FDA Findings: Trial Injections and Testing Into Compliance

A “trial injection” sounds harmless: a quick look before the real run. The problem starts when the trial uses an actual product sample. If the trial passes, it can be reported; if it fails, it can quietly disappear and be replaced by a run that passes. That is testing into compliance — and it is a pattern FDA continues to cite. Three Warning Letters from 2026 show how it looks in practice.

Background: data integrity and ALCOA+ in practice.

What FDA found

Company X1 — favourable results reported, OOS left out

Cited under 21 CFR 211.194(a), with related findings under 211.160(b) and 211.192. According to the letter, trial injections were run at HPLC and GC positions. FDA states that the favourable result was reported, while out-of-specification results from the trial injections were not reported or investigated. Laboratory notebooks lacked sample preparation records for the injections, and the firm said the operator did not record the trial injection and did not inform a supervisor or QA.

For API testing, FDA found injections run from an HPLC location designated for trial injections, with trial chromatograms not saved in the system or the batch record; the system activity log listed a number of such entries (redacted in the letter) between 2023 and 2025.

FDA found the response inadequate and stated that “the injection of trial samples is not acceptable”, in part because all data from analysis of product samples must be retained and reviewed. It requested an independent review of trial injections over the past five years and an investigation of any OOS trial results.

Company X2 — thousands of unexplained injections, a “Developer” role

The letter (an API manufacturer; FDA cites adulteration under FD&C Act section 501(a)(2)(B) without specific CFR sections) states that analysts performed thousands of unexplained injections on one chromatography data system over 30 months, and over 70 trial injections on another in a single month. Examples include four trial injections run under a “Developer” role that the analyst confirmed could not be traced to any product, sample or analysis, with no rationale in the notebook.

FDA’s concern is that allowing a developer-level role for analyst work on CGMP samples fails to prevent unauthorised or undocumented sample analyses. FDA acknowledged that the firm stopped all trial injections and removed the role, and requested a comprehensive, independent investigation of all trial injections showing they were not sample injections, plus a data integrity assessment covering all computerised systems.

Company X3 — unreported OOS injection, batch released

An API manufacturer evaluated against ICH Q7 expectations. FDA describes multiple instances of unreported sample injections for related substances and assay. In one batch, an OOS assay injection was not reported while a passing injection was; the batch was released and distributed to the US. The firm lacked procedures for electronic data review, and the quality unit did not review electronic data. In its response the firm acknowledged undocumented trial injections, unreported analytical data and discarded printouts; FDA found the response inadequate because it did not describe a thorough retrospective investigation of the OOS result.

Why this happens

Interpretation — the letters state findings, not root causes. These are common patterns, not claims about these firms.

• “Just checking the system.” Trial runs start as a way to check the column or the instrument, and drift into using real samples because they are at hand.
• Paper-only review. If the reviewer only sees the printed report, any injection not printed does not exist. Electronic data that nobody reviews (X3) is where unreported injections live.
• Over-privileged roles. Developer or administrator roles let analysts run outside the approved method and sequence (X2).
• Pressure on the first result. An OOS means an investigation; a re-injection that passes avoids one. Without a culture where an OOS is simply reported, the shortcut is tempting.

What good looks like

Example: a fictional QC lab running HPLC assays on a CDS we’ll call ChromaLog.

1. No sample, ever, outside the approved sequence. System suitability and equilibration use standards or blanks as defined in the validated method — never product samples. The procedure says so explicitly.
2. Every injection is accounted for. The reviewer reconciles injections acquired against injections reported for each sequence, including aborted, unprocessed and reprocessed runs. Anything unexplained is a deviation.
3. Review electronic data, not printouts. Second-person review covers the electronic results and relevant audit trail entries before results are used for release.
4. The first OOS stands until investigated. An OOS result is reported and investigated under 21 CFR 211.192; it is only invalidated with a valid, documented, scientifically sound justification.
5. Roles that fit the job. Routine analysts have no developer or administrator rights; method development is done in a separate, controlled environment or role, with its own review. See analysts with admin rights and shared logins.
6. Detect it systematically. Use the system’s own reports to list injections by user, role and project, and review them periodically — the same data investigators will ask for. See audit trail review.
7. Make reporting safe. Training explains why an OOS is never a personal failure and why a hidden one is. A quality culture where analysts report problems is a control, not a slogan.

Regulatory basis

• 21 CFR 211.194(a) — laboratory records must include complete data derived from all tests necessary to assure compliance with specifications.
• 21 CFR 211.160(b) — laboratory controls must be scientifically sound and appropriate.
• 21 CFR 211.192 — unexplained discrepancies and failures to meet specifications must be thoroughly investigated.
• API manufacturers: FDA evaluates API CGMP against ICH Q7 expectations, as both API letters above state.
• FDA guidance: Data Integrity and Compliance With Drug CGMP — Questions and Answers (final, December 2018): question 13, where FDA states it considers it a violative practice to use an actual sample in test, prep or equilibration runs; and question 2 on when a CGMP result may be invalidated. Guidance is non-binding; the regulations above are.

EU angle

Interpretation: EU GMP has no clause titled “trial injections”, but in our reading the same expectation follows from complete and original records and OOS investigation requirements in EudraLex Volume 4 (Part I, Chapter 6 for quality control; Annex 11 for computerised systems). Check the current versions on EudraLex before relying on specific clauses.

Takeaways

• A product sample injected outside the approved sequence is data, and all data must be kept and reviewed.
• If the reviewer only sees printouts, the review cannot find unreported injections.
• Reconcile injections acquired versus reported — every time.
• Report the first OOS. Then investigate it.