503B facilities: Rely on a supplier's certificate. Show an investigator why.
History, lot by lot. Carried to every clinic.
A 503B quality unit's release desk: every lot disposition, signed, with the reason kept. Caldera Sterile Outsourcing is a sample 503B facility; its suppliers, people, lots and figures are invented.
A supplier's certificate can spare you a full retest. Your records have to show why.
Under 211.84(d)(2), a supplier's report may replace some testing if you run an identity test and establish the supplier's reliability. An investigator asks how. The answer is a history.
United States Code21 U.S.C. §353b(a)(2)(D)
… accompanied by a valid certificate of analysis …
Code of Federal Regulations21 CFR 211.84(d)(2)
… the manufacturer establishes the reliability of the supplier's analyses …
Check, keep, qualify, sign, trace. Around your QMS, never instead of it.
Nothing in your QMS changes; it stays the system of record for manufacture and release. Veritura is the evidence layer around it, from certificate to clinic.
Check every component certificateAgainst the statute, published limits and FDA's registries, before your quality unit relies on it.
Read to the line, each finding cited.
The monograph claim, a maker registered to manufacture, and a certificate valid on its face.
What could not run is named, never counted as passed.
Keep the supplier's historyThe history 211.84(d)(2) rests on, lot by lot, dated.
What it showed, what was raised, and what the supplier corrected and when.
Each new document compared with the supplier's own earlier ones across 11 structural features.
Only the issuing laboratory's recorded reply earns source-confirmed.
Qualify suppliersSix dated elements, an owner for every gap, a signed decision.
Manufacturer identity, accreditation, FDA registration, quality agreement, documentation specifications and ongoing monitoring, each with an owner and a date.
Qualified, qualified with written conditions, or not qualified, signed by a named person.
Every decision carries one; past it, the decision reads as due. Qualified is refused while a gap is open.
Sign component dispositionsFive dispositions, signed by your quality unit, each chained to the one before.
Release to inventory, quarantine pending evidence, request supplier correction, hold for a person, or reject under 21 CFR 211.89.
A finding cannot be cleared by a signature, and nothing a decision rested on is ever overwritten or deleted.
Against openFDA enforcement records. A match holds the lot and marks its Passports.
Trace every unit to the clinicOne code per box, a numbered statement per batch, a recall declared once.
Received by code at each clinic, seven custody events each chained to the last.
Shipped, received, administered, returned and unaccounted, per batch.
Every clinic on Veritura holding the batch sees its units, and you see who has not opened it.
What needs the quality unit today. In order, with the requests already drafted.
Today opens on the quality unit's work in the order it is due. Vera, the AI agent built into Veritura, briefs the morning and drafts the requests. By default she drafts. A person sends.
Today, in the order it is due.
On the sample facility's Oct 14, Needs you holds 10 things. First the four quality events due, corrective actions for its Form 483; then held lidocaine lot BM-5612 to decide, and batch CA-2026-1013-01 waiting for its release. Coming up dates what is next.
- Each line opens where the work is done: the events, the held lot, the batch release
- Accreditations expiring, supplier file items due and clinic receipts expected, each dated
- A clinic receipt that has not come in reads as overdue
- Close the day: sign what was decided, so tomorrow starts clean
Vera briefs the morning and drafts the ask.
Her briefing names what needs a person: on Oct 14, lidocaine lot BM-5612, pending because receiving asked the supplier for a correction. From the supplier files she drafts the next request. Nothing is sent or recorded until a person does it.
- The dial: Observe, Recommend by default, or Act
- Act sends prepared document requests only, and only to a supplier already on file
- In every setting, no first contact, release, recall decision, policy change or access change
- Questions answered from the workspace's own records
Three asks of every bulk substance. Then the limits for your dose.
Beside the bulks list or shortage condition, 503B(a)(2) asks three things. Each is read on the paperwork, then the published limits.
Where a monograph exists, whether the certificate states the substance meets it. Never its acceptance criteria.
21 U.S.C. 353b(a)(2)(B)The original manufacturer, searched in FDA's establishment registry. A firm registered only to relabel does not pass.
21 U.S.C. 353b(a)(2)(C) · FDA DECRSSubstance, lot, laboratory and a named signer for the quality unit, each cited to its line.
21 U.S.C. 353b(a)(2)(D)Name, UNII, CAS number, formula and molecular weight against FDA's substance registry.
FDA GSRSEndotoxin as K over M, from your route and largest hourly dose; solvents and elements as a share.
USP <85> · ICH Q3C · ICH Q3DSupplier, maker and laboratory searched at read. Lots re-matched hourly; a match holds the lot.
openFDAVeritura checks the paperwork. It does not test components or replace your identity test.
Kept as you work. Not rebuilt when the investigator arrives.
The duties your quality unit already owns, each recorded as it happens.
A Form 483, answered on its clock. Every observation with its corrective action.
File the 483 as a PDF or photo, or type its observations. Map each one to the records that answer it and open its corrective actions, each with its own dates. The 15 business days count from the day the 483 was issued.
Counted from the day the 483 was issued, Monday to Friday, skipping federal holidays. FDA practice, not a regulation, and a response is not required; the page names its sources.
Each observation carries its corrective actions as quality events, with a target date and progress, on the same clocks as every other event.
The sections follow FDA's March 2026 draft guidance. A person writes, signs and sends the response; Veritura files nothing with FDA.
Every exhibit attached with its fingerprint, every step dated with who took it, and the day the response was sent, and by whom.
The 45 things an inspector commonly asks for.
The Inspection page keeps one list for an outsourcing facility, from the state license and FDA registration to the master production and control record. On the sample facility: 6 missing, 32 still to collect, 4 checked or confirmed.
- Each request says how it is established: read by Veritura, confirmed by a person, or checked at the board
- A packet PDF, built and dated when you download it, missing items first
- A rehearsal asks for each record the way an inspector does and writes down what it could not find
- Cato, once standing, walks the records every morning the way an inspector asks for them. He counts what is on file and never scores it.
Cato examines documentation. A rehearsal is not an inspection, does not predict one and does not stand in for one.
One batch, released to recalled. Where every unit was at 9:05 am.
Batch CA-2026-0921-02, Ascorbic acid 500 mg/mL, at Caldera Sterile on a sample workspace. Every firm, lot and person is fictional.
Mara Ellison, Head of Quality, signs the release of 300 units with her reason, after a person reviewed each component lot.
Four boxes ship, one code each. Three are received by code; Eastgate Clinic's 40 units read as unaccounted.
74 administrations, each a unit, a date and the clinic's own visit reference. No patient names.
A recall, declared once. Every clinic on Veritura holding the batch sees its units named. By 9:40 two have opened it; Linden Aesthetics has not.
Nothing is deleted. Not even the finding you set aside.
Every certificate kept as received, every signature chained to the one before. A finding set aside stays on file with the reason a person gave.
Comparing your laboratory's results with the supplier's stays your laboratory's work. Veritura keeps what each certificate said and what held up.
The same named checks, up to twenty, against a 503B's duties.
The verdict is built from up to 20 named checks in four groups, the same engine a 503A pharmacy uses.
Every check, in the methodologyThe 503B conditions
- A valid certificate
- Names the substance and the lot, issued by a named laboratory with a report ID, signed for the quality unit by a named person, addressed to your order. Each element cited to its page and line. 21 U.S.C. 353b(a)(2)(D) · ICH Q7 11.4
- A registered manufacturer
- The original manufacturer named and searched in FDA's establishment registry at read. A firm registered only to relabel or repack does not pass as the maker. You see the registration and FEI, or not found. 21 U.S.C. 353b(a)(2)(C) · FDA DECRS
- The monograph claim
- Where a USP or NF monograph exists, whether the certificate states the substance meets it: the statement and its line. The monograph's acceptance criteria are not checked. 21 U.S.C. 353b(a)(2)(B)
The supplier's reliability
- The history
- Every certificate from the supplier, what it showed, what was raised, what the supplier corrected and when, and the laboratory's recorded replies, kept per supplier: a dated history, lot by lot. 21 CFR 211.84(d)(2)
- Template drift
- Each new document compared with the supplier's own earlier documents across 11 structural features, from field order to the laboratory's phone number. Two certificates for one lot number that disagree are put side by side.
- The laboratory's reply
- A request to the laboratory is drafted for you, and only its recorded reply earns source-confirmed.
- Your laboratory's work
- Comparing your laboratory's results with the supplier's stays your laboratory's work.
Identity and published limits
- Identity
- Name, UNII, CAS number, formula and molecular weight compared with FDA's substance registry. A conflict fails with both figures named. FDA GSRS
- Bacterial endotoxins
- The limit computed as K / M from your route and maximum hourly dose: the arithmetic, against the printed limit. USP <85>
- Solvents and elements
- 60 residual solvents with their permitted daily exposures; cadmium, lead, arsenic and mercury by route; each as a share at your dose. Caught when inside the supplier's limit and over ICH's. ICH Q3C(R9) · ICH Q3D(R2)
- Microbial counts
- Total aerobic count and total yeasts and molds, each against the published criterion. USP <1111>
Qualification and lot decisions
- Six dated elements
- Manufacturer identity, accreditation, FDA registration, quality agreement, documentation specifications and ongoing monitoring, each current, due or overdue, every open gap with a named owner and a due date.
- A decision that stands
- An unsigned decision reads as recorded and never signed, so it does not stand. The verified file goes further: 37 items, each saying how and when it was verified.
- Setting a finding aside
- A newer clean certificate lets a person set an older finding aside, with a reason, and both stay on file.
- The signature
- The printed name, the time and a fixed meaning, bound to the record's fingerprint and chained to every signature before it.
Distribution and recall
- Outside DSCSA
- 21 U.S.C. 360eee(13) leaves drugs compounded under 503A or 503B out of its definition of product, so no federal tracing travels with a compounded unit. Custody records each one from release to the clinic. 21 U.S.C. 360eee(13)
- Custody events
- Seven events, from released to reported, every event on a unit chained to the one before it. Each box ships under one code and each clinic receives by code.
- The statement
- A numbered custody statement per batch: shipped, received, administered, returned and unaccounted.
- A recall
- Declared once on the batch. Every clinic on Veritura holding it sees the units named on its desk and by email, every patient who saved the unit or asked for recall notices is emailed, every other order comes back to you as an order list, and the statement shows which clinics have opened the notice.
What your buyers can read
- A Passport or a Seal
- A Passport per order or a Seal per unit opens the certificate's own lines from a fixed list of 14 fields, the chain by role and the release gates, with no score.
- Your verified file
- You can publish your verified file. Buyers read it with no account, whole and findings first, including the items an outsourcing facility carries: every batch tested before release, and your 503B duties.
Your determinations stay yours. Whether a substance qualifies under 503B(a)(2)(A) and the design of your component testing program remain your regulatory and quality teams' calls. Not checked: USP monograph acceptance criteria.
Questions, answered plainly.
No. 211.84(d)(1) and (d)(2) still call for your identity test, and your QMS stays the system of record for manufacture and release. Veritura checks the certificates and keeps the supplier history and decision trail around them.
The verdict checks the certificate, the maker's registration, identity and published limits, and shows the 503A routes and FDA's 503A lists. Whether a substance qualifies under 503B(a)(2)(A), from FDA's 503B bulks list or the shortage list, stays with your regulatory team.
The parts you release. A Passport per order or a Seal per unit opens the certificate's own lines from a fixed list of 14 fields, the chain by role and the release gates, with no score.
Declare it once on the batch. Every clinic on Veritura holding it sees the units named on its desk and by email, every patient who saved the unit or asked for recall notices is emailed, every other order comes back to you as an order list, and the custody statement shows which clinics have opened the notice.
Supplier files with their dated elements, every certificate as received with its fingerprint, signed decisions in one chain, the custody statement per batch, and, if you choose, a read-only records room whose link stops answering when you close it.
No, and it says so. It is not a validated GxP system, not SOC 2 certified and not a HIPAA-covered service. Signatures carry the printed name, time and meaning bound to the record's fingerprint; the first signature in each session asks for the signer's password, or their authenticator when it has not been used recently, unless they sign in only with Google or Microsoft and have no authenticator.
Still have questions? Talk to a person.