An FDA inspection involves more than the investigators who visit a manufacturing site. The reason for the inspection, the field team’s findings and the agency’s final classification are separate elements of a regulatory process. Understanding how these responsibilities are divided is essential for pharmaceutical manufacturers preparing for US market access or maintaining compliance.

Article 1 in the “Mapping Inspection Systems” series. Following an overview of who may inspect a pharmaceutical manufacturing site, this article examines the US Food and Drug Administration’s (FDA) inspection system in detail. The question “Will the FDA inspect our site?” is only the starting point. An inspection can be initiated, conducted and closed by different parts of the same agency, while the inspection team’s observations and the agency’s final decision represent distinct stages. Effective preparation requires understanding why an inspection was assigned, who will conduct it and who will determine its regulatory implications.

Scope: This article focuses on human drugs and active pharmaceutical ingredients (APIs), excluding veterinary products. The October 2026 FDA Concept of Operations (ConOps) discussed below describes the operating model for human drugs; it does not cover every FDA inspection programme or product category. For biological products, manufacturers should establish the responsible FDA centre early. The Center for Drug Evaluation and Research (CDER) oversees therapeutic protein products, including monoclonal antibodies and most other therapeutic proteins. Vaccines, blood products, allergens, and cell and gene therapies generally fall under the Center for Biologics Evaluation and Research (CBER), subject to FDA product-jurisdiction determinations. See the FDA’s guidance on therapeutic biological products (FDA guidance on therapeutic biological products) and CBER product jurisdiction (CBER product jurisdiction).

Why is the FDA inspecting your site?

Three common scenarios have different inspection objectives and preparation requirements.

Scenario 1: Your site is named in an application

When a manufacturing site is identified in a new drug application (NDA), an abbreviated new drug application (ANDA) or a biologics license application (BLA), FDA may assess the site’s readiness for commercial production before approval. Depending on the circumstances, this assessment may involve a pre-approval inspection (PAI), a records request or a remote assessment. A PAI primarily verifies that the manufacturing processes and controls described in the application operate as represented at the site and that the supporting data are reliable. The applicable FDA Compliance Program Guidance Manual for pre-approval inspections (pre-approval inspection programme) sets out the inspection framework.

The updated ConOps makes clear that a PAI is not automatic simply because a site is named in an application. CDER conducts a pre-approval evaluation of the establishment, the drug and the information submitted in the application. This assessment determines whether a PAI or a Remote Regulatory Assessment (RRA) is needed to support the quality assessment and the application decision.

Scenario 2: Your site already supplies the US market

Manufacturers of drugs and APIs supplying the US market are subject to risk-based surveillance inspections. FDA uses a risk model to select facilities and assesses defined systems rather than necessarily examining every aspect of the operation during each inspection. The quality system is a mandatory element of the relevant drug quality inspection programme. A separate programme addresses API manufacturers. The applicable documents are FDA’s Compliance Program 7356.002 (Compliance Program 7356.002) for drug manufacturing and Compliance Program 7356.002F (Compliance Program 7356.002F) for APIs.

Under the updated ConOps, CDER’s Office of Quality Surveillance (OQS) maintains the risk-based site selection model and prioritises establishments for surveillance. The Office of Human and Animal Drug Inspectorate (OHADI) schedules the inspections according to available inspection capacity. The field inspections themselves are led by the Office of Inspections and Investigations (OII), with CDER participation when requested by OII.

Scenario 3: A specific signal has emerged

A complaint, batch recall, Field Alert Report or concerning quality data may trigger a for-cause inspection outside the routine surveillance schedule. Such inspections are generally focused on the signal that prompted the assignment. A further inspection may assess whether deficiencies identified previously have been adequately corrected. The scope of a follow-up inspection depends on the assignment and the corrective actions under review.

The updated ConOps confirms that for-cause inspections are led by OII, with CDER participation when appropriate. Requests are generally initiated by CDER’s Office of Compliance or Office of Pharmaceutical Quality, although urgent circumstances may lead to requests from other offices.

Three levels of requirements

Manufacturers should distinguish statutory obligations, binding regulations and guidance when planning inspection readiness.

Statutory requirements: Section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act (FD&C Act) establishes the requirement that drugs be manufactured in accordance with current good manufacturing practice (CGMP). The statutory framework also applies to APIs.

Regulations: Finished drug products are generally subject to 21 CFR Parts 210 and 211. Positron emission tomography (PET) drugs are addressed in Part 212. Part 211 does not establish a dedicated set of legal requirements specifically for API manufacturing as such. FDA’s API inspection programme generally uses ICH Q7 as the relevant technical framework.

Guidance: ICH Q7 sets out GMP guidance for APIs. FDA considers compliance with Q7 an important basis for demonstrating compliance with statutory CGMP requirements.

For API inspections, manufacturers should therefore build their preparation programme around ICH Q7 rather than automatically applying a finished-product Part 211 checklist to every operation. The legal basis for a violation remains the applicable statute and regulations. An important qualification concerns APIs labelled as sterile: FDA’s inspection programme refers to Parts 210 and 211 for these products because sterilisation and aseptic processing are outside the scope of ICH Q7. Relevant primary documents include FDA’s ICH Q7 guidance (ICH Q7 guidance) and its pre-approval inspection programme (pre-approval inspection programme).

Who conducts the inspection—and who decides the outcome?

FDA’s field organisation has been reorganised. The former Office of Regulatory Affairs (ORA) is now the Office of Inspections and Investigations (OII), which leads field inspections and investigations. Pharmaceutical inspections are handled within the Office of Human and Animal Drug Inspectorate (OHADI), working with the relevant FDA centres.

The division of responsibilities is set out in the revised Integration of FDA Facility Evaluation and Inspection Program for Human Drugs: A Concept of Operations, dated 21 October 2026. The updated ConOps replaces the 2017 operating model and reflects the organisational changes made in October 2024. It clarifies how CDER and OII coordinate establishment evaluations, inspections and related compliance activities.

This division means that the investigators conducting an inspection do not necessarily make the final classification decision. The field team documents its findings and prepares the Establishment Inspection Report (EIR) and an initial recommendation. The responsible CDER or OII office then follows the classification process applicable to the inspection type.

See FDA’s official pages for the Office of Inspections and Investigations (Office of Inspections and Investigations), the Office of Human and Animal Drug Inspectorate (Office of Human and Animal Drug Inspectorate) and the Office of Pharmaceutical Manufacturing Assessment (Office of Pharmaceutical Manufacturing Assessment).

The updated ConOps also changes how the classification process and its timelines should be understood. There is no single 90-day rule that applies in the same way to every inspection category:

– Pre-approval inspections: The inspection team is responsible for endorsing the complete EIR package within 45 days of inspection close. For an initial VAI or OAI recommendation, the case is referred to OPMA. OPMA completes the final classification within 45 days of receiving both the complete EIR package and the establishment’s response, or by the applicable application-related due date, whichever is sooner.

– Post-approval inspections: The complete EIR package is to be endorsed within 45 days of inspection close. OPMA then completes its final assessment and recommendation in the following 45 days, with follow-up action initiated in the subsequent 10 days, as appropriate.

– Surveillance inspections: OHADI completes the EIR package and issues an initial classification within 45 days of inspection close. For NAI cases, OHADI issues the decisional letter within 90 days of inspection close. Initial VAI and OAI cases are referred to OMQ, which makes the final classification and, subject to the applicable process, issues the decisional letter within 90 days of inspection close. For final OAI classifications, OMQ takes appropriate action within three months of the decisional letter.

These are procedural timelines set out in the ConOps, not guarantees that every case will be completed within those periods. The applicable process depends on the inspection category, the findings, the establishment’s response and any additional regulatory considerations.

The updated ConOps also incorporates the use of inspection information from regulatory partners with which FDA has entered into Mutual Recognition Agreements (MRAs), as well as RRAs. These tools can inform FDA’s establishment assessments, but they do not all have the same legal status or replace the same statutory inspection requirements.

Three inspection purposes, three different scopes

Surveillance inspections

Surveillance inspections use a risk-based approach and examine selected manufacturing systems, such as quality, production and laboratory controls. The programme provides different coverage options, from an abbreviated assessment of at least two systems—with the quality system always included—to a broader inspection covering more systems. The objective is to assess the facility’s overall CGMP compliance rather than verify a particular application.

The updated ConOps describes surveillance as a system-based programme intended to identify systemic issues and adverse quality trends across establishments. CDER’s OQS maintains the risk-based site selection model, while OII leads the inspections. The model takes account of information such as inspection history, recalls, shortages, customer complaints and reports submitted to FDA.

Pre-approval and pre-license inspections

Pre-approval inspections (PAIs) for CDER applications and pre-license inspections (PLIs) for applicable licensed biological products verify readiness for commercial production, consistency with the application and the reliability of submitted data. Data integrity may be a central element of the review. FDA also maintains a separate programme for inspections associated with post-approval changes. Relevant documents include Compliance Program 7346.832M (https://www.fda.gov/media/191983/download) for applicable pre-license inspections and Compliance Program 7356.843 (https://www.fda.gov/media/164791/download) for post-approval changes.

For human drugs within the scope of the updated ConOps, CDER first evaluates the information available for each establishment named in an application. A PAI is requested when the risk assessment and application review indicate that an on-site inspection is needed. Where appropriate, CDER may instead conduct or lead an RRA to address outstanding concerns. The use of an RRA does not mean that the statutory requirements for an inspection have automatically been met.

For-cause inspections

For-cause inspections respond to a specific signal, such as a complaint, deviation, recall or suspected data falsification. The signal determines the focus and scope. Manufacturers should not infer the exact inspection agenda from the inspection type alone. The distinction matters operationally: the inspection team, requested documents, processes under scrutiny and expectations at closeout depend on the purpose of the assignment.

The ConOps also allows FDA to consider a for-cause RRA or, where appropriate, information from an MRA partner. The decision depends on the nature and urgency of the concern and the information FDA needs to assess it.

What happens during an FDA inspection?

Before the visit

Application-related inspections are preceded by an internal site risk assessment. A registered facility must provide access to investigators. Unreasonable delay, denial or limitation of an inspection can have serious legal consequences: under section 501(j) of the FD&C Act, drugs may be deemed adulterated when an inspection is refused, subject to the statutory provisions and applicable circumstances. This does not require FDA to establish a defect in a specific batch first. FDA recognises that some explanations for delays may be reasonable. The relevant distinction is between a justified delay and conduct that constitutes delaying, denying, limiting or refusing an inspection.

During the inspection

Investigators document their work, request records and interview personnel. Access to records is governed by FDA’s statutory authority. Manufacturers should ensure that relevant documentation can be retrieved promptly and that staff understand the procedures for responding to requests.

At closeout: Form FDA 483

During the closing discussion, the investigator presents observations. When the investigator believes that observed conditions or practices may constitute violations of the FD&C Act, they may be documented on Form FDA 483, Inspectional Observations. Form FDA 483 is not FDA’s final determination. It records the investigator’s observations and should not be treated as an automatic regulatory sanction or a final conclusion that the facility is non-compliant. FDA explains this distinction in its Form FDA 483 Frequently Asked Questions (Form FDA 483 Frequently Asked Questions).

After the inspection

A written response to Form FDA 483 is not mandatory, but FDA encourages firms to submit a response addressing the observations and corrective actions within 15 business days of issuance so that it can be considered during the agency’s decision-making process. FDA’s March 2026 draft guidance on responding to Form FDA 483 observations also recommends a consolidated response within this 15-business-day period. The draft guidance describes the elements of an effective response, including a patient- and product-focused risk assessment, investigation findings, root-cause analysis and a corrective and preventive action (CAPA) plan. As draft guidance, it represents FDA’s current thinking but is not a binding requirement.

The FDA prepares an Establishment Inspection Report (EIR), the written record of the inspection. The agency considers the EIR, Form FDA 483, evidence collected on site and any company response before determining whether further action is appropriate. The current inspection classification database and the March 2026 draft guidance on responses to Form FDA 483 (March 2026 draft guidance on Form FDA 483 responses) provide further information.

Understanding the inspection outcome

The outcome of a US inspection is a sequence of observations, review, classification and, where warranted, regulatory or administrative action. The following documents and statuses are not interchangeable.

FDA’s official resources explain inspection classifications (FDA inspection classifications), Warning Letters (FDA Warning Letters) and the separate grounds for Import Alert 66-40 (Import Alert 66-40) and Import Alert 66-79 (Import Alert 66-79).

Two distinctions are particularly important. First, the sequence “483 → OAI → Warning Letter → Import Alert” is not automatic. A Form FDA 483 may not be issued, and subsequent actions depend on the evidence, severity of the issues, the firm’s response and the applicable legal framework. Second, FDA publishes inspection classifications for relevant inspections in its inspection classification database (inspection classification database). The outcome may therefore be visible to customers, business partners and regulators in other jurisdictions.

Import Alert 66-79 deserves particular attention for foreign manufacturers. Its current scope includes establishments that refuse FDA inspection and establishments that refuse to respond to a mandatory RRA, such as a records request under section 704(a)(4). FDA may use this alert to detain affected drug shipments without physical examination. The alert is separate from Import Alert 66-40, which concerns drugs from firms that have not met drug GMP requirements.

Remote oversight tools: different procedures, different legal status

FDA uses several tools to assess facilities without relying exclusively on a conventional on-site inspection. Their legal status and consequences differ.

Records requests under section 704(a)(4)

FDA may request records that it is legally entitled to examine, including before or instead of an on-site inspection. These requests use Form FDA 4003 and are not simply informal information requests. A mandatory records request under section 704(a)(4) is one type of RRA. Failure or refusal to respond can have regulatory consequences, including potential inclusion in Import Alert 66-79 where the applicable criteria are met.

Remote Interactive Evaluations

A Remote Interactive Evaluation (RIE) is a voluntary remote assessment that may use live video, teleconferencing and screen sharing. It is not an inspection in the legal sense, and it does not result in a Form FDA 483. FDA instead communicates observations by email and recommends a response within 15 business days. Facilities cannot commission an RIE on their own initiative: FDA determines whether to use this tool.

Remote Regulatory Assessments

A Remote Regulatory Assessment (RRA) is a broader category of remote oversight activity. It may involve a review of records or other information submitted at FDA’s request, or remote interaction such as an RIE. An RIE is therefore one way of carrying out a remote assessment, rather than a separate statutory inspection category.

An RRA is neither an inspection nor an automatic substitute for one. It may support application reviews and other regulatory decisions. The updated ConOps expressly incorporates RRAs into CDER’s pre-approval, post-approval, surveillance and for-cause operating models. Both CDER and OII may lead RRAs, depending on the purpose and circumstances.

FDA’s overview of remote oversight tools (FDA remote oversight tools) and its guidance on records requests (FDA guidance on records requests) explain the different mechanisms. For manufacturers, a records request under section 704(a)(4) requires preparation comparable in seriousness to an on-site inspection, including the context and explanations needed to interpret the requested records.

An important legal distinction remains: an RRA conducted under section 704(a)(4) does not satisfy the physical inspection requirement under section 704(a)(1), because it does not involve physical entry into the establishment. By contrast, qualifying inspection reports from MRA partners can fulfil the relevant inspection requirements under section 510(h) of the FD&C Act.

If another regulatory authority has already inspected the site

The United States has GMP inspection mutual recognition agreements (MRAs) with the European Union, the United Kingdom and Switzerland. These arrangements allow regulatory authorities to rely on qualifying inspection work by partner authorities, but their scope and conditions differ.

The updated ConOps gives MRA inspection information a more explicit role in FDA’s establishment evaluation model. FDA may use recent reports from MRA partners to assess compliance with US CGMP requirements, support recommendations concerning application decisions and inform surveillance or for-cause activities. This does not mean that every inspection by a partner authority automatically removes the need for an FDA inspection.

FDA–EU MRA: Recognition covers routine surveillance inspections, subject to the confirmed capability of the individual inspectorate. The UK and Swiss arrangements are separate instruments and should be assessed under their own terms.

Excluded product categories: The FDA–EU agreement excludes advanced therapy medicinal products (ATMPs), human blood, human plasma, human tissues and organs, and veterinary immunological products.

Application-related inspections: Information from partner authorities does not automatically remove the need for an FDA inspection. It can inform the decision whether a PAI or RRA is needed, but it does not automatically remove the need for a PAI where FDA considers one necessary.

Third-country facilities. The updated ConOps confirms that FDA’s MRA arrangements can cover inspection reports for manufacturing establishments located both inside and outside the partner authority’s territory, subject to the applicable agreement and procedures.

The relevant primary reference is FDA’s EU mutual recognition agreement page (FDA–EU mutual recognition agreement), alongside its broader overview of GMP inspection MRAs (FDA overview of GMP inspection MRAs). Previous inspection by a European authority is relevant evidence, but it does not guarantee that FDA will cancel a planned visit. The decision depends on the inspection purpose, the product concerned and the scope of the applicable agreement.

Checklist before an FDA inspection

• Establish the basis: Is the inspection related to an application, routine surveillance, a specific signal or verification of corrective and preventive actions?
• Confirm the product and centre: Is CDER or CBER responsible? Does the site manufacture finished products subject to Parts 210/211 or APIs assessed against ICH Q7?
• Define the expected coverage: Which systems, processes and records fall within the applicable inspection programme?
• Identify the inspection team: Determine the relevant OII unit and, for application-related inspections, the expected involvement of centre specialists.
• Review inspection history: Compile previous Form FDA 483 observations, regulatory letters, commitments and evidence that CAPAs have been completed and assessed for effectiveness.
• Prepare records access: Check electronic systems, audit trails, document retrieval, English translations and supporting explanations.
• Assign site responsibilities: Identify who will answer questions, coordinate document requests, prepare any response to Form FDA 483 and manage the CAPA schedule.
• Plan the response and escalation process: Assign responsibility for deadlines, internal approval, executive sign-off and documenting disagreements with observations.

A response to Form FDA 483 should be managed as a distinct compliance project. FDA’s March 2026 draft guidance recommends a consolidated response addressing all observations, signed by an executive with authority to implement the commitments. It describes the expected elements as including a patient- and product-focused risk assessment, investigation reports and root-cause analysis, a CAPA plan and a planned effectiveness evaluation. These recommendations should be read in the context of the draft’s status.

The October 2026 ConOps adds another practical consideration: manufacturers should establish which FDA process applies to their site before assuming that every regulatory interaction will take the form of an on-site inspection. Depending on the purpose and risk assessment, FDA may use a PAI, post-approval inspection, surveillance inspection, for-cause inspection, RRA or qualifying MRA inspection information. Understanding who leads each process — and who makes the relevant classification or regulatory decision — is an important part of inspection readiness.

Next article in this series: EMA and national competent authorities: Who inspects your site — and who coordinates?