About this library. These observations are illustrative patterns drawn from FDA 483 observation history in regulated life sciences. They represent recurring authorization documentation gaps identified during inspections. Each observation demonstrates the type of language FDA investigators use when authorization records are absent.

Filter:
Showing 30 observations
Batch Release · 21 CFR 211.192
21 CFR 211.192 No written investigation record for atypical result prior to release Batch Release
Observation
"Batch production records reviewed by the Quality Unit did not include documentation of the investigation into an atypical viscosity result observed during coating operations. No written record exists demonstrating that the released batch met all specifications and that investigation of the atypical result was satisfactory prior to distribution."
Authorization Gap
The QP signature was present on the batch record. What was absent: any document capturing what evidence the QP reviewed, what the atypical result meant relative to historical process data, and the explicit rationale for concluding the batch was suitable for release. The signature proved review occurred. It did not constitute an authorization record for the exception decision.
21 CFR 211.192 QP signature obtained prior to completion of required testing Batch Release
Observation
"Your firm's Quality Unit approved batch records without reviewing all required laboratory testing. The QP signature on the batch record was obtained prior to completion of stability testing required under your written procedures. No record documents the basis for the authorization decision or identifies what evidence was available to the QP at the time of release."
Authorization Gap
The authorization record should capture the complete evidentiary state at the moment of decision — specifically, what data existed and what data was pending. A release decision made without a full data package is not necessarily wrong; what is indefensible is a release record that does not document what was and was not reviewed.
21 CFR 211.192 Out-of-trend result released without documented release rationale Batch Release
Observation
"Written batch production and control records do not contain complete information relating to the production and control of each batch. Records for batches containing out-of-trend dissolution results do not document the basis for the Quality Unit's decision to release product, what standards were applied to evaluate the trend, or the identity of the individual who authorized the release determination."
Authorization Gap
An out-of-trend result within specification is a decision moment. The investigator's question is not whether the decision was correct — it is whether the decision was made formally, by an identified individual, on the basis of documented evidence, at the time of release. None of those elements appear in a standard batch record signature.
21 CFR 211.192 Reviewer signatures do not indicate what documentation was reviewed Batch Release
Observation
"The Quality Unit's review and approval of batch records does not include documentation sufficient to reconstruct the basis for release decisions. Reviewer signatures on batch records do not indicate what specific documentation was reviewed, what regulatory standards were applied, what alternative conclusions were considered, or what evidence supported the final release determination."
Authorization Gap
This is the systemic version of the gap — it appears on inspections where no single batch had a deficient release, but the pattern across all batches shows that the authorization system itself is insufficient. The observation targets the absence of a documentation requirement, not a single failure.
21 CFR 211.192 Written procedures do not require authorization documentation for exception decisions Batch Release
Observation
"Your written procedures do not include requirements for documenting the authorization decision when batch records contain deviations or out-of-trend results. Review of batch records containing flagged exceptions found that none contained a separate authorization document capturing the evidence reviewed, the standards applied, or the rationale for the release determination."
Authorization Gap
When the observation is against the procedure rather than a specific batch, the finding is broader and more damaging. It signals that the quality system does not recognize the difference between a batch record signature and a release authorization record — and that every exception decision made under the current system carries the same exposure.
CAPA Effectiveness · 21 CFR 211.192
21 CFR 211.192 CAPA closed without documented effectiveness verification CAPA
Observation
"CAPA records were closed without documented effectiveness verification. Your CAPA procedure requires effectiveness checks at 30 and 90 days post-implementation. No records exist demonstrating these checks were performed or that a qualified individual reviewed the effectiveness data and formally authorized the closure determination."
Authorization Gap
CAPA closure is a decision — the conclusion that a corrective action was effective and that the root cause has been controlled. That decision requires an authorization record: who made it, what effectiveness data was reviewed, what time horizon was evaluated, and what standard was used to conclude the action was sufficient.
21 CFR 211.192 Root cause recurrence — prior effectiveness determination not on record CAPA
Observation
"The root cause identified in the current CAPA represents a recurrence of a deviation type addressed in a prior CAPA closed eighteen months prior. No record exists demonstrating that the effectiveness determination for the prior CAPA was reviewed as part of the current investigation, or that the prior authorization of effectiveness was evaluated in light of the recurrence."
Authorization Gap
When a root cause recurs, the prior CAPA's effectiveness authorization becomes evidence. If that authorization record does not exist — or exists only as a closure signature — the current investigation cannot properly evaluate whether the prior corrective action actually worked. The absence of the prior authorization record compounds the current finding.
21 CFR 211.192 Effectiveness determined by originating department without QU authorization CAPA
Observation
"CAPA effectiveness was determined by the originating department without Quality Unit review or approval. Your CAPA procedure requires Quality Unit authorization of effectiveness determinations prior to closure. No records document Quality Unit involvement in the closure of multiple CAPAs reviewed during this inspection."
Authorization Gap
Who authorized the effectiveness conclusion matters as much as the conclusion itself. An effectiveness determination made by the department that implemented the corrective action — without independent QU authorization — is structurally compromised regardless of whether the determination was accurate.
21 CFR 211.192 CAPA closed with no effectiveness data — subjective conclusion only CAPA
Observation
"CAPA closure records contain conclusions that corrective actions were effective without referencing specific data, metrics, or observations reviewed to support that determination. No record identifies what evidence was evaluated, over what time period, or what threshold was used to determine effectiveness had been demonstrated."
Authorization Gap
An authorization record for CAPA effectiveness must capture the evidence base — not just the conclusion. "Corrective action verified effective" is not an authorization record. The record must identify: what data was reviewed, what the data showed relative to the pre-CAPA baseline, and on what basis the reviewer concluded the action met the effectiveness standard.
21 CFR 211.192 Effectiveness check timeframe extended without documented authorization CAPA
Observation
"The effectiveness check timeframe specified in CAPA records was extended beyond the required period without documented authorization. No record exists of who approved the extension, what data was available at the required check date, or what justified delaying the effectiveness determination."
Authorization Gap
A deadline extension is a decision. The decision to delay an effectiveness check requires the same authorization documentation as the effectiveness determination itself — who made it, when, on the basis of what information, and under what authority.
OOS Investigation · 21 CFR 211.192 / 211.160
21 CFR 211.192 OOS result invalidated without documented authorization of invalidity conclusion OOS
Observation
"Laboratory investigation of an out-of-specification result failed to include documented authorization of the invalidity conclusion. Your investigation concluded the OOS result was attributable to analyst error. No record identifies the specific evidence reviewed, the evidentiary standard applied to support the invalidity determination, or the individual authorized to make the invalidity conclusion."
Authorization Gap
OOS invalidity is one of the highest-scrutiny authorization decisions in a regulated laboratory. The evidentiary standard for invalidating a result is high, and the authorization record must demonstrate that the standard was met — not just that a conclusion was reached. The FDA's OOS guidance explicitly requires that the investigation record support the invalidity conclusion.
21 CFR 211.192 Phase I terminated without authorization to proceed to disposition OOS
Observation
"Out-of-specification results were invalidated without completing a full Phase II investigation. Investigation records document a Phase I conclusion that assignable cause was identified, but no record exists of who authorized the decision to terminate investigation at Phase I, what standard was applied to determine assignable cause was sufficiently established, or the basis for proceeding directly to product disposition."
Authorization Gap
The decision to terminate an OOS investigation at Phase I rather than proceeding to Phase II is a formal authorization decision. The FDA's OOS guidance requires that the Phase I conclusion be documented and authorized before proceeding to disposition. The authorization record must capture the specific evidence that supported the assignable cause conclusion.
21 CFR 211.192 Disposition authorization absent from OOS investigation record OOS
Observation
"Your firm's written procedure for OOS investigation does not require documentation of who authorized the final disposition decision — whether to reject, retest, or release — or what evidence was reviewed in making that determination. Review of OOS investigation records found that none contained a disposition authorization document separate from the investigation summary."
Authorization Gap
The OOS disposition decision — to reject, retest, or release — is distinct from the investigation conclusion. The investigation establishes what happened. The disposition decision establishes what to do about it. Both require authorization records. Many sites document the investigation thoroughly and leave the disposition authorization implicit in the final signature.
21 CFR 211.160 Retesting performed without documented authorization OOS
Observation
"Retesting of out-of-specification samples was initiated without documented authorization. No record exists of who authorized the retest, what basis supported the decision to retest rather than reject, or what protocol governed the number of retests to be performed and the interpretation of retest results."
Authorization Gap
Retesting is not a default response to an OOS result — it is an authorization decision with a specific evidentiary standard. The authorization record for retesting must identify: the basis for concluding the original result was suspect, who made that determination, and the pre-specified protocol for interpreting retest results.
21 CFR 211.192 OOS investigation closed with root cause not identified — no authorization of inconclusive closure OOS
Observation
"OOS investigation records were closed with the notation that root cause was not identified. No record exists of who authorized the inconclusive closure, what investigation activities were completed prior to closure, what additional activities were considered and rejected, or the basis for concluding that further investigation would not yield an assignable cause."
Authorization Gap
Closing an investigation without identifying root cause is a decision that requires more, not less, authorization documentation. The record must demonstrate that the investigation was thorough, that the inconclusive determination was not premature, and that a qualified individual formally authorized the closure based on a complete record of what was and was not found.
Deviation · 21 CFR 211.100 / 211.192
21 CFR 211.192 Continuation decision not documented after production deviation Deviation
Observation
"A production deviation from written procedures was documented and a risk assessment completed. No record exists of the authorization decision to continue manufacturing — specifically, who authorized continuation, what evidence was reviewed at the time of the authorization, and under what risk framework the decision to proceed was made."
Authorization Gap
The decision to continue manufacturing after a deviation — not to stop and investigate — is a real-time authorization decision. The risk assessment documents the risk. The authorization record documents the decision to accept that risk and proceed. These are distinct documents with distinct purposes.
21 CFR 211.100 Deviation classification made without documented criteria or authorization Deviation
Observation
"Your deviation management procedure does not require documentation of the authorization decision for deviations classified as minor. Review of minor deviation records found that none contained documentation of who made the classification decision, what criteria were applied, or what evidence supported the determination that the deviation did not require investigation."
Authorization Gap
Classification is a consequential decision — it determines whether a deviation is investigated and whether a CAPA is required. The authorization record for a classification decision must identify who made it, against what written criteria, and on what basis. A "minor" classification without an authorization record is a classification that cannot be defended when the deviation pattern recurs.
21 CFR 211.192 Deviation closed with root cause not identified — inconclusive closure not authorized Deviation
Observation
"Deviation records were closed without documented root cause determination. Closure records contain the notation that root cause was not identified but provide no record of who authorized this conclusion, what investigation activities were performed, what evidence was reviewed, or what supported the determination that investigation was complete."
Authorization Gap
Closing a deviation without a root cause determination requires a higher standard of authorization documentation — not a lower one. The authorization record must demonstrate that the investigation was thorough, that root cause was genuinely not identifiable with the evidence available, and that a qualified individual made that determination formally.
21 CFR 211.100 Repeat deviation — prior deviation authorization record not reviewed Deviation
Observation
"Your firm experienced a recurring deviation from the same written procedure that was the subject of a deviation closed in the prior period. No record demonstrates that the prior deviation investigation was reviewed as part of the current event, or that the prior authorization of closure was evaluated in light of recurrence."
Authorization Gap
When a deviation recurs, the prior authorization record becomes evidence. If the prior deviation was closed with an authorization record that captured root cause, corrective action, and effectiveness criteria, the current investigation can reference and evaluate it. If the prior closure record is a signature without substance, the recurrence investigation has no foundation to build on.
21 CFR 211.100 Immediate correction performed without documented impact assessment authorization Deviation
Observation
"Immediate corrective actions taken in response to a production deviation were implemented without documented authorization of the product impact assessment. No record identifies who authorized the conclusion that the deviation did not adversely affect product quality, what evidence supported that determination, or what regulatory standard was applied."
Authorization Gap
The product impact assessment is not the deviation record — it is an authorization decision. The conclusion that a deviation had no adverse product impact must be documented as a formal determination: who made it, what evidence was available, and what standard was applied. The immediacy of the corrective action does not eliminate the requirement for a formal authorization record.
Change Control · 21 CFR 211.68 / 211.100
21 CFR 211.100 Revalidation conclusion not documented — impact determination authorization absent Change Control
Observation
"A change to your validated cleaning process was approved without documented risk assessment authorization. Your change control procedure requires a validation impact assessment for changes to validated processes. No record identifies who performed this assessment, what criteria were evaluated, or who authorized the conclusion that revalidation was not required."
Authorization Gap
The conclusion that a change does not require revalidation is one of the highest-consequence authorization decisions in a change control system. The authorization record must capture: what the validated state was, what the change altered, what the theoretical impact on validation was, and who formally authorized the determination that the validation remained valid.
21 CFR 211.100 QU change approval signature present — authorization record absent Change Control
Observation
"Your firm implemented process changes with Quality Unit approval signatures on change control records that do not document what the QU reviewed, what risk the change posed to product quality, or the basis for concluding the change did not require additional validation activities. The QU signature demonstrates approval was obtained; it does not demonstrate that the authorization decision was made on the basis of a complete risk evaluation."
Authorization Gap
Change control approval signatures are subject to exactly the same gap as batch record signatures. The signature proves someone reviewed something. The authorization record proves what was reviewed, what was concluded, and on what basis. A change control system built on signatures without authorization records produces change approvals that cannot be reconstructed or defended.
21 CFR 211.68 Computer system change implemented without IQ/OQ/PQ authorization decision Change Control
Observation
"A software update to a system used in GMP operations was implemented without documented authorization of the qualification impact assessment. No record identifies who determined that the update did not require IQ/OQ/PQ activities, what testing was performed to confirm the update did not alter system functionality, or who authorized the conclusion that the existing validation remained valid."
Authorization Gap
Computer system changes are among the most common authorization gaps in modern pharmaceutical manufacturing. The authorization record for a software change qualification decision must demonstrate that a qualified individual evaluated the change against the validated state, determined what qualification was required, and formally authorized the conclusion — not merely signed the change control.
21 CFR 211.100 Supplier change implemented without authorized re-qualification determination Change Control
Observation
"A change in raw material supplier was implemented following approval of the change control record. No documentation exists of the authorization decision regarding whether re-qualification of the affected process was required, what comparative analytical testing was performed, or who authorized the conclusion that existing process validation remained applicable to the new material source."
Authorization Gap
A supplier change is a process change in regulatory terms. The authorization record must document the qualification bridge decision: what analytical comparison was performed, what criteria were applied, and who authorized the conclusion that the new material source did not require process revalidation.
21 CFR 211.100 Change implemented before change control closure — authorization sequence inverted Change Control
Observation
"Review of change control records identified instances where changes were implemented prior to formal approval of the change control record. No record documents who authorized early implementation, what risk assessment supported the decision to proceed before formal approval, or what retrospective review was performed to confirm the pre-approved implementation did not adversely affect product quality."
Authorization Gap
When a change is implemented before authorization, the authorization record for the implementation decision — separate from the change control approval — must document the exception. Who decided to proceed early, on what basis, and under what authority. The change control approval closing the record after the fact does not retroactively constitute authorization of the implementation decision.
Data Integrity · 21 CFR 211.68 / 211.100
21 CFR 211.68 Data deletion performed without authorization record Data Integrity
Observation
"Audit trail review identified instances of data deletion in GMP systems. No record exists of who authorized the deletion activities, what data was deleted, whether Quality Unit review occurred prior to the activity, or what regulatory basis supported the conclusion that deletion was appropriate."
Authorization Gap
Any modification to GMP data — including deletion — requires an authorization record. The record must capture: who authorized the modification, what the modification was, what the regulatory basis was, and that an independent QU review occurred. The audit trail showing the deletion occurred is not an authorization record for the deletion.
21 CFR 211.68 Audit trail review completed without authorization of anomaly disposition Data Integrity
Observation
"Your firm's procedure for audit trail review does not require documentation of who reviewed the audit trail, what anomalies were identified, what investigation was performed for identified anomalies, or who authorized the conclusion that anomalies did not represent GMP data integrity violations."
Authorization Gap
Audit trail review is not complete until anomalies are formally dispositioned. The review record must document what was reviewed, what was found, and — critically — the authorization decision for each anomaly: who concluded it was acceptable, on what basis, and under what standard. A review record showing the audit trail was examined, with no anomaly disposition authorization, is an incomplete record.
21 CFR 211.68 Shared login credentials — individual authorization of data entries not established Data Integrity
Observation
"Your firm used shared login credentials for GMP data entry systems, preventing attribution of individual data entries to specific operators. No record demonstrates who entered specific data values, who authorized specific data entries, or who is accountable for specific decisions reflected in the system record."
Authorization Gap
Individual accountability is the foundation of data integrity. An authorization record requires an identified authorizer. A system that cannot attribute data entries to individuals cannot produce authorization records — it can only produce records of what was entered, with no defensible record of who authorized any specific decision.
21 CFR 211.100 Manual data transcription from raw data to records — transcription authorization absent Data Integrity
Observation
"Laboratory records contain manually transcribed data from instrument printouts. No written procedure requires documentation of who authorized the transcription, verification that the transcribed values match the original source data, or second-person review of transcription accuracy. Multiple instances were identified where the transcribed value differed from the instrument record."
Authorization Gap
Manual transcription is a data transfer decision. Each transcription requires an authorization record in the form of a verification: who transcribed the value, who independently verified it against the source, and what the source was. Where transcription and verification are performed by the same individual without a second-person review, the authorization record is structurally insufficient.
21 CFR 211.68 Electronic signature applied to records without documented meaning or authorization standard Data Integrity
Observation
"Your firm uses electronic signatures on GMP records without written procedures defining the meaning of each signature, the standards that must be met before a signature is applied, or the authorization granted by specific signature types. Electronic signature application procedures reviewed during the inspection did not specify what each signatory was certifying."
Authorization Gap
An electronic signature is not an authorization record — it is a mechanism for applying an authorization record. The authorization record must define what the signature means: what the signer reviewed, what the signer certified, and what standard the signer applied. Without that definition, the signature is a mark, not an authorization.