Cybersecurity and Medical Devices: What You Need to Know

Our analysis identified quality leadership and culture as a foundational systemic gap. When senior management does not give the quality unit sufficient authority, resources, and organizational support, deficiencies rarely stay confined to one procedure or department. They can affect investigations, facility maintenance, production decisions, corrective and preventive action (CAPA) effectiveness, and timely risk escalation throughout the pharmaceutical quality system (PQS). What the Warning Letters Revealed The Warning Letters reviewed for this analysis repeatedly showed three related patterns: ineffective quality-unit oversight, inadequate management attention to known deficiencies, and corrective actions that addressed individual observations without resolving their underlying systemic causes. 1. Ineffective Quality Unit Authority Quality units (QUs) commonly exist on paper but often lack the authority, resources, or competence to enforce current good manufacturing practice (cGMP) compliance. These limitations lead to a host of issues, from failing to investigate discrepancies to allowing unsafe production practices to continue. For example, in a June 2026 Warning Letter , the FDA found that Excelvision, a Fareva facility, was disinfecting critical equipment components with sporicide rather than sterilizing them between batches. The pharmaceutical manufacturer responded by stating that some components cannot be sterilized due to machine design. The company also claimed they would use sporicide between each batch, increase microbiological sampling, and swab equipment, but the FDA deemed these actions unacceptable substitutes for sterilization. FDA concluded that Excelvision's QU either lacked the proper authority to carry out its responsibilities or had insufficiently implemented them. The company must develop a remediation plan to ensure its QU has the authority and resources to function effectively, among other requirements. 2. Inadequate Executive Oversight and Resourcing Warning Letters commonly point to senior leaders failing to resolve deficiencies and systemic flaws, rather than exercising the oversight that cGMP compliance requires. Without that oversight, employees may find workarounds or hide issues that executive leadership failed to address proactively. Some leaders do not give QU the funds to ensure maintenance programs are followed, compromising product safety and ultimately forcing large-scale remediation or heightened scrutiny. Consider the June 2026 Warning Letter issued to Huons Co., Ltd . FDA found that a microbiology team leader directed staff to discard bioburden plates that showed contamination, and changed timestamps to create backdated documentation. The team leader also admitted to cutting pages out of a logbook and replacing them with fabricated ones, instructing an analyst to backdate and omit bioburden testing results. Huons must conduct a comprehensive investigation into the scope of the falsification, perform a risk assessment of the quality of the affected drugs, and commit to two years of third-party audits to verify its corrective actions, among other requirements, to address the violations. In the Warning Letter to Excelvision, the FDA found that the company had built parts of its sterile manufacturing areas, including filling rooms and compounding rooms, with ceiling and partition materials that could not be waterproofed or decontaminated. The facility experienced repeated water intrusion, and mold was detected in cleanrooms. Now the company must implement a CAPA plan ensuring vigilant oversight of equipment and facility conditions, including making necessary repairs and upgrades. 3. Reactive CAPAs and Repeated Deficiencies Throughout our research, we concluded that leadership may view recurring problems as isolated incidents that can be fixed by superficial corrective and preventive action (CAPA). Companies commonly retrain employees rather than finding and fixing the root cause. For example, in a December 2025 Warning Letter to Apothecary Pharma, LLC, the FDA found that retraining on aseptic technique failed to address specific behaviors that had caused the original contamination risk. Putting a temporary “band-aid” over problems may keep production moving, but it won't prevent recurring deficiencies. A superficial approach to problem-solving can also go along with reactive compliance, where companies act only after regulators intervene. In both the Excelvision and Huons Warning Letters, for instance, the FDA recommended a voluntary recall before either company committed to one, rather than deciding to recall on their own as a proactive measure.  Why This Is a Systemic PQS Weakness