Inadequate Supplier Oversight and missing Tests: Lessons from an FDA Warning Letter

The U.S. Food and Drug Administration (FDA) issued a Warning Letter to Zhejiang Gaorong Cosmetic Co., Ltd., a China-based manufacturer of over-the-counter (OTC) drug products. The letter also notes that some products the firm manufactures "may be regulated as cosmetics" under the FD&C Act and that MoCRA imposes new requirements on cosmetic manufacturers.
The Warning Letter is based on a review of the firm's records, not an on-site inspection. Although the letter does not report that any of the company's product was contaminated, it states that "the use of ingredients contaminated with (b)(4) has resulted in various lethal poisoning incidents in humans worldwide."
Its central message is one the pharmaceutical industry has heard for decades: an ingredient that is not properly tested can kill.

What the Letter cites

The letter lists two violations of Current Good Manufacturing Practice (CGMP) for finished pharmaceuticals:

• Component testing (21 CFR 211.84(d)(1) and (d)(2)). The FDA found that the firm did not test each incoming lot adequately for identity and impurities. It also relied on the supplier's certificate of analysis (CoA) for an active pharmaceutical ingredient without establishing the reliability of the supplier's test results.
• Quality unit (21 CFR 211.22(a)). The FDA found that the quality unit did not exercise its responsibilities effectively, including in batch record completeness and stability data.

FDA states that, without this testing, the firm "lack[s] scientific evidence that the components or drug products conform to the appropriate specifications." The letter also places all drugs and drug products from the firm on Import Alert 66-40, effective July 31, 2026.

What the Letter does not say

• The contaminant is not named. The letter does not name the ingredient, the contaminant, the supplier, or the affected products.
• No product or lot is identified as contaminated. The findings concern missing testing and inadequate supplier oversight.
• No death is linked to a Zhejiang Gaorong product in any source reviewed. The letter refers to incidents "worldwide" from contaminated ingredients in general.

Lessons for Quality and Compliance Teams

In practice, the following questions are worth asking of any site that uses ingredients from suppliers:

• Supplier and supply-chain qualification: Is the supplier adequately qualified to rely on a CoA? Is the supply chain mapped beyond the first-tier supplier, so the firm knows where its materials originate?
• Identity and impurity testing: Does each incoming lot of an API and high-risk excipients receive an identity test and a test for relevant impurities, or is the supplier's CoA accepted by default?
• Supplier CoA reliability: Has the firm validated the supplier's test methods and revalidated them at appropriate intervals? A CoA is only as reliable as the testing behind it.
• Retain samples: Are retain samples kept for high-risk component lots? The letter asks the firm to provide test results from retains of high-risk component lots, or to test implicated finished batches where no retain is available.
• Risk assessment and recall readiness: Can the firm identify, within a short time, all products that used a suspect lot and decide whether to notify customers or recall?

This Warning Letter is a reminder that an ingredient is not safe merely because it is labelled as pharmaceutical-grade. For quality units, the lesson is to qualify suppliers, test what matters, validate the tests that supplier data rely on, and be able to trace every lot.