Recall Forensics

Recall Forensics: The TCI BioCosme Warning Letter — the validation failure behind it

Team ValidLeaf · November 2026 · 6 min read

Recall Forensics is our series tracing real product recalls and enforcement actions to the specific validation gap behind them. Every fact comes from public regulator records or reporting of those records — no speculation, no invented causes. This case is not a recall. It is an FDA warning letter to a Taiwan manufacturer whose inspectors found a product not manufactured in accordance with its validated process: a step written into the validation was missing from the batch record, a second product had borrowed the first product's validation even though its process differed, and finished batches had reached the United States without assay testing of the active ingredient.

What happened

FDA inspected the facility of TCI Co., Ltd BioCosme PABP Branch (FEI 3014217121) in Changzhi Township, Pingtung County, Taiwan, from March 9 to 13, 2026. In a warning letter dated September 2, 2026 (reference 320-26-122, posted October 6), the agency said the firm's methods, facilities, and controls did not conform to the CGMP regulations in 21 CFR parts 210 and 211, so its drug products were adulterated under section 501(a)(2)(B) of the FD&C Act. FDA found the firm's April 2, 2026 response to its Form FDA 483 inadequate: it provided no supportive documentation or adequate evidence of corrective actions (FDA warning letter 320-26-122).

The first finding was about release. Under 21 CFR 211.165(a), FDA said the firm failed to adequately test its over-the-counter drug products before release to the US market — in the example cited, assay testing of the active pharmaceutical ingredient was not part of finished-product release testing, and the batches were released anyway. The firm replied that it would confirm specification definitions with its customer and verify whether the assay was included. FDA called that inadequate: the quality system did not ensure every required test was identified, documented, and performed before release, and there was no written procedure or quality agreement defining testing responsibilities between the firm, as contract manufacturer, and its customer. A contract facility, FDA noted, is responsible for the quality of what it produces regardless of the agreements in place (FDA).

The second finding was about what came in the door. Under 21 CFR 211.84(d)(1) and (d)(2), FDA said identity testing of incoming active ingredients and raw materials was incomplete, and the firm relied on supplier certificates of analysis without establishing the reliability of the suppliers' results. The gaps were not abstract: FDA listed tests the certificates lacked against the applicable USP monographs — including Identification Test A, lead, iron and other heavy metals, alkalinity, residue on ignition, and organic-impurity limits, varying by component. The firm explained that it lacked appropriate instrumentation for some tests and believed the USP methods did not specify others. FDA rejected both explanations: using the correct monograph, and testing components before use, is the manufacturer's responsibility (FDA; ECA Academy summary, October 21, 2026).

The third finding is the one this series exists for. Under 21 CFR 211.100(a), FDA said process validation was inadequate. The firm's Process Validation for Cosmetic Products document was being used to validate an OTC product, yet the investigator confirmed the product was not made according to that process — the validation included a step that is absent from the batch record. A second product had no validation of its own: it relied on the first product's validation, even though the two processes differ. The same section cited a component used in the products and to clean equipment, whose qualification protocol and report lacked total organic carbon, conductivity, and microbial testing. When the firm responded by sampling more often, FDA said that without defined action and alert limits, more frequent sampling alone is not a robust monitoring mechanism (FDA).

The fourth finding tied the others together. Under 21 CFR 211.22, FDA said the quality unit lacked adequate control: process parameters were changed in batch instructions without following the firm's own change-management procedure and without documented justification — a retrospective review attributed the changes to research and development staff making on-site adjustments. FDA also cited batch records that did not document each significant step, and no written stability testing program. During the inspection the firm said it had allowed its FDA drug registration to expire and would renew it only if a US order was received. FDA's closing position was direct: notify the agency before resuming drug manufacturing, resolve the systemic deficiencies first, and engage a qualified consultant for a comprehensive six-system audit (FDA).

An honesty note: FDA redacted the product names, active ingredients, components, batch numbers, and the missing validation step in the published letter, so none can be named here. The letter also does not report a specific named product found contaminated; its subject is missing tests, mismatched validation, and missing quality-unit control.

The validation gap: a validated process that exists only on paper

Process validation is a claim about a specific process, run a specific way, producing a specific product. It is not a binder that transfers. Both halves failed here at once: the document described a process the floor was not running, and the process the floor ran for a second product had never been validated at all. Add parameter changes made outside change control, and the link between evidence and production is severed in both directions.

For cosmetics manufacturers and the contract manufacturers who make both cosmetics and OTC products side by side, the controls that keep that link intact are specific:

• Reconcile the validation against the batch record, line by line. Every step and parameter in the validation protocol should trace to the master batch record actually in use, and every step in the record should trace back to validation. A reconciliation catches a phantom step in an afternoon; an FDA inspection catches it in a warning letter.
• One differing process, one validation. Borrowing another product's validation is only defensible with a documented rationale showing the processes are genuinely equivalent. "Different process, same document" is not bracketing — it is an unvalidated product with paperwork nearby.
• Treat change control as validation maintenance. A parameter changed on the floor without quality-unit approval and documented justification does not just break a procedure. From that batch onward, the process is in an unvalidated state, whether or not anyone wrote that down.
• Make release a test-by-test checklist, not a habit. An omitted assay is rarely a decision; it is usually a specification never fully built, or a responsibility split between contract manufacturer and customer that nobody wrote down. A quality agreement should name, test by test, who performs and who reviews every release test before the first commercial batch — a point FDA has also pressed in its final mandatory cosmetics recall guidance: the name and the duty travel together.
• Qualify utilities and shared components with limits, not activity. A qualification protocol without total organic carbon, conductivity, and microbial criteria proves attendance, not fitness. Sampling more often without alert and action limits only produces more numbers nobody must act on — the same discipline at stake in the Intercon hand-soap recall.

None of this requires new technology — only one discipline: the documents, the testing, and the floor must describe the same process at the same time, and the quality unit must check that they still do after every change.

How a GMP Readiness Assessment catches it

This is exactly the failure pattern a GMP Readiness Assessment is built to find. Over four weeks, it reviews:

• Validation-to-record reconciliation — does each protocol match the current master batch record step for step, and does every product have validation that is actually its own?
• Change-control integrity — can every process parameter in production be traced to an approved change, or are floor adjustments living outside the system?
• Release-testing completeness — is there a test-by-test matrix tying every specification and monograph requirement to a performed test and a named owner, including in quality agreements?
• Supplier certificate reliability — are supplier results validated and periodically re-verified, or are certificates filed on trust?
• Utility and component qualification — do protocols carry the chemical and microbial parameters and the alert and action limits that make monitoring a control?

It closes with a gap assessment, a remediation roadmap, and starter IQ/OQ/PQ templates — so the fix starts before the lab report does.