Outsourced Testing, Retained Liability: Why Does Contract Lab Qualification Matter to the FDA?
The FDA holds the product owner responsible for every result a contract lab generates. In its warning letters to contract testing labs, the agency states plainly that it considers contractors as extensions of the manufacturer’s own facility.
The FDA’s guidance on quality agreements for contract manufacturing arrangements makes the same point. It defines manufacturing to include testing, and it applies CGMP to all contract facilities, including analytical testing labs. If a lab fails an inspection, its oversight program warrants scrutiny, making lab qualification a regulatory obligation and not a procurement formality.
Drug sponsors, dietary supplement brands, and device manufacturers all need a documented, defensible process. Our guides to selecting a third-party testing laboratory or CRO and making effective use of contract laboratories cover the commercial side of that decision. This piece covers the regulatory side: The credentials a lab must hold and the evidence needed to verify them, with practical input from Kurt Schulze, lab director of ACTA Laboratories, who has hosted the lab’s FDA inspections since 1994. Kurt explains what sponsors should verify at each stage.
What Credentials Should a Contract Lab Hold for FDA-Regulated Work?
A contract lab qualifies for FDA-regulated work only when it operates under the quality regulations that govern the product(s) it tests. A generic accreditation does not meet that bar. The required mix differs with the product being tested—drugs, dietary supplements, and/or medical devices.
One common claim does not hold up. The FDA does not certify or approve laboratories. The agency only inspects labs, and a passed inspection is not a certification. What matters is whether an inspection covered the analyses a sponsor plans to outsource.
| Credential | What it signals | When it matters |
| FDA drug establishment registration | The lab appears in FDA’s Drug Establishments Current Registration Site with “Analysis” as a business operation, and renews its registration each year between October 1 and December 31 | Drug and API release, stability, and raw material testing |
| CGMP compliance under 21 CFR Parts 210 and 211 | The lab runs a GMP quality system with an independent quality unit | Any testing that supports drug batch release |
| GLP compliance under 21 CFR Part 58 | The lab can run nonclinical safety studies to FDA standards | Toxicology and safety data for submissions |
| DEA registration | The lab can legally receive and test controlled substances, and can account for them | Scheduled APIs and finished products |
| 21 CFR Part 111 capability | The lab uses scientifically valid methods suited to supplement CGMP | Dietary supplement identity, purity, strength, and composition |
| ISO 13485 alignment | The lab understands the device quality framework FDA adopted under the QMSR, effective February 2, 2026 | Device and combination product testing |
| ISO/IEC 17025 accreditation | Third-party confirmation of technical competence | Useful supporting evidence, but not a substitute for CGMP |
Kurt on the credentials that matter most:
Start with what you can check yourself. A lab testing drug product should be registered with FDA, and you can look up its registration and FEI number in FDA’s public databases before you ever call them. Registration only means FDA knows the lab exists and can walk in the door, so don’t stop there. What you really want is a CGMP quality system that’s being used every day: Written procedures, training records for the people who will run your method, calibrated and qualified instruments, and a real process for handling an out-of-specification (OOS) result. If your product is a controlled substance, the lab also needs a current DEA license that covers that schedule, and it should be able to show you how it secures and accounts for the material.
Paper vs Practice: What Should a Sponsor Look For during a Contract Lab Audit?
An audit tests whether a lab’s documented systems match what happens at the bench. While paper credentials show intent, an audit shows practice.
FDA’s quality agreement guidance frames contractor oversight through ICH Q10, which sets out three ongoing activities: Assessing a lab’s suitability before outsourcing, defining responsibilities in a written agreement, and monitoring performance afterward. The same guidance points to ICH Q9 for risk-based decisions, including how deeply to audit. For audit planning basics, see CL’s primer on auditing contract laboratories.
In practice, most sponsors start on paper. A quality questionnaire comes before the first sample; a full audit follows once there is data to review.
| Audit area | What to request | Red flag |
| Quality unit | Organization chart, quality manual, and QA review records | QA reports to the lab manager it oversees |
| SOPs and training | Current SOPs and analyst training files | Analysts running methods they have no training record for |
| Equipment | IQ, OQ, and PQ records, plus calibration logs | Overdue calibration or missing qualification for critical instruments |
| Method validation and transfer | Validation reports and method transfer protocols | Compendial methods used without verification for your matrix |
| OOS investigations | The last 12 months of OOS files for the product(s) tested. | Results invalidated without a documented root cause. Kurt highlights that sponsors should have access to data only on their products. Labs should maintain strict client confidentiality at all times. |
| Sample management | Chain of custody and retention records | Gaps between receipt and testing with no storage records |
| Stability (if applicable) | Chamber mapping and excursion logs | Unreported temperature or humidity excursions |
Kurt on what an auditor should examine first:
A good number of our clients request a paper audit in the form of a quality questionnaire before they send the first sample, and that’s how it should be. An in-person audit before the first sample isn’t typical for a contract lab because until you’ve sent a sample, there’s none of your own data to look at, only the quality system.
My advice is to pick one finished report and walk it backward to the bench. Ask for the raw data, the sample prep records, the standard and reagent lots, the instrument’s maintenance, calibration and validation records, and the training file of the analyst who ran it. A lab that has its act together can pull that pretty quickly. If it turns into a day of explanations, that tells you something.
Kurt names six findings that should end an audit on the spot:
- A lab that lacks basic upkeep, even though they knew the auditor was coming
- Shared logins
- Audit trails switched off, or missing where they belong
- Runs that were deleted or never reported
- Reluctance to show raw data
- Missing maintenance, calibration, or validation records, or missing status stickers on equipment that requires them
Follow the Audit Trail: How Should a Sponsor Evaluate a Lab’s Data Integrity Practices?
Data integrity comes down to traceability: Every result must lead back, unaltered, to its raw data. Data integrity failures remain one of the most common findings in FDA warning letters to contract testing labs.
The FDA’s guidance on Data Integrity and Compliance With Drug CGMP sets the baseline. It expects data to be attributable, legible, contemporaneous, original, and accurate (ALCOA). Industry practice extends this to ALCOA+, which adds complete, consistent, enduring, and available. Labs that create electronic records for CGMP purposes must also meet 21 CFR Part 11 requirements for audit trails and electronic signatures.
The FDA’s warning letters to contract testing labs return to the same three failure modes:
- Incomplete records. A lab reports a result, but the raw data behind it is partial or missing.
- Uncontrolled system access. Analysts can delete or alter chromatography files without a trace.
- Denied CGMP scope. A lab insists it does no CGMP work, while its clients use its data for CGMP decisions.
Each failure mode leads to the same audit question: Can the lab prove who generated a result, when, and whether anyone changed it since? Kurt adds—
Ask about spreadsheets because that’s where a number moves most easily. In our lab, spreadsheet calculations are run under a program that ties every entry to a user and password. Find out how they review their audit trails and what they found the last time. When everyone does their job honestly and correctly, the audit trail is clean. And a clean review is a good sign, as long as the lab can show you the review really happens.
Interpreting a Lab’s FDA Inspection History
An inspection history reveals as much through a lab’s responses as through its findings. A Form 483, or just 483, lists an investigator’s observations at the close of an inspection. A warning letter signals that the FDA judged the response inadequate or the violations significant
The FDA publishes most of this record—the agency’s warning letter database and the FDA Data Dashboard list inspection classifications and citations by firm. Form 483s are available by request from the FDA or directly from the lab. A well-run lab shares its most recent 483 and written response without hesitation.
Some patterns stand out in the FDA’s correspondence with contract labs: A weak response or one that lacks supporting documentation to a 483 invites escalation. Also, the FDA expects the lab to own method suitability and OOS communication. In a warning letter to a Florida contract lab, the FDA cited microbial test methods never shown equivalent to the USP compendial method. It reminded the lab to inform all customers of OOS results or significant testing problems. A lab’s written responses, therefore, reveal more than its count of observations.
These three questions frame that review:
- When was your last FDA inspection, and what was its scope?
- Did it include preapproval inspections for NDA or ANDA products?
- Can we review any 483 observations and your written responses?
Kurt on reading an inspection record:
Our clients use our inspection history as a report card, and I think that’s fair, as long as you read it the way an investigator would. A 483 is the investigator’s observations at the close of an inspection, not the FDA’s final word. When the FDA revisits, one of the first things they look at is how you responded last time, and a sponsor should do so too. The same observation showing up inspection after inspection is a bad sign, and so is anything involving deleted or altered data.
Kurt’s closing test for any lab is simple: “After reading their 483s and responses, ask whether this is the lab you want to trust your company’s reputation with.”
Put it in Writing: What Belongs in a Quality Agreement with a Contract Lab?
A quality agreement assigns each CGMP responsibility to a named party before testing begins. The FDA finalized its guidance in November 2016, and it applies directly to contract testing labs.
The guidance recommends keeping the quality agreement separate from commercial contracts, such as master services agreements. It also makes clear that the agreement cannot shift legal responsibility. In one of FDA’s illustrative scenarios, a contract lab repeatedly reports passing results for failed analyses. The FDA could hold both parties responsible: The lab for its data, and the owner for never auditing the lab despite having a two-year audit procedure in place.
| Clause | What it should define |
| Scope and methods | Which tests the lab performs, under which compendial or client methods |
| Method verification and validation | Who requests them, who performs them, and the acceptance criteria |
| Reference standards | Who supplies them, and how the lab qualifies and stores them |
| Shipping, storage, and retention | Receipt conditions, chain of custody, and sample retention periods |
| OOS investigation and reporting | The clock for notifying the sponsor, and how both parties coordinate the investigation |
| Change control | Which lab changes need sponsor approval before implementation |
| Data and records | Raw data access, retention periods, and audit trail review |
| Audit rights | Frequency, notice periods, and for-cause audits |
| Regulatory inspections | Whether the lab notifies the sponsor when FDA inspects work tied to its product |
| Subcontracting | Whether the lab may outsource any testing, and on what terms |
| Batch decisions | Confirmation that release and disposition decisions stay with the sponsor |
Kurt on where quality agreements break down:
Labs get into trouble when they use a manufacturing template to build a quality agreement, so half the clauses don’t fit a lab, and the ones that matter are vague. OOS handling causes the most friction once the testing starts. Agree on how the lab and the client will coordinate an out-of-spec investigation.
Before the First Result: A Final Checklist for Qualifying a Contract Lab
The FDA will judge your lab’s work as your own. Qualify it with the same rigor as you apply to your own facility. Qualification is complete only when each step below is documented before a lab releases its first regulated result.
[ ] Regulatory fit: Does the lab operate under the regulations that govern your product, such as Part 211, Part 111, or the QMSR?
[ ] Registrations and licenses: Have you verified the laboratory’s FDA and DEA registration, where applicable?
[ ] Risk assessment: Have you documented the testing’s criticality and set the audit depth accordingly?
[ ] Inspection history: Have you reviewed Form 483 observations, warning letters, and the lab’s responses?
[ ] Quality agreement: Have both quality units signed an agreement that assigns every CGMP responsibility, including how both sides coordinate OOS investigations?
[ ] Ongoing oversight: Have you scheduled periodic re-qualification and challenge testing?
[ ] Onsite audit: Have you traced one finished report back to its raw data, instrument records, and analyst training file?
[ ] Data integrity: Have you reviewed audit trails, user access controls, and Part 11 compliance?
Looking for an FDA-registered, CGMP laboratory for your next project?
Visit Contract Laboratory to find a qualified laboratory, or submit a lab request to get competitive quotes today.
Kurt Schulze is laboratory director of ACTA Laboratories, Inc.—an FDA-registered, DEA-licensed analytical testing lab in Foothill Ranch, California, that his mother, Carolyn Schulze, founded in 1990. He holds a BS in chemistry from UC Irvine and joined ACTA in 1992 as its second employee.
Kurt runs method development, method validation, stability programs, and the analytical strategy behind clients’ regulatory submissions—from early development through commercial manufacturing. He has hosted ACTA’s FDA inspections since 1994, co-hosting the two most recent, in 2023 and 2026. Kurt specializes in HPLC, GC, GC-MS, ICP-MS, FTIR, and UV-Vis, plus compendial, wet chemistry, and microbiology testing.
This article was created with the assistance of Generative AI and has undergone editorial review before publishing.