A Quality Unit That Averaged Away Its Own OOS Failures

On July 23, 2026, FDA's Center for Veterinary Medicine issued Warning Letter CMS Case 732115 to ABS Corporation, a drug manufacturer in Omaha, Nebraska. The letter follows a CGMP inspection from January 12–16, 2026, and it is not a list of procedural gaps. It is a record of a Quality Unit that, finding its own tests failing, decided the tests were wrong and changed the answer. Three separate findings make the same point, and together they describe a quality system that was not investigating failures so much as overriding them.

The first finding is the one that should stop any quality leader cold. During process validation for a tablet product, 17 in-process samples failed the USP assay specification. Instead of investigating, production personnel crossed out the original specification on the batch record, handwrote a higher limit, and released the batch, even though the results exceeded the revised limit too. That is not a documentation error. It is a decision to redefine the acceptance criterion after the data came in, so that a failing batch could pass. Under 21 CFR 211.192, an OOS result triggers an investigation, not a redrawn specification. When the specification itself becomes negotiable, the batch record stops being evidence and starts being a story the Quality Unit tells itself.

The second finding is the same decision logic applied to raw materials. ABS Corporation failed to run identity or limit testing, including DEG/EG testing, on high-risk incoming materials. Then it manufactured drug product using a raw material that was past its retest date. On June 11, 2024, a contract lab reported that the material had failed retesting. On that exact same day, ABS released two commercial drug lots, relying on a qualitative FT-IR scan comparison and ignoring the failing retest data. The release decision and the failing result landed on the same date. That is not a timing coincidence. It is a Quality Unit that had already decided the material was acceptable and treated the failing retest as an inconvenience rather than a signal.

The third finding removes any doubt about whether this was a one-off lapse. The firm maintained no written process validation protocols or final validation reports, asserting that "all equipment, steps, and acceptance criteria are listed within the batch record." FDA found substantial intra-batch variability, missing equipment parameters, and uninvestigated process exceedances across marketed lots. When there is no validation protocol, there is no defined acceptance criterion to defend, which is exactly why the specification could be rewritten by hand. The absence of validation is not a separate problem. It is the enabling condition for the first two.

What makes this letter worth reading closely is that none of these failures required a sophisticated data-integrity scheme. There is no deleted audit trail, no hidden trial injection, no falsified electronic record. The failures are visible in the batch records themselves: a crossed-out specification, a release decision dated the same day as a failing retest, a validation program that never existed. This is the harder failure mode to catch, because it does not hide. It sits in the file, and the Quality Unit signed off on it.

The pattern is a decision-logic failure, not a documentation failure. Every one of these findings is a moment where someone in the quality system chose the outcome they wanted over the outcome the data supported. OOS averaging to override a failing assay. A handwritten specification change to make a failing batch pass. A release decision that ignored a same-day failing retest. Each is a judgment call, and each went the wrong way because there was no mechanism forcing the investigation to run to its conclusion.

For a quality leader, the uncomfortable question is not whether your team would do this. It is whether your OOS investigation and batch-record change control would catch it if they did. A crossed-out specification is only a finding if someone reviews the batch record against the original. A same-day release against a failing retest is only a finding if someone checks the release date against the retest result. A missing validation protocol is only a finding if someone asks for it. If your quality system does not force those checks, then the difference between your team and ABS Corporation is not judgment. It is that nobody has looked yet.

The letter is a reminder that inspection risk is not about whether your documents exist. It is about whether your decisions would survive scrutiny. ABS Corporation had batch records. It had a Quality Unit. It had a release process. What it did not have was a mechanism that stopped a failing result from being redefined into a passing one. That is the gap that turns a quality system into a liability, and it is the gap an inspector is looking for.

See whether your OOS investigation and batch-record change control would survive the same scrutiny. Get your Inspection Risk Scan.