May 23, 2026 · By the RxRescue Team
What an FDA inspector actually asks a pharmacy to produce
The shorthand for a regulatory inspection is "audit," and audit makes people picture clipboards and tense conversations. The reality, for a small dispensing pharmacy, is closer to a records request. An inspector arrives with a list of things they want to see. Most of those things are documents you should already have. The inspection goes well or poorly depending almost entirely on whether you can put your hands on them quickly.
Here is what they actually ask for — and what each request is really testing.
1. Proof you can identify a product on your shelf
An inspector will pick a bottle off a shelf and ask: tell me where this came from, when it arrived, what lot it is, and when it expires. Under the Drug Supply Chain Security Act, you are responsible for being able to answer that — at the package level, for serialized product, with the GTIN, lot, serial, and expiry available. The small-dispenser enforcement date is November 27, 2026.
The test underneath the question is: do you have a system that captures this information at intake, or do you read it off the bottle in front of you? Reading the bottle works once. Reading it for fifty bottles, while an inspector watches, is the problem.
2. The transaction information for a specific product you received
The inspector picks a product and asks for the T3 transaction documents — Transaction Information, Transaction History, Transaction Statement — that came with it from your wholesaler. Those records live in the wholesaler's portal in most cases. The test is not whether the records exist, because they do. The test is whether you can produce them on demand, within the FDA's 48-hour window, without an unscheduled call to your wholesaler rep.
This is where pharmacies most often get caught flat-footed. The records are technically accessible — but the password is on someone's old laptop, the portal navigation has changed, and what looked like a five-minute task becomes a half-day scramble.
3. Your expired-stock controls
An inspector will look for expired product on the shelf, and they will look at your process for catching it before it gets there. Both matter. Finding an expired bottle on a dispensing shelf is a citation; not having a process that would have caught it is a deeper finding.
What they want to see is a routine, not a heroic one-time count. A monthly clipboard walkthrough by one staff member is a routine. A live, sorted list of what's expiring in the next 30, 60, and 90 days that any staff member can pull up is a better one. The question they are really asking is whether expiration management depends on a specific person being present.
4. Your recall response, for a specific recall
The inspector names a recent FDA recall and asks what you did. The expected answer is a paper trail: when you received the recall notification, how you checked it against your inventory, what you found, what you quarantined, what you returned, and the date you closed the loop. If you did not have any of the recalled lot, that itself is a record — "checked, no impact" with a date and an initial.
"We monitor the FDA email" is not an answer. "Here is our recall log for the last twelve months, including the four recalls that touched us and the eighteen that didn't" is.
5. Your suspect-product and quarantine workflow
If a product arrives damaged, with a broken seal, or with paperwork that doesn't match, what happens next? Where does the bottle go physically? Who decides whether to return it or escalate? How is that decision documented? DSCSA requires a quarantine workflow for suspect and illegitimate product. The inspector wants to see it — written down, followed, and with examples from the last year.
6. The records, for six years back
Everything above has a six-year retention requirement under DSCSA. The inspector may ask for transaction records from three years ago for a specific product. They are not testing your memory — they are testing your storage system. A folder of PDFs on one tech's desktop is not it. A defined location, with backup, that survives staff turnover is.
What "ready" looks like in practice
The pharmacies that handle FDA inspections well are not the ones with the most paperwork. They are the ones whose paperwork lives in one place, can be retrieved in minutes, and is generated as a byproduct of normal daily work — not assembled retroactively when an inspector calls to schedule.
The shift to make is from "we will figure it out when they come" to "we can produce any of the above today, in under an hour, without calling anyone." If your honest answer to that is no, you have until November 27, 2026 to change it — and the changes are mostly procedural, not expensive.
RxRescue is the visible inventory layer that makes those records easy to produce — bottle-level capture at intake, daily FDA recall monitoring with a persistent log, a quarantine workflow, and a one-tap DSCSA audit pack that exports the records in the form inspectors expect. See how it fits alongside your existing systems, or start a 30-day free trial.