When you take a pill or use a medical device, you expect it to be safe. But how do you know the factory that made it followed the rules? The answer lies in FDA inspection records - the official documents that show whether a manufacturing facility met federal quality standards. For companies making drugs or medical devices, understanding these records isn’t just about compliance. It’s about trust, risk, and survival.
What the FDA Can and Can’t See
The FDA doesn’t have unlimited access to everything inside a drug or device factory. There’s a clear line between what’s open for review and what’s protected. Under Compliance Policy Guide (CPG) Sec. 130.300, the agency generally avoids looking at internal quality assurance audits - the kind companies do to find their own mistakes before the FDA shows up. This policy was designed to encourage honesty. If companies fear every slip-up will become public, they won’t dig deep enough to fix problems. But here’s the catch: if a product fails, a customer complains, or a batch goes bad, those investigations? Those are fair game. The FDA can demand every email, lab report, and root cause analysis tied to that failure. This distinction is critical. A company might have a perfect internal audit report, but if their quality control team found a contamination issue in a batch and didn’t fix it properly, the FDA will see it - and act on it.What Records Must Be Kept (and For How Long)
Manufacturers can’t just throw away records after a few months. The law is strict. For prescription and over-the-counter drugs, 21 CFR 211.180 says you must keep all current Good Manufacturing Practice (CGMP) records for at least one year after the product’s expiration date. For medical devices, 21 CFR 820.180 requires records to stay for the device’s entire lifespan plus two more years. That means if you made a pacemaker in 2020, you still need to keep its production logs until 2042. These records include:- Batch production and control records
- Validation protocols for equipment and processes
- Deviation reports (when something went off-spec)
- Corrective and preventive action (CAPA) logs
- Training records for staff handling critical steps
- Supplier qualification files
Inspection Types: Routine vs. For-Cause
Not all FDA inspections are the same. In 2024, about 75% of pharmaceutical inspections were routine surveillance checks. During these, inspectors stick to the basics: production logs, equipment calibration, sanitation procedures. They usually don’t touch internal audit reports. But if something goes wrong - a recall, a whistleblower tip, or a pattern of complaints - the FDA can launch a for-cause inspection. These make up about 18% of inspections and are far more invasive. In these cases, the agency can demand every internal audit, email chain, and employee interview. The goal isn’t just to check compliance. It’s to uncover hidden systemic failures. Foreign facilities face even tougher scrutiny. In 2023, only 12% of inspections at overseas plants were unannounced. By the end of 2025, that number will jump to 35%. Domestic facilities? Almost all inspections are scheduled - about 92% of the time. The message is clear: the FDA trusts U.S. plants more than foreign ones. And they’re changing how they verify that trust.
What Happens When the FDA Finds Problems
If inspectors spot issues, they hand out Form FDA 483 - a list of observations. This isn’t a fine. It’s a notice: “We saw this. Fix it.” Companies have exactly 15 business days to respond. That’s not a suggestion. It’s a requirement. The response matters. Companies that use FDA’s recommended root cause analysis method - digging into why something happened, not just what happened - close 89% of their 483s within six months. Those that just patch the surface? Only 62% succeed. Many companies hire outside consultants just to write these responses. It’s expensive, but cheaper than a warning letter or shutdown. A warning letter is the next step. It’s public. It’s serious. And in Q1 2025, the FDA issued 17% more warning letters for companies that delayed or denied inspection access than they did the year before. Section 301(f) of the FD&C Act makes it illegal to block FDA inspectors. Refusing entry? That’s a federal offense.Remote Inspections Are Here - And They’re Changing Everything
In July 2025, the FDA finalized its guidance on Remote Regulatory Assessments (RRAs). This isn’t a full inspection. It’s a virtual review. The agency can ask for read-only access to your digital systems, request electronic records, or even join a live video tour of your clean room. RRAs don’t generate Form 483s, but they can lead to one if red flags show up. Companies using RRAs report 65% less production downtime during inspections. That’s huge. In 2024, the average pharmaceutical facility spent 14 days preparing for a physical inspection. With RRAs, that drops to under five. By Q1 2025, 73% of Fortune 500 drugmakers had built RRA-ready systems. It’s not optional anymore - it’s the new baseline.
Real Challenges Manufacturers Face
Despite the rules, confusion runs deep. A 2024 survey of 215 quality professionals found that 41% had seen different FDA district offices interpret the CPG Sec. 130.300 policy differently. One inspector says internal audits are off-limits. Another asks for them anyway. That inconsistency creates fear and over-compliance. Many companies, unsure of the boundaries, end up handing over too much. A Pfizer survey of 47 quality staff showed 63% had accidentally disclosed protected audit reports during inspections. That’s not just a mistake - it’s a risk. If the FDA starts seeing those reports regularly, the policy protecting them could collapse. The cost of getting it right? Around $385,000 per year per facility, according to a 2025 benchmarking study. That includes training, documentation systems, consultants, and dedicated inspection readiness teams. Most large manufacturers now have full-time staff whose only job is to prepare for FDA visits.What’s Next for Manufacturing Transparency
The pressure to open up is growing. Congress is considering the Pharmaceutical Supply Chain Transparency Act, which would force public release of some inspection findings. The pharmaceutical industry, through PhRMA, is fighting back, warning that public disclosure would kill the culture of honest self-auditing. The FDA’s own 2025-2027 plan aims to cut inspection cycle times by 25% using digital records and AI-assisted review. That means fewer in-person visits - but more data requests. The future of manufacturing transparency isn’t about walking through a plant. It’s about having your digital systems ready to stream data on demand. For manufacturers, the path forward is clear: build systems that separate protected internal audits from mandatory quality investigations. Train staff to know the difference. Invest in digital recordkeeping. And never assume the rules won’t change. The FDA’s priorities have shifted - and they’re watching closer than ever.Can the FDA inspect my facility without warning?
Yes, but only under certain conditions. For foreign facilities, the FDA is increasing unannounced inspections to 35% by the end of 2025. For domestic facilities, most inspections are scheduled, but the agency can still show up without notice if there’s a complaint, recall, or evidence of serious violations. Refusing entry is illegal under Section 301(f) of the FD&C Act.
What’s the difference between a Form FDA 483 and a warning letter?
Form FDA 483 is a list of observations made during an inspection - it’s not a penalty. A warning letter is a formal enforcement action issued if the company doesn’t respond adequately or if violations are severe. Warning letters are public, can trigger product seizures or import bans, and are tracked by investors and regulators.
Do I have to let the FDA see my internal quality audits?
Generally, no - under CPG Sec. 130.300, the FDA avoids reviewing internal quality assurance audits designed to encourage candid self-assessment. But if the inspection becomes for-cause - triggered by a product failure or complaint - the agency can demand those documents. The key is keeping internal audits separate from quality control investigations, which are always accessible.
How long do I need to keep manufacturing records?
For drugs, keep CGMP records for at least one year after the product’s expiration date. For medical devices, keep quality system records for the device’s lifespan plus two years. Records must be contemporaneous - created at the time of the activity - not rewritten later. Failure to meet this standard is a common reason for warning letters.
What is a Remote Regulatory Assessment (RRA)?
An RRA is a virtual evaluation conducted by the FDA using digital tools - like remote access to electronic records, video tours, or data sharing - instead of an on-site visit. RRAs don’t generate Form 483s, but they can lead to one. They reduce inspection downtime by up to 65% and are becoming standard for large manufacturers, especially those with global supply chains.
