FDA Warning Letter

Regulatory Event

On July 8, 2026, FDA’s Center for Drug Evaluation and Research (CDER) issued Warning Letter 320-26-100 (MARCS-CMS 728508) to Spa De Soleil, Inc., an over-the-counter (OTC) topical drug manufacturer at 10443 Arminta Street, Sun Valley, California (Facility Establishment Identifier (FEI) 3003876848), following an inspection conducted January 20 to 26, 2026. The letter’s central finding is not a single analytical miss. It documents a system that generated 51 out-of-limit (OOL) and out-of-specification (OOS) results from the firm’s pharmaceutical water system between May 2024 and July 2025 and never adequately investigated any of them, layered onto component identity testing gaps involving methanol- and diethylene-glycol-risk ingredients, an unvalidated manufacturing process, an unvalidated rapid microbiological method, and a quality unit FDA found incapable of enforcing any of it. FDA also noted that a prior inspection of this facility, conducted September 13 to 17, 2021, had already cited substantially similar Current Good Manufacturing Practice (CGMP) violations — the evidence FDA used to establish that the firm’s corrective actions have not held.

The primary citation, 21 CFR 211.192, addresses the firm’s water system testing program. From May 2024 through July 2025, Spa De Soleil generated 51 OOL/OOS results testing the water used to manufacture its OTC topical drug products — conductivity and total organic carbon (TOC) results exceeding specification, and recovery of gram-negative microorganisms from multiple points of use, without the investigations ever identifying those organisms to genus or species. Instead of determining assignable cause, the firm resampled and retested the water system until it obtained a passing result and continued using the water — the water-system equivalent of the retest-until-passing pattern that FDA v. Barr Laboratories, Inc., 812 F. Supp. 458 (D.N.J. 1993), and FDA’s 2006 OOS Guidance were written to prohibit. Barr established that a result cannot be invalidated, retested past, or averaged away without first identifying a specific, documented, assignable cause; where no laboratory error is found, the investigation must proceed to a Phase II assessment of the underlying system before any disposition decision is made. Spa De Soleil’s practice of placing an individual point-of-use valve on hold after a failing recovery, while continuing to draw water from other valves on the same recirculating loop, reflects a basic misunderstanding of water system microbiology: recoveries in a purified water loop are not localized events. A gram-negative recovery at one point of use is evidence about the biofilm state of the loop as a whole, not a property of that valve alone.

What the Record Documents

FDA’s inspection found the root cause the firm’s own investigations never reached: the water system itself was not designed or maintained to prevent biofilm formation. Dead legs, threaded fittings, Teflon tape, and ball valves — non-sanitary components inconsistent with the smooth, crevice-free design expected of a pharmaceutical water loop — created the physical conditions for persistent microbial colonization, and sampling frequency was not aligned to batch production schedules. This is a pattern FDA’s enforcement history returns to repeatedly: a system-level design and maintenance failure manifests as a string of individual OOS events, and a firm that treats each event as a discrete laboratory anomaly, rather than asking whether its system can consistently produce water meeting specification, will typically keep generating new OOS results. Root cause analysis that stops at “resample and retest” is not root cause analysis; it is symptom suppression — which is why FDA faulted the firm’s Corrective and Preventive Action (CAPA) plan directly: it did not commit to changing monitoring frequency, did not commit to identifying and quantifying recovered organisms going forward, and did not address whether the system’s design flaws contributed to the OOS pattern. FDA’s requested remediation is instructive for any firm facing a similar backlog: a vulnerability assessment covering temperature, materials of construction, slope, dead legs, stagnant locations, unsanitary fittings, and flow velocity; a full system validation report obtained only after those design issues are corrected; revised total microbial count limits appropriate to each product’s intended use; and a lot-by-lot risk assessment of every product currently in U.S. distribution or within expiry, including customer notification and recall.

The second major citation, 21 CFR 211.84(d)(1) and (d)(2), moves this warning letter from a laboratory-controls deficiency to a potential patient-safety event. Spa De Soleil did not perform identity testing on incoming shipments of a component at risk of methanol contamination that it used as an active pharmaceutical ingredient (API) in its OTC topical products, instead relying on supplier certificates of analysis (COA) without ever establishing the reliability of those suppliers’ testing. FDA’s letter references its own guidance on this exact hazard because the consequence is not theoretical: methanol-contaminated ingredients have caused fatal poisonings, a risk publicly underscored by the 2020–2021 hand-sanitizer methanol contamination events that triggered a wave of FDA import alerts and recalls. The same gap recurred with glycerin and other components at risk for diethylene glycol (DEG) or ethylene glycol (EG) contamination. The United States Pharmacopeia (USP) identity test for glycerin — parts A, B, and C of the compendial monograph — exists to detect DEG/EG before the material enters manufacturing, a safeguard FDA has emphasized following the DEG/EG-contaminated cough syrup deaths linked to manufacturers in India and elsewhere in recent years. Spa De Soleil performed neither the methanol identity test on its high-risk ethanol-type component nor the USP DEG/EG limit test on incoming glycerin. FDA’s response requirements are correspondingly urgent: retain-sample testing for DEG/EG within 30 calendar days, a full risk assessment of in-expiry product containing any DEG/EG-risk ingredient, and a description of how every component lot will be tested for identity, strength, quality, and purity going forward, with justification required for any continued reliance on supplier COAs in place of lot-by-lot testing.

Technical and Quality Context

Two further deficiencies show the same verification gap propagating through the rest of the quality system. Under 21 CFR 211.100(a), Spa De Soleil had not validated its manufacturing processes, and its batch records omitted critical processing parameters — times, speeds, and equipment identification for weight-based operations — needed to demonstrate a state of control. The firm’s response committed to executing process performance qualification (PPQ) by April 2026 but provided no validation plans, no critical parameter identification, and no retrospective risk assessment of product already distributed without validation. Under 21 CFR 211.160(b), the firm’s alternative rapid microbiological method was never adequately validated against USP <61> compendial methods; it treated what should have been a quantitative enumeration method as a qualitative limit test, an error that invalidates any claim of USP equivalency and calls into question every total-count and objectionable-organism result the method generated for water, raw materials, and finished product.

The pattern converges at 21 CFR 211.22(a): a quality unit without the authority or practice to catch any of this. FDA found the quality unit had not qualified its contract microbiology laboratories under 211.22(b), had not performed the annual product quality reviews required under 211.180(e), and had not validated cleaning procedures for shared equipment under 211.67(b). FDA explicitly noted that Spa De Soleil’s 2026 written commitments mirror commitments the firm made after the September 2021 inspection that cited similar violations — the clearest evidence FDA can cite that corrective actions were neither effective nor durable. A quality unit that approves the same remediation language twice in five years without executing it has not failed a single inspection; it has failed as a system.

Decision Relevance

For OTC drug manufacturers and their quality control directors, three lessons follow. First, water system OOL/OOS investigations must identify recovered organisms to genus and species and evaluate the system as a whole — a passing result at one point of use after a failing result at another is dilution of the evidence, not resolution. Second, identity testing for DEG/EG- and methanol-risk components is not a paperwork exercise satisfied by a supplier’s COA; FDA is likely to treat the absence of lot-by-lot identity testing on these specific components as a high-priority finding regardless of firm size. Third, repeat citations across inspection cycles are read by FDA as a management failure, not a laboratory failure — the fix has to reach the quality unit’s authority and the water system’s engineering, not just the investigation template. XGene Consulting’s Warning Letter and FDA 483 remediation practice works with OTC and topical drug manufacturers to rebuild OOL/OOS investigation systems, requalify pharmaceutical water systems against sanitary design standards, and design the component identity testing programs FDA now expects as a baseline for any firm bringing high-risk raw materials into a topical or oral OTC drug product.