FDA Warning Letter

Regulatory Event

On July 13, 2026, FDA issued Warning Letter 320-26-101 (MARCS-CMS 727904) to Shimoga Chemicals, an active pharmaceutical ingredient (API) manufacturer at W57A, MIDC, Kupwad, Sangli, Maharashtra, India, following an inspection conducted January 19-23, 2026. What FDA documented is not a single analytical lapse. It is a quality system in which the analytical laboratory, the sampling program, the process validation function, and the quality unit (QU) itself failed simultaneously – anchored by a specific, named data integrity violation involving a U.S.-distributed API batch that FDA’s own investigators caught, not the firm’s quality system.

The core finding involves clomiphene citrate USP, an API Shimoga manufactures for U.S. pharmacy compounding. FDA documented that batch CC/005/24-25 had an unreported high performance liquid chromatography (HPLC) injection for assay testing that produced an out-of-specification (OOS) result – a result that never appeared in the batch record. Instead, a separate, passing injection was the only result documented and submitted for quality unit review. Because Shimoga had no procedure requiring electronic data review, and its QU never reviewed the underlying electronic chromatographic data independent of the paper batch record, the batch was released and distributed to the U.S. market on the strength of a result the firm’s own analyst had already superseded with a discarded, unreported failing run. This is precisely the enforcement pattern FDA documented at Ranbaxy Laboratories’ Paonta Sahib facility in India, where investigators found analysts selectively reporting passing results while discarding failing chromatographic runs – a direct violation of 21 CFR 211.194(a)(8), which requires laboratory records to be complete, accurate, and attributable to the individuals who performed the testing. That 2008 finding resulted in Import Alert 66-40 covering more than 30 marketed products and, ultimately, criminal charges against senior executives. Shimoga’s firm-wide Import Alert 66-40, imposed June 2, 2026, sits on the same enforcement track.

What the Record Documents

The mechanism matters as much as the outcome. An unreported injection is not a paperwork omission – under ALCOA+, that first injection was still Attributable (tied to the analyst who ran it), Legible, and Contemporaneous the moment it was acquired. Deleting it from the reported record does not erase it as a regulatory event; it creates an independent Completeness violation layered on top of the underlying OOS result itself. FDA’s finding cites 21 CFR 211.68(b) – the requirement that computer-generated data be checked against the original electronic record rather than selectively transcribed or curated – precisely because Shimoga’s quality unit had no mechanism to detect the discrepancy between what the instrument actually generated and what the batch record reported. Without independent electronic data review, a quality unit is disposition-deciding on a curated narrative, not on the underlying analytical record, which is the same structural failure FDA cited at Sun Pharmaceutical Industries’ Halol facility in 2014, where backdated records and manipulated Empower audit trail entries made individual attribution of laboratory actions impossible and triggered an 18-month reinspection cycle before the facility was released from heightened scrutiny.

Shimoga’s response to this specific finding is where the letter becomes most instructive for practitioners. The firm acknowledged undocumented trial injections, unreported analytical data, discarded printouts, and inadequate review of electronic laboratory records – essentially conceding the violation. It committed to a retrospective review of all U.S. batches and to engaging a third-party data integrity consultant. But FDA explicitly found the response inadequate because it did not describe a thorough retrospective investigation into the OOS result for the specific batch already distributed to U.S. patients. Acknowledging a systemic problem is not the same as investigating the one batch already in the U.S. supply chain, and FDA drew that distinction sharply.

Technical and Quality Context

The letter’s second major finding compounds the first: Shimoga had no defined sampling instructions for its API batches – no specified sample quantity, sampling location, sampling method, or documentation of whether sampling occurred before or after key processing steps. During the inspection, the production manager stated that quality control samples were routinely collected from arbitrary locations, and the QC manager stated that in-process testing occurred only when the facility owner personally provided samples. That statement alone describes a laboratory operating outside any documented control system – testing was not a scheduled, procedure-driven activity but a discretionary one contingent on ownership involvement. Combined with the finding that no method verification had ever been performed for any test method used on clomiphene citrate USP – including identification, related substances by HPLC, residual solvent, and assay – the picture is a laboratory generating numbers without a validated basis for confidence in any of them, a 21 CFR 211.160(a)(b) deficiency at its most fundamental level.

The quality unit failure runs through every other observation in the letter. Shimoga has manufactured and distributed hundreds of batches since April 2023, yet documented zero OOS investigations, zero out-of-trend investigations, and zero laboratory incident records over at least two years – despite FDA identifying multiple events, including the CC/005/24-25 OOS, that should have triggered a formal investigation under 21 CFR 211.192. A quality unit that generates no investigations across two years of commercial manufacturing is not evidence of a well-controlled process; combined with an admitted unreported OOS result, it is evidence that the investigation trigger mechanism itself does not function. The same QU failure extended to the stability program: Shimoga’s own procedure required at least one commercial batch placed on stability annually, but the firm placed batches on stability only in 2021, 2022, and 2023 – no U.S.-market batches manufactured in 2025 or 2026 were ever placed on stability, and the firm lacked raw data to support its long-term stability conclusions. Stability samples were also held in packaging that differs from the commercial container-closure system, with no equivalence evaluation performed – meaning the expiry date assigned to a U.S.-distributed API is not actually supported by data generated in the container patients’ medications will ultimately depend on.

Decision Relevance

Process validation and cleaning findings reinforce the same root cause: procedures exist on paper but do not reflect actual practice. Shimoga’s validation reports did not address a key manufacturing operation at all, and hold times were not validated – one batch was held for an extended, undefined period with no supporting data. Cleaning acceptance criteria were not adequately defined, and facility management admitted that only one water type was used for all equipment cleaning regardless of product, directly contradicting the firm’s own written cleaning procedures. The analyst who performed the unreported injections had no documented laboratory or Current Good Manufacturing Practice (CGMP) training on file. Each of these findings, examined individually, might be treated as an isolated gap. Examined together, alongside a quality unit that ran no investigations for two years and a laboratory with no verified test methods, they describe a facility where written procedures and actual practice diverged systematically, and where the quality unit had neither the authority, the data, nor apparently the expectation to close that gap.

For any company operating or sourcing from an API facility with a similar profile – high batch volume, contract testing relationships, or discretionary in-process testing arrangements – this warning letter is a direct signal to audit whether your own quality unit independently reviews electronic laboratory data before batch disposition, rather than relying on the paper or PDF summary an analyst chooses to submit. It is also a signal to confirm that every analytical method in routine use, including those run by a contract testing laboratory, has documented verification or validation data on file, not a commitment to perform it later. XGene’s data integrity remediation and quality system practice works with API manufacturers and their U.S.-market customers to build electronic data review protocols, retrospective OOS investigation frameworks, and quality unit authority structures that would catch a discrepancy like CC/005/24-25 before a batch reaches distribution, not after an FDA investigator finds it during an inspection.