What do FDA warning letters to supplement firms actually cite?

FDA's warning letters database is public, and the language firms have already been cited for is one of the most concrete pictures available of what an inspection actually checks. The five letters below are real, current, and quoted directly. Nothing here is paraphrased into a claim FDA didn't make.

The letters

Specifications: the most common gap

21 CFR 111.70(e) requires product specifications for the identity, purity, strength, and composition of a finished batch. FDA cited its absence outright in the Nupack letter: “you were unable to produce finished product specifications for identity, purity, strength, composition and limits on contamination.” Flax & More had specifications for strength and composition but not identity or purity: “Specifications for the strength and composition of the product were established; however, you did not establish specifications for identity and purity.” Nutratech had gone further and set an identity specification, but FDA found it inadequate on its own terms: organoleptic testing alone “will not provide unique information that is specific to each” ingredient when multiple ingredients “share the same organoleptic properties.” Having a specification and having a specification FDA will accept are not the same thing.

Identity testing: the certificate-of-analysis trap

Mineral BioSciences relied on supplier certificates of analysis to confirm ingredient identity without first qualifying the suppliers through its own confirmatory testing. FDA's letter states the rule without qualification: “21 CFR 111.75(a)(2) does not allow firms to rely on a certificate of analysis to confirm the identity of a dietary ingredient. Rather, under 21 CFR 111.75(a)(1)(i), you must conduct at least one appropriate test or examination to verify the identity of any component that is a dietary ingredient, prior to using a component (or submit an exemption petition under 21 CFR 111.75(a)(2)(ii)).” The same letter also cited a failure to qualify suppliers under 111.75(a)(2)(ii)(A) for the non-identity specifications where CoA reliance is actually permitted: two related but separate violations in one finding.

Batch records: the paper trail FDA checks first

Three of the five letters cite incomplete manufacturing or batch records. Mineral BioSciences' batch production records were missing the initials of who weighed, measured, verified, and added each component, all required elements under 21 CFR 111.260(j)(2). Nutratech's master manufacturing records lacked written instructions for verifying manufacturing steps under 111.210(h)(3), and its batch production records omitted equipment identity, cleaning timestamps, yield statements, and monitoring results required under 111.260. Nupack had no master manufacturing record or batch production record for its products at all, meaning the baseline document, not a missing detail within one.

Own-label distributor responsibility: it doesn't transfer

The Ultra Perform letter addresses a brand that used contract manufacturers for its products and had no quality agreements with them. FDA's language is the clearest statement available of how responsibility works when a brand doesn't manufacture: “As a dietary supplement distributor that contracts with a manufacturer to manufacture a dietary supplement that you distribute under your own label, you have an obligation to know what and how manufacturing activities are performed so that your firm can make decisions related to whether your packaged and labeled dietary supplement products conform to established specifications and whether to approve and release the products for distribution.” And directly on outsourcing: “Although your firm may contract out certain dietary supplement manufacturing operations, it cannot, by the same token, contract out its ultimate responsibility to ensure that the dietary supplements it places into commerce… are not adulterated for failure to comply with dietary supplement CGMP requirements… regardless of who actually performs the dietary supplement CGMP operations.”

What this suggests for a brand that doesn't manufacture

1. A cGMP-certified manufacturer is not the same as a manufacturer whose specifications, identity testing, and batch records would survive an FDA inspection for your specific SKUs. Ask to see the documents, not just the certificate.
2. If your manufacturer relies on supplier certificates of analysis for identity, ask how the supplier was qualified. CoA reliance for identity, without qualification, is exactly what one of these letters cites.
3. A written quality agreement with your manufacturer does not move legal responsibility off your firm; it only allocates who does which task.
4. None of this tells you whether your own product would pass a review; it shows what FDA has actually cited other firms for. Check current documentation status with the free check.

• This article never states or implies that these firms' products are unsafe. A warning letter is a notice of alleged regulatory violations, not a safety finding about the finished product.
• No individual recipient of these letters is named here, even though each letter is addressed to a named person; only the firm is identified.

Related: 21 CFR Part 111 explained for brand owners, identity testing and the 100 percent rule under Part 111, and what your contract manufacturer is responsible for. Compliant Always tracks which documents are on file; it does not represent that a brand would pass an FDA inspection.