21 CFR 211Current Good Manufacturing Practice for Finished Pharmaceuticals

21 CFR Part 211 is the FDA's Current Good Manufacturing Practice (cGMP) regulation for finished pharmaceuticals — every prescription drug, every OTC drug, every animal drug intended for human or veterinary use in the United States. It sits inside Title 21 (Food and Drugs) of the Code of Federal Regulations, alongside Part 210 (general cGMP scope and definitions), Part 212 (PET drugs), Part 600 (biologics) and Parts 600–680 (biological products).

Part 211 was first published in 1978 and has been amended repeatedly. It is short by regulatory standards — about 50 pages of text — but its eleven subparts (A through K) reach into every corner of a drug-manufacturing operation: who works there, what the building looks like, where the equipment came from, how components are received and tested, how each batch is made and packaged, what the lab does, what records you keep, and how you handle returns and complaints.

The relationship to other rules matters. Part 210 sets out the scope and defines terms; you cannot read Part 211 without it. 21 CFR Part 11 governs the electronic version of any record Part 211 requires you to keep. EU GMP Part I (and the Annexes — particularly Annex 1 for sterile, Annex 11 for computerised systems, Annex 15 for qualification and validation) is the European equivalent. ICH Q7, Q8, Q9, Q10 sit above all of them as international harmonisation guidance.

Subpart J is the centre of the universe. Section 211.180 sets a six-year retention period (one year past expiry, never less). Sections 211.186 (MMR) and 211.188 (BMR) are the bones of every batch record system. Section 211.192 requires a written investigation of any unexplained discrepancy or failure to meet specification — that is where deviation, OOS and CAPA live. Section 211.198 governs the complaint file. If your records are wrong, nothing else in Part 211 can save you.

Section 211.22 establishes the Quality Unit as a distinct organisational function with the authority and responsibility to approve or reject all components, drug product containers, closures, in-process materials, packaging materials, labelling, and drug products — and to investigate errors. The Quality Unit must be independent of production. FDA inspectors look hard at the reporting line: if the head of Quality reports to the head of Manufacturing, that is a finding.

Section 211.25 covers personnel qualifications. Every person engaged in manufacturing, processing, packing or holding a drug product must have the education, training and experience to do their assigned work, and the training must be cGMP-specific, recurring, and documented. The training file is one of the first things an investigator asks for at the start of a site visit.

Sections 211.80 through 211.94 cover the lifecycle of every component (active and inactive), every container and every closure from receipt through release. You must have written procedures for each. Receipt (211.82) requires visual examination and identifying numbers. Storage (211.80) requires conditions appropriate for the material. Testing (211.84) requires representative sampling, identity testing on each lot, conformance to written specifications, and quarantine until released.

The identity test on every received lot of every component (211.84(d)(1)–(2)) is the rule most often translated badly into IT. It means each lot — not each shipment, not each supplier — must be sampled and identity-tested before it can be charged into a batch. Skipping identity tests because 'we trust the supplier' has cost more than one site a Warning Letter.

Containers and closures (211.94) must be tested for compatibility with the drug product, must not be reactive or additive in a way that alters the drug's identity or quality, and must protect the drug for its labelled shelf life. The validation of the primary pack is usually owned by Packaging Engineering but the cGMP evidence lives in the BMR.

Section 211.100 requires written procedures for production and process control that are designed to assure that the drug products have the identity, strength, quality and purity they purport or are represented to possess. These procedures must be drafted, reviewed and approved by the appropriate organisational units, and reviewed and approved by the Quality Unit. They are the master procedures the MMR references.

Section 211.101 covers charge-in of components — written procedures, weighing or measuring by one person and checked by a second, with both signing. This is the original 'two-person' rule and it is older than electronic signatures by decades. 211.103 requires yield calculation at appropriate phases. 211.110 requires written procedures for in-process controls and tests. 211.111 imposes time limits. 211.115 governs reprocessing — it must be approved by the Quality Unit, must follow a written procedure, and the reprocessed batch must be tested against the same specifications as the original.

Section 211.122 is the most-cited section in Subpart G and one of the most-cited in all of Part 211. It requires written procedures for receipt, identification, storage, handling, sampling, examination and testing of labelling and packaging materials. Labels must be stored in locked, limited-access areas. Issuance must be controlled — only the quantity needed for the batch, and a reconciliation at the end of the run between issued, used and returned-or-destroyed. Excess labels carrying lot or control numbers must be destroyed.

Section 211.125 covers labelling issuance. Section 211.130 covers packaging and labelling operations — including a 100% online label inspection (or equivalent) for cut labels with lot numbers. Section 211.132 covers tamper-evident packaging for OTC products. Section 211.137 covers expiration dating tied to the stability programme under 211.166.

The QC laboratory has its own subpart. Section 211.160 requires written specifications, standards, sampling plans and test procedures, all approved by the Quality Unit. Test methods used to release drug products must be validated — 211.165(e) calls this out explicitly and ICH Q2 sets out how. Section 211.166 mandates a written stability programme that supports the expiration date. Section 211.167 requires special tests for sterile products. Section 211.170 requires reserve samples held in their final container/closure for one year past expiry (or three years past distribution for OTC without expiry).

Section 211.192 — the OOS / discrepancy investigation rule — is part of Subpart J but is mostly executed in the lab. Any unexplained discrepancy or failure to meet any specification must be thoroughly investigated; the investigation must extend to other batches that may have been associated with the failure; the conclusion must be documented and signed by the Quality Unit. The FDA's 2006 OOS guidance walks through what 'thoroughly investigated' means in practice.

Section 211.180 sets retention: all records required by Part 211 must be retained for at least one year after the expiration date of the batch, or in the case of certain OTC products without expiry, three years after distribution. Sections 211.182 (equipment cleaning and use log), 211.184 (component records), 211.186 (MMR) and 211.188 (BMR) are the four pillars of the records subpart.

Section 211.186 — the MMR — requires the master to be prepared, dated and signed by one person and independently checked, dated and signed by a second person. The MMR must include name and strength, description of dosage form, name and weight or measure of each active and inactive ingredient, statement of theoretical weight and yield at each phase, complete manufacturing and control instructions, sampling and testing procedures, and special notations or precautions. Changes to an approved MMR must follow the same approval workflow.

Section 211.188 — the BMR — requires an accurate reproduction of the appropriate master production or control record to be prepared for each batch produced. It must include identification of major equipment and lines used; specific identification of each batch of component or in-process material used; weights and measures of components used; in-process and laboratory control results; inspection of packaging and labelling area; sampling performed; identification of persons performing and directly supervising or checking each significant step; any deviation from the master record; results of investigations; signature of the person responsible for approving any in-process or finished-product testing; and the signature of the person who approved the batch.

The FDA's 2018 data-integrity guidance reads Part 211 through the lens of ALCOA+ (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available). The agency makes clear that data integrity is not a Part 11 concern bolted on — it is what Part 211 has always required. Backdated records, shared logins, deleted chromatographic injections, and 'trial' runs that never appear in the BMR are all Part 211 violations first and Part 11 violations second.

Practical implications: every record must be attributable to a specific human (no shared logins), contemporaneous with the action (no transcribing from paper to system at end of shift), original (the first capture is the record — not a clean copy), and complete (every result, including failed ones, is in the record). If the system allows an analyst to inject a sample, look at the result, and delete it before saving, the system is not data-integrity-compliant regardless of what the marketing says.

1. 211.22 — Quality Unit lacks independence from production, or has insufficient authority to reject material.
2. 211.25 — Training records do not demonstrate ongoing competency on the SOPs the operator actually executes.
3. 211.42 / 211.46 — Environmental monitoring data shows excursions that were not investigated.
4. 211.84 — Incoming components released without the full identity testing required for each lot.
5. 211.100 / 211.110 — Production procedures are not followed; in-process limits are exceeded without investigation.
6. 211.122 — Label reconciliation is missing or done after the BMR is signed; excess labels not destroyed.
7. 211.160 / 211.165 — Test methods used for release are not validated, or are used outside their validated range.
8. 211.166 — Stability programme does not support the labelled expiry, or stations are missed without justification.
9. 211.188 — BMRs lack the signatures, equipment IDs, or in-process results required; deviations not linked to the batch they occurred on.
10. 211.192 — Investigations are superficial, do not extend to other batches, and are not signed by the Quality Unit.
11. 211.194 — Lab records lack raw data, calculations, or evidence of system suitability before injection.
12. 211.198 — Complaint files lack the investigation depth required to identify systemic causes.

V5's pharmaceutical profile is designed so that the Part 211 obligations are enforced by the workflow rather than checked at end-of-shift on paper. The shop floor cannot proceed past a step the rule requires, and the records the rule requires are written by the act of working, not by a transcription step afterwards.

• Subpart B — every login is attributable to a specific human; training assignments tie SOPs to roles, and kiosk steps are hard-blocked if the operator's training on the relevant SOP is overdue or unacknowledged on the current effective version.
• Subpart E — incoming lots require an identity test before they can be released to the warehouse; charge-in at the kiosk refuses to dispense from an unreleased or expired lot.
• Subpart F — every charge-in is two-person; tolerance bands come from the MMR snapshot; yield is calculated at every phase from kiosk data, not re-keyed.
• Subpart G — label artwork is under the same change-control workflow as the MMR; label issuance, use and reconciliation are mandatory kiosk steps; excess labels with lot data must be destroyed-and-witnessed before the WO can close.
• Subpart I — QC results flow into the BMR from instruments where possible; OOS investigations under 211.192 are first-class records that link to the originating batch and to any extended-scope batches.
• Subpart J — MMR is approved with two e-signatures (preparer + independent reviewer per 211.186); BMR is rendered from the immutable MMR snapshot bound to the WO; retention is enforced; audit trail is on every regulated table.