FDA sent 303 drug warning letters in FY2025 - a 59% increase from FY2024. Behind that headline number is a quieter, more consistent pattern: the same four CFR sections have held the top four positions in FDA's most-cited 483 observations in every inspection year from 2021 through 2024. This is not a story about a single bad year. It is a story about four specific, well-documented requirements that pharmaceutical sites have struggled to consistently meet for half a decade.
Understanding why these four keep appearing - and what a genuinely compliant response looks like for each - is one of the most commercially valuable things a QA professional can know, because it points directly at where inspection risk actually concentrates.
Failure to thoroughly investigate discrepancies
The requirement that any unexplained discrepancy or batch failure be thoroughly investigated has held the number one or number two position for four consecutive years. The most common specific failures are retesting without an identified assignable cause and investigations whose scope was not extended to other potentially affected batches.
Quality unit procedure and authority failures
21 CFR 211.22 establishes the quality unit's responsibility and authority over manufacturing, testing and release decisions. Citations here typically involve the quality unit lacking documented procedures for its own oversight activities, or evidence that the quality unit's authority to reject a batch was not actually exercised independently of production or commercial pressure.
Absence of written procedures, or procedures not followed
21 CFR 211.100(a) requires written procedures for production and process controls. Citations here span two distinct failure modes: a required procedure that simply does not exist, and a procedure that exists but was not followed as written - with the deviation from it undocumented and uninvestigated.
Laboratory control failures
21 CFR 211.160(b) requires that laboratory controls include scientifically sound specifications, standards and test procedures. Citations here typically involve test methods that were not validated for their intended use, or specifications that were not scientifically justified against the product's actual quality attributes.
Why the same four keep appearing
It would be easy to conclude that pharmaceutical sites simply are not aware these requirements exist. That is not what four consecutive years of consistent data suggests. These are not obscure provisions - they are foundational, widely taught elements of 21 CFR Part 211. What the persistence of the pattern actually points to is a gap between knowing a regulation exists and consistently implementing it correctly under real operating pressure, across every batch, every shift and every investigation.
21 CFR 211.192 investigations are genuinely difficult to execute consistently well. A thorough investigation that correctly identifies root cause and appropriately extends scope to other batches requires both technical skill and organisational discipline under time pressure - and the FDA's own March 2026 draft guidance on 483 responses explicitly cites failure to address root cause as a specific, common way a response fails to satisfy the agency.
21 CFR 211.22 quality unit findings often reflect a structural tension rather than a documentation gap - the quality unit's independence is easy to state as a principle and harder to consistently exercise when a batch release decision has commercial consequences attached to it.
Each of the four top-cited requirements shares a common feature: they are activities that must be performed correctly and consistently under real operational pressure, not simply documented as existing. A quality unit with independence stated in an SOP but not exercised in practice. A procedure that exists but is not followed when production is behind schedule. A laboratory method that was validated once but not maintained. An investigation that identifies a plausible cause without genuinely ruling out alternatives. The gap FDA keeps finding is between the system as designed and the system as actually operated.
What this means heading into 2026
With FY2025 warning letters up 59% and enforcement showing no sign of easing in 2026, the persistence of these four citation categories is a signal worth taking seriously rather than treating as background noise. A site that has never received a citation in one of these four areas is not necessarily doing something different from a site that has - it may simply not have been inspected as closely, or not yet, on the specific day an investigation, a procedure deviation or a laboratory result happened to be examined.
The practical response is not simply to write better procedures, though that matters. It is to build the organisational discipline that makes the procedure, the investigation standard and the quality unit's independence actually function the way they are documented to function - every time, not just on the days an inspector happens to be present.
Four years of consistent data across four different regulatory requirements point to the same underlying challenge: the distance between a well-designed quality system on paper and a quality system that functions correctly under real operational pressure. Understanding exactly what FDA has found deficient in each of these four areas - not just knowing the regulation exists - is what separates genuine inspection readiness from documentation that looks complete until it is tested.
Key regulatory references
- 21 CFR 211.192 - Production record review
- 21 CFR 211.22 - Responsibilities of quality control unit
- 21 CFR 211.100(a) - Written procedures, deviations
- 21 CFR 211.160(b) - Laboratory controls, general requirements
Our courses cover all four top-cited requirements in depth
OOS Investigations, Deviation Management, CAPA Systems and Laboratory Controls - each built from the specific regulatory text and current FDA enforcement data. Certificate on completion.