Why Published CRLs Cite Manufacturing

TL;DR: McCarthy and O'Boyle's peer-reviewed study, published in Drug Discovery Today in July 2026, tracked all 358 first-time small-molecule new drug applications CDER reviewed between 2013 and 2023 and coded the deficiencies behind the letters. Among the drugs that drew a CRL and later won approval, CMC was the most commonly cited deficiency category, at 45% of cases, and far more recoverable than a safety finding: 75% of CMC-cited drugs later won approval, against 44.4% for drugs cited on safety. Jefferies analyst Andrew Tsai's separate read of the FDA's full public archive, reported by BioSpace in May 2026, found more than half of rejections cite manufacturing and 41% cite product quality; Mizuho's Graig Suvannavejh reads the archive the same way. We pulled the FDA's own primary dataset ourselves, 459 records as of August 13, 2026, and read the full text of every letter that carries one; the pattern holds at scale. RSM US LLP puts the average CRL-to-approval gap at more than 2.5 years across the first 200-plus released letters, and found that more than half of the facility-related deficiencies happened because the FDA could not finish the pre-approval inspection in time rather than because the plant failed one. That's the part boards keep missing. In my read of the archive, the biggest controllable driver of CRLs sits with the technical leader who has seen the failure pattern before. Here is what the archive says, and what changes once someone in the room has sat through a PAI.

In May 2026, BioSpace reported on work Jefferies analyst Andrew Tsai's team had done: a quantitative pass through the FDA's own repository of published rejection letters, nearly 350 of them by that point. More than half cited manufacturing, primarily plants that failed or could not complete an FDA inspection. Forty-one percent cited poor product quality, impurities and failed stability testing. Mizuho's Graig Suvannavejh, reading the same archive, told BioSpace the majority, and perhaps the vast majority, of CRLs come down to those two issues, manufacturing and the data package. Jefferies also found 27% cited the need for more clinical data, which tells you where the weight actually sits.

That repository exists because the FDA decided, in a press release titled with a straight face "FDA Embraces Radical Transparency," to start publishing letters it used to keep confidential. More than 200 came out on July 10, 2025, covering applications reviewed between 2020 and 2024, every one of them eventually approved. Another 89 followed that September, drawn from applications still pending or withdrawn, the letters the first batch had left out. By the time Jefferies ran its numbers, the pile had grown to nearly 350.

Phase 3 pulled that same primary dataset in July 2026 and didn't stop at reading what other people found in it. The FDA's openFDA transparency release now runs to 459 records as of August 13, 2026, 446 of them Complete Response Letters, alongside a handful of legacy Not Approvable letters and other actions the FDA publishes in the same file. Most of the archive has been released since mid-2025, and the agency has committed to publishing new letters as they issue. One record carries no letter text, so we read the full text of the 458 that do. Facility-related language shows up in about 65% of letters, inspection language in about 60%. We're not going to hand you a clean "X% are manufacturing" figure off that keyword count, because the letters are long and most cite several problems in the same document, 81% mention both manufacturing and clinical language together. Our stricter section-header count, which tallies only the FDA's own uppercase deficiency-section titles, finds a manufacturing or quality section in 62.5% of the archive, and it is built deliberately as a conservative floor. What any scan of language gives you is scale and pattern: the letters are thick with facility and inspection findings. Which finding was the primary reason is a different question, and the peer-reviewed studies below are the ones that coded it. The full dataset, the method, and every number in this piece are published in our CRL data report, the running record of published letters and its how we counted them.

The number behind the number

A Complete Response Letter is the FDA's formal notice that it will not approve an application in its current form, listing every deficiency the sponsor must resolve before resubmission. In the FDA's published archive, manufacturing and quality deficiencies are cited more often than clinical ones, and they are also the most recoverable.

Break the archive open with a scalpel instead of a chainsaw and you get something narrower, and considerably more useful.

McCarthy and O'Boyle published the sharpest cut of it in July 2026, in Drug Discovery Today. Their cohort: 358 first-time small-molecule new drug applications reviewed by CDER between 2013 and 2023, biologics excluded on purpose. Forty-seven of those drugs, 13%, drew at least one CRL, and thirty of the forty-seven were eventually approved. Among those thirty, the slice whose deficiencies the authors coded, CMC was the most commonly cited category, at 45% of cases. Efficacy followed at 35%. Safety, the hardest category to come back from, sat at 21%.

Here's the part boards should actually sit with. CMC deficiencies are usually fixable: 75% of the CMC-cited drugs in that cohort went on to win approval. Safety was the toughest, only 44.4% of safety-cited drugs made it. Statistically, the letter that names your plant is better news than the letter that names your data.

Dilek and colleagues, writing separately in Therapeutic Innovation and Regulatory Science, analyzed the CRLs behind 43 novel therapeutics, all of them eventually approved. Manufacturing-facility deficiencies showed up in 65% of that group. CMC issues, the process and analytical package behind the drug, showed up in 51%, ahead of labeling at 44%, efficacy at 26%, safety at 26%, and PK/PD at 14%. Forty-three is a small number next to McCarthy's 358, but it lands on the same wall from a narrower angle.

Here's where this gets tricky. A facility deficiency and a product deficiency are not the same governance problem.

A CRL driven by a Form 483 finding at a contract manufacturer is a vendor-oversight failure with a vendor-shaped fix. A CRL driven by your own control strategy or your own analytical method is yours to own end to end. No amount of CDMO diligence saves you from that one.

I place CMC and quality leaders for a living. One pattern comes up again and again: facility risk sticks to the building long after the ownership changes.

The Novo Nordisk fill-finish site in Bloomington, Indiana started life as Cook Pharmica, then Catalent bought it in 2017, and Novo Nordisk took it over from Catalent in 2024. Two changes of ownership. Same buildings. Same equipment on the floor. In July 2025 the FDA ran a general inspection of the site, tied to no single product. The observations from that one visit produced two Complete Response Letters at two unrelated companies inside five weeks: Scholar Rock's apitegromab on September 23, and Regeneron's Eylea HD pre-filled syringe supplement on October 27. In between, on October 9, the agency classified the site Official Action Indicated, its most severe post-inspection grade, over pest and particulate contamination and a failure to determine root cause. One routine inspection, two companies, five weeks.

Whoever inherits that plant inherits its inspection history too. That's exactly why the real diligence question on a CDMO is less "who owns it today" and more "what has this site actually shipped, and under whose watch did the last finding happen."

I wrote about what that kind of repricing means for board composition in Wall Street Is Looking at CMC, Tech Ops & Quality. When the sell side starts pricing a risk category on its own terms, strategics and crossover investors are rarely far behind.

The months a letter costs

Median delay runs about fifteen months in Dilek's 43-therapeutic cohort and about 23 months of added time in McCarthy and O'Boyle's coded cohort, while RSM's read of the first 200-plus published letters averages more than 2.5 years from CRL to final approval. Plan for a year at best, two or more at the median.

A CRL is a delay with a bill attached. Boards routinely underprice both halves of that sentence.

Dilek's analysis puts the median time from CRL receipt to eventual approval at 1.28 years, about fifteen months, across that 43-therapeutic slice. McCarthy's larger cohort measures a different quantity: the delay a CRL adds against a first-cycle approval, a median of about 709 days, roughly 23 months. Different cohorts, different clocks, so resist averaging them; the honest read is that a letter costs you a year to two years, and sometimes far more. RSM US LLP's separate look at the first 200-plus released letters puts the overall average at more than 2.5 years from initial CRL to final approval. That's a whole-archive average, not a subgroup RSM broke out formally, though RSM's own commentary flags first-time launchers, companies with no prior approval to draw institutional memory from, as the ones who feel it hardest.

Here is the detail that matters more than the headline number. RSM found more than half of the facility-related deficiencies in that archive trace to inspections the FDA never got to finish in time, not contamination an inspector walked in and found. Part of that is agency bandwidth no sponsor controls. The rest is closer to a calendar and checklist problem than a science problem, and that part has an owner.

Your CTO should know how to get through a PAI

Here is the number. Of the facility-related deficiencies RSM found across the first 200-plus released letters, more than half came down to an inspection the FDA could not complete in time. Some of that is agency capacity, travel, scheduling, a foreign site the agency could not reach, and no sponsor controls it. Some of it is a site that was not ready to be inspected in the window it was offered. The first half is weather. The second half is a job someone should own.

A pre-approval inspection follows a predictable rhythm. Document requests, a walkthrough, an interview with whoever owns the deviation log, and a close-out meeting where the inspector tells you, more or less, what's coming in writing. Someone who has been through that rhythm before, on someone else's site, on someone else's dime, knows where the FDA tends to look and what tends to be missing when they look there.

That is the argument for hiring a CTO or Head of CMC with prior approvals in the seat: less the science, more the scar tissue of having sat through somebody else's failed inspection and remembered exactly which corner got cut.

They have watched a deviation get closed out sloppily, and watched that same shortcut turn into the paragraph an investigator reads back to the room eighteen months later. They know what "failure to determine root cause" looks like three weeks before an inspector writes it down, because they have stood in that room while someone else's team scrambled to explain it. That's what lets them steer the shop before it hits the iceberg instead of after.

The Bloomington finding, failure to determine root cause, is the most preventable phrase in the FDA's inspectional vocabulary. It means the team investigating a deviation stopped one question short of the actual answer. A technical leader who has been burned by that exact shortcut before does not let the investigation stop early, because they have seen what the plant looks like six months after it does.

CDMOs know this too, or the smart ones do. Regulatory violations, 483s and warning letters, are the single most cited reason a CDMO loses a bid, ahead of cost, according to a PharmaSource industry survey. Sponsors have started voting with their diligence checklists even when they have not started voting with their org charts.

What does a CRL cost in dollars?

Buy-side desks do not wait for the resubmission to reprice the asset. They reprice the day the letter is disclosed.

Run the math against a typical burn rate for a company running an active Phase 2/3 program, somewhere in the $5-10M-a-month range, and the delay stops being an abstraction. Adverum Biotechnologies reported R&D expense of $28.7M for the first quarter of 2025 in its SEC filing, close to $9.6M a month, while running its Phase 3 program. That's the ballpark, not a benchmark study. Just what an actual company actually spends.

That burn was always going to happen. The CRL doesn't create new spend. What it does is strand the runway you already had against a program that hasn't moved, and force the next raise onto the post-CRL price.

At $7M a month, twelve months of delay strands $84M of runway and refinances it at a worse valuation. Eighteen months strands $126M and hands you a worse term sheet on top. Both numbers are simple arithmetic against that burn rate, illustrative math, not someone else's audited model.

Neither figure shows up on the slide that says "CRL received, remediation underway." Both show up on the cap table six months later.

Why this keeps surprising boards

CMC is plumbing. Nobody in the boardroom asks about it until it springs a leak, and by the time it's spraying water across the fundraising deck, the fix costs a multiple of what the readiness work would have.

Clinical risk gets fifteen slides of probability-of-technical-success modeling and a director who has run three Phase 3s and can smell a soft endpoint from across the table. CMC gets a nod and a line item.

In theory, a board oversees both halves of the risk. In practice, less so.

I went deeper on that asymmetry, and what closing it looks like operationally, in the piece on the slide that costs runway. The short version holds here too. The risk category most boards wave through on trust is, by every independent read of the letters, the one most likely to be the reason for the delay.

Forgive me for being blunt, but most companies do not budget for this because most companies do not believe it will happen to them. In Jefferies' read of that archive, more than half of the letters cite a plant or a quality system rather than a failed hypothesis, and most boards still budget as though the opposite were true.

If I'm sitting in the CFO's chair, a CRL is a financing event with a science-shaped cause. The two get confused constantly, because the letter itself is written in regulatory language, not the language a term sheet is written in.

And this is the part people miss: the CFO doesn't need a tutorial on the assay. The CFO needs someone who can tell them, in dollars and months, what just happened to the model.

What it looks like to own the archive

Dilek's 43 were all eventually approved, and the FDA's first tranche in July 2025 was drawn entirely from applications that later cleared. That matters for how you read any recovery rate off this data: it skews toward drugs that made it. The September 2025 batch pushed the other way, 89 letters from applications still pending or withdrawn, and today about a third of the published archive sits marked unapproved, 150 of 459 records at the last count. Read the survivors as survivors. We didn't take anyone else's word for any of it. Phase 3 read the full text of all 458 published letters that carry one before writing a word of this.

What varied enormously was whether the CTO or Head of CMC was in the room early enough to get the manufacturing process, and the analytics that measure it, inspection-ready before an inspector ever showed up.

Think of it as the difference between GMP by heroics and GMP by system. One survives the first inspection on adrenaline and a handful of very tired people. The other was built to survive the tenth.

That work starts well before Phase 3, at the point the molecule first has to become a product. Drug development is a relay race, and this is the handoff most teams fumble, because the runner carrying the baton into CMC was never handed it early enough to get up to speed. That's why we opened the CTO Mandate series with exactly that question, Possible, before either of the other four mandates matter.

Handled early, the same technical rigor that keeps a program off this list is worth more than avoided delay. Acquirers price it directly at exit, an argument I've made at length in CMC as an exit multiplier.

The question becomes: does your CTO know what a PAI actually looks like from the inside, or only from a slide deck? And if a CRL landed on your desk tomorrow, would anyone in the room be able to tell you, within an hour, whether you're looking at a six-month fix or a two-year one?

If you don't have confident answers to those two questions, that's usually a leadership gap before it's a data gap. What matters is who was in the room early enough to manage the science, and who has actually sat through the inspection before. Worth sorting out before the letter arrives.

If you want a structured read on where your own program sits against this archive, that's a twenty-minute conversation, not a sales pitch, the kind of diagnostic our technical operations executive search practice runs before every engagement. Send me a message and we'll walk the archive against your program together.

Boards that chase clinical risk and CMC risk with equal attention tend to do fine. The ones that only chase the first one, hoping the second takes care of itself, tend to end up in this archive. Two rabbits, two hunters. That's the whole trick.

Sources and notes

Data status. Figures on this page are computed on the 457-record archive downloaded 22 July 2026. The live openFDA archive was 459 records when last verified on 20 August 2026, and the headline section-header figure is stable at 62.5-62.7% across both. Live count: api.fda.gov/transparency/crl.json. Full tables: crl-data.csv · crl-data.json (checksums: sha256).

• Among 358 first-time small-molecule new drug applications reviewed by CDER, 2013-2023 (biologics excluded), 47 (13%) received at least one Complete Response Letter; 30 of those (64%) were later approved. Among the 30 approved CRL NDAs (the coded slice), CMC was the most commonly cited deficiency category (45%), ahead of efficacy (35%) and safety (21%); 53% of CRL NDAs cited more than one deficiency type. CMC-cited drugs were later approved 75% of the time, versus 44.4% for safety-cited drugs; a CRL added a median of approximately 709 days (about 23 months) to approval versus first-cycle timing. Source: McCarthy G, O'Boyle NM, "Analysis of FDA approvals, delays and denials of new drug applications, 2013-2023," Drug Discovery Today (2026), 104739, published online July 14, 2026, DOI 10.1016/j.drudis.2026.104739. Open access. The first author discloses employment at Sanofi.
• openFDA Complete Response Letter transparency dataset (open.fda.gov): 459 records as of August 13, 2026, of which 446 are typed Complete Response Letters; four pre-2008 Not Approvable letters and a handful of other actions are published in the same file, and one record carries no letter text. Phase 3 Search full-text analysis (458 letters read): facility-related language appears in approximately 65% of letters, inspection language in approximately 60%; 81% mention both manufacturing and clinical language, so keyword presence is a scale-and-pattern signal rather than a measure of primary cause. Phase 3's section-header method, counting only the FDA's uppercase deficiency-section titles, finds a manufacturing or quality section in 62.5% of the archive (287 of 459, a conservative floor; 62.6% on the July 22 pull of 457). Method, sensitivity checks, and the recompute script are published on the the published method. The primary-reason percentages cited in this piece come from the peer-reviewed coded studies, not from language scans.
• More than half of FDA rejections cite manufacturing, primarily plants that fail or cannot complete inspection; 41% cite poor product quality; 27% cite the need for more clinical data. Jefferies analyst Andrew Tsai's quantitative assessment of the FDA's published Complete Response Letter repository; Mizuho analyst Graig Suvannavejh reads the archive the same way. Source: BioSpace, "Published FDA rejections point to manufacturing, data gaps as key stumbling blocks," Tristan Manalac, May 11, 2026. Jefferies' work is analyst research reported by BioSpace, not a public standalone document.
• The FDA released more than 200 Complete Response Letters on July 10, 2025 (applications reviewed 2020-2024, all later approved), a further 89 on September 4, 2025 (applications pending or withdrawn, not ultimately approved), and committed to releasing new letters promptly after issuance; the repository had grown to nearly 350 letters by May 2026 and 459 records by August 13, 2026. Sources: FDA press announcements, "FDA Embraces Radical Transparency by Publishing Complete Response Letters," July 10, 2025, and "FDA Announces Real-Time Release of Complete Response Letters," September 4, 2025; BioSpace, May 11, 2026; openFDA transparency dataset, August 2026.
• Among 43 novel therapeutics whose CRLs were later approved: 65% cited manufacturing-facility deficiencies, 51% cited CMC deficiencies, ahead of labeling (44%), efficacy (26%), safety (26%), and PK/PD (14%). Median time from CRL receipt to approval was 1.28 years. Source: Dilek S, Woods RH, Ballreich J, Moore TJ, Alexander GC (2026), "Deficiencies Delaying Prescription Drug Approvals by the U.S. Food and Drug Administration, 2020-2024," Therapeutic Innovation & Regulatory Science 60(3):837-846, DOI 10.1007/s43441-026-00921-3. This is a 43-therapeutic slice of the archive, all eventually approved; the percentages should not be read as archive-wide figures.
• Across the first 200-plus released CRLs, average time from initial CRL to final approval was more than 2.5 years; more than half of facility-related deficiencies occurred because the FDA could not complete the required pre-approval inspection in time. Source: RSM US LLP, "FDA's complete response letters underscore outsourcing and quality challenges," Laskey, Lohr and Bouchard, Feb. 5, 2026. The 2.5-year figure is an overall average across the released set, not a first-time-launcher-specific statistic; RSM's comments on first-time launchers being hit hardest are qualitative, not a separately measured subgroup.
• Cook Pharmica to Catalent (2017) to Novo Nordisk (2024) ownership history of the Bloomington, Indiana fill-finish site. A July 2025 general FDA inspection of the site produced observations resulting in CRLs for Scholar Rock's apitegromab (September 23, 2025) and Regeneron's Eylea HD pre-filled syringe supplement (October 27, 2025); the site was classified Official Action Indicated on October 9, 2025 over pest and particulate contamination and failure to determine root cause. Sources: BioSpace, "Violations at Novo's Indiana Plant 'Unacceptable,' FDA Says," Oct. 14, 2025; Scholar Rock and Regeneron disclosures, September-October 2025.
• $5-10M monthly burn rate for a Phase 2-3 development-stage biotech: an industry-typical range, not a named benchmark study, illustrated with Adverum Biotechnologies' Q1 2025 R&D expense of $28.7M (approximately $9.6M/month) per its SEC filing. The $84M and $126M figures for 12- and 18-month delays at a $7M monthly burn are illustrative arithmetic by the author, not a published statistic.
• Regulatory violations (Form 483s and warning letters) are the most commonly cited reason a CDMO loses a bid, ahead of cost. Source: PharmaSource industry survey.