How to respond to an FDA 483: what works, what fails
An FDA Form 483 is the list of observations an inspector writes up at the end of a facility inspection. You have 15 business days to respond. The response is your first — and sometimes only — chance to keep the observation from escalating into a Warning Letter, consent decree, or product hold. Most firms write that response the same way: a cover letter, a CAPA per item, training records attached. And most of those responses are inadequate, in the exact same ways, every year.
What FDA is actually looking for
The inspector who wrote the 483 already knows your facility is regulated and that you have an SOP. They're not auditing whether the SOP exists; they're auditing whether you can run a deviation investigation that explains why it failed. A response that answers 'we retrained the operator' answers a different question than the one they asked. The response they're looking for has four pieces:
- Root cause analysis that names the SYSTEM condition that allowed the event, not just the human who triggered it.
- Corrective action that addresses the named system condition.
- Preventive action that prevents recurrence on similar processes — not just the one cited.
- Effectiveness check with a numeric threshold, sample size, and closure criterion.
The four response patterns that draw a Warning Letter
FDA's own Warning Letter database is a public catalog of bad 483 responses. After reading a few hundred, the same four patterns appear in nearly every escalation:
| Pattern | Why it fails | What to do instead |
|---|---|---|
| "Operator error" as terminal root cause | Stops the investigation before identifying why the procedural design or training allowed the error. | Document the system condition (SOP ambiguity, training gap, shift coverage, fixturing issue) the operator was responding to. |
| Training-only CAPA | Training is the weakest control in the hierarchy. ICH Q9 expects engineering or procedural changes first. | Pair training with an engineering or procedural control (poka-yoke, fixture change, SOP rewrite with a check-step). |
| "Continue to monitor" effectiveness check | No threshold, no sample size, no closure criterion. The CAPA can never fail effectiveness — by design. | Re-measure for a named window (e.g., 30 batches over 60 days). Define the threshold and closure criterion in writing. |
| No prior-occurrence search | FDA expects you to look back ~24 months across similar lines, products, and sites. Skipping it makes the scope of the CAPA indefensible. | Document the prior-occurrence search in the response — even if the answer is 'none found.' |
The 15-day timeline, broken down
Most firms wait until day 12 to draft. That's how rushed, defensive responses get written. A workable cadence:
- Days 1–3: assemble the cross-functional investigation team. Confirm who owns the response. Pull the affected batch records.
- Days 4–7: investigate. Run the prior-occurrence search. Identify the system condition behind the observation.
- Days 8–10: draft each CAPA. Pair every corrective action with a preventive action. Write the effectiveness check with thresholds.
- Days 11–13: internal red-team. Have your QA leadership review against the four failure patterns above.
- Days 14–15: sign, package, submit. Include the prior-occurrence search and the effectiveness-check protocols as attachments.
What goes in the response packet
FDA reviewers see hundreds of these. A response that's easy to evaluate gets a faster, more favorable review. Standard packet structure:
- Cover letter — names the inspection, the dates, the response timeline, and the lead author.
- Observation-by-observation index — for each 483 item, a one-line summary of the response.
- Per-observation response — investigation summary, root cause, corrective action, preventive action, effectiveness check, evidence attachments.
- Prior-occurrence search results — even when none found.
- Updated SOPs, change controls, and training records as appendices.
Common procedural traps
Three things that don't show up on the 483 but quietly determine whether you get a Warning Letter:
- Promising future actions without a completion date. "We will revise the SOP" without a target date reads as deflection.
- Including only the named operator in the training CAPA. Inspectors expect all operators on similar processes to receive the corrected training.
- Not addressing the broader scope. If the 483 cites Line 4, your response should explain why the system condition doesn't apply to Lines 2, 3, and 5 — or extend the CAPA to cover them.
Red-team your response before submitting
The cheapest insurance against escalation is a 30-minute red-team session 24 hours before submission. One person reads the response as the FDA reviewer would. They look for the four failure patterns above and stop the response if any of them appear. Most firms skip this step. Most Warning Letters cite firms that skipped this step.