Every quality system has a deviation process, and every inspector knows where to look first: not at the deviations that were opened, but at the ones that were closed. Two FDA warning letters issued in 2026, to a biologics manufacturer in Ireland and a generics manufacturer in India, show what happens when closing a record becomes the goal instead of finding out what went wrong.
Neither firm lacked a deviation procedure. Both had one, and both used it. The failures were in what the procedure was allowed to do: cancel events without investigating them, and explain away failures with causes nobody could prove.
FDA found that the firm had cancelled numerous deviations without a root cause investigation or a product impact assessment, and described this as part of a pattern of inadequate quality unit oversight.
What the two letters found
FDA inspected Genzyme Ireland's Waterford facility from January 12 to 20, 2026. Investigators found that numerous deviations had been cancelled with no root cause investigation and no assessment of product impact. When the firm responded, it ran a retrospective review of 74 cancelled deviations and concluded that 36 of them needed investigation after all. FDA's reply questioned why the review covered such a limited timeframe, and asked the firm to look at cancelled deviations outside it. The cancelled events included reject-limit failures and missed secondary reviews. Separately, a deviation on filling residue that the quality unit had approved and closed attributed the findings inconsistently and never adequately explained the orange material that triggered it. The same inspection found a test repeated up to 11 times without any of the repeats appearing in the laboratory records.
Roughly twelve weeks earlier, on March 30, 2026, FDA issued a warning letter to Intas Pharmaceuticals following a September 2025 inspection of its Selaqui, Dehradun facility. The firm had confirmed multiple stability out-of-specification results since 2023 and had been recalling batches since 2024. For one confirmed 12-month stability failure, the investigation attributed the result to "product behavior" and did not evaluate reserve samples from distributed batches or other batches made with the same API lot. After the firm moved to a revised test method, two batches still failed, and FDA found no investigation into why, or whether the method itself was part of the problem. In a separate case, an assay result on a control batch was invalidated as a "solution preparation error" without conclusive evidence, no analyst-training CAPA followed, and an initial out-of-specification result was discarded with thin documentation and left out of final reporting.
FDA's concern in both letters was not that deviations or failing results occurred. Every manufacturer has them. The concern was what happened at the moment of closure: a cancellation with no investigation behind it, a root cause with no evidence behind it, a result discarded with no record of why. A closed deviation is a decision, and FDA expects to see the evidence for it.
What 21 CFR 211.192 and 211.22 actually require
21 CFR 211.192 requires that any unexplained discrepancy, or any failure of a batch or its components to meet specification, be thoroughly investigated, whether or not the batch has already been distributed. The investigation must extend to other batches of the same product, and to other products, that may have been associated with the same failure. A written record must capture the conclusions and the follow-up. 21 CFR 211.100(b) adds that deviations from written procedures must be recorded and justified, and 21 CFR 211.22 gives the quality unit the authority to review production records to make sure that errors have been fully investigated.
Read together, those requirements leave very little room for an event that is logged and then quietly resolved. If something happened that was not planned, someone has to be able to show what it was, why it happened, and what else it might have touched.
What a defensible deviation programme actually contains
A deviation system that survives inspection treats closure as the point of highest scrutiny, not the end of the paperwork:
- A record for every event before anyone decides whether it matters. The decision that something is minor, or not a deviation at all, is made inside the system with a documented rationale, never outside it.
- Cancellation held to the same standard as closure. A cancelled deviation needs a written justification reviewed by the quality unit, and cancellations should be trended and periodically audited as a category of their own.
- Scope that reaches beyond the single batch. The investigation asks which other batches, reserve samples, material lots, and products could share the cause, as 211.192 requires, and records the answer even when it is "none."
- Root causes that rest on evidence. "Product behavior," "analyst error," and "preparation error" are conclusions, not findings. Each needs data that rules out the alternatives.
- Invalidation rules defined in advance. The conditions under which a result can be invalidated or an initial result set aside are written down before the result arrives, and every discarded result stays visible in the record.
- Trend review that connects repeat events. Two failing batches after a method change, or the same type of deviation recurring across months, is a signal about the system, not a series of unrelated events.
Our earlier posts on CAPA systems and out-of-specification investigations cover two systems this one feeds directly. A deviation that is closed without a real root cause cannot produce a CAPA that works.
Why a cancelled deviation is a finding, not a clean-up
The Genzyme Ireland review is a useful illustration of how this plays out. When the firm went back through 74 cancelled deviations, nearly half needed investigation. That ratio changes how every other cancellation in the system should be read. A cancellation process that is wrong this often is not a filter for trivial events, it is a gap in the system, and FDA's request to extend the review beyond the original timeframe reflects that. Once a pattern like this is visible, the question stops being whether a single deviation was handled well and becomes how many others were handled the same way.
Why an unproven cause is not a root cause
The Intas letter shows the quieter version of the same failure. Attributing a confirmed stability failure to the behavior of the product, or an invalidated result to a preparation error, ends the investigation quickly, and ending the investigation quickly is exactly what makes those explanations attractive. FDA's response in each case was to ask what evidence supported the cause and what had been ruled out. For a stability failure, that includes whether the problem could extend to batches already in the market. An explanation that cannot answer those questions is a hypothesis, and 211.192 does not accept a hypothesis in place of an investigation.
When the record itself is changed
The Intas inspection also found that a quality assurance employee had asked a software vendor to change electronic batch records, and that the changes did not appear in the audit trail or under any quality-system control. In one batch record, an employee ID in a "dispensed by" field was replaced with no audit trail entry and no note. No deviation was opened. A change to a completed GMP record is itself an event that needs a deviation, an explanation, and an impact assessment, and a system that lets such a change pass silently has a gap that no downstream investigation can close.
A deviation programme is only as credible as its closures. Opening a record shows that someone noticed. Closing it correctly shows that someone understood, checked the scope, tested the explanation against the evidence, and looked at what else might be affected. Both 2026 letters came down to closures that could not show their work, and an inspector will always read the closed records first.
Key regulatory references
- FDA Warning Letter CBER 26-728681, Genzyme Ireland Limited, June 22, 2026
- FDA Warning Letter 320-26-57, Intas Pharmaceuticals Limited, March 30, 2026
- 21 CFR 211.192: Production record review
- 21 CFR 211.22: Responsibilities of quality control unit
- 21 CFR 211.100(b): Written procedures; deviations
- FDA Guidance: Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production
Explore our Deviation Management GMP Map and Deviation Investigation Builder
Walk the deviation process from detection through closure, then try the free Deviation Investigation Builder to pressure-test scope, root cause, and impact assessment on a real event.