SITUATIONAL — Medical Device GMPs | Pharmaceutical GMPs
When Quality Oversight Fails at the Top
An FDA Warning Letter Case Study
An FDA Warning Letter Case Study
This composite case study, drawn from patterns in public FDA warning letters, shows how management failures under 21 CFR 820.20 and 21 CFR 211.22 led to manufacturing shutdowns, three product recalls, and a formal warning letter.
Composite scenario. Company details are illustrative and based on patterns documented in public FDA warning letters and inspection records.
820.20
21 CFR Section
The Quality System Regulation section that mandates management responsibility — including formal reviews, resource provision, and quality policy ownership.
FDA, 21 CFR Part 820
#1
Most Cited Area
CAPA (21 CFR 820.100) and management controls (21 CFR 820.20) are among the most frequently cited deficiency categories in FDA device inspections year over year.
FDA Device Inspection Data
211.22
Pharma Counterpart
21 CFR 211.22 requires an independent quality control unit with full authority to review and approve all drug production and quality decisions — separate from production management.
FDA, 21 CFR 211.22
FDA does not expect quality to manage itself. Under 21 CFR 820.20 and 21 CFR 211.22, management is personally responsible for establishing, implementing, and maintaining an effective quality system. When executives disengage from that obligation, Form 483 observations follow. When those observations go unaddressed, warning letters follow. When warning letters go unaddressed, consent decrees and import alerts follow.
This case study is drawn from patterns documented across multiple public FDA warning letters targeting dual-licensed manufacturers operating under both the Quality System Regulation (21 CFR Part 820) and pharmaceutical GMP (21 CFR Part 211). The scenario is composite. The regulatory findings, enforcement sequence, and corrective action requirements reflect real FDA enforcement actions.
The central question is straightforward: what does FDA actually expect from executive management, and what does a failure to meet those expectations look like in practice?
The Scenario: A Routine Inspection Uncovers Systemic Gaps
Location
A domestic contract manufacturer operating two production lines: one under 21 CFR Part 211 (oral solid dosage forms) and one under 21 CFR Part 820 (Class II combination product components).
Workforce
Approximately 180 employees across quality, production, and regulatory affairs. The quality unit had been operating with three vacant senior positions for eleven months at the time of the inspection.
Outcome
FDA Warning Letter issued. Voluntary recall of three product batches. Pharmaceutical line operations suspended for 90 days pending corrective action verification by FDA follow-up inspection.
Primary Cause
No formal management review had been conducted in 22 months. The CAPA system had 31 open investigations, 14 of which had exceeded their documented target closure dates with no written justification for delay.
The FDA investigator arrived on a standard unannounced GMP inspection. No specific complaint had triggered it. The facility had passed its previous inspection three years earlier with two minor observations, both closed within 60 days. Senior leadership interpreted that outcome as confirmation the quality system was functioning adequately.
It was not. The three intervening years had seen significant personnel changes, two production line expansions, and a strategic shift toward higher-volume contract work. None of these changes had triggered a formal management review or a reassessment of quality system adequacy.
Timeline of Events
Month 0
Last Management Review Conducted
The most recent formal management review is held. Minutes are documented. Several CAPA investigations are flagged for follow-up. No follow-up schedule is established in the meeting minutes and no executive owner is assigned.
Month 6
Quality Director Departs
The quality director resigns. The VP of Operations temporarily assumes oversight of both production and quality. This dual role is not assessed for compliance with the independence requirement of 21 CFR 211.22(a) before implementation.
Month 11
CAPA Backlog Escalates Internally
An internal audit identifies 19 open CAPA investigations, including seven that have exceeded their originally documented closure target dates. No escalation to senior management is documented. The audit report is filed without action.
Month 15
Customer Complaint Triggers Deviation Investigation
A repeat complaint regarding particulate contamination in an oral dosage batch is received. A deviation investigation is opened. It remains open for seven months without root cause determination or interim controls applied to production.
Month 22
FDA Unannounced Inspection Begins
The FDA investigator requests management review records, CAPA logs, deviation investigation records, and quality unit staffing documentation. No formal management review records exist for the past 22 months. The CAPA log shows 31 open investigations.
Month 23
Form 483 Issued — 11 Observations
The FDA investigator issues a Form 483 with 11 observations. The most significant: failure to conduct management reviews, failure to maintain an effective CAPA system, and inadequate quality unit independence from production.
Month 26
Warning Letter Issued
FDA determines the 483 response was inadequate. A Warning Letter is issued requiring a comprehensive corrective action plan within 15 working days and verification inspections before pharmaceutical operations resume.
What Went Wrong: Three Critical Failures
Failure 1: Management Abdicated Quality System Oversight
Under 21 CFR 820.20(c), management with executive responsibility must review the suitability and effectiveness of the quality system at defined intervals. The manufacturer had not conducted a documented management review in 22 months. There was no defined schedule, no assigned reviewer, and no record that quality system performance data had been presented to senior leadership in that period.
The FDA investigator found no evidence that production capacity increases, personnel departures, or the growing CAPA backlog had ever been formally reviewed at the executive level. Management’s position was effectively that quality would escalate problems if needed. FDA’s position is the opposite: management is responsible for ensuring the system works, not for waiting to hear that it has broken down.
Failure 2: CAPA System Operated Without Oversight or Accountability
21 CFR 820.100 requires manufacturers to establish and maintain procedures for implementing corrective and preventive actions and to document and analyse the results to determine whether actions taken were effective. Under 21 CFR Part 211, equivalent requirements apply to out-of-specification investigations, deviations, and complaints under sections 211.192 and 211.198.
The manufacturer had a written CAPA procedure. It was simply not executed at the management level. The 14 investigations that had exceeded their target closure dates included two related to repeat failure modes: particulate contamination and documentation errors. Repeat failures tell FDA that previous corrective actions were either not implemented or not effective. The absence of effectiveness verification is itself a separate regulatory violation.
Failure 3: Quality Unit Independence Was Structurally Eliminated
21 CFR 211.22(a) requires the quality control unit to have authority to approve or reject all components, drug product containers, closures, in-process materials, packaging material, labelling, and drug products — and to be independent of production. When the VP of Operations assumed oversight of both production and quality for eleven months, this independence was structurally eliminated.
During that period, the individual responsible for approving batch releases was the same individual responsible for meeting production targets. FDA found that two batches had been released with outstanding, unresolved deviation investigations. Under an independent quality unit, such a release would have required documented justification and quality authority sign-off. Neither existed.
Investigation Findings: FDA Regulatory Violations
Source: 21 CFR Part 820 | 21 CFR Part 211
Root Cause Analysis
Systemic Root Cause Factors
No Management Review Schedule or Assigned Executive Owner
Primary
The procedure existed but treated reviews as optional. No calendar obligation, no named executive accountable, no trigger for escalation.
Leadership Transition Managed as HR Event, Not Regulatory Risk
Contributing
No regulatory gap analysis was conducted when the quality director departed. The interim dual-role arrangement was not reviewed for compliance with 21 CFR 211.22(a) before it was implemented.
CAPA System Lacked Executive Visibility and Escalation Triggers
Contributing
CAPA aging reports were never presented to executive leadership. The backlog accumulated over 22 months with no mechanism to surface overdue investigations above the quality team level.
Quality Resources Not Scaled with Production Expansion
Contributing
Production capacity grew significantly over two years. Quality unit headcount did not grow proportionally. Three senior quality positions remained vacant while production hiring continued.
Analysis consistent with root cause patterns in: FDA QSR Guidance | FDA Drug Quality Guidance
Corrective Actions Required by FDA
1
Appoint a Qualified, Independent Quality Director
FDA required appointment of a qualified individual with authority over quality decisions, reporting to executive leadership but structurally independent of production management. Qualifications and CV were to be submitted to FDA within 30 days. The organisational chart was required to reflect independence explicitly.
2
Conduct a Comprehensive Management Review
A formal management review covering all required inputs under 21 CFR 820.20(c) was required within 45 days. Inputs must include: quality system performance data, CAPA status and effectiveness, customer complaints, internal audit findings, regulatory correspondence, and resource adequacy. Minutes must be retained and made available for FDA review.
3
Remediate All Open CAPA Investigations
A written remediation plan for all 31 open CAPAs was required, with individual root cause determinations and closure timelines for each. For the 14 overdue investigations, written justification for the delay and interim controls were required immediately. FDA reserved the right to review CAPA documentation at the follow-up inspection.
4
Implement a CAPA Escalation Procedure
A documented escalation procedure was required specifying that any CAPA investigation exceeding its target closure date must be presented to the quality director within 30 days and to executive management within 60 days, with documented justification and revised timelines. This procedure was to be included as a standing management review input.
5
Assess and Recall Batches Released with Open Deviations
The two batches released with unresolved deviations required a recall risk assessment. Based on particulate contamination investigation findings, a voluntary recall of three batches was initiated. A written batch release procedure was required prohibiting release of any batch with unresolved deviations affecting product quality or patient safety.
Lessons Learned
Management Review Is Not Optional
21 CFR 820.20(c) uses the word “shall” — mandatory under FDA regulatory language. Defined intervals must be defined in writing. Companies that conduct reviews only when prompted by a crisis have already failed this requirement. The gap between the last review and the inspection was the single most significant finding in this case.
21 CFR 820.20(c)
Personnel Changes Are Regulatory Events
When a quality director departs, the regulatory obligations they fulfilled do not depart with them. Any interim arrangement placing quality oversight under someone with production responsibility violates 21 CFR 211.22(a) regardless of that individual’s integrity. Compliance assessment must happen before the arrangement is implemented, not after inspection identifies the violation.
21 CFR 211.22(a)
A CAPA Backlog Is Evidence of a Management Failure
FDA treats overdue CAPA investigations not as a scheduling problem but as evidence that the quality system is not functioning as required. An overdue investigation without documented justification tells inspectors both that the problem remains unresolved and that the organisation lacks either the resources or authority to close it. Both support enforcement action.
21 CFR 820.100
Prevention Checklist: Management Quality Obligations
Key Takeaways
Management Review Is a Regulatory Obligation
Under 21 CFR 820.20(c), management review is mandatory at defined intervals with documented inputs and outputs. Missing a review is not an administrative gap; it is a regulatory violation that signals to FDA that executive leadership has disengaged from quality system oversight. In this case, the 22-month gap was the single most significant finding.
Quality Unit Independence Is Structural
FDA does not accept good intentions as a substitute for structural independence. When quality and production responsibility are held by the same individual, the independence requirement of 21 CFR 211.22(a) is violated regardless of that individual’s integrity. Interim leadership arrangements must be assessed for regulatory compliance before they are implemented.
A Silent CAPA System Is Not a Functioning CAPA System
The CAPA backlog in this case accumulated over 22 months without ever reaching executive awareness. That is not a CAPA problem; it is a management system problem. Effective quality systems include escalation mechanisms that automatically surface aging investigations, repeat failure modes, and resource constraints to the level of management that can act. If your CAPA system only reports closed investigations, it is not reporting accurately. FDA expects management to know when the system is under stress and to respond when it is.
Frequently Asked Questions
What does 21 CFR 820.20 require from executive management?
21 CFR 820.20 requires management with executive responsibility to establish and maintain an effective quality system, ensure the quality policy is understood and implemented, identify and provide adequate resources, appoint a management representative for quality, and conduct formal management reviews at defined intervals. These obligations belong to named executives and cannot be wholesale delegated to the quality team.
How often must management reviews be conducted under FDA regulations?
21 CFR 820.20(c) requires reviews at “defined intervals.” The regulation does not specify a minimum frequency. The manufacturer must define the interval in their procedure and then adhere to it. Whatever interval is defined becomes the regulatory obligation. Missing it is a violation regardless of the justification offered after the fact.
What makes a quality control unit “independent” under 21 CFR 211.22?
21 CFR 211.22(a) requires the quality control unit to have authority to approve or reject all components, drug products, packaging, and labelling, and to review production records. Independence means the quality function cannot report to, or be subject to override by, the production function. Placing quality oversight under a production manager — even temporarily — violates this requirement.
Can a company release batches while CAPA investigations remain open?
It depends on what the investigation covers. If the open investigation relates to a failure mode that could affect the quality or safety of the batch under review, releasing without resolution or a documented risk-based justification is a violation of 21 CFR 211.192. Manufacturers must have documented procedures specifying under what circumstances batch release can proceed with open deviations, what quality authority level must approve such a decision, and how it is documented in the batch record.
What happens after an FDA warning letter related to management responsibility?
The company must respond in writing within 15 working days, detailing corrective actions taken and planned. FDA may conduct a follow-up inspection to verify corrections before allowing resumed operations. If the response is deemed inadequate, FDA can escalate to consent decrees, import alerts, or injunctions. Warning letters are published publicly on FDA’s website and often affect business relationships with customers conducting supplier audits.
What inputs are required in a compliant management review under 21 CFR 820.20?
FDA expects the review to cover: audit results, customer feedback and complaints, process performance and product conformity, CAPA status and effectiveness, follow-up from previous management reviews, changes that could affect the quality system, and recommendations for improvement. All inputs and resulting decisions must be documented in meeting minutes retained as quality records.
How does FDA’s Quality Management System Regulation change management responsibility requirements?
FDA’s QMSR (effective February 2026) aligns 21 CFR Part 820 with ISO 13485:2016. Management responsibility requirements are maintained and in some respects strengthened under the QMSR, with clearer documentation expectations for management review inputs and outputs and explicit requirements for demonstrating management commitment. Companies that were genuinely conducting documented management reviews under the prior QSR will find the transition manageable.
Sources
Government and Regulatory Sources
- FDA. 21 CFR Part 820 — Quality System Regulation — Governs quality system requirements for medical device manufacturers including management responsibility under 820.20 and CAPA under 820.100.
- FDA. 21 CFR Part 211 — Current Good Manufacturing Practice for Finished Pharmaceuticals — Governs quality control unit responsibilities under 211.22 and production record review under 211.192.
- FDA. Medical Device Inspection Information — Published FDA data on device inspection findings and most commonly cited deficiency categories.
- FDA. (2023). Quality Management System Regulation (QMSR) Final Rule — The 2023 final rule aligning 21 CFR Part 820 with ISO 13485:2016, effective February 2026.
Research and Industry Sources
- FDA. (2006). Quality Systems Approach to Pharmaceutical CGMP Regulations — Foundational guidance connecting quality systems concepts to 21 CFR Part 211 management responsibilities.
- FDA. Quality System (QS) Regulation: Medical Device Good Manufacturing Practices — FDA’s official guidance on QSR implementation and management review compliance expectations.
Related VelSafe Articles
Insights
EU GMP Annex 11: 2025 Draft Insights for Computerised Systems
Analysis of the EU GMP Annex 11 draft update and implications for quality system management of computerised systems in pharmaceutical manufacturing.
Situational
IVDR Compliance Scenario for Medical Device Manufacturers
A case-based examination of IVDR compliance challenges and the quality system gaps most commonly cited during notified body audits of device manufacturers.
Worker Safety
EU Directives and Inspection Readiness: What Workers and Supervisors Need to Know
Practical guidance on what EU directive requirements mean at the operational level and how to prepare frontline teams for regulatory inspections.
Build a Quality System FDA Cannot Fault
VelSafe covers GMP compliance from management responsibility to CAPA systems, batch release procedures, and inspection readiness. Browse the full library of pharmaceutical and medical device quality resources.
Explore VelSafe Resources
