On October 2, 2026, FDA's Center for Drug Evaluation and Research (CDER) issued a warning letter to Hanlim Pharm Co., Ltd. in Yongin-si, South Korea. The letter concerns sterile drug products made by aseptic processing. It follows an on-site inspection carried out April 16-24, 2026. The letter as we have it does not mention an import alert. You can read it at FDA's letter.
Some terms first. A Form FDA 483 lists an investigator's observations at the end of an inspection. A warning letter is FDA's later, formal notice of significant violations of current good manufacturing practice (CGMP). This article covers only what FDA cited. We add nothing about the company and make no guesses about causes.
FDA cited six findings. Two are aseptic-processing and facility controls that software does not fix. The other four touch on records, oversight and follow-up, where a plant's electronic systems can help it run its own controls.
Aseptic procedures, operator practices, smoke studies and aseptic area controls (21 CFR 211.113(b) and 211.42(c))
What FDA cited. Under 211.113(b), FDA cited inadequate aseptic and sterilization procedures, operator practices and smoke studies. Under 211.42(c), FDA cited inadequate controls in the aseptic areas and inadequate environmental monitoring (EM).
Why plants run into this. Aseptic filling depends on many things working together: how people gown and move, how they intervene at the line, how air flows around open product, and how the cleanroom is designed and kept. Over time habits drift. Airflow patterns that were acceptable once may no longer match the equipment, the layout or the interventions in use. EM programs can also stop reflecting where the real risks are.
How it is prevented. Written aseptic procedures that match what operators actually do. Operator qualification and observation. Airflow (smoke) studies that cover the real interventions and are repeated when the setup changes. A cleanroom design and an EM program set by risk, with action on trends.
A laboratory, facility or process control. Aseptic processing is a process control, and the state of the aseptic areas is a facility control. Software does not fix either one, so we name no module for these findings.
Visual inspection and high defect rates (21 CFR 211.110(a))
What FDA cited. FDA cited a deficient visual inspection program with high defect rates.
Why plants run into this. Visual inspection of sterile products is partly a human task. Inspector qualification, lighting, inspection time and defect limits are often set once and rarely looked at again. High defect rates can be seen as a normal cost of production instead of a signal to investigate.
How it is prevented. Written in-process controls with defined limits. Qualified inspectors. A rule that results outside the limits are recorded and investigated, with a corrective action whose effect is checked afterward.
Where Atto Pharma helps. Atto Pharma eBMR turns a site's approved batch record into screens and records the batch on them, including in-process checks. The eBMR training covers limits, deviations, review and QA release. When a limit is missed, a plant can raise a deviation in the batch record instead of leaving the figure unexplained. For follow-up, Atto QMS keeps CAPA in a set order: draft with actions, approval by the QA Head, actions done and verified, completed, then an effectiveness check by a QA reviewer. The eBMR does not set your inspection method or defect limits. Those stay in your procedures.
Quality unit authority and oversight (21 CFR 211.22)
What FDA cited. FDA cited that the quality unit lacked authority and oversight.
Why plants run into this. Authority on paper is not always authority in practice. When production pressure is high, a quality decision can be bypassed. Reviews can also be done by the same person who did the work. Open investigations and actions can sit unnoticed.
How it is prevented. Clear written responsibilities for the quality unit. Release and disposition decisions that only quality can make. Independent review and verification. Visible lists of what is overdue.
Where Atto Pharma helps. Atto QMS applies several of these as rules in the database, so they hold even if the screens are bypassed.
- A step can only be taken in its turn and by the right role. Roles (QA reviewer, QA Head, QC supervisor, Manufacturing Head and others) are given in QMS → People.
- The person who did an action cannot verify it.
- A confirmed OOS cannot be approved.
- With the eBMR, an OOS logged against a batch holds its QA release until the OOS is closed with its disposition.
- Every step is signed with the person's password, in their own name, with the server's time. It is kept in the record's audit trail, and nothing is deleted.
- The registers for change control, OOS and CAPA show status and due date, and overdue records are marked. Extensions are given by the QA Head, with a reason.
Atto Pharma is built for 21 CFR Part 11 and EU GMP Annex 11. The authority of your quality unit still comes from your quality system and your management, and the software only enforces the roles you set.
Stability program not followed (21 CFR 211.166(a))
What FDA cited. FDA cited that the stability program was not followed.
Why plants run into this. A stability protocol is a long commitment: pulls over months or years, across products and storage conditions. Pulls get missed or moved, a protocol is changed without a formal decision, or an unexpected result is not escalated the way the procedure says.
How it is prevented. A written protocol that is followed as written. Any change made through change control. Results outside specification handled as OOS investigations. Corrective actions tracked to closure.
Where Atto Pharma helps. Atto QMS covers the parts of this that are quality-system records. Change control runs from draft through review, QA review, concurrence, approval as major or minor, impact assessment, verified actions, post-implementation review, closure and an effectiveness check. A change control is not reviewed after implementation while an action is open. For OOS, a confirmed stability OOS needs its notification recorded before the disposition. CAPA follows the steps described above. The documentation does not describe Atto QMS as scheduling stability pulls. The protocol and its schedule remain your own procedure.
EM data not recorded contemporaneously (21 CFR 211.194(a))
What FDA cited. FDA cited that EM data was not recorded contemporaneously.
Why plants run into this. Data is written on scraps, in notebooks or from memory, and entered into the official record later. This often happens when sampling is busy, when forms are far from the work area, or when several people share one record. Later entry weakens the record. It is a core ALCOA+ expectation that data be attributable, legible, contemporaneous, original and accurate.
How it is prevented. Recording at the point of work, on the official record, signed by the person who did the work. A second-person review. Clear rules on what is original data.
Where Atto Pharma helps. Atto eLogbooks replaces paper equipment, area and instrument logbooks with templates, logbooks, entries and sign-off, with alerts, reminders and exports. A plant that keeps area logbooks there can record entries when the work is done and sign them in the system. The documentation does not describe an EM-specific results module, so how EM sampling results are captured stays within your laboratory procedures. Atto Pharma's training includes a module on GMP and data integrity essentials, covering ALCOA+, 21 CFR Part 11 and Annex 11.
What to check in your own plant
- Do your aseptic procedures match what operators do at the line today, including interventions?
- When did you last repeat airflow (smoke) studies, and did the setup change since?
- Does your EM program follow risk, and is someone acting on trends?
- Are visual inspection defect rates trended, with a limit that triggers an investigation?
- Can a quality decision be bypassed? Check who can release, who can approve, and who verifies actions.
- Is every stability pull done on schedule, and every protocol change made through change control?
- Is EM data written at the point of work on the official record, or copied later?
- Do overdue investigations, changes and CAPA show on a list someone reviews?
Questions people ask
What is a Form FDA 483? It is a list of an investigator's observations, given to a company at the end of an inspection. It is not a final FDA decision on whether a violation occurred.
How does a warning letter differ? A warning letter is FDA's later, formal notice of significant violations of CGMP. It asks the company to respond with corrections. It is a separate document from a Form FDA 483.
What was the main finding in this letter? FDA cited 21 CFR 211.113(b): inadequate aseptic and sterilization procedures, operator practices and smoke studies. That rule concerns written procedures meant to prevent microbial contamination of products that are supposed to be sterile. It is a process control. Software does not fix it. Your procedures, operator qualification and airflow studies do.
Source: FDA's warning letter to Hanlim Pharm Co., Ltd., as published by FDA. This article explains the findings in general terms; it adds nothing about the company beyond FDA's letter. Software helps a plant run these controls; it does not decide the outcome of an inspection.
Prevent these findings on your own records
This letter's findings are the kind Atto Pharma eBMR, Atto eLogbooks and Atto QMS are built to prevent: checks as each value is entered, electronic signatures, audit trails, and investigations, changes and CAPA that can't be closed half-way. Built for 21 CFR Part 11 and EU GMP Annex 11. Every new company starts with a free 14-day pilot on its own batch records.