WARNING LETTER

Ava Inc. MARCS-CMS 721180 — April 14, 2026

Delivery Method:: VIA EMAIL WITH READ RECEIPT
Reference #:: 320-26-64
Product:: Drugs

Recipient:: Recipient Name

Dr. Ram P. Chakroborty; Recipient Title

President & Chief Executive Officer; Ava Inc.; 7051 S. Adams St.
Willowbrook, IL 60527-7592
United States

Issuing Office:: Center for Drug Evaluation and Research (CDER); United States

Warning Letter 320-26-64

April 14, 2026

Dear Dr. Ram P. Chakroborty:

The United States Food and Drug Administration (FDA) inspected your drug manufacturing facility, Ava Inc., FEI 3008736380, at 7051 S. Adams St., Willowbrook, IL, from October 6 to October 21, 2025.

This warning letter summarizes significant violations of Current Good Manufacturing Practice (CGMP) regulations for finished pharmaceuticals, Title 21 Code of Federal Regulations (CFR), parts 210 and 211 (21 CFR parts 210 and 211), and significant deviations from CGMP for active pharmaceutical ingredients (APIs).

Because your methods, facilities, or controls for manufacturing, processing, packing, or holding do not conform to CGMP, your drugs are adulterated within the meaning of section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act (FD&C Act), 21 U.S.C. 351(a)(2)(B).

We reviewed your November 12, 2025 response to our Form FDA 483 in detail and acknowledge receipt of your subsequent correspondence.

During our inspection, our investigators observed specific violations and deviations including, but not limited to, the following.

Finished Drug CGMP Violations

1. Your firm failed to exercise appropriate controls over computer or related systems to assure that only authorized personnel institute changes in master production and control records, or other records (21 CFR 211.68(b)).

Your firm lacked adequate system security and access controls over your laboratory equipment used to test drug products prior to release. For example, your firm utilized a common username and password to access high performance liquid chromatography (HPLC) equipment used for impurity testing of drug products. Additionally, analysts had administrator privileges to modify and delete data. Our investigators also found multiple deleted gas chromatography (GC) analytical sequences in the recycle bin, including sequences used for system suitability and stability analysis.

In your response, you state your employee violated your procedure and training by deleting sequence files without informing the supervisor or quality assurance (QA). You also state a software update allowed users to bypass “User-Security Access Restrictions” and that you have disabled the automatic software update function. You also state that you have implemented security parameters to enhance access controls to electronic data files.

Your response is inadequate. You do not provide adequate details of management oversight to ensure effectiveness of the corrective actions implemented. You also lack a comprehensive assessment of all electronic and paper-based documentation systems to ensure their adequacy.

In response to this letter, provide:

A complete, independent assessment of documentation systems used throughout your manufacturing and laboratory operations to determine where documentation practices are insufficient. Include a detailed corrective action and preventive action (CAPA) plan that comprehensively remediates your firm’s documentation practices to ensure you retain attributable, legible, complete, original, accurate, contemporaneous records throughout your operation.
A comprehensive, independent assessment of computer system security and integrity. Provide a report that identifies vulnerabilities in the design and controls and a thorough CAPA plan for each of your laboratory computer systems and that addresses the following elements:
o A list of all hardware (both standalone and networked) and software used by your laboratory.
o Identify and evaluate vulnerabilities in performance and security of all of these computer systems including, but not limited to, their configurations, administrative rights, password controls, audit trail capabilities and state of implementation for each system, qualification/validation status, deviation history, backup capabilities, network requirements, completeness of data records, suitability of current hardware/software for its intended use(s), change management, and management oversight.
o Detail the associated user privileges for each system.
 Specify user roles and associated user privileges for all staff levels who have access to the laboratory computer system, and provide organizational affiliations, responsibilities, and titles. Clearly specify all staff who have administrator privileges.
 Fully describe how you will ensure segregation of firm personnel involved with laboratory testing from those with administrator rights. For all staff roles that are permitted to have administrative rights, specify the scope and type of privileges.
o Assess each system to determine if unique usernames and passwords are used.
o Evaluate policies and procedures regarding computers and data governance with special emphasis on audit trails, prohibiting data deletion, and appropriate modifications of results. Specify how your firm prevents data deletion and undocumented/inappropriate modifications of data. Also describe how you ensure original data and information are always preserved. Provide your procedures for audit trail review.
o Provide requirements for data retention and backup for all laboratory systems.
o Describe how you will ensure that all quality control (QC) tests are performed by an analyst and receive second-tier review from a separate qualified individual (e.g., lab manager). Provide related procedure(s).
o Summarize your interim controls to assure reliable performance and security while your CAPA plan is being implemented.

2. Your firm failed to ensure that laboratory records included complete data derived from all tests necessary to ensure compliance with established specifications and standards (21 CFR 211.194(a)).

Your laboratory records did not include complete and accurate data to support the analyses performed. For example:

The audit trail for the Fourier Transform Infrared (FTIR) spectroscopy equipment showed no activity from September 23 to 30, 2025. However, your testing records, including the FTIR daily usage log, showed drug testing was performed with this equipment during this time frame. Furthermore, your analyst stated your FTIR system frequently crashes.
Our investigators found chromatograms for testing performed at HPLC location 61, which your analyst stated was used for trial injections, although your HPLC procedure had been updated in 2022 to remove the requirement to perform trial injections. For example, your analyst performed a trial injection of a sample of (b)(4)% (b)(4) topical solution (b)(4) impurity content at HPLC vial location (b)(4). The (b)(4) content result was (b)(4) parts per million (ppm) which met your specification of equal to or less than (b)(4) ppm. Your analyst then repeated the injection at vial location (b)(4) and obtained a result of less than (b)(4) ppm. Both results were within your acceptable specification range. However, the more favorable result was reported. Furthermore, your laboratory notebook contained no details of the sample preparation for the initial injection at location (b)(4).
Our investigators found chromatograms for testing performed at GC location (b)(4), which your analyst stated was used for trial injections. For example, your analyst performed a trial injection of an in-process sample of (b)(4)% (b)(4) topical solution (b)(4) content determination at GC location (b)(4). The (b)(4) result was (b)(4)%, which exceeded the specification of (b)(4) to (b)(4)%. A second trial injection was performed with a result of (b)(4)%. Your analyst then repeated the injections using GC location (b)(4) and obtained a result of (b)(4)%, which was within your acceptable specification range. The favorable result was reported, and out-of-specification (OOS) results from the trial injections were not reported or investigated. Furthermore, your laboratory notebook contains no record of the sample preparations associated with the OOS results. We also note your GC procedure requires a trial injection to “be performed to ensure the system is equilibrated before beginning a sequence. The trial injection is only for information purposes and is not processed as a part of raw data.” It is particularly concerning that you included these unacceptable practices in written procedures, as they had the effect of directing staff to deviate from basic CGMP requirements.

Your systematic use of trial injections indicates a fundamental lack of oversight of data integrity in your laboratory. This practice also enables performance of undocumented analytical work, justifying unfavorable results, and indicates your laboratory system is not under control.

In your response, you state trial injections were performed to verify the condition of the system. Additionally, you state, “The Operator did not record the trial injection, nor did they inform their Supervisor nor QA, violating Company procedure and their training.” To correct gaps in your procedures related to trial injections and audit trail review, you conducted data integrity training and created a written procedure to outline general expectations on data integrity.

Your response is inadequate. Your proposed corrective actions do not adequately address your practice of performing trial injections. The injection of trial samples is not acceptable, in part, because all data from analysis of product samples must be retained and reviewed. You generally reported trial injections when passing results were recorded and disregarded when less favorable or OOS results were obtained. Furthermore, you do not adequately address the capability of your system suitability to determine the readiness of the equipment for analysis.

In response to this letter, provide:

A complete assessment of documentation systems used throughout your manufacturing and laboratory operations to determine where documentation practices are insufficient. Include a detailed CAPA plan that comprehensively remediates your firm’s documentation practices to ensure you retain contemporaneous, attributable, legible, complete, original, and accurate records throughout your operation.
Describe your plans to prevent manipulation and enhance control of all CGMP records. Specifically, describe your reconciliation and integrity improvements for all CGMP records that may be in loose form or otherwise vulnerable to manipulation. Based on an independent review by a qualified consultant, provide a gap analysis and specific CAPA measures you will take to safeguard integrity of records (e.g., recording data in logbooks, pre-paginated documents, and validated electronic systems).

3. Your firm failed to establish an adequate quality control unit with the responsibility and authority to approve or reject all components, drug product containers, closures, in-process materials, packaging materials, labeling, and drug products (21 CFR 211.22(a)).

Your quality unit (QU) did not provide adequate oversight for the manufacture, testing, and release of your drug products. For example:

Analysts frequently conducted trial injections. This practice is not scientifically sound. (21 CFR 211.160(b)).
Your QU failed to perform investigations into OOS results obtained during trial injections. (21 CFR 211.192)
Your QU failed to establish a written procedure to review audit trails and raw analytical data captured by analytical instruments to ensure data reliability for batch release (21 CFR 211.160(a)).

We also noted your procedure requires quality assurance personnel to have “unbiased responsibility, separate from quality control.” However, your quality control unit has performed the finished product quality assurance approval function since at least 2023.

Your firm’s quality systems are inadequate. See FDA’s guidance document, as well as, for help implementing quality systems and risk management approaches to meet the requirements of CGMP regulations 21 CFR, parts 210 and 211 at https://www.fda.gov/regulatory-information/search-fda-guidance-documents/q10-pharmaceutical-quality-system and https://www.fda.gov/regulatory-information/search-fda-guidance-documents/quality-systems-approach-pharmaceutical-current-good-manufacturing-practice-regulations, respectively.

In your response, you state QC was signing as final approval “likely due to a temporary period of high turnover of these positions.” You also acknowledge observing entry errors or missing entries.

Your response is inadequate. You lack a sufficient comprehensive evaluation of your quality unit’s capabilities to fulfill all required quality related functions.

In response to this letter, provide:

A comprehensive assessment and remediation plan to ensure your QU is given the authority and resources to effectively function. The assessment should also include, but not be limited to:
o A determination of whether procedures used by your firm are robust and appropriate
o Provisions for QU oversight throughout your operations to evaluate adherence to appropriate practices
o A complete and final review of each batch and its related information before the QU disposition decision
o Oversight and approval of investigations and discharging of all other QU duties to ensure identity, strength, quality, and purity of all products
A comprehensive, independent assessment of your laboratory practices, procedures, methods, equipment, documentation, and analyst competencies. Based on this review, provide a detailed plan to remediate and evaluate the effectiveness of your laboratory system.
A retrospective, independent review of all invalidated OOS (including in-process and release/stability testing) results for products currently in the U.S. market and within expiry as of the date of this letter for the last three years from the initial date of inspection and a report summarizing the findings of the analysis, including the following for each OOS result:
o Determine whether the scientific justification and evidence relating to the invalidated OOS result conclusively or inconclusively demonstrate causative laboratory error.
o For investigations that conclusively establish laboratory root cause, provide rationale and ensure that all other laboratory methods vulnerable to the same or similar root cause are identified for remediation.
o For all OOS results found by the retrospective review to have an inconclusive or no root cause identified in the laboratory, include a thorough review of production (e.g., batch manufacturing records, adequacy of the manufacturing steps, suitability of equipment/facilities, variability of raw materials, process capability, deviation history, complaint history, batch failure history). Provide a summary of potential manufacturing root causes for each investigation, and any manufacturing operation improvements.
A comprehensive review and remediation plan for your OOS result investigation systems. The CAPA should include, but not be limited to, the following:
o Quality unit oversight of laboratory investigations
o Identification of adverse laboratory control trends
o Resolution of causes of laboratory variation
o Initiation of thorough investigations of potential manufacturing causes whenever a laboratory cause cannot be conclusively identified
o Adequately scoping of each investigation and its CAPA
o Revised OOS investigation procedures with these and other remediations

API CGMP Deviation

Failure to maintain complete data derived from all laboratory tests conducted to ensure your API complies with established specifications and standards.

Your firm did not include complete data to support the analysis performed. For example, your QC staff conducted API analysis at HPLC location (b)(4), which your analyst stated was designated for trial injections. In addition, chromatograms from trial injections were not saved in the analytical testing system or as part of your official batch record, creating opportunities to compromise the integrity of analytical data used for making batch release decisions. From October 12, 2023, to October 3, 2025, your system activity log listed approximately (b)(4) entries described as “instrument running sample from location (b)(4).”

Furthermore, the audit trail for the FTIR spectroscopy equipment showed no activity from September 23 to 30, 2025. However, your testing records, including the FTIR daily usage log, showed you performed API testing with this equipment during this time frame on (b)(4)% (b)(4) API. Furthermore, your analyst stated your FTIR system frequently crashes.

In your response, you indicate, “A test/trial injection was performed as needed to verify HPLC system conditioning. However, no documentation was performed for the trial/test runs.” You also state your procedures now outline general data integrity expectations including instructions on controlling and reviewing audit trails, and you have removed instructions to perform trial injections.

Your response is inadequate. You fail to adequately address how the various issues associated with the unstable laboratory equipment will be handled by your deviation system in the future, and how you will ensure stability is restored only through appropriate systems suitability approaches. You lack an adequate retrospective review to determine the scope and impact of your data integrity issues throughout your facility. You also fail to provide a sufficient impact analysis of your past FTIR crashes.

In response to this letter, provide:

A comprehensive, independent review of all trial injections performed in the last five years for your API and finished drug testing. Include the initial results and all results that were used to release the API batches and finished drug lots. Indicate whether any of the affected batches remain in the market or were used to support a filing drug application. If used to support an application, notify our office at CDER-OC-OMQ-Communications@fda.hhs.gov.
o As part of the comprehensive independent review by your third party (see Data Integrity Remediation paragraph below), note all results that were OOS from the trial injections and confirm whether an investigation was conducted at the time of testing. If not, perform a comprehensive investigation into the OOS result. At the time of the inspection, you had not conducted investigations into your practice of conducting trial injections. Therefore, provide your investigation into this practice and provide your CAPA to prevent its recurrence.

CGMP Consultant Recommended

Based upon the nature of the violations and deviations we identified at your firm, you should engage a consultant qualified to evaluate your operations to assist your firm in meeting CGMP requirements.

Your use of a consultant does not relieve your firm’s obligation to comply with CGMP. Your firm’s executive management remains responsible for resolving all deficiencies and systemic flaws to ensure ongoing CGMP compliance.

Data Integrity Remediation

Your quality system does not adequately ensure the accuracy and integrity of data to support the safety, effectiveness, and quality of the drugs you manufacture. See FDA’s guidance document Data Integrity and Compliance With Drug CGMP: Questions and Answers for guidance on establishing and following CGMP compliant data integrity practices at https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers.

We strongly recommend that you retain an independent third-party to assist in your remediation. In response to this letter, provide:

A comprehensive, independent investigation into the extent of the inaccuracies in data records and reporting. Your investigation should include:
o A detailed investigation protocol and methodology; a summary of all laboratories, manufacturing operations, and systems to be covered by the assessment; and a justification for any part of your operation that you propose to exclude.
o Interviews of current and former employees to identify the nature, scope, and root cause of data inaccuracies. We recommend that these interviews be conducted by a qualified third party.
o An assessment of the extent of data integrity deficiencies at your facility. Identify omissions, alterations, deletions, record destruction, non-contemporaneous record completion, and other deficiencies. Describe all parts of your facility’s operations in which you discovered data integrity lapses.
o A comprehensive retrospective evaluation of the nature of the testing data integrity deficiencies. We recommend that a qualified third party with specific expertise in the area where potential breaches were identified should evaluate all data integrity lapses.
A current risk assessment of the potential effects of the observed failures on the quality of your drugs. Your assessment should include analyses of the risks to patients caused by the release of drugs affected by a lapse of data integrity and analyses of the risks posed by ongoing operations.
A management strategy for your firm that includes the details of your global corrective action and preventive action plan. Your strategy should include:
o A detailed corrective action plan that describes how you intend to ensure the reliability and completeness of all the data you generate including analytical data, manufacturing records, and all data submitted to FDA.
o A comprehensive description of the root causes of your data integrity lapses including evidence that the scope and depth of the current action plan is commensurate with the findings of the investigation and risk assessment. Indicate whether individuals responsible for data integrity lapses remain able to influence CGMP-related or drug application data at your firm.
o Interim measures describing the actions you have taken or will take to protect patients and to ensure the quality of your drugs, such as notifying your customers, recalling product, conducting additional testing, adding lots to your stability programs to assure stability, drug application actions, and enhanced complaint monitoring.
o Long-term measures describing any remediation efforts and enhancements to procedures, processes, methods, controls, systems, management oversight, and human resources (e.g., training, staffing improvements) designed to ensure the integrity of your company’s data.
o A commitment to have a qualified consultant conduct extensive annual audits, for at least two years, to assist in evaluating CAPA effectiveness after you have executed your data integrity remediation protocol.
o Inform FDA if you will be hiring a Chief Integrity Officer who is fully empowered to receive anonymous complaints from employees reporting data integrity concerns and with the authority to ensure any potential breach is promptly investigated (by independent quality assurance function, along with expertise from outside entities whenever needed).
o A status report for any of the above activities already underway or completed.

Conclusion

The violations and deviations cited in this letter are not intended to be an all-inclusive list of violations and deviations that exist at your facility. You are responsible for investigating and determining the causes of any violations and deviations and for preventing their recurrence or the occurrence of other violations and deviations.

Correct any violations and deviations promptly. Failure to promptly and adequately address this matter may result in regulatory or legal action without further notice including, without limitation, seizure and injunction. Unresolved violations and deviations may also prevent other Federal agencies from awarding contracts.

Failure to address violations and deviations may also cause FDA to withhold issuance of Export Certificates. FDA may withhold approval of new applications or supplements listing your firm as a drug manufacturer until any violations and deviations are completely addressed and we confirm your compliance with CGMP. We may re-inspect to verify that you have completed corrective actions to address any violations and deviations.

This letter notifies you of our findings and provides you an opportunity to address the above deficiencies. After you receive this letter, respond to this office in writing within 15 working days¹. Specify what you have done to address any violations and deviations and to prevent their recurrence. In response to this letter, you may provide additional information for our consideration as we continue to assess your activities and practices. If you cannot complete corrective actions within 15 working days, state your reasons for delay and your schedule for completion.

Send your electronic reply to CDER-OC-OMQ-Communications@fda.hhs.gov. Identify your response with FEI 3008736380 and ATTN: Matthew Jensen.

Sincerely,
/S/

Francis Godwin
Director
Office of Manufacturing Quality
Office of Compliance
Center for Drug Evaluation and Research
_______________________

1 Under program enhancements for the Generic Drug User Fee Amendments (GDUFA) reauthorization for fiscal years (FYs) 2023-2027, also known as the GDUFA III Commitment Letter, your facility may be eligible for a Post-Warning Letter Meeting to obtain preliminary feedback from FDA on the adequacy and completeness of your corrective action plans.