Most compounding pharmacies can describe what they test. They can name the assays, point to the USP chapters, tell you whether they use an in-house lab or a contract testing facility.

Far fewer can answer the next set of questions without hesitation:

That gap – between running analytical tests and owning a complete, defensible, on-demand record of every test you’ve ever run – is where FDA Form 483 observations are born. It’s where warning letters originate. And it’s the problem that trips up 503B outsourcing facilities that invested heavily in their analytical capability but not equally in their analytical documentation.

This guide maps the testing obligations for both 503A pharmacies and 503B outsourcing facilities, explains where they diverge and why, and gives you a practical framework for building a testing program that’s as defensible as it is functional.

Why analytical testing is the backbone of compounding compliance

Analytical testing in a compounding context isn’t primarily a quality control function, though it serves that purpose. It’s evidence. Every test result is a data point in the chain of proof that the product in that vial, that capsule, or that syringe is what it claims to be, at the concentration the label states, free from contamination, and stable enough to remain that way until the expiry date.

503B outsourcing facilities are pharmaceutical manufacturers in every meaningful regulatory sense, and in a pharmaceutical manufacturing context the chain of evidence is what the FDA is looking for when investigators arrive.

503A and 503B pharmacies face materially different testing requirements because they operate under materially different regulatory frameworks. Understanding where the obligations are similar, where they diverge, and where the common failure modes lie is the starting point for building a program that works.

Analytical testing requirements for 503A pharmacies

503A pharmacies operate under USP standards rather than full CGMP, and their testing obligations reflect that. The baseline is USP <795> for non-sterile preparations and USP <797> for sterile compounding – both of which were substantially revised in 2023, with the revisions taking full effect in 2024.

Beyond-use dating (BUD) is the area where testing most directly affects 503A operations. BUD is the date beyond which a compounded preparation may not be used – it’s the 503A equivalent of a manufacturer’s expiry date. Under the revised USP <795>, default BUD limits have tightened significantly. If you want to assign a BUD longer than the category defaults allow, you need stability testing data to support it – real data from your specific formulation, not published literature for a similar product.

Sterile preparations carry the most significant testing burden for 503A pharmacies. High-risk sterile preparations under USP <797> require sterility testing and, where relevant, bacterial endotoxin testing. The revised <797> has tightened the classification of sterile compounding categories and added more explicit requirements around testing triggers and documentation. For any 503A pharmacy doing significant sterile compounding, these revisions deserve careful review.

State board variability is a reality that many 503A pharmacies navigate with inadequate information. Some state boards require potency testing on specific drug categories – compounded hormone preparations, for example, are frequently subject to state-level testing requirements that go beyond USP minimums. Others defer entirely to USP. If you’re operating in multiple states or shipping to practitioners in multiple jurisdictions, you need to know each state’s specific requirements, not just the federal USP baseline.

The contract lab gap is the most common 503A compliance failure mode in testing. Many 503A pharmacies send samples to external labs for potency or sterility testing and receive a Certificate of Analysis in return. The COA is filed. The pharmacy has ‘done its testing.’ But has it? If there’s no formal procedure for reviewing the COA against your internal specification, no process for investigating a failing result, no requirement to see the raw data behind the result – what you have is the appearance of a testing program, not the substance of one.

Analytical testing requirements for 503B outsourcing facilities

For 503B outsourcing facilities, analytical testing is not an adjunct to compliance. It is compliance. The full CGMP framework under 21 CFR Parts 210 and 211 imposes comprehensive, non-discretionary testing requirements at every stage of manufacturing.

In-process controls under 21 CFR 211.110 require that representative samples be tested during manufacturing to ensure the finished product will conform to specifications. For a sterile compounded product, in-process testing typically includes appearance checks, pH measurement, osmolality, fill weight verification, and yield calculations at intermediate steps. These aren’t optional quality checkpoints; the results must be recorded in the batch production record at the time they’re performed.

Finished product release testing is the battery of tests that must pass before any 503B batch can be distributed. For sterile products, this is substantial:

• Identity testing: confirmation that the API is present and correctly identified, typically by HPLC or another validated chromatographic method
• Potency testing: confirmation that the labeled concentration is within acceptance criteria – usually ±10% or tighter depending on the drug and formulation
• Sterility testing per USP <71>: inoculation of specified media, incubation for 14 days, examination for microbial growth
• Bacterial endotoxin testing (BET) per USP <85>: Limulus Amebocyte Lysate (LAL) assay confirming endotoxin levels are below the limit calculated from the maximum valid dose
• Particulate matter testing per USP <788> and <789>: light obscuration counting for both visible and sub-visible particles
• Container-closure integrity testing for sterile products in sealed containers

Every test failure triggers a formal Out-of-Specification (OOS) investigation

Under 21 CFR 211.192, you cannot simply retest and report a passing result. The OOS investigation must proceed in two phases:

1. Laboratory investigation: analyst error? instrument malfunction? sample preparation problem?
2. If the lab investigation doesn’t identify the root cause, a full-scale investigation involving production review must follow.

The entire process must be documented, and the disposition of the batch – release, rejection, or retest under defined conditions – must be formally justified.

Stability programs are the evidentiary backbone for every expiry date you print on a product label. FDA expects 503B outsourcing facilities to align their stability programs with ICH Q1A guidance: real-time studies at the intended storage condition (typically 25°C/60% RH for room temperature products, 5°C for refrigerated), accelerated studies at 40°C/75% RH, with testing at defined time points (typically 0, 3, 6, 9, 12, 18, 24 months, and longer for multi-year expiry claims). Each time point requires the same analytical battery used for release testing, plus any formulation-specific degradation tests. The data is reviewed statistically to determine the shelf-life that can be justified.

Method validation is the infrastructure that gives your test results scientific credibility under 21 CFR 211.194. Every analytical method used for finished product release must be validated before it’s used to make a release decision. Validation demonstrates – with documented experimental data – that the method is specific (it measures what you intend to measure and nothing else), linear (the response is proportional to concentration across the relevant range), accurate (it returns the known value), precise (it gives reproducible results under the same conditions and across different analysts and instruments), and robust (it performs reliably under minor variations in conditions). A method transferred from a contract lab, from published literature, or from a pharmacopeial monograph must be verified or revalidated in your facility before it can be used for compliance-critical testing.

503A vs 503B: testing obligations side by side

Testing dimension	503A pharmacy	503B outsourcing facility
Finished product testing	Required for high-risk sterile; potency per state board or BUD extension needs	Full release battery required for every batch – identity, potency, sterility, BET, particulates
In-process controls	Not formally required; good practice for sterile compounding	Mandatory per 21 CFR 211.110; documented in batch production record
Stability program	Required only to support BUD beyond USP category defaults	Formal ICH Q1A-aligned program; expiry date data-derived for all products
Method validation	Not required; compendial methods used without formal validation	Required per 21 CFR 211.194 for all release and stability methods
OOS procedures	Best practice; not explicitly mandated by USP or most state boards	Mandatory per 21 CFR 211.192; two-phase investigation with full documentation
Contract lab use	Acceptable; COA review recommended; no formal vendor qualification required	Acceptable with formal vendor qualification file, quality agreement, and performance monitoring
Part 11 applicability	Not mandated; strongly recommended for sterile compounding records	Mandatory for all CGMP records – audit trails, electronic signatures, system validation required

In-house vs contract testing: making the right call

Whether to build in-house analytical capability, rely on contract testing laboratories, or operate a hybrid model is one of the more consequential decisions a 503B facility makes early in its operational history. The decision is usually framed as a cost question. It’s also a data integrity question that many facilities don’t fully reckon with until they’re in an FDA inspection.

Contract labs make sense for specialised methods requiring instrumentation or expertise that isn’t cost-justified in-house (LC-MS/MS for impurity profiling at trace levels, for example), for sterility testing by facilities that haven’t yet qualified their own sterility testing environment, and for stability testing overflow when in-house capacity is limited. For early-stage 503B operations building their quality infrastructure in phases, contract labs provide capability before in-house capability is established.

The data integrity risk is the part that doesn’t show up in the cost model. When you send samples to a contract lab, the raw analytical data – the original HPLC chromatogram, the LAL plate reader output, the particle counter files – lives on the contract lab’s servers, in the contract lab’s LIMS. If an FDA investigator asks to see the original instrument output for a specific lot of a specific product from eighteen months ago, you are dependent on the contract lab’s data retention practices and their willingness to produce records during your inspection. Your quality agreement with that lab needs to explicitly address data retention, access rights, and production of original records to FDA investigators.

Vendor qualification for contract labs used in release or stability testing is a CGMP requirement under 21 CFR Part 211. This means an audit of the lab’s quality system (either on-site or via questionnaire for lower-risk labs), a method transfer and validation study, a quality agreement covering responsibilities and escalation procedures, and ongoing performance monitoring through trending of results and periodic re-audits. The vendor qualification file must be available for FDA review.

Data integrity: the test behind the test

FDA data integrity guidance – reinforced by a steady stream of warning letters and import alerts targeting pharmaceutical manufacturers globally – establishes ALCOA+ as the framework for evaluating whether laboratory records are trustworthy. ALCOA stands for Attributable, Legible, Contemporaneous, Original, and Accurate. The ‘+’ adds Complete, Consistent, Enduring, and Available.

Applied to compounding laboratory records:

• Attributable: Every data entry must be traceable to the specific person who made it. Shared login credentials violate this requirement. A result entered without a unique user ID is unattributable.
• Contemporaneous: Data must be recorded at the time of the observation or action – not reconstructed afterward. If a weight is taken at 10:15 and recorded in the batch record at 15:00 from a sticky note, the record is not contemporaneous, and any competent investigator will identify it.
• Original: The primary record is the original data – the first capture, in whatever medium. If that’s a paper form, the paper is the original. If that’s an electronic instrument file, the file is the original. A transcribed copy is not the original, even if it’s accurate.
• Accurate and complete: Results must be reported accurately and completely – including results that failed. Selective reporting of results, or ‘testing into compliance’ by running an assay until you get a passing result without documenting and investigating the failures, is a data integrity violation of the most serious kind.

The most consistent data integrity failures in compounding facility inspections involve spreadsheets. Not because spreadsheets are inherently fraudulent – most people using them are trying to do their jobs competently. But because spreadsheets have no audit trail, no access controls, no signature binding, and no version control that can survive scrutiny. Formulas can be changed without record. Cells can be overwritten. Files can be emailed, copied, and modified without any trace. For a CGMP-regulated 503B outsourcing facility, a spreadsheet-based quality system is a structural data integrity problem, regardless of how carefully it’s managed.

Building an audit-ready analytical testing program

An audit-ready testing program isn’t a program that performs well under normal conditions. It’s one that can withstand adversarial scrutiny – an FDA investigator who has been trained to find gaps, asks for records that are two years old, requests original instrument output for a specific batch, and asks your analyst to demonstrate their method on the spot.

Building toward that standard involves several practical commitments:

• Instrument qualification and calibration management that is tracked systematically and linked to your testing operations. Every analytical instrument should have a calibration due date. That due date should be visible in your quality system. A batch that was tested using an instrument whose calibration had lapsed when the test was performed is a problem – both for the validity of the result and for your inspection readiness.
• SOPs for OOS investigations that define the process, the responsibilities, the timeframe, and the documentation requirements. The SOP should specify how a laboratory investigation is conducted, what triggers escalation to a full-scale investigation, who makes the disposition decision, and how the investigation is formally closed. The SOP is not enough by itself – it must be demonstrably followed, every time.
• Integrated electronic records that capture test results, reviewer signatures, instrument IDs, and batch information in a single system. The goal is that for any batch in your history, you can produce in minutes – not days – the complete analytical record: who tested it, when, on what instrument, with what result, reviewed by whom, and any OOS investigations that were triggered.
• System validation documentation for every software system used in compliance-critical testing. This includes your LIMS, your instrument data systems, and any spreadsheet-based calculation tools that haven’t yet been replaced. Validation packages – IQ, OQ, PQ, user requirements specification, functional requirements specification – must be maintained and updated when systems change.

SciCord’s informatics platform brings LIMS, ELN, and Electronic Batch Record functionality together in a single validated system built for pharmaceutical compliance. Instrument results flow directly into batch records with automatic timestamping. Electronic signatures meet 21 CFR Part 11 requirements. OOS results trigger structured investigation workflows. Calibration schedules are tracked and enforced. Stability data is managed in the same system as release data. The entire analytical record for any batch is retrievable on demand.

For a 503B outsourcing facility navigating the documentation requirements of CGMP analytical testing – or a 503A pharmacy building toward future 503B registration – the platform delivers the infrastructure to make audit readiness an operational reality, not an aspiration.

Ready to see what an audit-ready 503B quality system looks like in practice? Book a 30-minute demo with the SciCord team – we’ll walk through how SciCord manages your analytical testing records end to end.