Skip to main content

regulatory reference

The Anatomy of an FDA Warning Letter: Every Section Explained, With Real Examples

Published 2026-07-16

By Andy Gaber, founder of Argus HQ

TL;DR

  • An FDA Warning Letter follows a consistent structure regardless of which center issues it: an identification block, an inspection reference, one or more numbered citations tied to specific CFR subsections, an assessment of the company's response (if one was submitted), warning language about legal status ("adulterated" / "misbranded"), and a response demand with a deadline (FDA, About Warning and Close-Out Letters).
  • Warning Letters use at least three different numbering conventions depending on issuing office and era — MARCS-CMS numbers, "WL" case numbers (e.g., WL 320-26-95), and plain "CMS #" references — and none of them is interchangeable with a Form 483 number or an Import Alert number.
  • The response window is a Regulatory Procedures Manual norm, not a statute: typically 15 working days, not 15 calendar days (Argus HQ, "How long does a company have to respond to an FDA Warning Letter?").
  • Six FDA centers issue Warning Letters — CDER, CDRH, CBER, CFSAN (via the Human Foods Program), CTP, and CVM — and which one issues a given letter depends on product jurisdiction, not company size or violation severity.
  • The words "adulterated" and "misbranded" are not editorial description. They are terms of art under the Federal Food, Drug, and Cosmetic Act that establish the legal basis for the citation.

In this series: The Anatomy of an FDA Warning Letter

  1. What Do the Numbers Mean? Decoding FDA Warning Letter ID Formats
  2. Which FDA Center Issues Your Warning Letter, and Why It Matters
  3. "Adulterated" and "Misbranded": The Two Words That Do the Legal Work
  4. Does an FDA Warning Letter Name Individuals, or Just the Company?
  5. The Boilerplate Paragraphs Every FDA Warning Letter Shares
  6. How to Tell If a Warning Letter Citation Is a Repeat Finding

See also: FDA Enforcement by Industry -- the companion pillar on how enforcement differs by sector.

Why the anatomy matters before the content does

A new compliance hire's first Warning Letter usually arrives as a wall of text with no map attached: a MARCS-CMS number at the top, a list of CFR citations in the middle, a paragraph explaining why FDA found the company's prior response inadequate, and a demand for a written reply within a stated number of working days. Reading the letter for its substance — what was actually cited, and how serious it is — is much faster once the structure underneath that wall of text is familiar. This guide walks through that structure section by section, using real 2026 letters as illustrations, and links out to Argus HQ's more detailed coverage of pieces we've already written up on their own.

Section 1: The identification block

Every Warning Letter opens with an identification block that answers four questions: who is FDA writing to, which facility does this concern, what is the tracking number, and what date was the letter issued. This is also where the numbering-convention confusion starts, because FDA has used more than one system across different eras and different offices.

A 2026 CDER letter to Huons Co., Ltd. was tracked as WL 320-26-95, issued 2026-06-15, referencing the facility's FEI number (3007163376) directly in the identification block (sample brief, argushq.ai). A different 2026 letter to Full Fresh Produce LLC was instead tracked by CMS number — CMS #726913 — rather than a WL-prefixed case number. A third convention, MARCS-CMS, appears on letters like the one to Med Shop Inc (MARCS-CMS 725157, June 23, 2026). All three are FDA's own internal case-tracking identifiers; none of them is the same numbering system used for a Form 483 (which is tied to an individual inspection, not a subsequent Warning Letter) or an Import Alert (which uses its own alert-number series, such as Import Alert 66-40).

The identification block also names the facility by its FEI (FDA Establishment Identifier) number where relevant — critical for multinational companies with several registered facilities, since a Warning Letter cites a specific plant, not the parent company's entire operation.

Section 2: The inspection reference

The body of the letter opens by describing the inspection that produced the findings: dates, location, and often the specific investigator observations that were escalated. FDA's own guidance describes the letter as one that "identifies the concern(s), such as poor manufacturing practices, problems with claims for what a product can do, or incorrect directions for use," building directly from what an inspection turned up (FDA, About Warning and Close-Out Letters).

This is also the section that connects a Warning Letter back to an earlier Form 483, when one exists. Not every Warning Letter follows a Form 483 — some are issued without a physical inspection, based on labeling review or marketing claims alone — but when an inspection did occur, the Warning Letter's inspection-reference section is where that connection is made explicit, including the inspection date range. Argus HQ has covered how the two documents relate to each other and why most Form 483s never escalate to a Warning Letter at all (Argus HQ, "What's the difference between a Form 483 and an FDA Warning Letter?").

Section 3: The citation section — the core of the letter

This is the section that carries the actual legal and technical substance, and it is built the same way regardless of industry: each finding is tied to a specific, numbered CFR subsection, described in plain language, and supported with the specific facts the investigator documented.

A June 2026 letter to Huons Co., Ltd. illustrates the pattern clearly. FDA's CDER cited the firm across five separate CFR subsections in a single letter — 21 CFR 211.194(a) (laboratory record integrity), 211.113(b) (microbial contamination control), 211.192 (production record review), 211.34 (consultant oversight), and 211.42(c) (facility design) — each tied to a specific documented failure, including a microbiology team leader who "cut finished pages out of a lab logbook with a knife and replaced them with fabricated ones," and 1,897 blank uncontrolled forms found on site (Argus HQ, "Huons Co., Ltd. FDA Warning Letter 320-26-95 — data integrity CGMP violations"). A separate 2026 letter to Wizcure Pharmaa cited a fabricated microbial-plate result — "Original plates were discarded and replaced with new plates" — alongside a missing ISO 5/ISO 7 barrier and deficient media fills (Argus HQ, "Wizcure Pharmaa FDA Warning Letter 320-26-97").

The citation-to-CFR-subsection structure is deliberate, not incidental. FDA's underlying CGMP regulations are organized around personnel, facilities, equipment, component controls, production controls, packaging, holding, laboratory controls, and records — and Warning Letter citations map directly onto those same categories, which is why 21 CFR 211.22 (the quality control unit's authority) topped FY2025's citation list at 62 of 134 inspection-based drug Warning Letters (Argus HQ, "The 5 most-cited FDA warning letter violations in FY2025, ranked"; see also Argus HQ, "What Is CGMP? FDA's Core Manufacturing Standard, Explained").

For medical devices, the citation section instead references the Quality System Regulation, now the Quality Management System Regulation (QMSR) under 21 CFR Part 820, effective February 2, 2026 — a structurally similar but legally distinct framework from the drug CGMP citations above (Argus HQ, "Is FDA's new device quality rule a compliance reset? The first warning letters say no").

Section 4: The company-response assessment

If a company already responded to an earlier Form 483 or a prior communication, the Warning Letter typically includes a section assessing whether that response was adequate — and if FDA found it inadequate, the letter explains why. A June 2026 letter to BlephEx, LLC illustrates just how far this can go: CDRH rejected six separate company responses in a row before issuing the Warning Letter, on findings that included marketing three ophthalmic devices beyond their cleared use and an unreported charger correction after a handpiece "blew up" (Argus HQ, "Why Did FDA Reject BlephEx's Quality Fixes Six Times?").

This section is where FDA draws the line between a correctable finding and a company that has already had the opportunity to correct it and failed to do so — which materially affects the tone and legal exposure of the rest of the letter. Argus HQ has built a standalone checklist for what actually makes a response adequate enough to close out a citation, built directly from FDA's own Regulatory Procedures Manual (Argus HQ, "What actually makes an FDA warning letter response 'adequate' enough to close out?").

Section 5: The legal-status language — "adulterated" and "misbranded"

Buried in the middle of most Warning Letters is language stating that, based on the findings above, the product in question is "adulterated" and/or "misbranded" within the meaning of the Federal Food, Drug, and Cosmetic Act. These are not adjectives describing severity — they are the specific statutory terms that establish the legal basis for everything that follows, including FDA's authority to pursue further enforcement (seizure, injunction, import detention) if the company doesn't correct the violations. A drug found not to meet CGMP requirements is, by the Act's own terms, adulterated regardless of whether it is otherwise safe or effective; the CGMP failure itself is the legal defect.

Section 6: The response demand and deadline

Every Warning Letter closes its substantive content with a demand for a written response within a stated window — most commonly 15 working days, a Regulatory Procedures Manual norm rather than a statutory deadline, and a period FDA has occasionally proposed changing in draft guidance (Argus HQ, "How long does a company have to respond to an FDA Warning Letter?"). This window is distinct from — and typically shorter in practical effect than — the response period companies get after a Form 483, and the two should not be treated as the same clock (Argus HQ, "A Practical Guide to Responding to an FDA Form 483 Before It Becomes a Warning Letter").

Section 7: The boilerplate — and why it isn't filler

The closing paragraphs of nearly every Warning Letter repeat a near-identical set of statements: that failure to correct violations promptly may result in FDA enforcement action without further notice, that the letter does not constitute a complete list of every deficiency present at the facility, and that future inspections may identify additional violations beyond what's cited here. This language looks like filler, but it is doing real legal work — it is the basis on which FDA can escalate to seizure, injunction, or a consent decree without treating the original Warning Letter as having exhausted the matter. Pharmasol Corporation's path from a 2019 Warning Letter to a December 2023 consent decree over the same unresolved CGMP failures is a documented example of exactly this progression (Argus HQ, "What is an FDA consent decree, and how does a Warning Letter lead to one?").

Which FDA center issues the letter, and why it varies

A Warning Letter's issuing office is determined by product jurisdiction, not by severity or company size. CDER (Center for Drug Evaluation and Research) issues drug and biologics-adjacent letters; CDRH (Center for Devices and Radiological Health) issues device letters; CBER (Center for Biologics Evaluation and Research) issues biologics letters, including cell and gene therapy; the Human Foods Program (successor to much of CFSAN's enforcement role) issues food and dietary supplement letters; CTP (Center for Tobacco Products) issues tobacco and vape letters; and CVM (Center for Veterinary Medicine) issues animal-health and veterinary drug letters. A single company that makes both a drug and a companion diagnostic device can receive Warning Letters from two different centers, on two different tracks, with two different response clocks running simultaneously.

What this means for reading any Warning Letter

  • Read the identification block first, but don't assume the numbering format tells you the issuing office. MARCS-CMS, WL-prefixed, and plain CMS# formats all appear across different centers and eras; the office is stated separately in the letter body.
  • Treat the citation section as the actual content and everything else as context around it. The CFR subsection is the specific, actionable finding; the surrounding narrative explains why FDA found it, but the subsection number is what a remediation plan has to address.
  • A rejected prior response (Section 4) is a materially worse starting position than a first-time citation. BlephEx's six rejected responses shaped a harsher outcome than a first citation typically would.
  • The boilerplate closing language is not decorative. It is the legal hook FDA uses to escalate past the Warning Letter stage if correction doesn't happen, and it should be read as a live threat, not a formality.

Related reading — deeper coverage already on Argus HQ

Sources

Argus HQ is informational only. Summaries are AI-assisted and may contain errors, misclassifications, or omissions. The underlying FDA Warning Letters are public records; always verify against the original source before regulatory decisions. Not legal, financial, or medical advice.

Stop tracking this by hand.

Argus reads every FDA Warning Letter the day it publishes and delivers the ones touching your watchlist by 6am ET. $199/month, cancel any time.

Start Enforcement Intelligence — $199/moSee a sample brief