The facility passed its first FDA inspection cleanly. No observations. The QA director called it a good day and bought the team lunch.

Two years later, investigators returned. This time, they left behind a Form 483 with four observations. Not one of them was about a contaminated batch. Not one cited a manufacturing error or a patient harm. Every single observation was about records – batch records reconstructed from spreadsheets after the fact, an instrument calibration log that couldn’t be located during the inspection, a deviation that had been noted but never formally investigated, electronic signatures that didn’t satisfy 21 CFR Part 11 requirements.

The drug was fine. The paperwork wasn’t.

That gap – between making a safe product and being able to prove you made it safely – is the operational challenge that catches 503B outsourcing facilities off guard more than any other. The technical work of compounding sterile drug products is demanding, but it’s learnable. The documentation and quality infrastructure required by CGMP is a different category of problem entirely, and most facilities underestimate it until they’re living it.

This post maps the terrain honestly, section by section.

The CGMP paper mountain: what 21 CFR Parts 210 and 211 actually require

The phrase ‘CGMP compliance’ often gets treated as a single thing to achieve. In practice, it’s a continuous, accumulating body of documentation that grows with every batch you manufacture, every deviation you investigate, and every product you add to your portfolio.

Master formula records are the authoritative reference documents for every formulation – the approved template specifying ingredients, quantities, equipment, processing steps, in-process checks, and acceptance criteria. You create one per formulation; it lives in your controlled document system and never changes without a formal change control procedure.

Batch production records are the executed record for each individual lot: the master formula, completed step by step, with dates, times, initials, instrument readings, weights, and in-process results filled in contemporaneously – meaning at the time the action was performed, not reconstructed afterward. FDA investigators are specifically trained to identify after-the-fact entries. Ink pressure patterns, uniform handwriting across a multi-hour process, and metadata timestamps that don’t match claimed entry times are all red flags.

Deviation records document every departure from an approved procedure – whether it’s a temperature excursion, a fill volume outside specification, or a cleaning step performed out of sequence. Each deviation must be investigated to determine root cause, assessed for product impact, and closed with a documented disposition decision. ‘No action taken’ is not an acceptable closure unless you can show why the deviation had no quality impact.

CAPA records – Corrective and Preventive Actions – go further. When a deviation reveals a systemic problem, CAPA is the mechanism for addressing the root cause and preventing recurrence. A healthy CAPA system is one of the things FDA investigators look for as evidence of a functional quality culture, not just quality paperwork.

Annual product reviews require you to look back across the year’s batch data for each product: yield trends, deviation rates, OOS results, complaint history, stability data, supplier changes. The goal is to identify trends before they become problems. In practice, pulling this data manually from spreadsheets and paper records at year-end is a significant project – which is why facilities that rely on disconnected systems often produce incomplete or late annual reviews.

Analytical testing obligations: in-process, release, and stability

For a 503A pharmacy, testing is largely discretionary – you test when USP or your state board requires it, or when you’re extending a beyond-use date. For a 503B outsourcing facility, testing is mandatory, comprehensive, and methodically documented.

In-process controls are documented checks performed during manufacturing: yield at intermediate steps, appearance, pH, osmolality, fill volume. These aren’t optional QC checkpoints – they’re required by 21 CFR 211.110, and the results must be recorded in the batch production record at the time they’re performed.

Finished product release testing determines whether a completed batch is suitable for distribution. For a sterile compounded product, the release battery typically includes identity and potency testing (confirming the drug is what it says it is at the labeled concentration), sterility testing per USP <71>, bacterial endotoxin testing (BET) per USP <85>, and particulate matter testing per USP <788>. Every test must pass before the batch can be released. A single failure triggers an OOS investigation.

Out-of-specification investigations are governed by 21 CFR 211.192. When a test result falls outside acceptance criteria, you cannot simply retest and report the passing result. You must conduct a formal investigation: laboratory investigation first (instrument error? analyst error? sample preparation issue?), followed by a full-scale investigation if the root cause isn’t found in the lab. The entire investigation – every step, every finding, every decision – must be documented. The disposition of the batch must be justified.

Stability programs are required to justify every expiry date on every product. Under ICH Q1A guidance (which FDA expects 503B facilities to align with), you run real-time stability studies under label storage conditions and accelerated studies at elevated temperature and humidity. The data from those studies – sampled at defined intervals, tested by validated methods – is what tells you when the product degrades beyond acceptable limits. Expiry dates are not estimates or conventions. They’re data-derived claims that FDA investigators will ask to see the evidence for.

Method validation is the framework that gives your test results credibility. Under 21 CFR 211.194, every analytical method used for finished product release must be validated for specificity, linearity, accuracy, precision, and limits of detection and quantitation. You can’t use a literature method or a contract lab’s method without a formal transfer and validation study demonstrating the method performs correctly in your hands, with your instruments, on your product matrix.

Sterile manufacturing: USP 797 adds a second compliance layer

If your 503B facility compounds sterile products – and the majority do – USP <797> imposes requirements that run alongside your CGMP obligations, not instead of them. The practical result is two overlapping documentation systems, each with its own SOPs, training records, and data streams.

Environmental monitoring (EM) is the systematic program of viable and non-viable air sampling, surface sampling, and personnel monitoring that demonstrates your ISO-classified cleanrooms are maintaining the contamination control levels required for aseptic processing. Viable air sampling uses settle plates and active air samplers; non-viable monitoring tracks particle counts. Surface sampling covers critical surfaces, equipment, and personnel gloves after gowning. Results must be trended over time – a single excursion triggers an investigation; a trend of elevated counts triggers a formal investigation and potentially a temporary shutdown of the affected area.

Cleaning validation is the documented evidence that your cleaning and disinfection procedures reduce surface bioburden and endotoxin contamination to levels that won’t compromise product sterility. You can’t simply assert that your cleaning procedure works. You need coupon studies, swab recovery validation, and a documented cleaning validation protocol with pre-determined acceptance criteria.

Media fills – also called process simulations or sterility tests of the process – are periodic aseptic processing simulations using microbial growth media in place of drug product. They are the most direct demonstration that your aseptic technique and cleanroom environment are capable of producing sterile product reproducibly. Failures are highly significant and require extensive investigation before processing can resume.

The overlap with CGMP creates a documentation challenge: your USP <797> EM data, cleaning records, and media fill results need to be integrated into your batch record system and accessible during FDA inspections, not maintained in a separate binder that no one can find when it matters.

Supply chain complexity: APIs, excipients, and COA management

A 503B facility with 50 active formulations is managing relationships with dozens of raw material suppliers, receiving hundreds of incoming lots per month, and maintaining qualification records for every single one of them. This is not a problem that scales gracefully with manual processes.

Approved vendor lists (AVLs) must be maintained for every raw material supplier: API manufacturers, excipient suppliers, container manufacturers, and packaging material suppliers. Qualification records must show that each approved vendor meets CGMP requirements – which means supplier audits, quality agreements, and ongoing performance monitoring.

Certificate of Analysis (COA) review is the incoming material control process: for each new lot received, the COA from the supplier must be reviewed against your internal material specification before the lot is released for production use. Some materials also require identity testing on receipt before they can be used in production. Until formally released, materials sit in quarantine.

The volume problem is real. At scale, the incoming material review process is a significant operational burden. Labs that manage it manually – checking COAs against paper specifications, logging receipt in a spreadsheet, storing COA images in a shared drive – consistently experience backlogs, missed identity tests, and documentation gaps that surface at the worst possible time. An FDA investigator asking for the COA and incoming test data for a specific lot of active pharmaceutical ingredient used in a batch eighteen months ago should be a routine retrieval exercise, not a multi-day search project.

21 CFR Part 11: electronic records in practice

21 CFR Part 11 establishes the criteria under which the FDA accepts electronic records and electronic signatures as equivalent to paper records and handwritten signatures. For 503B facilities, this isn’t a future consideration – it’s a current requirement for any system that creates, modifies, maintains, archives, retrieves, or transmits records required under CGMP.

Audit trails are the core requirement: every electronic record must carry an unalterable record of who created it, when, and what changes were subsequently made and by whom. This applies to batch records, test results, deviation logs, stability data – all of it. An audit trail that can be disabled, edited, or selectively deleted is not a compliant audit trail.

Electronic signatures must meet specific technical requirements: unique user identification, a password or biometric component, and a binding that links the signature to the record in a way that cannot be broken or falsified. A typed name at the bottom of a Word document is not an electronic signature under Part 11. A scanned handwritten signature is not an electronic signature under Part 11.

System validation is the documented proof that your software does what it claims to do, reliably and consistently, in your environment. This means an Installation Qualification (IQ) confirming the system was installed correctly, an Operational Qualification (OQ) confirming it functions as specified, and a Performance Qualification (PQ) confirming it performs correctly under your actual conditions of use. The validation package – including test scripts, test results, and validation summary report – must be maintained and updated when the system changes.

From operational friction to audit readiness: what changes

The facilities that navigate FDA inspections well – the ones that produce records on demand, answer investigator questions with specificity, and leave inspections with no observations – share a common operational characteristic. Their quality data isn’t scattered across a LIMS for sample tracking, a spreadsheet for batch calculations, paper logs for instrument calibration, and a shared drive for deviation records. It lives in a single integrated system that was designed to meet the documentation requirements of regulated manufacturing from the ground up.

What that looks like operationally:

• Batch records are electronic, structured, and configured to enforce contemporaneous data entry – you can’t complete a step without recording the result at the time it’s performed.
• Instrument results flow directly from the analytical instrument into the electronic batch record, with timestamps and instrument ID captured automatically. No transcription. No opportunity for transcription error.
• An out-of-specification result triggers an automatic deviation record. The deviation is linked to the batch, the test, and the analyst. The investigation workflow is enforced by the system, not by someone remembering to open a paper form.
• Calibration schedules are tracked in the same system as the batch records. An instrument whose calibration has lapsed cannot be used to generate release data without a documented override.
• Annual product review data can be pulled in minutes, not weeks, because the batch data, test results, deviation records, and stability data all live in the same database.

SciCord’s informatics platform – a hybrid LIMS and ELN built for the pharmaceutical industry – is designed to deliver exactly this. Electronic batch records, instrument integration, compliant electronic signatures with full Part 11 audit trails, deviation and CAPA workflows, and stability program management, all in a single cloud-based system that can be implemented in weeks. Customers who’ve been through FDA inspections with SciCord in place report no system-related findings.

Ready to see what an audit-ready 503B quality system looks like in practice? Book a 30-minute demo with the SciCord team – we’ll walk through batch records, OOS workflows, and Part 11 compliance in your specific compounding context.