FDA Warning Letter: Eurofins SF Analytical Laboratories, Inc. (October 2026)

November 8, 2026 · 8 min read · All FDA letters · All articles

On October 6, 2026, the Center for Drug Evaluation and Research (CDER) issued a warning letter to Eurofins SF Analytical Laboratories, Inc. of New Berlin, United States, a contract microbiological testing laboratory. The letter is based on an on-site inspection on June 1-3, 2026 at the company's Horsham, PA site. The letter mentions no import alert. You can read it in full here: FDA's letter.

A warning letter is FDA's formal notice of significant violations of CGMP. It comes after the inspection, not instead of it. This article stays with what FDA wrote. It does not guess at causes inside the company, and it does not say how the inspection would have gone with different tools. FDA cited three findings. We take each one, explain why plants in general run into it, describe the control that prevents it, and say where software helps and where it does not.

Incomplete laboratory records: 21 CFR 211.194(a)

What FDA cited. Under 21 CFR 211.194(a), FDA cited incomplete laboratory records. In its words, TNTC and compromised plate results were omitted or discarded without review. TNTC means "too numerous to count," a result a microbiology lab sees when a plate has more colonies than can be counted.

Why plants run into this. Microbiology work produces awkward results. A plate may be overgrown, spread, cracked, contaminated or otherwise hard to read. The pull is to repeat the test and keep only the clean plate, because the unusable one seems to say nothing. Under time pressure, a plate that doesn't fit the usual result format is easy to set aside.

How it is prevented. The rule behind 211.194(a) is that laboratory records include complete data from all tests. That means every result, including an unusual one, is recorded and reviewed by a second person. A good procedure defines what counts as TNTC and what counts as a compromised plate. It says what the analyst records for each, who reviews it, and when a repeat test is allowed. It also says that the original result stays in the record when a test is repeated. Second-person review of the raw data, not just the final number, is what makes omissions visible. Training analysts to treat a bad plate as data, not as a nuisance, matters as much as the procedure.

A laboratory, facility or process control. This is a laboratory control: how plates are read, recorded and reviewed in the microbiology laboratory. We name no Atto Pharma module for it, because the documentation describes no feature for recording plate counts.

Aberrant media conditions not investigated: 21 CFR 211.192

What FDA cited. Under 21 CFR 211.192, FDA cited that aberrant media conditions were not investigated.

Why plants run into this. Section 211.192 requires a thorough investigation of any unexplained discrepancy, and it extends to related batches. In a laboratory, media can look or behave unexpectedly: an odd appearance, a surprising growth pattern, something that doesn't match the usual picture. If nobody has defined what triggers a formal investigation, the observation may be mentioned in passing, worked around, or never written down. Plants also run into the opposite problem: an investigation is opened, but it drifts, has no owner and no due date, and closes without a conclusion.

How it is prevented. Write down what counts as an unexplained discrepancy, including media observations. Require that any such observation opens a record. Give each investigation an owner, a due date and a defined path: what was checked, what the conclusion is, what happens to the affected results, and what corrective action follows. Have the quality unit review and approve the conclusion before the work is considered closed.

Where Atto Pharma helps. The scientific question of what makes media aberrant belongs to the laboratory, and Atto Pharma does not record plate counts or media observations. What the software can do is hold the investigation itself to a defined path. Atto QMS keeps out-of-specification (OOS) results, CAPA and change controls electronically. An OOS record moves through its steps in order:

• Logged by the QC analyst.
• Phase IA, for an obvious error.
• Phase IB, the laboratory investigation.
• Hypothesis plan approved by a QA reviewer.
• Hypothesis study.
• Retests by a second analyst, then the original analyst.
• Phase II, the plant investigation.
• Laboratory failure investigation.
• Phase III, which covers other batches and CAPA.
• Disposition.
• Review after closure.

The database applies the rules. A step can only be taken in its turn and by the right role. The analyst of the original result can't do the first retest. A confirmed OOS can't be approved. Every step is signed with the person's password, in their own name, with the server's time, and kept in the record's audit trail; nothing is deleted. The register lists each record with its status and due date, and overdue ones are marked. Extensions are given by the QA Head with a reason, two times at most by default.

A CAPA record has its own path: drafted with its actions, approved by the QA Head, actions done and verified by someone other than the person who did them, completed, then an effectiveness check by a QA reviewer. For batch records, the Atto Pharma eBMR requires a remark or deviation number when a result is outside the internal limit. A result outside the buyer's specification needs a deviation number before work continues. An OOS logged against one of your batches holds that batch's QA release until the OOS is closed with its disposition. This applies to manufacturing batches, not to a contract testing laboratory's own samples. Whether an event is treated as an OOS, a deviation or something else is set by your own procedures.

Quality unit without oversight of laboratory operations: 21 CFR 211.22

What FDA cited. Under 21 CFR 211.22, FDA cited that the quality unit lacked oversight of laboratory operations.

Why plants run into this. The quality unit is responsible for approving or rejecting results and for reviewing records and investigations. That authority is hard to exercise when the laboratory runs on its own paper, spreadsheets and habits, and when QA sees only the final report. The first two findings in this letter sit in the laboratory's day-to-day work: records and investigations. When omitted results and uninvestigated observations are never seen by QA, oversight has no data to work with. Oversight also weakens when QA has no simple view of what is open, what is late and who owns it.

How it is prevented. Give the quality unit defined review points in laboratory work, not only at the end. Make QA the approver of investigation plans and conclusions. Have a routine, for example a monthly one, where QA reviews open investigations, overdue items and trends. Make sure the quality unit has the people, training and authority to say no, and that its role is written down in procedures.

Where Atto Pharma helps. In Atto QMS, QA roles are part of the workflow, not an afterthought. The company's administrator or QA Head assigns roles in QMS → People: QA reviewer, QA Head, QC analyst, QC supervisor, Manufacturing Head, Head of department and others. A person may hold several. The OOS workflow gives QA named steps: the QA reviewer approves the hypothesis plan, QA takes part in the Phase II plant investigation, the QA Head decides the disposition, and a QA reviewer does the review after closure. In a change control, QA reviews the risk assessment, decides which departments concur, and checks effectiveness at the end.

Two features make oversight practical. My work lists the records waiting for a step you may take, your open actions, the actions QA must verify, and the month's counts for the monthly review. The registers for change control, OOS and CAPA show status and due dates and mark what is overdue. Because the database enforces the order and the roles, and the person who did an action can't verify it, QA review can't be skipped by habit. Atto Pharma is built for 21 CFR Part 11 and EU GMP Annex 11. Whether your quality unit's oversight is adequate still depends on your procedures, your staffing and your validation of the system.

What to check in your own plant

• Does your procedure define TNTC, overgrown, cracked or otherwise compromised results, and say exactly what is recorded and who reviews each one?
• When a test is repeated, does the original result stay in the record with a reason?
• Does the second-person review look at raw data and not just the reported number?
• Is there a defined trigger for investigating unexplained observations, including media and incubation conditions?
• Does every investigation have an owner, a due date, a conclusion and a QA approval before it closes?
• Can QA see, in one place, what is open and what is overdue in laboratory investigations?
• Is QA's role in laboratory oversight written down, and does QA have the time and authority to carry it out?
• Do analysts know that an unusable result is still a result that must be reported to review?

Questions people ask

What is a Form FDA 483? A Form FDA 483 lists an investigator's observations at the end of an inspection. It is a list of what the investigator saw, not a final finding of violation. The company can respond in writing.

How is a warning letter different? A warning letter is FDA's later, formal notice of significant violations of CGMP. It is a separate document with its own date and cites specific parts of 21 CFR. It asks the company to correct the violations and respond. It is not a Form FDA 483.

What does 21 CFR 211.194(a) expect of a laboratory? It expects laboratory records to include complete data from all tests. For microbiology, that means results that are hard to read, such as TNTC counts or compromised plates, are recorded and reviewed, not left out or discarded. FDA cited this finding in the letter. It is a laboratory control, and the procedure, the training and the second-person review carry it.

Source: FDA's warning letter to Eurofins SF Analytical Laboratories, Inc., as published by FDA. This article explains the findings in general terms; it adds nothing about the company beyond FDA's letter. Software helps a plant run these controls; it does not decide the outcome of an inspection.