After an FDA Warning Letter

Life Sciences & Healthcare Blog · Legal cluster

A US Food and Drug Administration (FDA) Warning Letter lands, and two documents begin to take shape inside the same company: the customer-facing notice that commercial teams want to send to hospitals and distributors, and the corrective and preventive action (CAPA) file that quality is drafting for the FDA. If those documents disagree on facts, root cause, or scope, the company does not simply look inconsistent — it hands the agency its next investigation theme. This article explains how a China-based manufacturer keeps the two narratives on one factual spine, and how the discipline of aligned communication protects both customer relationships and regulatory standing.

Why this matters: the Warning Letter is a public, permanent record#

FDA Warning Letters are published on the agency website, and for export-oriented manufacturers they travel fast: distributors copy them into tender responses, buyers paste them into supplier questionnaires, and competitors use them in commercial pitches. For a Chinese manufacturer of medical devices, the Warning Letter is simultaneously a regulatory finding, a commercial event, and — increasingly — a document that other regulators read. China's National Medical Products Administration (NMPA) conducts its own inspections, and cross-border quality events that originate in an FDA citation can surface in domestic recall and supervision conversations. The company that treats the Warning Letter as a quality-department problem is missing the point; it is an enterprise-wide communication problem with a regulatory core.

Governing legal and regulatory framework#

US FDA Quality System Regulation (21 CFR Part 820)#

The CAPA requirements that most Warning Letters cite live in the FDA Quality System Regulation. Section 820.100 obliges manufacturers to establish procedures for corrective and preventive action, including investigating the cause of nonconformities, identifying the action needed to correct and prevent recurrence, and documenting the implementation and verification of those actions. The CAPA is not a narrative of good intentions; it is a documented, verifiable set of commitments that the agency expects to see implemented, with evidence, on a follow-up inspection.

21 CFR 820.100(a): Each manufacturer shall establish and maintain procedures for implementing corrective and preventive action. The procedures shall include requirements for: (1) analyzing processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product, quality, or other problems; ... (4) verifying or validating the corrective and preventive action to ensure that such action is effective and does not adversely affect the finished device.

PRC Regulations on Supervision and Administration of Medical Devices (2021 revision)#

For the China side of the operation, the Regulations on the Supervision and Administration of Medical Devices impose parallel obligations on manufacturers and importers, including record-keeping, adverse-event reporting, and cooperation with supervision and inspection. A Warning Letter event is therefore not a foreign regulatory anomaly; it is a trigger that runs into domestic device-supervision duties. Articles 35 and 52 of the regulations address production quality management and the responsibility of manufacturers to keep their quality systems effective — the same themes the FDA examines under 21 CFR Part 820.

Key legal analysis and enforcement precedents#

The FDA's Quality System Inspection Technique (QSIT) has been used consistently to structure Warning Letter findings, and Chinese exporters have been frequent recipients. QSIT-based Warning Letters typically combine a lead finding — most often CAPA failure or failure to establish adequate procedures — with supporting observations drawn from complaint handling, process validation, and supplier controls. The recurring lesson from the published letters is that the FDA does not enforce against the defect in isolation; it enforces against the system that allowed the defect to escape, which is why CAPA language matters more than the language of any single product fix.

Enforcement practice treats a company's own documents as the primary evidence. If the customer notice says "minor documentation issue" while the CAPA admits a systemic data-integrity failure, the discrepancy is itself a finding in the making. Investigators collect both documents in the same file: the response to the agency, the customer FAQ, the internal board pack, and the minutes of the CAPA review meeting. Consistency is not a public-relations luxury; it is a regulatory requirement in practice, because every one of those documents is a quality record once it is created.

For China-connected operations, the cross-border dimension adds a second layer. A manufacturer that reports corrective actions to the FDA while simultaneously running domestic corrective actions under NMPA supervision must ensure the two narratives describe the same root cause. Divergent stories across regulators are how "the company cannot keep its own facts straight" becomes a formal observation in a later inspection, on either side of the Pacific.

The FDA's expectations for the Warning Letter response are procedural as well as substantive. The agency typically requests a written response within fifteen working days, addressing each observation, describing the corrective actions already taken, and stating the timeline for completion. A response that promises action without dates, or that disputes observations without evidence, is itself a quality-system observation waiting to be written. The same discipline applies to the customer notice: it should be dated, factual, and issued on a defined timeline, so that the customer file shows the manufacturer responding to a known event in a controlled way rather than improvising under pressure.

Operational vulnerabilities and transactional pitfalls#

The failure points cluster around four behaviours that are common in post-Warning-Letter communications:

• The soothing letter: commercial teams draft a short customer notice that minimises the event, uses phrases like "minor documentation issue," and reassures distributors that nothing is wrong. If the CAPA says otherwise, the letter is a false statement to customers and a contradiction in the evidence file.
• The scapegoat narrative: quality or HR identifies an individual, disciplines or dismisses the employee, and writes the CAPA to blame the person. Regulators read individual blame as a symptom of a shallow root-cause analysis. Worse, the employee may contest the disciplinary action in a Chinese labour arbitration, producing a third document — the employment decision — that contradicts the CAPA's claim of a systemic fix.
• The tender question: customers ask, in a tender or supplier questionnaire, "Have you received any regulatory warning letters in the past three years?" The answer must be truthful and factual. Evasive or bravado answers to a direct question are worse than a straightforward, dated, factual disclosure accompanied by the corrective actions taken.
• The split record: the quality team builds one version of events for the FDA, the commercial team builds another for customers, and the board pack builds a third for investors. Every version is a record; the first inspection that collects all three creates the contradiction.

Each of these vulnerabilities is a communication failure before it is a legal failure, and each is preventable with a single source of truth.

A Sydney compliance perspective on the Warning Letter spine#

In my pharmaceutical-compliance practice in Sydney, the FDA Warning Letter for a client in the region usually triggers the same race between two documents: the customer-facing notice that commercial wants to send, and the CAPA file that quality is drafting for the FDA. The race is the risk. If the notice minimises the event — “minor documentation issue” — while the CAPA states a systemic finding, the company has handed the agency its next investigation theme and misled its customers in the same document set. The compliance principle I apply is the single factual spine: before any customer notice is drafted, the CAPA root-cause analysis is completed and approved by quality, regulatory and legal together, and every audience-facing document — the customer notice, the distributor Q&A, the tender response, the social-media statement — is written from that same spine. The China layer adds a second authority: the NMPA device-supervision regulations impose parallel record-keeping, adverse-event and inspection-cooperation duties, and a Warning Letter event is not a US-only matter for a manufacturer that also answers to the NMPA. The recurring failure is the soothing letter and the scapegoat — the first creates a false statement that outlives the event, and the second contradicts the CAPA’s systemic finding. The Warning Letter is a public, permanent record; the file built on one factual spine is the only defence that survives the record.

Strategic compliance roadmap and action plan#

The post-Warning-Letter communications programme should be built on one factual spine, executed in five steps:

1. Establish the single factual spine: before any customer notice is drafted, the CAPA root-cause analysis is completed and approved by quality, regulatory, and legal together. The spine states the facts — what happened, what the impact was, what is being corrected — in language that every audience-facing document will use.
2. Map the audience matrix: identify every document that will be produced — FDA response, customer FAQ, tender disclosures, distributor letters, board pack, employee communications — and require each to be drafted from the spine, with audience-appropriate length but identical facts.
3. Apply the consistency rule: no document may use "minor documentation issue" if the spine says systemic data-integrity failure; no document may claim a quick fix if the CAPA timeline is twelve months; no document may blame an individual if the root cause is procedural.
4. Handle employment actions with care: if personnel changes are necessary, they are implemented as part of the corrective action with documented, defensible grounds under Chinese labour law — not as public scapegoating that undercuts the CAPA's ownership of the problem.
5. Answer tender questions with facts and timelines: a direct question receives a direct answer — the Warning Letter, its date, the corrective actions taken, and the current status — without bravado and without minimisation. The facts are the defence; the timeline is the proof.

After the communications are issued, run a reconciliation audit: collect the FDA response, the customer notices, and the internal records, and check them sentence by sentence against the spine. Any deviation is corrected immediately, because a deviation found in your own audit is a deviation you can still fix before an inspector finds it.

Finally, the post-Warning-Letter programme should be rehearsed before it is needed. The company that has a standing crisis-communication protocol — the notification tree, the pre-drafted customer FAQ template, the escalation criteria for legal review, the records-preservation instruction — can execute in days; the company that improvises after the letter arrives spends its most pressured weeks drafting documents it should have drafted in calm times. The same protocol serves the company when an NMPA inspection, a product recall, or a customer dispute creates the identical communication challenge. In our work with Chinese manufacturers on regulatory responses, the difference between a controlled outcome and a cascading one is almost always the existence of a rehearsed playbook, not the intelligence of the people in the room. The discipline extends to the customer-facing side of the tender process. When a customer questionnaire asks about regulatory actions, the compliant answer is a dated, factual statement of the Warning Letter and the corrective actions, accompanied by the same evidence the company submitted to the agency. The tender answer should never promise more than the CAPA demonstrates, and it should never omit a material fact that the customer will discover in a later audit. In cross-border procurement, the customer's own quality team often conducts an independent verification of the CAPA commitments, and a customer-facing statement that diverges from the CAPA is caught in that verification — converting a regulatory matter into a contractual and reputational one. The single-spine rule is therefore not only a defence to the FDA; it is the same file that keeps the customer relationship, the tender pipeline, and the distributor network intact.

What not to do#

Do not let commercial teams write to customers before quality has approved the factual spine. Do not dismiss the Warning Letter as a US-only matter in a company that also answers to the NMPA. Do not blame a single employee for a systemic failure, and do not let HR run a disciplinary process that contradicts the CAPA. And do not send a soothing letter — the record will outlive the soothing.

Read next: FDA Warning Letter playbook · EU MDR/IVDR

Cluster: Life sciences legal hub · Life sciences blog