FDA就纽约州Rensselaer原料药厂向Curia New York发出CGMP警告信

Delivery Method:

VIA ELECTRONIC MAIL READ/DELIVERY RECEIPT REQUESTED

Reference #:

320-26-127

Product:

Drugs

Recipient:

Recipient Name

Philip Macnabb

Recipient Title

CEO

Curia New York, Inc.

223 South West Street
Raleigh, NC 27603
United States

(b)(4)

Issuing Office:

Center for Drug Evaluation and Research (CDER)

United States

September 18, 2026

WARNING LETTER
Reference number: 320-26-127

To Mr. Philip Macnabb:

This warning letter advises you of significant deviations observed during a U.S. Food and Drug Administration (FDA) inspection of your facility. Promptly address the deviations described herein without delay, including ensuring that appropriate resources are allocated to fully address the deviations and prevent their recurrence. This is not intended to be an all-inclusive list of the deviations that exist at your facility. It is your responsibility to ensure that your firm complies with all requirements of federal law, including FDA regulations. Failure to adequately address deviations may result in regulatory or legal action without further notice including, without limitation, seizure and injunction.

Deviations were observed and documented during an inspection of your drug manufacturing facility, Curia New York, Inc., FDA Establishment Identifier (FEI) 1310298 at 33 Riverside Avenue, Rensselaer, New York, from January 28 to February 5, 2026. This inspection was conducted under FDA’s statutory authority and public health responsibilities to protect the public from unsafe, ineffective, and poor quality drugs.

This warning letter summarizes significant deviations from Current Good Manufacturing Practice (CGMP) for active pharmaceutical ingredients (APIs).

Because your methods, facilities, or controls for manufacturing, processing, packing, or holding do not conform to CGMP, your APIs are adulterated within the meaning of section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act (FD&C Act), 21 U.S.C. 351(a)(2)(B).

We reviewed your February 27, 2026, response to our Form FDA 483 in detail, and we also acknowledge receipt of your subsequent correspondence.

Violations of the Federal Food, Drug, and Cosmetic Act

The following are deviations identified during our inspection and review. As a reminder, this is not an all-inclusive list of deviations at your establishment.

1. Failure to have laboratory control records that include complete data derived from all laboratory tests conducted to ensure your API and intermediates comply with established specifications and standards.

Not all electronic test results are included in your review to determine conformance of your API products.

Your laboratory analysts routinely conducted unexplained injections in high-performance liquid chromatography (HPLC) and ultra-performance liquid chromatography (UPLC) without adequate documentation or supervision to ensure that product samples were not being tested. Your laboratory used Empower and TotalChrom software for chromatographic data processing and analysis. Your laboratory analysts performed thousands of unexplained injections using Empower over the last 30 months, and over 70 trial injections using TotalChrom in October 2025 alone. The injections that utilized the Empower software used the “Developer” role rather than the “Operator” role without appropriate documentation. For example:

A. Our investigators found chromatograms for testing that was performed on January 14, 2026, on chromatography equipment HPLC 49, which showed four unexplained trial injections that were injected under the “Developer” role. Your analyst confirmed these trial injections could not be traced to any product, sample, or analysis. In your response you attributed the injections to the testing of (b)(4) swab samples. Pages from the associated laboratory notebook 830-7 contained no reference to the four trial injections. Your analyst did not document any rationale for performing the trial injections using the “Developer” role in the laboratory notebook.

B. Your analyst conducted testing that showed two unexplained injections on February 1, 2026, on chromatography equipment UPLC 57, using the “Developer” role. Your analyst stated your QC supervisor tested (b)(4) cleaning swab samples that were reported in laboratory notebook 823-6. However, the laboratory notebook did not provide documentation on these unexplained injections.

Your response regarding these two examples states that the trial injections were performed as part of a troubleshooting exercise assisted by your quality control supervisor, and that the trial injections had no impact. However, in your retrospective review of all trial injections you identified nine injections that lacked sufficient justification and need further investigations.

You also stated in your response that nearly 20 percent of Empower trial injections were acquired or altered in “Developer” mode, which reflects inconsistent training or poor understanding of your procedure, SOP-RLS-000435. Allowing the use of the “Developer” role for analyst activities involving CGMP samples or regulated data fails to prevent analysts from performing unauthorized or undocumented sample analyses.

Your response is inadequate because it does not include an investigation of all unexplained injections performed to determine the associated CGMP risk, and because it does not provide an explanation of why these trial injections were performed by analysts using the “Developer” role.

We acknowledge your firm’s cessation of all trial injections, the removal of the “Developer” role in Empower, and your commitment to provide an additional retrospective assessment of all trial injections findings from January 2021 to October 2023.

In response to this letter, provide the following:

• A comprehensive, independent investigation report for all trial injections, with supporting documentation showing that the trial injections were not sample injections. If an injection is identified as a sample injection, include a determination of the impact on the distributed API materials.
• A comprehensive, independent data-integrity assessment for all facilities, covering all computerized systems used in CGMP operations, that is, not limited to Empower and TotalChrom.

2. Failure of your quality unit to exercise its responsibility to ensure the API and intermediates manufactured at your facility are in compliance with CGMP.

Your Quality Unit failed to ensure adequate control over paper and electronic records. On January 29, 2026, our FDA investigator observed original laboratory records inside the shred bins maintained in your laboratory. For example, we found an original pH meter printout slip, indicating a pH reading of (b)(4); an original analytical balance printout slip, with a value of (b)(4) grams; and reviewer-signed Analytical Data Review Checklists.

Your response states that there was negligible impact from these discrepancies; however, your response lacks evidence to support the conclusion of negligible impact for discarding these records. Your firm could not identify who generated the pH meter printout on December 19, 2025, and why they were discarded. Your analyst discarded a balance printout weight slip dated January 25, 2026, but did not document why this balance printout slip was discarded. Furthermore, you were unable to make batch associations with the discarded original sourced documents (for example, specific batch testing).

Without attribution of the discarded records to defined test analyses, the conclusion of negligible impact lacks an adequate evidentiary basis. Although procedure SOP-RLS-000346 was updated to require the use of instrument logbooks, your quality unit failed to investigate why the generated records were discarded in the shred bins, indicating a lack of adequate oversight. The full scope of this traceability gap is not adequately included in your response.

Additionally, our investigators found in the shred bin an excessive number of photocopies of your laboratory notebook pages, with CGMP activities documented. Your laboratory personnel reviewed photocopies of the original data rather than the original records, and subsequently they signed off on the original analyst notebooks without verifying any changes to the underlying data.

Your response acknowledges that the photocopy review practice was a direct violation of your procedure SOP-RLS-000456, requiring that all electronic primary data be reviewed and verified against the analyst's notebook.

In addition, your procedure RLS-SOP-PW-0047 GMP, “Document Storage, Control, and Retention,” requires that paper records pertaining to batch analysis be maintained. Your quality unit failed to ensure that all production control records were retained in accordance with this established procedure and failed to implement adequate controls to ensure the integrity of data generated at your facility.

We acknowledge you removed (b)(4) shred bins from the locations in building (b)(4) and transferred them under the QU control. However, your response is inadequate. Your review of shred bin data appears not to include an analysis of the contents of all the shred bins identified during the inspection. Your protocol “Review of Shred Bin Contents” identified a bin that was not included in your summary report and did not provide an explanation for this omission.

Your firm had indicated that the (b)(4) bins are collected (b)(4) by a third-party service provider for off-site destruction. You are unable to determine the scope of prior discarded material from the previous document destructions.

Your quality system does not adequately ensure the accuracy and integrity of data to support the safety, effectiveness, and quality of the drug substances you manufacture. See FDA's guidance document Data Integrity and Compliance with Drug CGMP at https://www.fda.gov/media/119267/download.

In response to this letter, provide the following:

• A determination of how long the shred bin disposal of GMP documents has been occurring at your facility.
• A retrospective assessment of the scope and potential effect of the absence of instrument-use logbooks for all QC laboratory equipment over the applicable record-retention period, including an evaluation of whether any GMP testing results may be unattributable or unverifiable as a result.
• A retrospective assessment of the potential scope of records that may have been improperly destroyed before the inspection, given that shred bins were collected (b)(4) with no QA review.
• A broader data-integrity assessment, including a retrospective review of your QC laboratory operations to determine the extent to which uncontrolled documentation practices may have affected the integrity of GMP records.
• The complete final investigation report(s) regarding documents found in all shred bins. Include classification of documents, associated effect on product and manufacturing processes, and any deviation generated from the final assessment.
• A detailed, comprehensive data-integrity investigation protocol describing how your third-party consultants will evaluate electronic data.
• A comprehensive investigation into the extent of the inaccuracies and inconsistencies in data, records, and reporting. Your investigation should include:
  o A detailed investigation protocol and methodology; a summary of all laboratories, manufacturing operations, and systems to be covered by the assessment; and a justification for any part of your operation that you propose to exclude.
  o Interviews of current and former employees to identify the nature, scope, and root cause of data inaccuracies. We recommend that these interviews be conducted by a qualified third party.
  o An assessment of the extent of data-integrity deficiencies at your facility. Identify omissions, alterations, deletions, record destruction, non-contemporaneous record completion, and other deficiencies. Describe all parts of your facility’s operations in which you discovered data-integrity deficiencies.
  o A comprehensive, retrospective evaluation of the nature of testing data-integrity deficiencies. We recommend that a qualified third party with specific expertise in the area where the potential breaches were identified should evaluate all occurrences.
• A current risk assessment of the potential effects of the observed failures on the quality of your drugs. Your assessment should include analyses of the risks to patients caused by the release of drugs affected by a data-integrity event and analyses of the risks posed by ongoing operations.
• A management strategy for your firm that includes the details of your global corrective action and preventive action (CAPA) plan. Your strategy should include:
  o A detailed corrective action plan that describes how you intend to ensure the reliability and completeness of all data, including analytical data, manufacturing records, and all data submitted to FDA.
  o A comprehensive description of the root causes of each data-integrity deviation, including evidence that the scope and depth of the current action plan are commensurate with the findings of the investigation and the risk assessment. Indicate whether the individuals responsible for the data-integrity breaches can still influence CGMP-related or drug-application data at your firm.
  o Interim measures describing the actions you have taken or will take to ensure the quality of your drugs and to protect patients, such as notifying your customers, recalling product(s), conducting additional testing, adding lots to your stability programs to ensure stability, drug-application actions, and enhanced complaint monitoring.
  o Long-term measures describing any remediation efforts and enhancements to procedures, processes, methods, controls, systems, management oversight, and human resources (for example, training, staffing improvements) designed to ensure the integrity of your company’s data.
  o Confirmation that you will be hiring a data integrity compliance officer who is fully empowered to receive anonymous complaints from employees reporting data-integrity concerns, and with the authority to ensure that any potential breach is promptly investigated by an independent quality-assurance function, along with expertise from outside entities whenever needed.
  o A status report for any of the above activities already underway or completed.

3. Failure to exercise sufficient controls over computerized systems to prevent unauthorized access or changes to data.

Our investigators observed significant data-integrity violations at your facility involving the sharing of usernames and passwords that are used to gain access to your electronic computerized system for GMP analysis. For example, your electronic computerized system, (b)(4), interfaces with laboratory equipment (b)(4) and restricts access through individual, unique usernames and passwords. Despite this control, your laboratory analyst used another analyst's login credentials to conduct (b)(4) calibrations and to perform (b)(4)-sample testing.

The sharing of credentials constitutes a serious violation of data-integrity principles and is inconsistent with GMP requirements. Your quality system failed to detect and prevent repeated occurrences of this practice.

Your response acknowledges that your written procedure SOP-RLS-000438, “The Use of Computerized Systems for GMP Operations,” prohibited username and password sharing. Your retrospective review under Protocol RQA-P-0560 was limited to 12 stand-alone analytical instruments for the period from February 10, 2025, through February 4, 2026. This review does not encompass all computerized equipment requiring username and password access, nor does it evaluate discrepancies beyond the stated review period.

In response to this letter, provide the following:

• A retrospective review of all computerized equipment for all your facilities, including but not limited to stand-alone systems that require username and password authentication to gain access, and all products for which the equipment was used for testing, limited to distributed products currently within expiry and on the U.S. market.
• A comprehensive, independent assessment covering all GMP-integrated computerized systems for a three-year period to fully characterize the scope of this data-integrity failure.
• A management strategy for your firm that includes the details of your global CAPA plan to implement attributable, legible, complete, original, accurate, contemporaneous (ALCOA) records throughout your operation. The detailed corrective action plan should describe how you intend to ensure the reliability and completeness of all data, including microbiological and analytical data, manufacturing records, and all data submitted to FDA.
• A comprehensive, independent assessment of your laboratory practices, procedures, methods, equipment, documentation, and analyst competencies. Based on this review, provide a detailed plan to remediate and evaluate the effectiveness of your laboratory system.

Conclusion

You are responsible for investigating and determining the root causes of any deviations and implementing corrective and preventative measures to ensure future and sustained compliance so that these violations and any others do not occur.

Unresolved deviations may prevent other Federal agencies from awarding contracts. Failure to address deviations may also cause FDA to withhold issuance of Export Certificates. FDA may withhold approval of new applications or supplements listing your firm as a drug manufacturer until any deviations are completely addressed and we confirm your compliance with CGMP. We may re-inspect to verify that you have completed corrective actions to address any deviations.

If you are considering an action that is likely to lead to a disruption in the supply of drugs produced at your facility, FDA requests that you contact CDER’s Drug Shortages Staff immediately at [email protected], so that FDA can work with you on the most effective way to bring your operations into compliance with the law. Contacting the Drug Shortages Staff also allows you to meet any obligations you may have to report discontinuances or interruptions in your drug manufacture under 21 U.S.C. 356c(b). This also allows FDA to consider, as soon as possible, what actions, if any, may be needed to avoid shortages and protect the health of patients who depend on your products.

Send your written response to [email protected] within fifteen (15) business days of receipt of this letter¹. Identify your written response with FEI 1310298 and ATTN: Compliance Officer Sneha Patel in the letter or in the subject line of the email.

If you have information that you believe demonstrates that your products are not in violation of the FD&C Act and FDA regulations, include that information for our consideration.

FDA posts warning letters to www.FDA.gov.

Sincerely,
/S/

Francis Godwin
Director
Office of Manufacturing Quality
Office of Compliance
Center for Drug Evaluation and Research
U.S. Food and Drug Administration

_______________________________________

1 Under program enhancements for the Generic Drug User Fee Amendments (GDUFA) reauthorization for fiscal years(FYs) 2023-2027, also known as the GDUFA III Commitment Letter, your facility may be eligible for a Post-Warning Letter Meeting to obtain preliminary feedback from FDA on the adequacy and completeness of your corrective action plans.