially questions 10 and 12, on why electronic records take primacy over paper printouts.⁹

Second Person Review

Second person review has been a regulatory requirement since 1978 in 21 CFR 211.194(a)(8).¹⁹ For further details, see FDA DI guidance⁹ questions 7 and 8 for audit trail review.

Quality Oversight and Culture

Why does the Quality Unit not have any oversight or authority over the work performed in the laboratory? Line 326–328 of the guidance mentions the quality assurance (QA) role:

…determine why the issues leading to the observation were not previously identified by the quality unit or corrected by the establishment’s management before the FDA inspection… the establishment should consider how improvements to the quality system, personnel management, and overall quality culture may improve organizational performance.¹

Lack of quality oversight and data governance could lead to DI violations, and we will discuss it as a likely root cause later.

Computerized Systems and Complete Data

There is a requirement in 21 CFR 211.194(a) for complete data.¹⁹ Put simply, “complete” includes all data and records collected during analysis, not just a summary printout. Is the laboratory taking a similar approach with other computerized systems by merely reviewing printed summary reports?

1. For the CDS, the summary report may not contain chromatograms.
2. What happens between acquisition and reporting is not mentioned: SST failures, integrating into compliance, data deletion, etc. This has been covered in several “Questions of Quality” columns over the years.^20-22
3. The role of IT was not mentioned in the 483, but at a minimum, you need to know how computerized systems, even standalone ones, are configured, backed up, and time synchronized.

Extend Investigation to Analytical Instruments?

Are there similar user role gaps when using USP <1058> Group B analytical instruments?²³ Modern analytical instruments, such as balances and pH meters, have functions to set up user roles with access privileges where only an administrator can change the clock. Are there such instruments used in the laboratory, and are there individual accounts established with segregation of duties? Any printouts would be attributable to a user.

Management Leadership

The glossary defines executive management as a senior person who directs and controls an establishment at the highest levels, with the authority and responsibility to mobilize resources within the establishment.¹ This leadership, including data governance, appears missing in action.

One of the remediations in the Stayson and Tender warning letters recommended by the FDA^{24, 25} required management and QA to have knowledge of computerized systems to ensure compliant operations; see “Focus on Quality” column for analysis of the two warning letters.²⁶

Staff Interviews

It should not be limited to employees in roles connected with observation, as mentioned in the FDA guidance, line 253.¹ According to PIC/S 041 12.1.1.1, staff interviews should be conducted with both current and former personnel,¹⁰ from the bench to the board room, and include process owners, IT system owner(s), and laboratory administrators to learn why this situation was allowed. The role of quality oversight and its relevant accountability should be included as part of the interview. We will discuss this later. 

In this case study (part C of Observation 2), the interview process could be expanded to the CDS supplier. This could help the company gain insight as to whether poor technical controls were a contributory factor to poor configuration management—for example, the ability to turn audit trails off and then back on again. Was a DIRA performed prior to system purchase?

Review of Batch Records

Section C of the draft guidance indicates the 21 CFR 211.192 requirement to investigate other batches of the same drug product and other drug products that may have been associated with the specific failure or discrepancy (line 297-298).¹ Additionally, lines 309-314 provides an example and describes how to expand the investigation’s scope.¹ This is consistent with PIC/S 12.1.1.1.¹⁰

Determination of the scope (data, products, processes and specific batches) …

Although it is not stated in Form 483,⁷ the impact on product quality, patient safety, and data integrity may require investigation to extend to reviewing batches released to market. What is the impact of distributed products that used systems that were questionable?

Our suggestion is to consider a review of a complete batch record from raw material, in process to release tests for a single product. A retrospective approach is required to determine the certain number of batches and the production period.^10,27 The issues such as manual integration, manipulation of integration parameters, and reprocessing data can call into question the product impurity profile. This could direct the investigation to determine whether there was any potential patient safety risk.

Deficiency Risk Assessment

For this case study, there is a wide range of deficient DI, DG, and DM practices focused on the CDS. The glossary of WHO TRS 996 annex 5 defines good data and record management practices as follows:

The totality of organized measures that should be in place to collectively and individually ensure that data and records are secure, attributable, legible, traceable, permanent, contemporaneously recorded, original and accurate and that if not robustly implemented can impact on data reliability and completeness and undermine the robustness of decision-making based upon those data records.²⁸

Table 1 shows some examples that fall under poor DM and DI. The company’s QMS is not mentioned in Form 483. The whole QMS needs to be thoroughly reviewed to ensure data governance and integrity is ingrained throughout it and staff receive appropriate training to ensure effective implementation.

Possible Root Causes

Owing to the minimal information in the 483,⁷ the possible root causes listed below have a high uncertainty. Here are our suggestions:

• Apparent lack of senior management involvement in the laboratory operations, such as Gemba walks to get out of their offices and understand any problems firsthand.
• Lack of CGMP regulatory knowledge and training throughout the organization on generating GMP records involving computerized systems and data integrity: This requires training for all laboratory staff, as well as quality assurance and management. This needs to be implemented by initial and on-job trainings, as well as verification of the effectiveness:

21 CFR 211.15(a): Training in current good manufacturing practice shall be conducted by qualified individuals on a continuing basis and with sufficient frequency to assure that employees remain familiar with CGMP requirements applicable to them.¹⁹

This is the same as required by EU GMP chapter 2.11:²⁹

• Lack of quality oversight of analytical work indicates that quality unit personnel do not appear to have sufficient education, training, and experience to perform their duties.
• Conflict of interest in the CDS and any other computerized systems in the organization: change controls are raised and new roles and access privileges are documented, followed by risk-based validation.

These are not quick and easy fixes but require time to implement interim and long-term actions effectively.

Using AI to Help Your Response?

Just as this column went to press, the Medicines and Healthcare Products Regulatory Agency (MHRA) published some advice on its website about using artificial intelligence (AI) to respond to regulatory findings. The advisory notes:

… encountered responses containing references to MHRA guidance that doesn't exist, citations of inappropriate regulatory frameworks, and responses to serious deficiencies that appear designed to mislead rather than address underlying problems.³⁰

… contained material inaccuracies, including non-existent references as well as inaccurate information …³⁰

Inappropriate use of AI created a greater regulatory burden for the Agency but also increased patient risk. Therefore, don’t be a clown and dump an observation into a commercial online AI tool expecting a sage response; be transparent and use AI wisely and in a compliant manner. The post provides similar advice to the draft FDA guidance¹: Responses must be technically accurate, verified by multidisciplinary experienced personnel, and approved by senior management. The post offers an option to disclose that AI has been used in responding to observations. Please read AND follow this advice.³⁰

Summary: Understanding the Cost of Noncompliance

You may be thinking that there is a lot of work, time, and money involved in investigating and resolving ONE 483 observations, as shown in Figure 4. You are correct. Look at Figure 1 in the November 2020 “Focus on Quality” article,²⁶ and you will see that the cost of compliance is always, always, always cheaper than the cost of noncompliance. You know it makes sense, but does senior management realize this?

Acknowledgments

We thank the following, in alphabetical order, for their review comments that have improved this column: Monika Andraos, Chris Burgess, Andrea Chellini, Hugues Desreumaux, Jim Henderson, Bob Iser, and Prasadhi Shiva.

References

1. FDA Draft Guidance for Industry Responding to FDA Form 483 Observations at the Conclusion of a Drug CGMP Inspection; Food and Drug Administration: Silver Spring, MD, 2026.

2. FDA Form 483 Frequently Asked Questions. Food and Drug Administration website, 2020. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/inspection-references/fda-form-483-frequently-asked-questions (accessed 2026-05-24).

3. What Should I Expect During an Inspection? Food and Drug Administration website, 2020. https://www.fda.gov/industry/fda-basics-industry/what-should-i-expect-during-inspection (accessed 2026-05-25).

4. Inspection Observations. Food and Drug Administration website. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/inspection-references/inspection-observations (accessed 2026-06-26).

5. Inspection Classifications. Food and Drug Administration website, 2024. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/inspection-basics/inspection-classifications (accessed 2026-05-19).

6. McDowall, R. D. The Tiger Has Sharp New Teeth. Advanstar, 2009. https://www.spectroscopyonline.com/view/tiger-has-sharp-new-teeth (accessed 2026-05-28).

7. FDA Form 483 Observations, Staska Pharmaceuticals Inc.; Food and Drug Administration: Silver Spring, MD, 2026.

8. FDA Application Integrity Policy: Fraud, Untrue Statements of Material Facts, Bribery, and Illegal Gratuities (Compliance Policy Guide Section 120.100); Food and Drug Administration: Rockville, MD, 1991.

9. FDA Guidance for Industry Data Integrity and Compliance With Drug CGMP Questions and Answers; Food and Drug Administration: Silver Spring, MD, 2018.

10. PIC/S PI-041 Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments; PIC/S: Geneva, 2021.

11. ICH Q10 Pharmaceutical Quality Systems. International Council on Harmonisation of Technical Requirements for Pharmaceuticals for Human Use: Geneva, 2008.

12. EudraLex – Volume 4 Good Manufacturing Practice (GMP) Guidelines, Annex 11 Computerised Systems. European Commission: Brussels, 2011.

13. 21 CFR Part 11; Electronic Records; Electronic Signatures Final Rule. Federal Register 1997, 62(54), 13430–13466.

14. MHRA GXP Data Integrity Guidance and Definitions. Medicines and Healthcare products Regulatory Agency: London, 2018.

15. McDowall, R. D. Can We Simplify Data Process Mapping? Spectroscopy 2024, 39(7), 20–26. DOI: 10.56530/spectroscopy.tk4986x8

16. Able Laboratories Form 483 Observations. Food and Drug Administration website, 2005. https://www.fda.gov/media/70711/download (accessed 2026-07-25).

17. McDowall, R. D. Able Laboratories Fraud Case: What Have We Learnt? LCGC International 2025. https://www.chromatographyonline.com/view/able-laboratories-fraud-case-what-have-we-learnt-

18. Facts About the Current Good Manufacturing Practices (CGMPs). Food and Drug Administration website, 2021. https://www.fda.gov/drugs/pharmaceutical-quality-resources/facts-about-current-good-manufacturing-practices-cgmp (accessed 2026-07-25).

19. 21 CFR 211 Current Good Manufacturing Practice for Finished Pharmaceutical Products. Food and Drug Administration: Silver Spring, MD, 2008.

20. McDowall, R. D. Where Can I Draw The Line? LCGC Europe 2015, 28 (6), 336–342.

21. Longden, H.; McDowall, R. D. Can We Continue to Draw the Line? LCGC Europe 2019, 32 (12), 641–651.

22. McDowall, R. D. Ingenious Ways to Manipulate Peak Integration? LCGC International 2024, 1 (2), 20–26.

23. USP General Chapter <1058> Analytical Instrument Qualification. United States Pharmacopoeia Convention Inc.: Rockville, MD.

24. FDA Warning Letter, Tender Corporation; Food and Drug Administration website, 2020. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/tender-corporation-599789-07232020 (accessed 2026-07-25).

25. FDA Warning Letter, Stason Pharmaceuticals, Inc.; Food and Drug Administration website, 2020. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/stason-pharmaceuticals-inc-604889-07082020 (accessed 2026-07-25).

26. McDowall, R. D. Do You Really Understand the Cost of Noncompliance? Spectroscopy 2020, 35 (11), 13–22.

27. McDowall, R. D. Data Integrity and Data Governance: Practical Implementation in Regulated Laboratories; Royal Society of Chemistry: Cambridge, U.K., 2019.

28. WHO Technical Report Series No. 996 Annex 5 Guidance on Good Data and Records Management Practices. World Health Organisation: Geneva, 2016.

29. EudraLex – Volume 4 Good Manufacturing Practice (GMP) Guidelines, Chapter 2 Personnel. European Commission: Brussels, 2014.

30. Use of AI for GXP Inspection Responses: Setting Standards Without Stifling Innovation. Medicines and Healthcare products Regulatory Agency (MHRA) website, 2026. https://mhrainspectorate.blog.gov.uk/2026/06/29/use-of-ai-for-gxp-inspection-responses-setting-standards-without-stifling-innovation/ (accessed 2026-06-29).

Mahboubeh Lotfinia works as a qualified person and quality partner at F. Hoffmann-La Roche and is trained in GMP/GDP audit execution and CSV (computerized system validation).