The pace of FDA drug warning letters that began escalating in FY2025 has carried into 2026, and the analytical procedure citations inside them repeat with unusual consistency. Read Ava Inc., Intas Pharmaceuticals, Huons Co., Tower Laboratories and Sanofi’s Waterford site back to back and the same failure modes appear: incomplete laboratory records, audit trails that do not match usage logs, out-of-specification investigations closed without root cause, and analytical methods that were never fit for their intended purpose. The specific 21 CFR citation changes; the underlying laboratory behaviour does not.

FDA issued 303 drug and biologics warning letters in FY2025, a step change from 190 the year before, and the first half of FY2026 has continued at that elevated tempo. What follows is not a full enforcement census but a read of what the analytical procedure citations in this year’s letters have in common, and where a QC laboratory preparing for its next inspection should be looking.

The audit-trail-versus-usage-log gap

The Ava Inc. warning letter of 14 April 2026 lays out one of the cleanest examples. FDA cited 21 CFR 211.194(a) after finding that the audit trail on an FTIR spectrometer showed no activity between 23 and 30 September 2025, while the same instrument’s daily usage log recorded drug testing during that same window. Investigators separately found chromatograms sitting at an HPLC location the site described as reserved for trial injections, even though the HPLC procedure had removed the trial-injection step in 2022.

The two findings are the same finding in different equipment. Somewhere between the analytical instrument, the paper log, and the electronic audit trail, the record of what actually happened diverges from the record of what is supposed to have happened. That divergence is the specific thing 211.194(a) requires laboratories to prevent - complete data from all tests, contemporaneously recorded - and it is the specific thing that keeps showing up in 2026 letters.

Huons Co., Ltd., cited on 15 June 2026 under the same 21 CFR 211.194(a) provision, was written up for laboratory records that lacked complete and original data to support the analyses performed. The finding is close enough to Ava’s to read as a template.

Analytical methods that never validated what they measured

The Intas Pharmaceuticals letter of 30 March 2026 raises a different but related pattern. FDA criticised the firm for low assay values that Intas had attributed to a limitation in the analytical method itself, specifically incomplete extraction of the active pharmaceutical ingredient. Investigators found that this extraction limitation had not been identified during original method validation, and that the OOS investigation did not evaluate whether the method itself was contributing to the observed result variability. The method was tacitly recognised as unfit for its purpose only after it produced results the firm did not want.

This is the citation pattern that most directly connects to the ICH Q14 implementation tracker and the analytical procedure development framework it now formalises. Q14 asks manufacturers to define the performance requirements of an analytical procedure up front, then demonstrate that the procedure meets them - the opposite of retrofitting a validation story onto a method whose weakness only surfaces in a failure investigation.

Tower Laboratories Ltd., cited in a warning letter dated 23 December 2025, drew the same criticism from a different angle: HPLC sample preparation that had not been adequately validated, and OOS investigations that used unsubstantiated packaging-defect explanations to close failed stability timepoints without evaluating the analytical procedure. FDA’s directive to Tower - a comprehensive independent retrospective review of all invalidated OOS results for products currently on the U.S. market, plus a full reassessment and revalidation of analytical methods - is the shape of what FDA is now asking for whenever it finds a laboratory pattern rather than an isolated event.

OOS handling as the diagnostic tell

Across every 2026 letter listed above, out-of-specification investigations are the artefact that inspectors read most closely. Phase I closures without Phase II escalation, retesting into compliance without documented root cause, and cancelled deviations closed with what the Sanofi Waterford letter of 22 June 2026 described as justifications that “lacked adequate scientific validation” - those are the specific behaviours FDA has been targeting.

Sanofi’s Waterford site is a useful case because it involves a large, well-resourced biologics manufacturer producing Thymoglobulin and Altuviiio. The letter records that of 74 cancelled deviations reviewed retrospectively, 36 required investigation and the firm’s rationales for skipping the other 38 did not stand up. The specific problem is not that a laboratory produced an OOS result. It is that the laboratory’s own procedure for deciding which OOS results are real was compromised.

This is the same pattern that surfaced in the FDA Quality Metrics program refresh earlier this year - the agency is asking for evidence that a laboratory can reconstruct why it made the decisions it made about analytical data, not just that the decisions were made.

Access control, review checklists, and the shared-login problem

A quieter thread runs through the 2026 letters: the mechanics of who can do what inside the analytical software. Person & Covey’s September 2025 letter flagged uncontrolled software access with shared logins and a single “System Administrator” role that everyone used. Sanofi Waterford was cited for QC personnel using uncontrolled review checklists that were subsequently discarded, preventing independent reconstruction of the laboratory reviews. Ava had a documented HPLC procedure that no longer matched the workflow analysts were actually running.

None of these are new findings in the abstract - FDA has been writing about audit trail integrity for a decade. What is different in 2026 is how often the finding is now paired with a specific analytical procedure and a specific instrument, rather than left as a general data-integrity paragraph. The letters read as though inspectors are correlating the chromatography software’s electronic record against the paper worksheet against the SOP against the change control history, and citing the mismatches.

What the pattern suggests for laboratories now

Three practical readings sit on top of this year’s letters, and they line up with what the current FDA-EMA-PMDA chemometric model lifecycle comparison already flags:

First, a laboratory that cannot reconstruct why an OOS result was invalidated should assume that gap is the primary inspection risk. The corrective action pattern FDA is asking for - independent retrospective review of invalidated OOS - is now the default remediation.

Second, an analytical method whose validation package does not address the specific failure modes that appear in routine use is exposed. The Intas extraction-limitation finding is the template for how that exposure is discovered.

Third, the audit-trail-versus-usage-log alignment is the fastest inspection test a QC unit can run on itself. The Ava finding required no laboratory equipment beyond opening the FTIR software and comparing dates against the daily log. Any laboratory can perform that comparison in an afternoon; very few appear to have done so.

The letters do not describe a new regulatory expectation. They describe the same expectation, cited with more granular evidence, more frequently.