21 CFR 211.84: Testing, Approval, and Rejection of Components

Under 21 CFR 211.84, a pharmaceutical manufacturer must hold every incoming lot of components, drug product containers, and closures in quarantine, draw representative samples, test or examine those samples against written specifications, and obtain a release decision from the quality control unit before any of that material enters production.¹ The quality control unit holds sole authority over that decision. No other function in the company can override it.

Quarantine on Receipt

Quarantine is the default state for every incoming lot. The material is withheld from use until it has been sampled, tested or examined, and formally released.¹

Two related provisions run alongside 211.84 at the receiving dock. Under 21 CFR 211.82, personnel visually examine each shipment on arrival, checking labeling, container damage, broken seals, and any visible sign of contamination.² Under 21 CFR 211.80, each lot in each shipment receives a distinctive identification code that travels with the material through testing and final disposition. That code is how a lot is traced from the loading dock through the laboratory to release or rejection.

How Samples Must Be Collected

Sampling is where a lot of 211.84 problems begin, and FDA investigators know it. Sampling standard operating procedures get close scrutiny during inspections, because poor sampling can undermine even rigorous laboratory work.

Sample Size

Representative samples must be drawn from each shipment of each lot. The regulation sets no fixed number of containers. Sample size is instead driven by:¹

Statistical criteria — the expected variability of the component, the confidence level needed, and the desired precision.
Supplier history — an established supplier with a strong track record may justify a smaller sample size than a new or unproven vendor.
Analytical needs — enough material must be collected for the immediate analysis and for any reserve samples required under 21 CFR 211.170.

The flexibility cuts both ways. A manufacturer that samples too few containers without documented justification is as exposed as one that skips testing outright.

Collection and Handling

Six procedural requirements govern how samples are physically taken:¹

Containers selected for sampling must be cleaned as necessary to avoid introducing contaminants into the component.
Containers must be opened, sampled, and resealed in a way that protects both the sampled material and nearby materials from contamination.
Sterile equipment and aseptic sampling methods are required when the material or situation calls for them.
Sub-samples taken from the top, middle, and bottom of a single container must be tested separately. They cannot be composited before testing.
Each sample container must be labeled with the material name, lot number, source container, collection date, and the name of the person who took the sample.
Any container from which a sample has been drawn must be marked to show that sampling occurred.

The compositing prohibition catches people off guard. If sampling from different depths within a container is intended to detect stratification, blending the sub-samples before analysis would mask exactly the variation the test is designed to catch.

Testing Components

Section 211.84(d) sets out what has to happen in the laboratory once samples are in hand. For drug product components — active ingredients, excipients, and other raw materials — the requirements fall into three categories.

Identity

Every lot of every component must pass at least one identity test confirming it is what the label claims.¹ Where a recognized specific identity test exists, the manufacturer must use it. A general screening method will not satisfy the regulation when a targeted test is available. Identity testing is the one requirement the manufacturer can never delegate to a supplier, a point the FDA reinforces in nearly every warning letter involving 211.84.

Purity, Strength, and Quality

Each component must also be tested against all applicable written specifications for purity, strength, and quality.¹ Every applicable specification has to be checked. Selecting the most convenient tests and ignoring others is a violation, even if the skipped tests seem unlikely to fail.

Microbiological Contamination

Any lot of a component, container, or closure that could carry harmful microbiological contamination must undergo microbiological testing before use.¹ Whether a particular lot triggers this requirement depends on the nature of the material and how it will be used. Components going into a sterile injectable face a higher bar than those going into a topical ointment, but the principle holds: if microbiological contamination would be objectionable given the intended use, the manufacturer must test for it.

Testing Containers and Closures

Bottles, vials, caps, stoppers, and seals carry their own testing obligations, and those obligations differ from component testing in an important way.

Containers and closures must be tested against all applicable written specifications.¹ The identity standard, however, is lower. Components require at least one specific identity test; containers and closures require at least a visual identification by the manufacturer, with the supplier’s certificate of testing acceptable for other attributes provided the manufacturer validates those results at appropriate intervals.

When containers or closures directly contact the drug product, an additional layer applies. Those materials must be tested for reactivity, additives, and extractables where those tests apply. This goes beyond confirming the right container arrived and into whether the container could leach something harmful into the medication over its shelf life.

When You Can Rely on a Supplier’s Analysis

Manufacturers do not have to run every test themselves. The regulation offers a path for using supplier data, but the conditions are strict enough that this is an alternative with its own compliance burden, not a shortcut.

Components

A manufacturer may accept a supplier’s report of analysis in place of running its own purity, strength, and quality tests on a component, but only if two conditions are met. The manufacturer must still conduct at least one specific identity test on the component in its own facility, and it must validate the supplier’s test results at appropriate intervals to confirm the supplier’s analyses are reliable.¹

The regulation does not define “appropriate intervals” or prescribe a specific validation method. Most manufacturers build a periodic re-testing program that runs full in-house analysis alongside the supplier’s report and compares results, with frequency tied to the supplier’s track record, the criticality of the component, and the manufacturer’s risk assessment.

Containers and Closures

A similar option exists for containers and closures. The manufacturer can accept a certificate of testing from the supplier, provided it performs at least a visual identification on the materials and validates the supplier’s test results at appropriate intervals.¹ The in-house bar is lower here — visual identification rather than a specific identity test — but the validation obligation is identical.

How This Goes Wrong

A 2025 FDA warning letter illustrates the failure mode. The agency cited a manufacturer for not conducting identity testing on incoming components and for not validating the reliability of its supplier’s analyses at appropriate intervals. Without adequate testing, the FDA said, the manufacturer had no scientific evidence that components met specifications before use.³ Corrective actions demanded included a comprehensive review of the entire material qualification system, chemical and microbiological specifications for every incoming component, and a documented program for validating supplier certificates going forward.

Retesting Materials Held in Storage

An earlier release does not last forever. Under 211.84(e), components, containers, and closures must be retested or reexamined for conformity with specifications before use if they have been in storage long enough that their quality could have changed.¹ The regulation sets no universal retest interval. The manufacturer’s written procedures decide when retesting is triggered, based on factors like the material’s stability profile and storage conditions.

Materials degrade. Hygroscopic powders absorb moisture, elastomeric closures can oxidize, and temperature fluctuations can alter a component’s chemical profile over months or years. A lot that passed every specification eighteen months ago may not meet them when production finally pulls it off the shelf.

Approval, Rejection, and Records

The quality control unit alone decides whether a lot is released for production or rejected.¹ Purchasing cannot override it. Production management cannot override it. A lot is released only after all required testing confirms it meets every applicable specification for identity, strength, quality, and purity.

Any lot that fails must be rejected and segregated to prevent unauthorized use in manufacturing. The disposition decision, together with the supporting sampling and testing data, forms the core of the lot’s permanent record.

Those records are kept under the general CGMP recordkeeping rule at 21 CFR 211.180. For components, containers, closures, and labeling, the minimum retention period is one year past the expiration date of the drug product that incorporated the material.⁴ For certain OTC products that carry no expiration date because they qualify for the exemption in 21 CFR 211.137, the retention period extends to three years after distribution of the last lot that used the material.

Enforcement Consequences

A 211.84 failure is not just an inspection observation. Under federal law, a drug manufactured out of conformance with CGMP is adulterated,⁵ and introducing an adulterated drug into interstate commerce is a prohibited act that carries criminal exposure.⁶

Penalties scale with intent and history. A first offense carries up to one year of imprisonment, a fine of up to $1,000, or both. A repeat offense, or one committed with intent to defraud or mislead, carries up to three years of imprisonment, a fine of up to $10,000, or both.⁷

Criminal prosecution is the extreme. More commonly, the FDA issues warning letters demanding corrective action on a tight timeline. If violations remain unresolved, the agency can pursue product seizures, injunctions barring further manufacturing, and debarment from government contracts.³ Export certificates can also be withheld, effectively closing off international markets. For a manufacturer whose business depends on uninterrupted production, a 211.84 violation can be financially devastating long before any criminal case is filed.

1
eCFR. 21 CFR 211.84 – Testing and Approval or Rejection of Components, Drug Product Containers, and Closures
2
eCFR. 21 CFR 211.82 – Receipt and Storage of Untested Components, Drug Product Containers, and Closures
3
U.S. Food and Drug Administration. Medical Chemical Corporation – 706007 – 07/09/2025
4
eCFR. 21 CFR 211.180 – General Requirements
5
Office of the Law Revision Counsel. 21 USC 351 – Adulterated Drugs and Devices
6
Office of the Law Revision Counsel. 21 U.S. Code 331 – Prohibited Acts
7
Office of the Law Revision Counsel. 21 U.S. Code 333 – Penalties