Pharmaceutical Compliance Documentation: FDA cGMP, 21 CFR and GxP Requirements

The FDA enforces the world's most rigorous pharmaceutical documentation standards. Every US drug manufacturer — and every foreign manufacturer exporting finished dosage forms or active pharmaceutical ingredients to the United States — must satisfy the current Good Manufacturing Practice (cGMP) requirements codified in 21 CFR Parts 210 and 211, maintain electronic records systems compliant with 21 CFR Part 11, and produce complete submission packages in eCTD format for New Drug Applications (NDAs) and Abbreviated New Drug Applications (ANDAs). Documentary deficiencies are among the leading causes of FDA 483 observations, Warning Letters and import alerts — with direct consequences for product availability, investor confidence and commercial partnerships.

FDA cGMP Requirements: 21 CFR Parts 210 and 211

21 CFR Part 210 establishes the minimum cGMP standards that apply to all drug manufacturing, processing, packing and holding operations, while 21 CFR Part 211 sets the specific cGMP requirements for finished pharmaceuticals — including organizational structure, facilities, equipment, production controls, laboratory controls, and records and reports.

The following table summarizes the key subparts of 21 CFR Part 211 and their primary documentary requirements:

The cGMP regulations are performance-based standards — they describe required outcomes, not prescriptive methods. The "c" in cGMP is significant: manufacturers are expected to implement current best practices as technologies and standards evolve, not simply to comply with the literal text of regulations written decades ago. FDA's CDER (Center for Drug Evaluation and Research) and CBER (Center for Biologics Evaluation and Research) both publish guidance documents and process validation guidance that inform what "current" means in practice.

For facilities manufacturing controlled substances, the DEA (Drug Enforcement Administration) imposes additional record-keeping requirements under 21 CFR Part 1304 — including perpetual inventory records for Schedule I and II substances, order forms under 21 CFR Part 1305 and detailed dispensing logs. DEA records must be maintained separately from cGMP records and are subject to DEA inspection independent of any FDA audit.

Master Manufacturing Records and Batch Production Records

Under 21 CFR Part 211.186 and 211.188, every drug manufacturer must maintain a Master Production and Control Record (MPCR) for each drug product and a separate Batch Production and Control Record (BPCR) executed for every production batch.

The Master Production and Control Record is the master template — the validated, approved blueprint for manufacturing the product. It must include: the product name and strength; the composition (formula) and any established specifications; a complete description of the drug product container, closure, and packaging materials; sampling and testing procedures; a description of drug product containers and closures; complete manufacturing and control instructions, sampling and testing procedures, specifications, special notations, and precautions to be followed.

The Batch Production and Control Record is the executed record — a copy of the relevant portions of the MPCR completed in real time during actual production of a specific batch. A complete batch record must contain:

• The product name, strength, dosage form and batch number
• The date and time of each significant step in manufacture, processing, packing and holding
• Identification of equipment and major lines used
• Lot numbers and actual weights or measures of components used, including in-process samples
• In-process and laboratory control results
• A statement of the actual yield and percentage of theoretical yield at appropriate phases of processing
• Complete labeling control records, including specimens or copies of all labeling used
• Description of drug product containers and closures
• Any sampling performed; results of examination of finished product
• Identification of the persons performing and directly supervising or checking each significant step in the operation
• Any investigation made into yield discrepancies or failures of batches, including lot numbers of reprocessed batches if applicable

What happens during an FDA inspection regarding batch records? During a cGMP inspection, FDA investigators will request batch records for recently manufactured lots — typically the most recent 30 batch records or all batches within a defined time window. Investigators examine records for completeness (every required field must be populated), contemporaneousness (entries must be made at the time the step is performed, not reconstructed after the fact), and accuracy (data must match equipment printouts, instrument logs and laboratory systems). Discrepancies between paper batch records and electronic system data are a primary source of data integrity 483 observations and, if systemic, can escalate to Warning Letters.

NDA, ANDA, and eCTD Submission Requirements

New Drug Applications (21 CFR Part 314) and Abbreviated New Drug Applications must be submitted to the FDA in the Electronic Common Technical Document (eCTD) format, a five-module structure developed by the International Council for Harmonisation (ICH) that is used by regulatory authorities globally.

The eCTD modules as applied to FDA submissions are:

• Module 1: US-specific administrative information, including FDA Form 356h (NDA/ANDA cover sheet), proposed labeling, and patent and exclusivity certifications
• Module 2: Summaries — quality overall summary, non-clinical overview and clinical overview
• Module 3: Quality data — active substance manufacturing and controls, finished product manufacturing and controls, analytical procedures and validation
• Module 4: Non-clinical study reports (pharmacology, toxicology)
• Module 5: Clinical study reports and references

What is the difference between a Drug Master File and an NDA? A Drug Master File (DMF) is a confidential submission to the FDA containing detailed information about a facility, process, article or material used in the manufacturing, processing, packing or holding of a human drug — but it is not a standalone application for approval. The most common type is a Type II DMF, covering the manufacturing information for an active pharmaceutical ingredient (API). An API supplier submits a Type II DMF once; multiple NDA or ANDA holders can then cross-reference it in their own applications without disclosing the supplier's proprietary process data. An NDA, by contrast, is a complete application by the drug sponsor seeking approval to market a specific finished dosage form — it incorporates all quality, non-clinical and clinical data and, where applicable, references one or more DMFs. The NDA holder is responsible for ensuring the DMF it references remains current and acceptable to the FDA.

ANDA submissions follow the same eCTD structure but rely on bioequivalence data in place of full clinical programs, and must reference the approved Reference Listed Drug (RLD). The FDA's Orange Book lists approved drugs and their patent and exclusivity status, which ANDAs must navigate via Paragraph IV certifications where applicable.

The United States Pharmacopeia (USP) publishes the official standards for drug substances, dosage forms, compounded preparations and dietary supplements used in the United States. Module 3 quality data must be aligned with applicable USP monographs and general chapters, and any deviation from a compendial method must be scientifically justified.

Electronic Records Compliance: 21 CFR Part 11

21 CFR Part 11 governs the use of electronic records and electronic signatures in FDA-regulated activities, establishing requirements for audit trails, access controls, system validation and the legal equivalence of electronic signatures to handwritten signatures on paper records.

The regulation applies to records that are created, modified, maintained, archived, retrieved, or transmitted under any FDA regulation — the so-called "predicate rule." If cGMP (21 CFR Part 211) requires a record, and that record is maintained electronically, then 21 CFR Part 11 governs how it must be maintained. Key requirements include:

Audit trails: Computer-generated audit trails must record when and by whom electronic records were created, modified or deleted, including the date and time of the event, the user's identity, the original value and the new value. Audit trails must be protected against modification and must be retained for the same period as the records they document.

Access controls: Systems must use unique user identifiers that cannot be shared. Authority checks must be implemented to ensure only authorized users can perform specific functions (create, modify, approve, delete). Systems must be designed to hold electronic signatures accountable to their respective users at all times.

Electronic signatures: Under 21 CFR Part 11.100, each electronic signature must be unique to one individual and must not be reused or reassigned. Signatures must include the printed name of the signer, the date and time of signing, and the meaning of the signature (e.g., review, approval, responsibility, authorship). Signatures based on biometrics must be designed to ensure they cannot be used by anyone other than the genuine owner.

System validation: Computer systems used to create, modify or maintain 21 CFR Part 11 records must be validated to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records. Validation documentation must cover installation qualification, operational qualification and performance qualification.

Closed vs. open systems: 21 CFR Part 11 distinguishes between closed systems (where access is controlled by those responsible for the content) and open systems (networks accessible to the public). Open systems require additional controls including encryption and digital signature standards.

Note that the US regulatory framework does not include GDPR. Health data privacy in the United States is governed primarily by HIPAA (Health Insurance Portability and Accountability Act, 45 CFR Parts 160 and 164), which applies to covered entities and business associates handling protected health information (PHI) — a distinct compliance track from 21 CFR Part 11, though both may apply to clinical trial data systems.

Document Retention Requirements Under FDA Regulations

Retention periods under FDA cGMP regulations vary by document type. Manufacturers must also consider state-level requirements and contractual obligations, which may impose longer retention periods than the federal minimum:

The general FDA rule for batch records requires retention for at least three years from the date of distribution of the lot. This is shorter than the EU GMP rule, which applies a one-year-post-expiry standard with a five-year minimum. For products sold in both markets, manufacturers must apply the more stringent of the two standards — typically the EU rule for long-shelf-life products.

Electronic records must be retained in a form that is accurate, legible, complete and readily available for review and copying. Legacy system migrations must be validated to confirm that no data has been corrupted or lost. FDA investigators have the authority during inspections to access all required records, including electronic systems, and failure to produce required records is itself a cGMP violation.

For a cross-sector perspective on document retention obligations, see our article on document retention requirements by country and industry.

Automating Pharmaceutical Document Verification

Pharmaceutical document management is among the most resource-intensive activities on a manufacturing site: batch record completeness reviews, CoA validation, signature verification, cross-system reconciliation and regulatory submission pre-checks — all high-volume tasks where human error can directly result in a 483 observation, a delayed batch release or a Warning Letter. Manufacturers with FDA Warning Letters face public disclosure, potential import restrictions and loss of commercial partnerships.

CheckFile's platform has processed over 2.4 million verified documents with 98.7% OCR accuracy — performance benchmarks aligned with the traceability requirements of FDA-regulated facilities. Customers in regulated environments report an average 83% reduction in document processing time compared to manual review workflows.

Typical pharmaceutical use cases include:

• Batch record completeness verification: automated detection of missing entries, absent operator signatures, incomplete IPC sections or unresolved deviation references before submission to the quality unit — catching deficiencies before they become 483 observations.
• Supplier CoA extraction and validation: automated reading of certificate of analysis documents from API and excipient suppliers, with cross-checking against approved specifications and identity confirmation against DMF references.
• Personnel qualification cross-referencing: verification that individuals who signed critical batch record steps hold current documented training records and qualifications for the operations performed.
• Regulatory submission pre-screening: automated review of eCTD module content for formatting compliance, cross-reference consistency and completeness against FDA and ICH checklist requirements before formal submission.

Our document verification solutions integrate into existing document control workflows via API — without requiring revalidation of systems already qualified under 21 CFR Part 11. The security architecture of the platform includes encryption at rest and in transit, comprehensive access logging and audit trail generation consistent with 21 CFR Part 11 expectations. View our pricing or the industry verification guide to assess fit for your FDA-regulated compliance program.

For related credential verification context in healthcare settings, see our article on healthcare credential verification and accreditation.

Frequently Asked Questions

What triggers an FDA 483 observation, and how is it different from a Warning Letter?

An FDA Form 483 (Inspectional Observations) is issued at the conclusion of an inspection when investigators observe conditions that, in their judgment, constitute violations of the Food, Drug, and Cosmetic Act or associated regulations. A 483 is not a final agency finding — it is an opportunity for the company to provide a written response, typically within 15 business days, proposing corrective actions. A Warning Letter is the next escalation level: it is issued when FDA determines that a company's response to a 483 was inadequate or when violations are serious enough to warrant formal notice without the intermediate 483 step. Warning Letters are published publicly on FDA's website and carry significant commercial consequences — including potential import alerts for foreign manufacturers and accelerated scrutiny in future inspections. Warning Letter violations frequently involve data integrity, batch record accuracy and laboratory out-of-specification (OOS) investigation adequacy.

What is the difference between an NDA and an ANDA?

An NDA (New Drug Application, 21 CFR Part 314, Subpart B) is required for a drug product containing a new chemical entity or a new formulation that has not previously been approved by the FDA. The NDA must demonstrate safety and efficacy through the full suite of preclinical and clinical data, presented in eCTD format. An ANDA (Abbreviated New Drug Application, 21 CFR Part 314, Subpart C) is the pathway for generic drugs — products that are pharmaceutically equivalent and bioequivalent to an already-approved Reference Listed Drug. Rather than repeating the originator's clinical studies, an ANDA relies on bioequivalence data to demonstrate that the generic performs the same way in the body as the reference product. ANDAs are reviewed by CDER's Office of Generic Drugs and typically take 12–18 months for approval in the standard pathway, versus 10–12 months for an NDA under Priority Review.

How does FDA regulate electronic records from foreign pharmaceutical manufacturers?

21 CFR Part 11 applies extraterritorially to any organization that creates, modifies, maintains, archives or retrieves electronic records used to support FDA-regulated activity — regardless of where that organization is located. A drug manufacturer in India, Belgium, or Ireland that exports to the United States, holds a US drug establishment registration or participates in an FDA-regulated clinical trial must ensure its electronic systems comply with Part 11 for records related to those activities. FDA conducts foreign drug inspections through its overseas offices and during pre-approval inspections. Foreign manufacturers are subject to the same inspection authority as domestic sites, and unresolved 21 CFR Part 11 data integrity findings can result in import alerts that effectively block product entry into the US market.

What records does the DEA require for manufacturers of controlled substances?

DEA-registered manufacturers of controlled substances must maintain specific records under 21 CFR Part 1304, separate from cGMP batch records. These include: a biennial inventory of controlled substances on hand (21 CFR 1304.11); a complete and accurate record of each controlled substance manufactured, received, sold, delivered, or otherwise disposed of (21 CFR 1304.21); DEA Form 222 order forms for Schedule I and II substances; and all executed order forms received. Schedule II records must be maintained separately from all other records. Controlled substance records must be kept for a minimum of two years and must be available for inspection by DEA agents at any time during normal business hours. Discrepancies between DEA inventory records and production batch records are treated as potential diversion events and can trigger both DEA and FDA investigations.

What are the most common cGMP documentation violations cited by FDA?

Based on FDA's published 483 data and Warning Letter trends, the most frequently cited documentation violations fall into five categories: (1) data integrity failures — overwriting data, deleting audit trail entries, backdating records or using shared login credentials; (2) incomplete batch records — missing operator signatures, blank fields for required steps or incomplete deviation investigations; (3) inadequate OOS investigation documentation — Phase I laboratory investigations that fail to rule out assignable laboratory error before concluding an OOS result is real, or Phase II investigations that lack adequate sampling and retesting protocols; (4) validation gaps — computerised systems used in GMP activities without formal validation or with outdated validation documentation that no longer reflects the current configuration; and (5) training record deficiencies — personnel performing critical operations without documented training on the current approved procedure version.

---

This article is for informational purposes only and does not constitute legal, regulatory, or compliance advice. Pharmaceutical regulatory requirements are subject to change; always consult the current published guidance from the FDA, the applicable CFR provisions at eCFR.gov, and qualified regulatory counsel before making compliance decisions.