Trial Injections, Shared Logins and Shred Bins: The Curia Warning Letter Checklist

On 18 September 2026 the United States Food and Drug Administration signed warning letter 320-26-127 to Curia New York, Inc., an active pharmaceutical ingredient (API) manufacturer in Rensselaer, New York. The letter, posted publicly on 29 September 2026, reads like a field guide to how laboratory data integrity fails. It describes thousands of unexplained chromatography injections, analysts sharing one another's logins, and original laboratory records pulled out of shred bins during the inspection.

For any Canadian company that ships APIs or finished drugs into the United States, or that runs a quality control laboratory under Health Canada good manufacturing practices, this is not a distant story. The same three failure modes show up in Health Canada inspection observations and in warning letters to firms far smaller than Curia. This article breaks the letter into a practical checklist so your quality unit can test its own systems before an inspector does it for you.

Executive summary

The Curia warning letter cites three distinct data-integrity failures: unexplained and unjustified chromatography injections (often called testing into compliance), shared computerised system logins, and uncontrolled destruction of original laboratory records. FDA found the firm's corrective actions too narrow, including a retrospective review that covered only 12 stand-alone instruments. The agency asked for an independent, multi-year assessment of every computerised system, a determination of how long records had been going into shred bins, and the hiring of a dedicated data-integrity compliance officer. The lesson for licence holders is simple to state and hard to do: your laboratory data must be attributable, contemporaneous and complete, and your corrective action must be as wide as the problem, not as narrow as the single instrument an inspector happened to open.

• Trial injections run outside a documented method, under a developer or administrator role, are a classic data-integrity red flag.
• Shared logins break attributability, the first letter of ALCOA, and no password policy on paper fixes it if the system still allows it.
• Original records in a shred bin are original records destroyed, and a negligible impact conclusion needs evidence, not an assertion.
• A retrospective review that stops at the instrument FDA inspected will be judged insufficient. Scope it to the risk, not the finding.

What the Curia warning letter actually says

What is it? FDA warning letter 320-26-127 followed an inspection of Curia New York from 28 January to 5 February 2026 and a review of the firm's 27 February 2026 response to the Form FDA 483. The letter classifies the APIs as adulterated under section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act because the methods and controls used for manufacture did not conform to current good manufacturing practice. Why does it matter? Because the findings are about data, not about a contaminated batch, and data-integrity findings question every result the laboratory has ever released. What should companies do? Read the letter as a checklist of controls to test, then verify each control in your own laboratory with records, not with reassurance.

The letter groups its concerns into three areas: laboratory control records and chromatography injections, quality unit oversight and record control, and computerised system controls. The table below summarises what FDA found in each. Every figure in it comes directly from the published letter.

Trial injections and testing into compliance

What is it? A trial injection is a chromatography run made outside the controlled, approved sequence, often labelled as a test, a system check or a developer activity. Testing into compliance is the practice of running samples repeatedly, or adjusting conditions, until a passing result appears, then reporting only the passing result. Why does it matter? Because it hides out-of-specification and out-of-trend data and makes the reported result unreliable. What should companies do? Treat every injection as a record, require a documented reason for any injection that is not part of the approved method, and review the full audit trail, not only the final result.

At Curia, FDA described over 70 trial injections in one system in a single month and noted that injections were acquired under the Developer role rather than the Operator role without documentation. The firm's own retrospective review found nine injections that lacked sufficient justification, and the firm acknowledged that nearly 20 percent of its trial injections in one system were acquired or altered in Developer mode. FDA read this as a sign of inconsistent training and a weak understanding of the governing procedure, not as a handful of isolated mistakes.

The corrective action is not only to stop trial injections. It is to review the audit trails that would reveal them. Our guide to audit trail review as the data-integrity battleground explains how to build a risk-based audit-trail review into routine batch release so that an unexplained injection is caught by your quality unit, not by an inspector. A defensible corrective and preventive action here identifies the root cause (role configuration and training), extends the review across every chromatography data system, and verifies effectiveness with a follow-up audit.

Shared logins and computerised system access control

What is it? Access control means every person who touches a computerised system has a unique account, a role that limits what they can do, and an audit trail that records what they did. Why does it matter? Because the first principle of data integrity is that a record must be attributable to the person who created it. A shared login makes that impossible. What should companies do? Remove shared and generic accounts, assign roles by the least-privilege principle, and prove through system configuration that one action maps to one named user.

FDA found that at least one Curia analyst used another analyst's login to perform calibrations and sample testing. The firm had a procedure that prohibited password sharing, yet the quality system failed to detect that it was happening repeatedly. The agency stated that sharing credentials is a serious violation of data-integrity principles. The point for every licence holder is that a policy on paper is not a control. The control is the system setting that enforces unique logins, locks out shared accounts, and produces an access log the quality unit actually reviews.

This is a computerised system validation problem as much as a behaviour problem. User access management, role configuration and audit-trail settings should all be part of the validated state of the system and should be re-verified after every upgrade. Our review of recurring FDA data-integrity warning letters shows how often shared logins and disabled audit trails appear together, and why an access-control assessment belongs in every annual data-integrity programme.

Shred bins: uncontrolled record destruction

What is it? Record control means that original good manufacturing practice records are identified, retained for the required period and destroyed only under a controlled, documented process. Why does it matter? Because a record you cannot produce is, to an inspector, a record that may never have supported the result you released. What should companies do? Define what an original record is, control where originals go, and never allow originals into a shred bin without a documented, approved disposition.

At Curia, inspectors found original records in laboratory shred bins on 29 January 2026, including a pH meter printout, an analytical balance printout and reviewer-signed analytical data review checklists. The firm could not identify who generated a December 2025 pH printout or why it had been discarded, and a January 2026 balance printout had been discarded without a documented reason. The firm also found excessive photocopies of notebook pages in the bins, and FDA noted that staff had reviewed photocopies instead of originals. Because the bins were collected by a third party for off-site destruction, the firm could not determine the full scope of what had already been destroyed. The firm's negligible impact conclusion, FDA said, lacked adequate evidentiary support.

The practical fix is a record-retention and destruction procedure that names the owner of every original record, prohibits unapproved destruction, and requires a reconciliation step before any disposal. Our guidance on writing SOPs that pass a Health Canada inspection sets out how to write a destruction procedure that a reviewer can follow and an inspector can accept, with a log that proves nothing in scope left the building unaccounted for.

How wide should a retrospective data-integrity review be?

What is it? A retrospective review, or lookback, is a structured re-examination of past data to find and correct the same failure wherever it occurred. Why does it matter? Because a data-integrity finding on one instrument raises a reasonable doubt about every similar instrument. What should companies do? Scope the review to the risk, document the rationale for the boundaries you set, and be ready to widen it if the first findings suggest a broader problem.

Curia's retrospective review covered only 12 stand-alone analytical instruments over a period of roughly one year, and FDA called that insufficient. In the warning letter the agency asked for far more: an independent investigation of all trial injections, a data-integrity assessment of all computerised systems and not only the two chromatography systems named, a determination of how long GMP documents had been going into shred bins, a review of instrument-use logbook gaps for all quality control equipment, and an independent assessment of GMP-integrated systems over a three-year period for products still within expiry on the United States market. FDA also asked the firm to hire a data-integrity compliance officer and to produce a current risk assessment and a global corrective and preventive action plan.

The lesson is that the scope of your corrective action signals the seriousness of your quality culture. A review bounded by the single instrument an inspector opened tells the agency you are managing the finding. A review bounded by the risk tells the agency you are managing data integrity. Decide the boundary deliberately, write down why, and let the evidence move the boundary if it needs to.

Why this matters for Canadian exporters

A Canadian site that exports to the United States is subject to FDA inspection and to the same expectations. The warning letter notes that unresolved violations can lead FDA to withhold export certificates and to withhold approval of new applications, and can affect a firm's ability to win federal contracts. The data-integrity principles are not US-only either. Health Canada applies the same attributable, legible, contemporaneous, original and accurate expectations through its good manufacturing practices guidance, and MHRA and the European authorities apply them through their own guidance. If your laboratory controls would not survive the Curia inspection, they would not survive a Health Canada inspection. Our guide to responding to a Form 483 or a Health Canada inspection observation explains how to turn findings into a credible remediation, and our analysis of the Empower Pharmacy data-integrity warning letter shows the same patterns in an aseptic setting.

Data-integrity compliance checklist

Work through the following with your laboratory and quality unit. If you cannot answer any item with a record, you have found a gap worth closing now.

• Every user of every computerised system has a unique account, and shared or generic logins are disabled at the system level.
• User roles follow least privilege, and no routine analyst holds a developer or administrator role on a chromatography data system.
• Audit trails are enabled, cannot be switched off by users, and are reviewed as part of batch release on a documented, risk-based frequency.
• Every injection is traceable to a sample, a method and an approved sequence, and any injection outside the method has a documented reason.
• Original records are defined in writing, their owner is named, and destruction happens only under a controlled procedure with a reconciliation step.
• Shred bins and off-site destruction services cannot receive GMP originals without an approved, documented disposition.
• Reviewers check original data, not photocopies, and sign only after verifying there are no undocumented changes.
• Any retrospective review scopes to the risk, records the rationale for its boundaries, and widens if early findings warrant it.
• Analysts are trained on the governing procedures, and training records show the training was effective, not merely delivered.

Common mistakes

• Treating a password-sharing SOP as the control. The SOP is the rule. The control is the system configuration that enforces it and the access log the quality unit reviews.
• Reviewing only the reported result. Without an audit-trail review, trial injections and deleted runs stay invisible until an inspector finds them.
• Declaring negligible impact without evidence. A conclusion that discarded records did not matter must be supported by data, not by assertion.
• Scoping the lookback to the finding. A review limited to the instrument FDA opened will be judged insufficient, as it was at Curia.
• Fixing the symptom, not the root cause. Removing the Developer role is a fix; understanding why training and configuration allowed its misuse is the root-cause work that keeps CAPA from failing.

What FDA asked Curia to do, and what you should prepare

The warning letter gave Curia 15 business days from receipt to respond. The table maps the agency's main requests to the preparation every licence holder can do before a letter ever arrives.

Frequently asked questions

What is a trial injection in a GMP laboratory?

A trial injection is a chromatography run made outside the approved, controlled sequence, often described as a test or a system check. Trial injections are not banned, but each one must have a documented purpose and must not be used to screen samples so that only a passing result is reported. When injections are run under a developer or administrator role without a reason, as FDA found at Curia, they become a data-integrity concern because they can hide failing or out-of-trend data.

Can analysts share logins in a GMP lab?

No. Every user must have a unique account so that each action is attributable to a named person. FDA called shared credentials a serious violation of data-integrity principles. A written rule against password sharing is not enough on its own. The computerised system must enforce unique logins, and the quality unit must review the access log to confirm that the rule is being followed in practice.

What did FDA find in the Curia New York warning letter?

FDA cited three main problems: thousands of unexplained chromatography injections over 30 months, including injections run under a developer role; original laboratory records, such as pH and balance printouts and signed review checklists, found in shred bins; and analysts sharing logins. The agency also judged the firm's retrospective review of 12 instruments over about one year to be too narrow and asked for a multi-year, independent assessment of all computerised systems.

How long do you have to respond to an FDA warning letter?

The Curia warning letter required a response within 15 business days of receipt. That is the standard period stated in most FDA warning letters, though you should always follow the exact deadline and contact details in the letter you receive. A strong response acknowledges each finding, explains the root cause, sets out corrective and preventive actions with timelines, and commits to a verification of effectiveness.

Does this affect Canadian companies that export to the United States?

Yes. A Canadian site that ships APIs or finished drugs into the United States is subject to FDA inspection and to the same data-integrity expectations. Unresolved findings can lead FDA to withhold export certificates and to delay approval of new applications. The underlying principles also match Health Canada good manufacturing practices, so laboratory controls that would fail an FDA inspection would likely fail a Health Canada inspection too.

How wide should a retrospective data-integrity review be?

Wide enough to match the risk. FDA rejected Curia's review of 12 instruments over one year as insufficient and asked for a multi-year assessment of all computerised systems. Scope your review by risk, document the rationale for the boundaries you set, and be prepared to widen it if early findings show the problem is broader than you assumed. A lookback that stops at the one instrument an inspector opened is almost always too narrow.

How MFLRC can help

MF License and Regulatory Consultants helps Canadian and international manufacturers build laboratory systems that stand up to FDA and Health Canada scrutiny. Our data-integrity gap assessments test the exact controls the Curia letter calls out: chromatography audit-trail review, user access and role configuration, and record retention and destruction. We help you write the SOPs that make those controls real, validate your computerised systems so access and audit trails are part of the validated state, and design retrospective-review protocols whose scope you can defend. When a Form 483 or a warning letter does arrive, we support root-cause investigation, a credible CAPA programme, and the response itself. We also run mock inspections so your team practises before the real one.

Could your laboratory pass an unannounced review of its chromatography audit trails and user accounts today? If you are not certain, that uncertainty is the gap worth closing first.

Conclusion

The Curia warning letter is a clear, public example of how laboratory data integrity fails and how an inspector responds when corrective action is too narrow. Trial injections, shared logins and shred bins are not exotic problems. They are everyday risks in any laboratory that has not built and tested the controls that prevent them. Use the letter as a checklist, verify each control with records rather than reassurance, and scope your corrective action to the risk. Do that, and an inspection becomes a confirmation of your quality culture rather than a threat to it.

Sources and references

• FDA, Warning Letter 320-26-127, Curia New York, Inc. (18 September 2026)
• FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers (guidance)
• MHRA, GXP Data Integrity Guidance and Definitions
• Health Canada, Good Manufacturing Practices Guide for Drug Products (GUI-0001)