For sponsors developing drug-led or biologic-led combination products, understanding the specific quality system deficiencies FDA raises during review is essential to preparing defensible regulatory submissions. Information Requests issued under the streamlined cGMP framework of 21 CFR Part 4 can significantly delay approval timelines, yet the granular content of these requests—what exactly FDA asks, in what language, and against which Quality System Regulation provisions—is rarely consolidated in a single reference.
This analysis examines FDA Information Requests and deficiency letters issued during BLA and NDA reviews that invoke 21 CFR Part 4 compliance obligations, with particular focus on four QSR provisions most frequently cited: management responsibility (21 CFR 820.20), design controls (21 CFR 820.30), corrective and preventive action (21 CFR 820.100), and purchasing controls (21 CFR 820.50). Drawing on review documents from Drugs@FDA and CBER BLA files across both CDER- and CBER-led combination products, the material below provides verbatim and near-verbatim examples traceable to named applications.
Want Rhizome's help on your own question? Try it for free.
FDA Information Requests on 21 CFR Part 4 combination-product cGMP: management responsibility, design controls, CAPA, and purchasing controls
Regulatory basis
Under 21 CFR 4.4, a co-packaged or single-entity combination product may demonstrate cGMP compliance in one of two ways: (1) comply with the full specifics of each applicable set of cGMP regulations for each constituent part, or (2) operate a streamlined single cGMP operating system under 4.4(b), building on either a drug-cGMP base or a device-quality-system base 196. When a facility runs a drug-cGMP-based operating system for a product that contains a device constituent, 4.4(b)(1) requires it to additionally show that specified device quality-system provisions have been satisfied 196. In practice, FDA's combination-product reviewers translate that requirement into a recurring set of IRs asking the applicant to document management responsibility, design controls, purchasing controls, and CAPA for the device constituent and the combination product as a whole. The consolidated regulation now frames these add-on obligations in QMSR/ISO 13485 terms (for example ISO 13485 Clause 7.3 for design and development, Clause 7.4 for purchasing, plus 21 CFR 820.10 and 820.35) 196, but the review-era IRs below were written against the corresponding legacy Part 820 sections.
What FDA actually asks for, by provision
1. Management responsibility (21 CFR 820.20)
The most common management-responsibility IR asks the applicant to summarize its management structure with executive responsibility, confirm which entity holds ultimate responsibility for Part 4 compliance, and describe the role of each manufacturing facility.
Representative standard wording, sent to Fresenius Kabi USA for IDACIO, asked for "a summary of your management structure with executive responsibility for those who manage, perform, and assess work affecting quality of the product and related controls to ensure that your quality policies are appropriately implemented and followed, and the product appropriately designed and manufactured in conformance with CGMP requirements, including quality system requirements met, per 21 CFR 820.20," plus "a description of the functions and responsibility of each facility involved in the manufacturing of the combination product and its constituent parts" 69. Near-identical language went to Celltrion for YUFLYMA 161, to AstraZeneca/Pearl Therapeutics for BEVESPI AEROSPHERE 118, and to Sandoz for ZARXIO ("A detailed summary of how management with executive responsibility establishes its policy, objectives for, and commitment to quality in compliance with 21 CFR 820.20") 67177.
FDA also breaks the provision into its sub-elements. For LONHALA MAGNAIR KIT (Sumitomo Pharma America), the IR itemized (1) the management executive responsible for the quality policy, (2) the organizational structure with responsibilities, authorities, and interrelations of personnel, and (3) who reviews the suitability and effectiveness of the quality system at defined intervals, i.e. quality policy, organization, and management review 153. For BONSITY (Alvogen), FDA asked the firm to "Provide a summary of how your firm's management has established responsibility to assure that the combination product is manufactured in compliance with all applicable CGMP requirements (see 21 CFR Part 4)" 95.
Where a single applicant sits above multiple manufacturers, FDA presses on ultimate accountability and control. For YUSIMRY (Coherus BioSciences), the IR said "The Sponsor should specify which Sponsor has ultimate responsibility over the overall combination product. The Sponsor should describe the organizational structure (i.e. organization structure chart) and explain how it controls all levels of the structure (i.e. agreements)" 176. The same theme recurs as a documented deficiency: for STIOLTO RESPIMAT (Boehringer Ingelheim), FDA noted the firm's facility table "did not contain a list of the manufacturers involved in the manufacturing of the device components," lacked an organizational-structure diagram, and "did not summarize how it will ensure that its quality policy is understood, implemented, and maintained at all levels of the organization" 167. For KYLEENA (Bayer HealthCare), FDA issued a formal deficiency (No. 1, sent 05/16/2016) stating the firm "inadequately addressed the requirements of 21 CFR 820.20" and requesting "a detailed summary of the firm's Quality System and management structure with executive responsibility" 178.
2. Design controls (21 CFR 820.30)
Design-control IRs ask the applicant to explain how it applied the design-control process to the device constituent and to provide the design plan (or a summary) covering the full 820.30 lifecycle: design and development planning, design input, design output, design review, design verification, design validation, design transfer, design changes, and the design history file (DHF).
The canonical wording appears in the EVENITY (Amgen, BLA 761062) review: "Provide a description of your design control system, which should include requirements for design and development planning, design input, design output, design review, design verification, design validation, design transfer, design changes, and design history file. Provide a copy or a summary of the plan used to design the combination product. Explain how you implemented the design control system to develop the combination product under review" 42. FDA sent materially the same request to Biogen for PLEGRIDY 38, to AstraZeneca for BEVESPI AEROSPHERE 40, to Hikma for KLOXXADO 4146, to Labs Farma Rovi for RISVAN 53, and to Harm Reduction Therapeutics for RIVIVE 49.
Reviewers frequently sharpen the ask. For LONHALA MAGNAIR KIT, FDA asked the applicant to "provide an explanation of where in your design and development process the combination product became subject to design control program" and to supply the design and development plan(s) or a summary, with responsibility assigned for inputs, outputs, review, verification, validation, and changes 37. For NARCAN (Emergent), FDA said it was unclear how the firm had implemented design control and asked it to "Submit a summary description of how your design process fulfills the requirements for design and development planning, design input, review, verification, validation, transfer, changes, and design history file" 54. For SOGROYA (Novo Nordisk) and VALTOCO (Neurelis), FDA requested "A complete and detailed device constituent design requirements and specifications document, including design inputs and outputs in accordance with 21 CFR 820.30 design controls," with VALTOCO also asked for design verification documentation 4456.
3. Corrective and preventive action / CAPA (21 CFR 820.100)
The CAPA IR is highly standardized: FDA asks for a summary of the CAPA procedure(s) and requires it to cover four elements: (a) identification of quality-data sources and analysis to find existing and potential causes of nonconforming practices and products; (b) investigation of nonconformities and their causes; (c) identification and implementation of actions to correct and prevent recurrence; and (d) verification or validation of the actions taken.
That four-part structure was sent verbatim to Indivior for PERSERIS KIT 4 and to Amphastar for BAQSIMI, where FDA stated the firm "has inadequately addressed the requirement for 21 CFR 820.100, corrective and preventive actions," before listing elements (a) through (d) 3. For ZEMBRACE SYMTOUCH (Tonix), FDA observed the firm "did not appear to provide a summary of its procedure(s) for its Corrective and Preventive Action (CAPA) System" and restated the required analysis, investigation, and verification/validation content 1. For HYRIMOZ (Sandoz), FDA flagged that "All documents provided by the firm were pertaining to drug manufacture only. The requirements of 21 CFR 820.100 were not addressed," then requested the same four-element CAPA summary 2, a useful illustration of why a drug-only quality dossier does not by itself satisfy the device-constituent add-ons under 4.4(b)(1).
4. Purchasing controls (21 CFR 820.50)
Purchasing-control IRs ask for a summary of the purchasing procedure(s) addressing supplier evaluation and the type/extent of supplier control, records of acceptable suppliers and purchasing-data approval, the balance between purchasing assessment and receiving acceptance, and assurance that contractor/supplier changes will not affect the final combination product.
The full standard text was sent to Takeda for ENTYVIO: "Provide a summary of the procedure(s) for purchasing controls. The summary should: a. Describe your supplier evaluation process and describe how it will determine the type and extent of control you will exercise over suppliers. b. Explain how you maintain records of acceptable suppliers and how you address the purchasing data approval process. c. Explain how you will balance purchasing assessment and receiving acceptance... Explain how the procedure(s) will ensure that changes made by contractors/suppliers will not affect the final combination product" 1114. The same wording recurs for Adamis's SYMJEPI 7071, Alvogen's BONSITY 14, and Heron's ZYNRELEF KIT 22. FDA commonly bundles this request with the management-responsibility, design-control, and CAPA asks in a single Part 4 IR, as seen for EVENITY (Amgen) and RIVIVE (Harm Reduction Therapeutics) 4249.
Bundled Part 4 IRs and the "identify your operating system" question
Many reviews show FDA opening with a threshold IR: identify the cGMP operating system for the combination product and, if streamlined, state whether it is drug-cGMP-based or QS-regulation-based, before requesting the specific 820 documentation. For RIVIVE (NDA 217722, Harm Reduction Therapeutics), FDA asked the firm to identify the operating system and then requested management responsibility, design control, and purchasing-control information in one package 49. Similar bundled Part 4 IRs, spanning several of the four provisions, were sent to Mylan for HULIO (BLA 761154), which covered 820.20, 820.30, 820.50, and 820.100 together 106; to Xeris for GVOKE (NDA 212097) 99; to Indivior for OPVEE (NDA 217470) 97; to scPharmaceuticals for FUROSCIX (NDA 209988) 52; and to Heron for ZYNRELEF KIT (NDA 211988) 114. For QFITLIA (NDA 219019, Genzyme), which used a device-quality-system-based streamlined approach rather than a drug base, FDA's mid-cycle IR instead asked for a summary table showing compliance with 21 CFR Part 820 and information demonstrating adherence to the drug cGMPs in Parts 210 and 211 115.
Biologics-led (CBER) examples
The same IR patterns appear in BLA review. For MNEXSPIKE (Moderna, BLA 125835), FDA's IR #46.1 asked Moderna to "identify the CGMP operating system approach in place at each manufacturing site" and, "If a site is utilizing a streamlined approach described in 21 CFR Part 4.4(b), please identify the elected approach," reminding the applicant that each Part 4 facility should identify whether it follows the combination-product streamlined approach and the base regulation set (211 or 820) 123. For KEBILIDI (PTC Therapeutics, BLA 125722), FDA's device IR #18 asked PTC to describe, in a revised Module 3.2.R, "how your quality system ensures quality of the combination product as a whole, as well as ensuring all ancillary device components needed for product administration meet minimum performance requirements" 121122. For HAEGARDA (CSL Behring, BLA 125606), FDA confirmed the product was a combination product and that the applicant "needs to be able to demonstrate compliance to cGMPs required for combination products," pointing to the streamlined approach and requesting a plan and timeline to respond to related IRs 128.
The most detailed device-QS IR in the biologics set went to GlaxoSmithKline Biologicals for PENMENVY (BLA 125819). After noting that the container-closure section claimed compliance with 820.20, 820.50, and 820.100 but did not include the underlying procedures, FDA requested: (a) "A copy of your basic QS procedures, including quality or internal audit procedures, management review procedures, and an outline of the structure of the quality system documentation"; (b) "A copy of your procedures for purchasing controls, including your supplier evaluation process, supplier records management, and a description of how you balance purchasing assessments and receiving acceptance"; and (c) "A copy of your CAPA system procedures, including a description of how your CAPA system is tied to your management program... an explanation of how your CAPA system addresses nonconforming practices as well as nonconforming product, a summary of your CAPA effectiveness procedure, CAPA information subject to management review, and an explanation of how the CAPA system interacts with your design change control and risk management systems" 187188. Reviews for PREVNAR 20 (Wyeth, BLA 125731) and ABRYSVO (Pfizer, BLA 125768/125769) document FDA's assessment of the sponsors' 4.4(b)(1) streamlined approach integrating 820.20, 820.30, 820.50, and 820.100, though those pages record review discussion rather than verbatim IR text 125126127. FDA also flagged Form 356h and facility-listing expectations for combination products in reviews such as NGENLA (Pfizer, BLA 761184) 111, BENLYSTA (GSK, BLA 761043) 112, and VIZZ (LENZ, NDA 218585) 113.
Practical takeaways for reviewers and applicants
- The four provisions in the question (820.20, 820.30, 820.50, 820.100) are the recurring core of FDA's combination-product IRs when a firm elects the drug-cGMP-based streamlined operating system under 4.4(b)(1); the IR language is largely templated across products, so applicants can anticipate and pre-empt it in Module 3.2.P.3 / 3.2.R and on Form 356h 4249106123.
- A drug-only quality dossier will draw a deficiency. FDA explicitly rejected drug-manufacture-only documentation for CAPA in HYRIMOZ 2 and issued formal deficiencies for incomplete management responsibility in KYLEENA 178 and STIOLTO RESPIMAT 167.
- FDA increasingly wants the combination product addressed "as a whole," including ancillary device components and the interfaces between CAPA, design change control, and risk management, as seen in KEBILIDI 121122 and PENMENVY 187188.
- Note the QMSR transition: the current 4.4(b)(1) text is written in QMSR/ISO 13485 terms (Clause 7.3 design, Clause 7.4 purchasing, plus 820.10 and 820.35) 196, so future IRs may cite those clauses rather than the legacy Part 820 section numbers used in the reviews above.
A natural follow-up a reader may want to ask Rhizome directly: how has the phrasing of these Part 4 IRs shifted after the QMSR came into effect, and which specific ISO 13485 clauses are now being cited in the newest combination-product reviews.