Batch Release Without Real Testing: What FDA Cites Under 21 CFR 211.165 and 211.84

In March 2026, the United States Food and Drug Administration published a warning letter to an over the counter drug manufacturer that had been releasing finished product batches on the strength of appearance, colour and weight checks. No identity testing of the active ingredient. No strength testing. The company also accepted its suppliers' certificates of analysis for incoming materials without ever confirming that those certificates could be trusted. On paper the batches looked fine. In regulatory terms, the company had no scientific basis to say the product was what the label claimed.

This is one of the most common and most avoidable findings in drug manufacturing, and it reaches Canadian companies directly. If you sell a drug or an over the counter product into the United States, or you contract a manufacturer who does, 21 CFR Part 211 applies to that product. The same logic lives in Health Canada's Good Manufacturing Practices. This article explains what batch release and component testing actually require under 21 CFR 211.165 and 211.84, when a supplier certificate of analysis is genuinely acceptable, and how to make sure your release decision would survive an inspection.

Executive summary

Batch release is a scientific decision, not a visual one. You must test to specifications before you distribute, and you cannot outsource that judgement to a supplier's paperwork.

• 21 CFR 211.165(a) requires appropriate laboratory determination that each batch conforms to final specifications, including the identity and strength of each active ingredient, before release. Appearance, colour and weight do not meet this.
• Test methods must be validated. Their accuracy, sensitivity, specificity and reproducibility must be established and documented under 211.165(e), and any batch that fails specifications must be rejected under 211.165(f).
• 21 CFR 211.84 requires at least one identity test on every component lot. A supplier certificate of analysis can replace other testing only if you still run your own identity test and you validate the supplier's results at appropriate intervals.
• Release and component testing failures rarely travel alone. They usually appear with missing process validation (211.100) and a weak quality unit (211.22), as the March 2026 warning letter shows.
• The fix is a documented release specification, validated methods, a real supplier qualification programme and a quality unit with the authority to reject. Each is a defined, auditable control.

What FDA requires before you release a batch

What it is: the release testing rule. Under 21 CFR 211.165(a), for each batch of drug product there must be appropriate laboratory determination of satisfactory conformance to final specifications, including the identity and strength of each active ingredient, before the batch is released. Why it matters: release is the last point at which you can catch a product that does not meet its own specification. If you only check what you can see and weigh, you are not testing the two things that most define a drug, what is in it and how much.

The regulation does not stop at identity and strength. Under 21 CFR 211.165, the accuracy, sensitivity, specificity and reproducibility of your test methods must be established and documented, which in practice means validated methods. And any drug product that fails to meet its established standards or specifications must be rejected. A release decision is therefore a chain: a written specification, a validated method that measures against it, a result that conforms, and a quality unit sign off. Break any link and the release is not defensible.

The component side: identity testing and the certificate of analysis trap

What to do: test what comes in the door, not just what goes out. Under 21 CFR 211.84, each lot of components, containers and closures must be withheld from use until it has been sampled, tested or examined and released by the quality control unit. At least one test must be conducted to verify the identity of each component, and a specific identity test must be used where one exists. This applies to active pharmaceutical ingredients and excipients alike.

Here is where many firms get into trouble. 21 CFR 211.84 lets you accept a report of analysis, a certificate of analysis, from the supplier in place of full testing for most attributes. But that allowance is conditional, and companies routinely read the allowance and ignore the conditions. You may accept the supplier's results for purity, strength and quality only if you still conduct at least one specific identity test yourself, and only if you have established the reliability of that supplier's analyses through appropriate validation of their results at appropriate intervals. A certificate you have never verified is not a control. It is a hope.

When can you actually rely on a supplier certificate of analysis?

How it affects compliance: a certificate of analysis is acceptable only inside a qualification programme. You always run your own identity test on each lot, you periodically test the full attribute set yourself and compare it to the supplier's certificate, and you document that the two agree. If your results and theirs diverge, the supplier is not qualified and the certificate cannot be relied on until the gap is understood and closed.

This is why supplier qualification is not a filing exercise. It is an ongoing programme of testing, comparison and record keeping, usually backed by supplier audits for materials that carry real risk. The certificate of analysis is only as good as the last time you proved the supplier deserved your trust.

The March 2026 warning letter, decoded

Why it matters: the FDA warning letter to Yangzhou H&R Plastic Daily Chemical Co., Ltd., dated 18 March 2026, is a textbook example because the failures compound. Limited release testing, unverified certificates, no process validation and a quality unit without teeth are not four separate problems. They are one system that cannot assure quality, described from four angles.

The FDA warning letter cited four linked failures. The firm limited finished product release to appearance, colour and weight, with no identity or strength testing of the active ingredient, against 211.165(a). It relied on supplier certificates of analysis without establishing supplier reliability at appropriate intervals, against 211.84(d)(1) and (d)(2). It had not performed process performance qualification studies or a meaningful ongoing process monitoring programme, against 211.100(a). And its quality unit lacked the responsibility and authority to oversee manufacture, against 211.22. The lesson for any manufacturer is that inspectors read these controls as a set. A clean release record means nothing if the method behind it was never validated and the quality unit could not say no.

It is not only FDA: the Health Canada parallel

What to do: do not assume this is a United States only concern. Health Canada's Good Manufacturing Practices, set out in Division 2 of the Food and Drug Regulations and the GMP guide GUI-0001, require finished product testing against specifications before release and testing of raw materials, with comparable conditions for relying on a vendor certificate. The wording differs, the principle does not. A product that fails FDA release expectations would very likely fail a Health Canada inspection on the same facts.

Method validation is the common thread. Whether you answer to FDA or Health Canada, a release result is only meaningful if the method that produced it is validated for accuracy, sensitivity, specificity and reproducibility. We cover the discipline in our guides to analytical method validation and to Health Canada GMP inspection readiness. If you export to the United States, aligning to the stricter of the two sets protects you in both markets.

How this connects to validation and your quality unit

How it affects compliance: release testing proves a single batch conforms. Process validation proves the process can make conforming batches repeatably. Under 211.100, you need process performance qualification and ongoing monitoring, not just a one time study. Without it, every batch is an experiment, and release testing is catching failures rather than preventing them.

The quality unit is the control that ties it together. It owns the specifications, approves the methods, qualifies the suppliers and makes the final release or reject call. When FDA finds a weak quality unit, the other findings almost always follow, because nobody with authority was watching. We have written about how warning letters so often start with the training record and about what a failing quality unit looks like to FDA. A strong quality unit is the cheapest insurance in the building.

Batch release and component testing checklist

• Confirm the identity and strength of each active ingredient by laboratory testing before every batch is released, not appearance, colour or weight.
• Hold a written, approved finished product release specification and test every batch against it.
• Validate every test method for accuracy, sensitivity, specificity and reproducibility, and keep the validation records.
• Run at least one specific identity test on every incoming component lot, including each active pharmaceutical ingredient.
• Before relying on a supplier certificate of analysis, fully test the component yourself, compare to the certificate, and repeat at defined intervals.
• Document supplier qualification and reliability checks, and withdraw reliance when results diverge.
• Complete process performance qualification and maintain ongoing process monitoring, not a single historical study.
• Give the quality unit the written authority to reject any batch, component or supplier, and record that it exercised that authority.

Common mistakes

• Treating in process checks as release testing. Appearance, colour and weight are useful, but they do not confirm identity or strength and cannot support release on their own.
• Reading the COA allowance, skipping the COA conditions. A certificate replaces other testing only with your own identity test and validated supplier reliability at intervals.
• Using unvalidated methods. A passing result from an unvalidated method is not evidence of conformance and will not hold up in an inspection.
• Qualifying a supplier once and never again. Reliability is established at appropriate intervals. A one time check at onboarding does not satisfy 211.84(d)(2).
• Leaving the quality unit without authority. If the quality unit cannot reject a batch or a supplier, the whole control system is on paper only.

Frequently asked questions

Does FDA require identity and strength testing before releasing every batch?

Yes. Under 21 CFR 211.165(a), each batch of drug product must have an appropriate laboratory determination of satisfactory conformance to final specifications, including the identity and strength of each active ingredient, before it is released for distribution. Appearance, colour and weight checks do not satisfy this requirement.

Can I rely on a supplier certificate of analysis instead of testing a component?

Only partly. Under 21 CFR 211.84(d), you may accept a supplier report of analysis in place of your own testing for purity, strength and quality, but you must still conduct at least one specific identity test yourself and establish the supplier's reliability through validation of their results at appropriate intervals. Identity testing can never be fully outsourced to the certificate.

What does establishing supplier reliability actually involve?

You fully test the component against all appropriate specifications yourself, compare your results to the supplier's certificate, confirm they agree, and repeat this at defined intervals. The checks must be documented. If your results and the certificate diverge, the supplier is not qualified for reliance until the discrepancy is resolved.

Why do batch release findings so often appear with process validation findings?

Because they are two halves of the same assurance. Release testing confirms a single batch meets specification. Process validation, under 21 CFR 211.100, confirms the process can produce conforming batches repeatably. A firm that skips validation is usually also weak on release testing, and an inspection tends to surface both at once.

Do these rules apply to Canadian manufacturers?

If you ship product into the United States, 21 CFR Part 211 applies to that product. Separately, Health Canada's Good Manufacturing Practices under Division 2 of the Food and Drug Regulations and the GUI-0001 guide impose comparable finished product and raw material testing expectations. The safe approach for exporters is to meet the stricter of the two standards.

What is the fastest way to find a gap like this before an inspector does?

Pull a recent batch record and trace the release decision back to its evidence. Confirm there is a written specification, a validated method, a conforming identity and strength result, an identity test on each component lot, a documented supplier reliability check, and a quality unit sign off. Any missing link is your gap. A mock inspection or gap assessment does this systematically across your products.

How MFLRC can help

MFLRC helps pharmaceutical, over the counter, natural health product and cannabis manufacturers build release and component testing that holds up to FDA and Health Canada inspection. Our US FDA regulatory support team maps your release programme to 21 CFR Part 211, while our analytical and stability support confirms your methods are validated and your specifications are defensible.

If you want to find the gap before an inspector does, our GMP audit services run a release and supplier qualification gap assessment with CAPA support, and our quality system design and documentation service builds the specifications, SOPs and supplier qualification programme that keep your release decisions evidence based.

Not sure your batch release would survive an inspection? Have MFLRC pressure test it before the FDA or Health Canada does.

Conclusion

Releasing a drug batch on appearance, colour and weight is not a shortcut. It is a finding waiting to happen. FDA is explicit: confirm the identity and strength of every active ingredient against a written specification using validated methods before you release, test the identity of every component lot, and rely on a supplier certificate only inside a qualification programme you can prove. Those controls, with real process validation and a quality unit that can say no, are what separate a defensible release from a warning letter. Build the evidence now, while the only pressure you face is your own, not an inspector's.

Sources and references

• 21 CFR 211.165, Testing and release for distribution (eCFR)
• 21 CFR 211.84, Testing and approval or rejection of components, containers and closures (eCFR)
• 21 CFR 211.100, Written procedures; deviations (eCFR)
• FDA Warning Letter, Yangzhou H&R Plastic Daily Chemical Co., Ltd., 18 March 2026