The CAPAs Were Filed. The Problem Kept Recurring.

Two FDA warning letters issued in March 2026 share a citation pattern that is easy to misread. Medline Industries, LP, cited on March 25, was not told it lacked CAPA procedures. Intas Pharmaceuticals Limited, cited on March 30, was not told its CAPA system was absent. Both firms were told their CAPAs did not work.

Medline's letter describes corrective and preventive actions that were not commensurate with the risk posed by recurring complaints and medical device reports. The firm had procedures. The firm had a complaint record. The CAPA responses simply did not match what the accumulating signal was telling the quality unit to do. Intas faced a structurally similar finding on the drug side: FDA characterized its CAPAs as "not robust," pointing directly to recurring out-of-specification results in assay stability testing. The OOS events continued after CAPAs were closed. That is the record FDA brought to the inspection.

This is a different kind of failure than what most CAPA training addresses. The standard preparation focuses on the initiation question: what threshold or trigger should move a deviation into a CAPA? The March 2026 findings sit past that question entirely. Both firms had initiated CAPAs. Both firms had closed them. The problem they were cited for happened after the CAPA record was complete.

What "commensurate with risk" means operationally is that the investigation depth, the scope of corrective actions, and the timeline and method for effectiveness verification all need to reflect the magnitude of the signal that opened the CAPA. A CAPA response to a cluster of related complaints that uses the same investigation depth as a single isolated event is not a defensible quality system. It is a filing system. FDA's language in Medline's letter makes this distinction explicitly: the actions taken were not sized to what the incoming risk data was showing.

The Intas OOS stability pattern is a precise illustration of what "not robust" means in practice. Stability out-of-specification findings do not arrive without warning. They develop across testing intervals, and a quality unit reviewing stability data has time to see the pattern before it becomes a citation. A CAPA that addresses one OOS event without examining the trend across multiple timepoints, the analytical method, the storage conditions, or the relationship between the failing batches is a CAPA that was written to close a record. When FDA sees recurring OOS findings after a CAPA was generated for the same failure type, the agency's assessment is not that the firm had an unlucky year. The assessment is that the root cause was never correctly identified, which means the corrective action was predictably insufficient from the start.

Both March 2026 cases reflect a line of FDA scrutiny that has been present in enforcement data for several years but is showing up more explicitly in recent WL language. The inspection is not limited to whether a CAPA procedure exists or whether CAPA records are current. The inspection is now examining whether the CAPAs that were generated changed outcomes. For Medline, complaints and MDRs continued arriving after CAPA actions were documented. For Intas, OOS stability results recurred after CAPAs were closed. Both of those outcome records were visible to FDA on inspection, and both firms were cited for what the records showed about effectiveness, not about process compliance.

For quality teams, the diagnostic question is not whether your CAPA log is maintained. The question is whether your root cause investigations are generating actions that are scaled to the problem. A root cause finding of "operator error" in response to a sterility event, or an attribution of recurring OOS results to a single analyst's technique without examining the measurement system, the reference standard, or the environmental controls, will not hold when those failures continue after the CAPA is marked closed. Review the CAPAs your site has closed in the last 18 months and look specifically at any finding where the underlying failure type recurred within 12 months of closure. That is the pattern FDA is identifying in its enforcement actions, and it is the pattern that produces re-citations on reinspection. The question is not whether your CAPA system is running. The question is whether the actions it produces are sized to the risk that opened them.

CTA: Find out whether your CAPA closures would survive FDA scrutiny. Submit your facility for an Inspection Risk Scan.