FDA Warning Letter Due to Inadequate Controls over Data Deletion and Data Changes

On April 10, 2026, the FDA issued a Warning Letter to a French company for CGMP violations. The Warning Letter is based on an FDA inspection in September 2025. In the FDA's view, the company's responses dated October 7, 2025 to the observations listed on Form 483 were insufficient. FDA Warning Letters always refer to the GMP requirements set out in 21 CFR Part 211. In the case of the French company Fareva Amboise, multiple violations were identified across various areas. The discussion below focuses on data integrity observations: 
Your firm failed to exercise appropriate controls over computer or related systems to assure that only authorized personnel institute changes in master production and control records, or other records (21 CFR 211.68(a))

Observations

• The investigator observed that employees were able to change system dates, alarm limits, and access settings without restriction.
• User authentication for the network was not required.
• Management confirmed that no controls were in place to ensure the integrity of printed data records.
• The review repeatedly showed action-limit exceedances in the Grade A area. Original printouts of these events could not be provided, nor were any records found in the batch record. Instead, retests were performed, and only confirming retest results were retained in the manufacturing documentation. Required corrective actions were also not documented.
• Backup and retention procedures were inadequate. In this case, a vendor deleted all existing electronic data during calibration. There was no backup of the deleted data

Response of the company

The company fully acknowledged the deficiencies, opened a deviation, and planned staff training on proper data retention. In addition, new equipment with electronic data capture and server connectivity was procured. The company announced a site-wide review of other IPC equipment and an investment plan to replace paper-based systems.

The company's responses to this observation were insufficient. Why?

• There was no assessment of the immediate and ongoing risks to data integrity during the implementation phase.
• No enhanced quality oversight was initiated for ongoing production.
• There was no commitment to assess the impact of the identified deficiencies on batches that had already been released.

What does the FDA expect in the response to this Warning Letter?

The FDA expects a comprehensive investigation of computer system performance and security. It requires a vulnerability assessment and a CAPA plan for each laboratory / production system, including

• A list of all hardware and software in use.
• Identification and assessment of vulnerabilities related to the performance and security of these computer systems, including their configurations, administrator privileges, password controls, audit trails and their implementation status for each system; the qualification/validation status; deviation history; backup capabilities; network requirements; data completeness; the suitability of the current hardware/software for the intended use(s); change management; and management oversight.
• An assessment of each system to determine whether unique user names and passwords are used.
• An assessment of policies and procedures related to computers and data governance, with particular focus on audit trails, prohibiting  data deletion, and appropriate changes to results. The company should state how it will prevent data deletion and undocumented/inappropriate changes to data. It should also describe how it will ensure that original data and information are always retained and how audit trails are reviewed. Last but not least, requirements for data retention and data backup for all laboratory and production systems should be provided.

Source: Warning Letter an Fareva Amboise vom 10. April 2026