FDA Complete Response Letters: What 438 Published CRLs Say About Facility Readiness

A Complete Response Letter (CRL) is the FDA's written refusal of a drug or biologic application. The agency has published 438 of them, spanning 2002 to 2026, and it writes them in sentences it reuses.

We classified every one against its own wording. The most common quality reason for refusal is not a failed trial, a safety signal or a statistics problem. It is the facility.

Your next Complete Response Letter will probably not be about your data.

Roughly half of the letters cite facility readiness, and the count has climbed every year since 2018. If your pre-submission risk register still treats a CRL as mostly a clinical risk, you are planning against a version of the FDA that stopped existing around 2018.

This is the full analysis behind the Atlas CRL report. It carries every chart, the method, the two ways the record gets misread, and six checks a quality team can run before its next filing.

1. What we classified, and why the wording matters more than the keyword

The corpus is the openFDA transparency dataset of Complete Response Letters.

Each letter was classified twice:

• First into one of eleven rejection categories. Clinical Data, Safety, CMC, Manufacturing and Facility, Inspection, Labeling, PK/PD, Statistics, Benefit-Risk, Regulatory and Compliance, and Other.
• Then into finer deficiency sub-themes, from sterility assurance and process validation to out-of-specification results and container closure integrity. Every sub-theme is mapped to the GxP domain that owns it (GMP, GCP, GLP, PV), so a team can filter to what it is accountable for.

The classification follows each letter's own language rather than its summary paragraph. That choice sounds academic. Section 6 on labeling shows it flips the conclusion.

Three limits apply to every number on this page:

• The corpus is what the FDA has published, not everything it has issued. Publication is ongoing, so any total is the record at a date.
• Each letter may cite several deficiencies, so theme shares do not sum to one hundred percent.
• No share is the sole reason an application was refused.

Issuance climbed through the late 2010s and peaked in 2024. Some of that curve is transparency rather than severity. The FDA is publishing more letters, and faster, than at any point in its history, so the raw count overstates how much stricter the agency has become. Composition is the part a quality team can act on, and one theme dominates it.

2. Why the FDA issues a Complete Response Letter: the four sentences it reuses

When the agency refuses an application on facility grounds, the reviewer does not phrase the finding freshly each time. Four sentences recur across dozens of letters, and each one carries a requirement a filing plan can be tested against.

Sentence one, in 13 letters.

"Satisfactory outcomes of both the PAI and the CGMP surveillance inspections will be needed prior to an approval of the application."

Two conditions, not one. The pre-approval inspection of the named facility has to be satisfactory, and so does the surveillance history of that site, independent of your application. A plan that prepares for one inspection has prepared for half the requirement.

Sentence two, in 22 letters.

"The facility should provide satisfactory responses to these deficiencies to the FDA office indicated on the FDA 483 prior to your complete response to your application."

This is a sequencing requirement, and it is the one programs most often get wrong. The Form 483 response goes to the district office named on the form, and it has to land before the application response, not alongside it.

Sentence three, in 27 letters.

"Your complete response should include the date(s) of the facility's response(s) to the FDA Form 483."

Quality can satisfy this before it is ever asked by holding a dated log of every Form 483 response for every site and contract site named in a filing. Most organizations cannot produce that log quickly.

Sentence four, in 10 letters.

"The facility's satisfactory responses are dependent on FDA's determination that the facility has come into compliance with CGMP and may require re-inspection of the facility."

A written response may not be enough. Reinspection stays a live possibility, so any launch timeline resting on a single successful inspection is resting on the optimistic case.

Together, the four sentences describe a gate that is procedural rather than scientific. In a large share of these refusals the reviewers accepted the science and refused the site.

Atlas

See what Atlas knows about your next investigator.

700,000+ inspections since 2010. Search by investigator, CFR code, or supplier. Every 483 they’ve issued, in under a second.

See it live

3. The trend has shifted toward the facility

We broke the GMP scope into sixteen sub-themes and counted citations by year from 2015 onward.

The facility and Form 483 row carries 211 citations across twelve years, and the consolidated theme it belongs to appears in roughly half of all letters analyzed. Three things stand out in that row:

• It is the only GMP theme that kept growing after 2021 instead of fading.
• It peaked in 2024, the same year total letter volume peaked.
• It outweighs the next two sub-themes combined.

Two themes that quality leaders spend a great deal of time on barely register. Data integrity appears three times in twelve years. Training and personnel appears seven times. Both are rounding errors against 211. Data integrity governance and training records are important, and neither is what the agency writes down when it refuses an application.

The modern Complete Response Letter is less likely to say a drug does not work than to say the agency cannot yet trust how, or where, you will make it. A refusal because of a failed pivotal trial is a strategic problem years in the making. A refusal because of an open Form 483 observation or an unvalidated cleaning protocol is a readiness problem, and readiness is something Quality already owns.

4. What the letters ask for below the facility gate

The GMP requests under the facility headline are specific enough to scope against. A program mapped to the agency's phrasing catches more than one mapped to a principle.

Extractables and leachables, 55 letters. The ask is concrete:

"You have not provided an adequate extractables/leachables evaluation to support the safety of your proposed container closure system."

Process validation, 23 letters. Sometimes at the level of the equipment rather than the protocol:

"You do not provide process validation references demonstrating your assembly line has been determined to be adequate."

Combination products, 35 letters. The stability requests reach into device performance. This catches teams who scoped stability to the drug alone:

"Provide stability data supporting the proposed shelf-life of the combination product including testing of the expelled volume, breakloose, and glide force of the combination product."

Sterile manufacturing, similar numbers. Sterilization validation data, sterile filtration parameters, microbial retention studies and media fills recur, with microbial language appearing in 36 letters.

Stability, specifications and impurities spike hardest around 2018 and recur every year after. Drug substance, DMF and API findings sit next to container closure integrity as the supply chain's two most common chokepoints.

5. Refusals concentrate in a few review offices

• One review office accounts for 19.6 percent of the letters that name an approval center.
• The top three together account for 36.5 percent.
• The rest falls into a long single-digit tail.

This is worth knowing before you file. If your application goes to one of the concentrated offices, a substantial body of published precedent exists about what that office has refused and why, and a team can read it. If it goes to the tail, almost none does, and you are working from general expectations rather than that office's own record.

6. Two ways to misread this record

Two mistakes account for most of the wrong conclusions drawn from CRL data, and both are avoidable.

Mistake one: counting citations as if they were letters

In 2024 the classification records 209 deficiency citations across the letters issued that year. There were nowhere near 209 letters. Each letter cites several deficiencies, so a citation count runs roughly three times a letter count, and the two are not interchangeable.

Read as citations, those are close. Read as decisive reasons for refusal, they are not.

Mistake two: taking the labeling number at face value

Labeling appears in more than half of all Complete Response Letters, and the count crests in 2024. Read as a deficiency rate, that says the industry has a labeling problem. It does not. A large share of those appearances is one sentence:

"We reserve comment on the proposed labeling until the application is otherwise adequate."

That is the agency declining to review labeling because something else in the application is unresolved. Where labeling is queried on its own terms, the ask is usually procedural:

"Your proposed Prescribing Information (PI) must conform to the content and format regulations found at 21 CFR 201.56(a) and (d) and 201.57."

Two things follow:

• Do not build a risk model that treats labeling as a leading cause of refusal.
• Expect that a first-cycle refusal on manufacturing grounds means the labeling review is still ahead of you, not behind you.

This is the clearest argument for classifying against the letters' own wording. A keyword count would have reported a labeling crisis, and the sentences say the opposite.

On the safety side, the most common theme is not a specific toxicity but an inadequate safety database, meaning not enough exposure to characterize risk. That theme also reached its high-water mark in 2024.

7. The refusal is rarely the end, so speed becomes the metric

The majority of applications that receive a Complete Response Letter are eventually approved after remediation and resubmission.

Quality is therefore measured less on whether a refusal happens than on how fast and how completely the team closes it out, and that speed is mostly controllable. A team that has read how comparable findings were closed moves faster than one starting cold. The team that closed the gap before filing never has to.

8. Six checks to run against your next filing

Each check comes from the wording quoted above and from how facility inspections proceed, not from general principle.

1. Hold a dated record of every Form 483 response for every site and contract site named in the filing, and confirm it went to the district office named on the form itself. Two of the recurring sentences ask for precisely this.
2. Plan against two inspections, not one. A pre-approval inspection and a surveillance inspection of the same site, because the letters set both as conditions.
3. Treat reinspection as scheduled rather than exceptional, and know what it does to your launch date.
4. Scope container closure, extractables and leachables, and combination product stability the way the letters query them, including device performance where a device is involved.
5. Read your own record the way an inspection reads it. Pull the last two years of change controls and deviations, sample them, and test each one against the SOP it cites. Then cross-check the systems that log the same event. An environmental monitoring timestamp that disagrees with the access record behind it becomes an observation even when the work was done.
6. Ask which of the four recurring sentences the agency could write about this program tomorrow.

Anything you cannot answer with a document is your gap list.

9. Explore the classification yourself

The classification is available as a free interactive view. Filter by deficiency theme, GxP domain and year, read the agency's own wording behind any theme, and export the view you build as a CSV to take into your own gap review. No account required.

The shorter version of this analysis, written for quality leaders on LinkedIn, is here: What 438 published CRLs say about facility readiness.

What Atlas does with the rest of the record

The Complete Response Letter classification is one part of a larger system. Atlas structures the public FDA record, including inspection outcomes, Form 483 observations, warning letters, establishment inspection reports and Complete Response Letters, alongside inspection records from international agencies, so the questions in this analysis can be asked directly of the data rather than assembled by hand from PDFs.

• Inspection intelligence. More than 700,000 inspection records with outcomes, investigator profiles and site histories, searchable before an inspection rather than after one.
• Enforcement records, connected. Form 483s, warning letters and CRLs linked to the sites and applications behind them, so a facility finding traces to its consequences.
• Benchmarking. Your sites, USFDA investigators and deficiency history against the published record, scoped to the GxP domains your team owns.

The record grows every few weeks, and it keeps saying the same thing. The only open question is whether your team reads it before a letter arrives with your company's name on it.