The Investigation FDA Cites First: How to Get 21 CFR 211.192 Right

When an FDA investigator opens a drug file, one of the first questions is not whether a batch failed, but what the company did when it did. The regulation that governs that answer is 21 CFR 211.192. It is short, it is decades old, and it is one of the current good manufacturing practice provisions FDA cites most often in drug warning letters. The citation is rarely about the deviation itself. It is about a batch failure investigation that never found a root cause, never reached the other lots that were affected, and never confirmed that the fix worked.

This guide explains what 21 CFR 211.192 requires, why it is a magnet for inspection findings, what a thorough investigation must contain, how it connects to out-of-specification test results, and how to close an investigation with a corrective and preventive action that holds. It is written for quality assurance managers, quality control leads, Quality Assurance Persons and site leaders who want their investigations to survive the next inspection rather than generate the next observation.

Executive summary

21 CFR 211.192 requires the quality control unit to review and approve every production and control record before a batch is released, and to thoroughly investigate any unexplained discrepancy or any failure of a batch or its components to meet specifications, whether or not the batch has been distributed. The investigation must extend to other batches and products that may have been affected, and the written record must include conclusions and follow-up. FDA cites this provision when investigations are shallow, when they stop at the first plausible cause, when they are not extended to other lots, and when the corrective action is never verified. A defensible investigation identifies a true root cause, assesses product impact, reaches every affected batch, and closes with a CAPA whose effectiveness is checked.

What is 21 CFR 211.192?

21 CFR 211.192, titled Production record review, requires the quality control unit to review and approve all drug product production and control records, including packaging and labelling, before a batch is released or distributed. Any unexplained discrepancy or any failure to meet a specification must be thoroughly investigated. You can read the full regulation on the eCFR.

The rule packs four obligations into one short paragraph. First, the quality control unit reviews and approves the records before release. Second, any unexplained discrepancy, including a yield outside the established maximum or minimum, or any failure of a batch or its components to meet a specification, must be thoroughly investigated, whether or not the batch has already shipped. Third, the investigation must extend to other batches of the same product and to other products that may have been associated with the failure. Fourth, a written record of the investigation must be made, and it must include the conclusions and the follow-up. Each of those four obligations is a place where inspections find gaps.

Why it matters: the citation FDA reaches for

21 CFR 211.192 is one of the GMP provisions FDA cites most often, and the pattern in the letters is consistent: the investigation did not find a root cause, it was not expanded to other potentially affected lots, and the corrective action was never shown to work. The published FDA warning letters return to the same failings again and again. If you receive a Form 483 observation on an investigation, a weak reply raises the odds of a warning letter, so the response matters as much as the investigation. Our guide on responding to an FDA Form 483 or Health Canada inspection observation walks through how to answer without making the situation worse.

The lesson is uncomfortable but useful. Regulators expect deviations to happen. What separates a compliant site from a cited one is the quality of the investigation that follows. An investigation that names a cause without evidence, that closes in days because the batch was needed, or that never asks which other lots share the same risk, is the investigation that generates the finding.

What thoroughly investigated actually means

A thorough investigation identifies the true root cause, assesses the impact on product quality, extends to every batch and product that could share the failure, and closes with a verified corrective and preventive action. Depth is the test. A cross-contamination event that looks like a one-off can turn into a Type I recall once the investigation follows the evidence, as our analysis of a cleaning validation cross-contamination recall shows. The table below sets out what an inspector expects at each step and the shortfall that most often appears instead.

Out-of-specification results and the two-phase investigation

An out-of-specification, or OOS, result is a test result that falls outside the specifications or acceptance criteria in the application, the compendia or the manufacturer's own limits, and FDA expects it to be investigated in two phases. The Agency sets out its current thinking in the Investigating Out-of-Specification Test Results guidance (Level 2 revision, May 2022). Phase one is the laboratory investigation, which asks whether the result came from a real product problem or an assignable laboratory cause. A result can only be invalidated when a specific, documented laboratory error is found. Phase two is the full-scale investigation, which reaches into production when phase one does not explain the result, and this is where 21 CFR 211.192 takes over. Analysts who do not understand these rules tend to retest their way out of a result, which is exactly what inspectors look for, and it ties back to GMP training under 21 CFR 211.25.

Two practices draw findings faster than any other. The first is invalidating an out-of-specification result without a documented, assignable laboratory cause. The second is averaging a failing result with passing results to bring the mean into range, which can mask a genuine problem. Neither survives an inspection, and both point to an investigation programme that is protecting the batch rather than the patient.

The extension requirement almost everyone misses

The regulation says the investigation shall extend to other batches of the same product and other products that may have been associated with the failure. This is the single most overlooked sentence in the rule. When a root cause is a shared piece of equipment, a common raw material lot, a cleaning failure, or a recurring process step, the failure rarely lives in one batch. If your investigation scope stops at the batch that triggered it, you have not met the requirement, and you have left affected product in the market. Every investigation should ask three questions: which other batches used the same materials or equipment, which other products passed through the same step, and whether any of that product has already been distributed.

A worked example: when one batch becomes twelve

Picture a solid-dose line where a single tablet batch fails dissolution. The quick investigation blames a worn tooling punch and releases the batch after a passing retest. Six weeks later, the same product fails again. A deeper investigation finds the real cause: a granulation step running at the edge of its validated range, shared across a dozen batches and two products. Because the first investigation never extended beyond the triggering batch, affected product had already shipped.

The rule anticipated exactly this. The requirement to extend the investigation to other batches and products is not bureaucratic. It is the mechanism that catches a shared root cause before it becomes a recall. Firms that treat every investigation as a single-batch event will keep meeting the same failure, and keep explaining it to an inspector.

From investigation to a CAPA that closes

An investigation is only as strong as the corrective and preventive action that follows it, and FDA expects that CAPA to be verified as effective, not just implemented. Use a structured root cause method, such as the five whys or a cause and effect diagram, so the cause is evidenced rather than assumed. Our guide on why CAPA keeps failing covers the root cause discipline in depth. Build an effectiveness check into every CAPA, with a defined metric and a review date, so you can show the problem did not return. And remember that the investigation record itself is a data integrity artefact: the audit trail, the timestamps and the review all have to hold up, a theme we cover in audit trail review and data integrity.

Compliance checklist

• Confirm the quality control unit reviews and approves every batch record before release, with signatures and dates.
• Open an investigation for every unexplained discrepancy, out-of-yield result, or failure to meet a specification, distributed or not.
• Use a structured root cause method and support the cause with evidence, not assumption.
• Define the scope so it extends to other batches and products that could share the cause.
• Document a product impact and patient risk assessment for every disposition decision.
• Invalidate an out-of-specification result only when a specific, documented laboratory cause is found, and never average away a failure.
• Close every investigation with a CAPA that has a defined effectiveness check and review date.
• Make a complete written record with conclusions and follow-up, and keep the audit trail intact.

Common mistakes

• Stopping at the first plausible cause instead of proving the true root cause with evidence.
• Limiting the investigation to the single batch that triggered it and ignoring the extension requirement.
• Justifying release because the batch passed final testing, without addressing the discrepancy.
• Invalidating an out-of-specification result without an assignable laboratory cause, or averaging it away.
• Closing a CAPA on paper with no effectiveness verification, so the same failure recurs.
• Leaving the written record incomplete, with missing conclusions, follow-up, or quality control unit approval.

Frequently asked questions

What does 21 CFR 211.192 require?

It requires the quality control unit to review and approve every production and control record before a batch is released, and to thoroughly investigate any unexplained discrepancy or failure to meet a specification. The investigation must extend to other affected batches and products, and the written record must include conclusions and follow-up.

Do I have to investigate a failure if the batch already passed release testing?

Yes. The rule applies to any unexplained discrepancy or failure to meet a specification, whether or not the batch has been distributed. A passing final result does not remove the duty to investigate a discrepancy found along the way, and it does not by itself justify release.

When must an investigation extend to other batches?

Whenever the cause could be shared. If the root cause is a common material lot, a shared piece of equipment, a cleaning failure, or a recurring process step, other batches and products may carry the same risk. The regulation requires the investigation to extend to them, and to any product already distributed.

How is an out-of-specification result different from a deviation?

An out-of-specification result is a test result outside an established specification or acceptance criterion. A deviation is any departure from an approved procedure. Both can trigger a 211.192 investigation, and an out-of-specification result follows the two-phase laboratory then full-scale investigation approach in FDA's OOS guidance.

Can I retest my way out of an out-of-specification result?

No. You may only invalidate an out-of-specification result when a specific, documented laboratory error is identified. Retesting to obtain a passing result, or averaging a failing result with passing ones to mask it, is exactly the practice FDA looks for and cites.

Why does FDA cite 211.192 so often?

Because investigations are where quality systems most visibly succeed or fail. The recurring findings are shallow root cause, no extension to other lots, and unverified corrective action. Those are quality-system weaknesses an inspector can see in the records, which makes the provision easy to cite and hard to defend.

How MFLRC can help

MFLRC helps pharmaceutical, biologics and natural health product manufacturers build investigation and CAPA programmes that hold up under FDA and Health Canada scrutiny. Through our audit services, we run mock inspections, gap assessments and CAPA reviews that surface a weak investigation before a regulator does. Through our quality assurance services, we develop the SOPs, root cause training and records-review practices that make thorough investigations routine. We also provide QAP services, GMP gap assessments and validation support across the product lifecycle.

Worried your investigations would not survive a 483? MFLRC can review your investigation and CAPA programme, close the gaps, and train your team to run investigations that hold. Book a consultation to get started.

Conclusion

21 CFR 211.192 is short, but it carries a large share of the risk in a drug quality system. FDA cites it not because deviations happen, but because the investigations that follow are too often shallow, too narrow, and never verified. Build investigations that find a real root cause, reach every affected batch, and close with a CAPA you can prove worked, and you turn your single most cited provision into one of your strongest defences. The discipline is not glamorous, but it is what an inspector reads first.

Sources and references

• eCFR, 21 CFR 211.192 Production record review (FDA, Current Good Manufacturing Practice for Finished Pharmaceuticals).
• FDA, Investigating Out-of-Specification (OOS) Test Results for Pharmaceutical Production, Level 2 revision (May 2022).
• FDA, Warning Letters database (Inspections, Compliance, Enforcement and Criminal Investigations).