The Certificate of Analysis Is Not a Test

FDA's March 2026 warning letter to Yangzhou H&R Plastic Daily Chemical Co., Ltd. opens with a violation statement that should register for every quality director who has ever signed a batch release record: the Chinese OTC manufacturer was distributing finished products without completing identity tests on its active ingredients. The firm relied on supplier certificates instead. It believed those certificates were sufficient evidence of conformance.

They were not.

Warning Letter 320-26-79 is not notable because the violations were unusual. It is notable because they were not. Three failures appeared together in this letter, and each one maps onto a deficiency cluster FDA has cited in small and mid-size OTC manufacturer inspections for years. When all three appear in the same facility, they are not independent failures. They are symptoms of a quality function that was never resourced or structured to operate independently.

The Identity Testing Requirement Has No Exceptions

21 CFR 211.84(d)(2) requires that each lot of components be tested by the manufacturer to determine conformance to specifications before use. A supplier Certificate of Analysis does not satisfy this requirement. It never has.

The logic is straightforward. A CoA is the supplier's documentation of what the supplier measured, on the supplier's equipment, at the supplier's facility, on a specific date before shipment. It documents the supplier's process. It does not document the condition of the material when it arrives at the receiving facility. It cannot detect contamination, degradation, or substitution that occurred during transit or storage. It does not constitute independent verification of identity.

FDA's position on this has been stated clearly in guidance and in enforcement letters across multiple inspection cycles. The CoA-as-release defense fails because the regulatory standard for identity testing specifies that the manufacturer performs the test. That language has not changed. The expectation has not shifted. The citations keep accumulating because some proportion of smaller manufacturers continue to treat the supplier's document as equivalent to their own testing, often because performing identity tests on every incoming lot requires laboratory resources they have not allocated.

That resource gap is not a compliance exemption. It is an operational problem the manufacturer is required to solve before placing regulated products in commercial distribution. FDA's response to firms that cite testing capacity constraints is consistent: the constraint does not modify the obligation.

The Yangzhou letter made this explicit. The firm acknowledged it did not have the capacity to test every incoming batch of active ingredients. FDA did not offer a phased timeline or an interim control path. It issued a warning letter. The remediation expectation is identity testing on each lot.

When the Quality Unit Director Also Buys the Ingredients

The second finding in the Yangzhou letter explains the structural condition that made the first one possible.

21 CFR 211.22 requires that the quality unit have the authority and responsibility to approve or reject drug products and components. The key word in that regulation is authority. Authority is not a job title. It is a structural condition that requires the quality function to be organized in a way that insulates quality decisions from commercial and operational pressures.

FDA found at Yangzhou that the Quality Unit Director also held responsibility for purchasing. The analyst conducting incoming material testing also managed warehouse operations.

This is a design problem, not a personnel problem.

A Quality Unit Director who controls purchasing cannot make independent decisions about incoming materials. The same person who approved the supply contract, authorized the purchase order, and committed the organization to a delivery schedule is also the person who decides whether the batch arriving from that supplier meets specifications. When a shipment falls short and the purchase order is already paid, when the production schedule depends on the material being released, the quality decision and the commercial decision are being made by a single person with visibility into both sides of the conflict.

ICH Q7, Section 2.20, requires that the quality unit be independent of production. FDA's 21 CFR 211.22 framework exists precisely to create the structural separation that makes independent oversight possible. When the org chart violates that separation, the reviews that flow from that structure are not independent reviews. They are approvals made by someone who has every organizational reason to approve.

The Yangzhou pattern is not new in the enforcement record. Small manufacturers routinely consolidate roles to manage headcount. Quality directors take on purchasing or operations responsibilities. Analysts perform warehouse functions alongside testing duties. Each accommodation looks reasonable in isolation. Collectively, they eliminate the structural independence the regulation requires.

No Process Validation Before Commercial Distribution

The third finding in the Yangzhou letter documents an absence: the firm had no process performance qualification studies for any of its OTC drug products before placing them in commercial distribution.

21 CFR 211.100 requires that production and process control procedures be designed and followed to ensure that drug products have the identity, strength, quality, and purity they are represented to possess. Process Performance Qualification is the documented evidence that the manufacturing process, as designed and executed, consistently produces a product meeting those specifications across commercial-scale runs.

Without PPQ, Yangzhou had no validated baseline for what normal production looked like. No documented basis for distinguishing acceptable variation from a process that had drifted out of control. No systematic evidence that one batch produced under the same procedures as the previous batch would yield equivalent results.

This failure intersects with the identity testing failure in a specific way. A firm that has not confirmed the identity of its incoming active ingredients and has not validated the process that converts those ingredients into finished product is distributing products for which it has neither input verification nor process assurance. The entire quality chain from raw material to release is operating on assumption.

What Keeps Appearing in the Enforcement Record

The three violations at Yangzhou are not random. They are the typical co-occurring cluster FDA finds at manufacturers where quality investment has not kept pace with production growth.

An underfunded quality function cuts corners on incoming testing because laboratory capacity is limited. A QU Director takes on purchasing responsibility because headcount is constrained. Validation programs are deferred because the resources needed to run PPQ studies are being consumed elsewhere. Each decision is understandable at the time it is made. Together, they produce the inspection profile FDA found at Yangzhou.

The remediation FDA expects does not accommodate the underlying resource constraints. It requires full compliance: identity testing on each incoming lot, a quality unit with no conflicted reporting structure, and documented process validation before commercial distribution. The expectation is the same whether the manufacturer has forty employees or four thousand.

The practical question a quality director at a smaller operation should take from the Yangzhou letter is not whether they are testing incoming materials, though that question is worth asking. The more diagnostic question is whether the person signing off on incoming material releases has any organizational reason to approve them regardless of the data.

If the QU Director also controls the budget that pays the suppliers, the org chart is already a finding.