TL;DR
- FDA issued 303 warning letters to drug and biologics manufacturers in FY2025, up 59% from 190 in FY2024 (Pharmaceutical Online, March 13, 2026).
- Of those, 135 were inspection-based. Analysis of 134 of them (one CBER device letter excluded) shows the top-cited CFR section was 21 CFR 211.22 — quality control unit responsibilities — cited in 62 letters.
- The next four: 211.100(a), written procedures (51 letters); 211.84(d)(1)/(d)(2), component identity testing (48); 211.192, investigations (47); 211.166, stability testing (40).
- 211.84(d) citations cluster heavily in OTC products with diethylene glycol/ethylene glycol contamination risk — 40 of 48 letters citing it cited both subsections together.
- 85 of 135 inspection-based letters (63%) went to U.S. domestic firms, roughly consistent with FY2024's 61% domestic rate.
303 warning letters. One number tells you where FDA is looking.
FDA sent 303 warning letters to drug and biologics manufacturers in fiscal year 2025. That's a 59% jump from FY2024's 190, according to an analysis by ELIQUENT Life Sciences published in Pharmaceutical Online on March 13, 2026. Big number. But it hides two very different stories.
One story is about scale: 167 of those 303 letters were non-inspection-based, driven largely by GLP-1 telehealth compounding crackdowns and OTC unapproved-drug initiatives. The other story is about substance: 135 letters came out of actual FDA inspections, and those letters tell you, CFR section by CFR section, exactly what inspectors keep finding wrong on the floor.
This piece is about the second story. We pulled the ranked list of most-cited CFR sections from the 134 inspection-based letters ELIQUENT analyzed (they excluded one CBER device letter from the CFR count), and we're breaking down what each one means for a working quality system — not just what the regulation says, but what FDA is actually catching people doing.
Quick-reference: the top 5 most-cited CFR sections, FY2025
| Rank | CFR Section | Subject | Warning letters citing it |
|---|---|---|---|
| 1 | 21 CFR 211.22 | Responsibilities of the quality control unit | 62 |
| 2 | 21 CFR 211.100(a) | Absence of written production/process control procedures | 51 |
| 3 | 21 CFR 211.84(d)(1) and (d)(2) | Identity testing of components | 48 |
| 4 | 21 CFR 211.192 | Failure to thoroughly investigate discrepancies | 47 |
| 5 | 21 CFR 211.166 | Inadequate stability testing program | 40 |
Two sections just missed the cut and are worth watching: 211.165(a),(b),(d),(e) (testing and release for distribution) appeared in 34 letters, and 211.160 (laboratory controls) appeared in 33. If your quality system has weak spots in either, don't treat their sixth- and seventh-place ranking as safety margin. Forty-eight or forty companies is not a small sample; it's a pattern.
1. 21 CFR 211.22 — Quality control unit responsibilities (62 letters)
This is the most-cited section in FY2025, appearing in 62 of 134 inspection-based warning letters — nearly half. 21 CFR 211.22 requires a quality control unit with the authority and responsibility to approve or reject all components, drug product containers, closures, in-process materials, packaging, labeling, and finished products. In practice, an 211.22 citation almost always means the same underlying failure: the QC unit either didn't have real authority, didn't exercise the authority it had, or wasn't structurally independent enough to say no to production.
What it means for your quality system, in practice:
- Authority on paper isn't authority in practice. If your QC unit's sign-off is a formality that production can route around under deadline pressure, FDA will find that during batch record review.
- Independence matters more than headcount. A two-person QC function that can actually halt a batch beats a ten-person function that reports through manufacturing and never says no.
- This is usually the citation that leads to the others. A weak QC unit is frequently the root cause investigators later trace 211.100(a) or 211.192 findings back to. Fix this one first.
2. 21 CFR 211.100(a) — Absence of written procedures (51 letters)
Fifty-one letters cited 21 CFR 211.100(a), which requires written procedures for production and process controls designed to assure that drug products have the identity, strength, quality, and purity they purport to have. This section covers a wide range of gaps: no procedure at all, a procedure that exists but doesn't match what's actually done on the line, or a procedure missing acceptance criteria.
FDA's warning letter to Oasis Medical Inc. is a useful illustration of how the agency frames this failure. The letter states: "Process validation evaluates the soundness of design and state of control of a process through its lifecycle... Successful process qualification studies are necessary before commercial distribution" (FDA warning letter to Oasis Medical Inc., July 15, 2025, quoted via Pharmaceutical Online). Note the phrase "before commercial distribution." A common failure pattern is validating a process retroactively, after commercial batches have already shipped, rather than before.
What to check:
- Do written procedures exist for every unit operation, or only the ones that got audited last time.
- Do the procedures match the batch record exactly, step for step.
- Is process validation complete and documented before, not after, commercial release.
3. 21 CFR 211.84(d)(1) and (d)(2) — Identity testing of components (48 letters)
21 CFR 211.84 requires component identity testing, and subsections (d)(1) and (d)(2) specifically require either testing each component or validating a supplier's certificate of analysis before relying on it. Forty-eight letters cited this section, and per the source data, 40 of those 48 cited both subsections together — meaning the failure usually wasn't "we skipped one step," it was "identity testing wasn't a real control at all."
This citation concentrated heavily in OTC products carrying diethylene glycol and ethylene glycol contamination risk: hand sanitizer, hand soap, and topical products. That's not a coincidence. DEG/EG contamination is a known, serious hazard in glycerin-based and alcohol-based OTC formulations, and it's exactly the kind of hazard identity testing exists to catch before a bad drum of raw material becomes a bad batch.
Guidance for quality teams sourcing components:
- If your firm makes hand sanitizer, hand soap, or similar topical OTC products, treat glycerin and propylene glycol identity testing as non-negotiable, not a corner to cut on a trusted supplier.
- A supplier's certificate of analysis is not a substitute for your own identity test unless you've validated that supplier's reliability with documented data. "We've used them for years" is not validation.
- Test the specific lot you received, not a representative sample from a prior shipment.
4. 21 CFR 211.192 — Investigations (47 letters)
Forty-seven letters cited 21 CFR 211.192, which requires a thorough investigation of any unexplained discrepancy or batch failure to meet specifications, whether or not the batch has already been distributed. This is the classic "your CAPA process is not actually a CAPA process" citation.
The pattern FDA calls out repeatedly: an out-of-specification result gets logged, sometimes even gets a root cause assigned, but the investigation doesn't extend to other batches that might share the same cause, and it doesn't produce a corrective action that actually prevents recurrence. A short investigation. A root cause of "analyst error" with no supporting evidence. No extension of scope to related lots.
What separates a real investigation from a paper one:
- Root cause is supported by evidence, not asserted. "Likely operator error" without investigation into training records, environmental conditions, or equipment logs won't hold up.
- Scope extends backward. If a discrepancy could affect other batches made under the same conditions, the investigation has to check them, not just the one that triggered it.
- Corrective action is verified to work, not just implemented. Closing an investigation the same week it opens is a signal FDA reads correctly.
5. 21 CFR 211.166 — Stability testing (40 letters)
Forty letters cited 21 CFR 211.166, which requires a written testing program to assess drug product stability and to use the results to set appropriate expiration dates and storage conditions. This citation typically shows up when a firm has an expiration date on the label that isn't backed by real-time stability data, or a stability program that exists but has gaps: missing time points, wrong storage conditions tested, or no protocol for handling an out-of-trend result.
Stability testing sits at the end of the list here, but it's not a minor issue. An expiration date is a claim about safety and efficacy over time. If it's not backed by data, it's a guess wearing a label.
Practical checks:
- Confirm your stability protocol covers the actual storage and distribution conditions the product will see, not just ideal lab conditions.
- Track whether stability time points are being pulled and tested on schedule. A protocol that exists on paper but slips in execution is functionally the same as no protocol.
- Have a documented procedure for what happens when a stability result trends toward failure before the expiration date arrives.
Domestic versus foreign: where these letters landed
Of the 135 inspection-based warning letters, 85 (about 63%) went to U.S. domestic firms, and 50 (about 37%) went to firms outside the U.S., spread across 13 countries (Pharmaceutical Online, March 13, 2026). That's roughly consistent with FY2024's 61% domestic rate. If you've assumed FDA's inspection-based enforcement leans heavily toward overseas manufacturers, the data doesn't support that. Domestic firms are getting cited at a similar or slightly higher rate, on the same core set of CGMP failures.
Why this matters beyond the numbers
Here's the thing about a top-5 list built from 134 letters: it's not really five separate problems. It's usually one weak quality system producing multiple citations in the same letter. A QC unit without real authority (211.22) is the reason written procedures don't get enforced (211.100(a)). A weak investigation process (211.192) is often the reason a stability failure (211.166) wasn't caught earlier. These sections cluster together in individual letters more often than they appear in isolation.
If you're benchmarking your own quality system against this list, the honest exercise isn't "do we have a procedure for X." It's "if FDA showed up tomorrow, would our QC unit's authority, our written procedures, our investigation depth, our component testing, and our stability data all hold up as independently defensible." For background on what happens procedurally once FDA does show up, see our breakdown of the difference between a Form 483 and a warning letter and our guide to warning letter response deadlines.
FAQ
What was the single most-cited CFR section in FDA's FY2025 drug/biologics warning letters?
21 CFR 211.22, covering quality control unit responsibilities, was cited in 62 of the 134 inspection-based warning letters analyzed — the highest count of any CFR section in FY2025 (Pharmaceutical Online, March 13, 2026).
How many warning letters did FDA issue to drug and biologics manufacturers in FY2025?
FDA issued 303 total warning letters to drug and biologics manufacturers in FY2025, up 59% from 190 in FY2024. Of those 303, 135 were inspection-based; the remaining 167 were non-inspection-based, driven largely by GLP-1 telehealth compounding and OTC unapproved-drug enforcement.
Are inspection-based warning letters and non-inspection-based warning letters counted together in the CFR citation ranking?
No. The ranked CFR citation list in this piece comes only from the 134 inspection-based letters FDA issued in FY2025 (135 total, minus one CBER device letter excluded from the analysis). Non-inspection-based letters don't cite specific CGMP inspection findings the same way, so they're a separate category entirely.
Why do 211.84(d)(1) and (d)(2) citations concentrate in OTC products specifically?
Forty of the 48 warning letters citing 211.84(d) cited both subsections together, and the concentration was heaviest in OTC products carrying diethylene glycol or ethylene glycol contamination risk, such as hand sanitizer, hand soap, and topical products. Component identity testing is the control specifically designed to catch this kind of contamination before it reaches finished product.
Does a high citation count for a CFR section mean it's the most serious violation type?
Not necessarily. Frequency measures how often inspectors find a given failure across firms, not the severity of any single instance. A section cited less often, like 211.166 stability testing at 40 letters, can still trigger serious enforcement action if the underlying data gap put patient safety at risk.
Source: Trends In FDA FY 2025 Warning Letters, Pharmaceutical Online, March 13, 2026. Byline: Andy Gaber. Published 2026-07-08.