By Jared Clark, JD, MBA, PMP, CMQ-OE, CPGP, CFSQA, RAC | Certify Consulting
There is a specific category of manufacturing failure that is especially hard to defend in front of an FDA investigator: the kind where the contamination was chemically invisible by design. When your active ingredient has no effect on the organism that contaminated your product, you cannot argue that the product should have been self-correcting. You have to explain, instead, why every upstream control that was supposed to catch this failed in sequence.
That is the situation facing manufacturers of isopropyl alcohol-based antiseptic products following the March 19, 2026 recall of Webcol™ Large Alcohol Prep Pads by Cardinal Health. The FDA recall notice identified Paenibacillus phoenicis contamination across more than 400 lot numbers — approximately 170 million units distributed between September 2025 and February 2026 across the United States, Puerto Rico, and Japan. FDA described the risk as a "reasonable probability" of local and systemic infections, with immunocompromised patients, cancer patients on chemotherapy, and patients with poorly controlled diabetes singled out as facing the highest danger.
The scale of this recall — 170 million units across six months of distribution — points toward a contamination event that was not acute. This was not a single bad batch that slipped through. The contamination was persistent, and the monitoring systems that should have caught it upstream either were absent, were not looking for the right things, or were not sensitive enough to detect the problem before product reached patients.
This article is about prevention. The recall is the evidence. The question worth answering is: what quality systems, testing protocols, and manufacturing controls make this kind of event extraordinarily unlikely? And what does the regulatory landscape look like right now — specifically, what changed on February 2, 2026, six weeks before this recall became public — that raises the stakes even higher for manufacturers operating in this space?
Why a 70% Alcohol Product Can Harbor a Living Organism
Manufacturers sometimes carry an unstated assumption that the active ingredient in an antiseptic product provides a margin of safety against microbial contamination in the finished product. For vegetative bacteria, that assumption has some basis. Seventy percent isopropyl alcohol disrupts cell membranes and denatures proteins rapidly in vegetative bacterial cells. But for spore-forming organisms, this assumption is simply wrong.
Paenibacillus phoenicis is a spore-forming bacterium in the Firmicutes phylum. Like all spore-formers, it can produce endospores — dormant, metabolically inactive structures encased in multi-layered proteinaceous coats that physically prevent alcohol penetration. The spore coat is not a thin membrane that isopropyl alcohol can disrupt on contact. It is a dense, chemically resistant shell that evolved precisely to survive environmental insult: heat, desiccation, UV radiation, and — critically — chemical antiseptics including alcohols.
Seventy percent isopropyl alcohol is classified as bactericidal against vegetative cells. It is not classified as sporicidal. This is not a subtle distinction buried in technical literature. The sporicidal activity of common antiseptics has been documented in the primary scientific literature and codified in regulatory guidance for decades. A manufacturer producing an alcohol prep pad who has not internalized this distinction and designed their quality program accordingly has a foundational gap.
Paenibacillus species naturally inhabit soil, water, and the rhizosphere — the zone of soil surrounding plant roots. They are routinely introduced into manufacturing environments through contaminated raw materials (plant-fiber-derived nonwoven substrates, for example), inadequately controlled water systems, and environmental ingress. Approximately 25% of clinical Paenibacillus isolates have been associated with true infections: abscesses, wound infections, bacteremia, and CNS infections. The clinical significance is not theoretical.
What makes the Cardinal Health recall particularly concerning is the end-use context. Alcohol prep pads are used immediately before needle puncture — to prepare the skin before blood draws, subcutaneous injections, and IV access. In an immunocompromised patient, an alcohol prep pad contaminated with a spore-forming bacterium does not protect the puncture site. It delivers the contaminating organism directly into the tissue, creating parenteral exposure before any physiological barrier can respond. That exposure pathway is the reason FDA specifically named immunocompromised patients, chemotherapy patients, and patients with poorly controlled diabetes in the recall notice. These are populations with impaired ability to clear bacterial infection at the source.
The Four Upstream Entry Points Where Contamination Enters Antiseptic Manufacturing
For a manufacturer of isopropyl alcohol prep pads, contamination with a spore-forming organism like Paenibacillus cannot be intercepted at the finished product stage — not reliably, and not by the active ingredient. Prevention has to happen upstream. There are four distinct entry points where contamination typically enters this type of manufacturing process, and each requires its own specific controls.
The first is the nonwoven substrate. The absorbent pad material in an alcohol prep pad is typically a nonwoven fabric derived from plant fiber, synthetic fiber, or a blend. These materials are not manufactured in cleanroom conditions. They are produced in textile-type environments where soil organisms — including Paenibacillus — can colonize the substrate during processing, storage, or transit. The bioburden of the incoming nonwoven substrate is one of the most significant contamination variables in this product type, and it is directly addressable through incoming lot testing. 21 CFR § 211.84(d)(6) is unambiguous on this point: components susceptible to microbiological contamination must be subjected to microbiological testing before use. That requirement applies to the nonwoven substrate, and the testing must include spore-forming organism detection — not only total aerobic count. A standard total aerobic count will not reliably detect spore-formers unless samples are heat-shocked (typically 80°C for 10 minutes) to kill vegetative cells and germinate survivors before plating.
The second entry point is the isopropyl alcohol itself. Pharmaceutical-grade isopropyl alcohol has specifications that address purity and chemical content, but microbial quality of the IPA supply is sometimes overlooked on the assumption that the alcohol is inherently antimicrobial. It is not — not against spores. IPA should be tested for microbial quality at receipt, including bioburden testing that specifically covers spore-forming organisms. Spore contamination of IPA is uncommon but not impossible, particularly if the IPA passes through a non-pharmaceutical supply chain or is stored under conditions that allow water ingress and dilution at the container interface.
The third entry point is the facility water system. Paenibacillus is a known colonizer of water systems, including HVAC condensate, purified water systems, and cooling water loops. 21 CFR § 211.48 requires that water systems be free of defects that could contribute contamination. For a manufacturer using purified water in any part of the manufacturing process — including cleaning operations — the water system is a potential spore-former reservoir. Routine bioburden monitoring of water systems must specifically include spore-former detection, and the trend data must be reviewed with enough regularity to catch colonization before it reaches product contact surfaces.
The fourth entry point is the manufacturing environment itself. If spore-formers are present in the environment — on surfaces, in the air, in HVAC systems — they can deposit on product, packaging, or equipment surfaces during manufacturing. Environmental monitoring for a non-sterile product like an alcohol prep pad operates under a different framework than sterile manufacturing, but 21 CFR § 211.113(b) requires written procedures specifically designed to prevent objectionable microorganisms in non-sterile drug products. Spore-forming organisms in a product used on compromised patient skin before parenteral puncture are objectionable organisms by any reasonable standard. The environmental monitoring program must reflect that.
The Regulatory Framework Just Changed — Six Weeks Before This Recall
The timing of this recall is not coincidental to the current regulatory moment, and manufacturers operating in this space need to understand what changed on February 2, 2026.
FDA's new Quality Management System Regulation (QMSR) — an amendment to 21 CFR Part 820 incorporating ISO 13485:2016 by reference — became effective on that date. The QMSR represents the most significant structural change to the medical device quality regulation in nearly three decades. For manufacturers of combination products or dual-regulated products like alcohol prep pads, which are classified as OTC drug products and also subject to device quality system expectations in some manufacturing contexts, the QMSR matters directly.
The most consequential change for contamination control purposes is this: FDA eliminated the prior exemption that shielded supplier audit records, management review records, and quality audit reports from FDA inspection. Under the old Quality System Regulation (QSR), these categories of records were protected from direct review during inspections. That exemption is gone. As of February 2, 2026, FDA investigators conducting inspections under the updated Inspection of Medical Device Manufacturers Compliance Program (7382.850) — which FDA also adopted on February 2, 2026, simultaneously retiring the QSIT protocol — can now directly review:
Supplier qualification audits. Management review records. Quality audit reports. Internal audit findings.
For a manufacturer whose supplier qualification program consists primarily of certificate of analysis review rather than genuine audits with documented findings, this change is not abstract. It means that the next FDA inspection can go directly to your Approved Supplier List, pull the qualification file for your nonwoven substrate supplier, and assess whether you conducted a real audit, when you last re-qualified that supplier, and what you did the last time that supplier notified you of a process change.
The Cardinal Health recall happened six weeks after QMSR took effect. Manufacturers who were operating under the old QSR mindset — including the assumption that supplier audit records were inspection-protected — are now behind. This is not a grace period situation. The effective date was February 2, 2026, and it was announced with substantial lead time. The inspection expectation is current.
For products classified as OTC drug products — as alcohol prep pads are — 21 CFR Part 211 cGMP also applies in parallel. The bioburden testing requirements of 21 CFR § 211.110(a) and the objectionable microorganism prevention requirements of 21 CFR § 211.113(b) govern the drug manufacturing side of this operation, independent of the device quality system considerations. Manufacturers of dual-regulated products must navigate both frameworks simultaneously, and neither framework provides shelter from the other.
ISO 13485:2016 § 6.4, now codified in the QMSR, requires that environmental conditions that could adversely affect product quality be identified, monitored, and controlled. ISO 13485:2016 § 7.4 addresses supplier controls — and those supplier qualification records are now FDA-inspectable. The convergence of drug cGMP requirements and the new QMSR creates a compliance floor that is higher than either regulation alone, and both sets of expectations are active right now.
What a Compliant Bioburden Control Program Actually Looks Like
For a manufacturer of non-sterile antiseptic products with documented contamination risk, a defensible bioburden control program has several required components that are specific enough to be audited and concrete enough to be executed.
Incoming raw material testing for the nonwoven substrate must occur at lot receipt, before any substrate enters the manufacturing environment. The testing protocol must include total aerobic count, total yeast and mold count, and — this is the gap most programs have — a specific spore-forming organism count. The spore-former count requires a different sample preparation step (heat shocking to 80°C for 10 minutes prior to plating) that is not part of standard total aerobic count methodology. If your incoming testing SOP does not specify heat-shocked plating as part of the bioburden test for the substrate, you are not detecting spore-formers in that incoming testing. This is addressable today with a procedure revision and a method validation — there is no reason to defer it.
The bioburden testing method itself must be validated or at minimum qualified per ISO 11737-1 (the bioburden testing standard for medical devices) and USP General Chapter <71>. Method suitability testing must demonstrate that the test method can recover representative microbial populations from the specific substrate material, which has its own extractable compounds that can inhibit growth on recovery plates if counteraction steps are not incorporated. A method that passes growth promotion on a standard TSA plate but is inhibited by substrate extractables is not a validated method for that substrate — it is a method that produces falsely reassuring data.
Environmental monitoring for the manufacturing environment must cover four domains: viable air (both active sampling and passive settle plates), surface monitoring (swabs and contact plates), personnel monitoring (glove prints, gowning exit monitoring), and utility monitoring (water systems, HVAC condensate). The alert limit versus action limit distinction is not optional for defensibility. Alert limits trigger investigation without mandatory product hold; action limit excursions trigger immediate CAPA and product impact assessment. Both must be defined, documented, and reviewed at least annually against actual monitoring data. Reference standards are USP General Chapter <1116> for microbiological evaluation of controlled environments and PDA Technical Report No. 13 for environmental monitoring of manufacturing facilities.
Trending is where most programs fail inspection. Collecting data and reading each result in isolation is not trending. Trending is systematic: monthly and quarterly summaries by location, by organism type, by season, and by operator. A single spore-former recovered from an environmental surface is a finding. The same species recovered from the same zone three months apart is a harborage signal. A program without formal trend analysis cannot catch that signal, and that signal is precisely the leading indicator that contaminated product is leaving the facility.
Annual requalification of bioburden test methods is required to confirm that the method remains suitable as substrates, suppliers, or formulation elements change over time.
Supplier Qualification Is Now FDA-Inspectable: What That Means for Your Program
The QMSR change to supplier audit record inspectability is the single most operationally significant regulatory shift for contamination risk management in this product category. Here is what a defensible supplier qualification program for a nonwoven substrate supplier now looks like under the new framework.
Your Approved Supplier List must be tiered by risk, and the nonwoven substrate supplier belongs in the highest risk tier. Risk tier is not a formality — it drives the required verification activities. For a highest-risk-tier supplier, certificate of analysis review is a verification activity that supplements, not replaces, an actual supplier qualification audit. The audit must be documented: scope, findings, corrective actions for any deficiencies, and the approval decision. Remote audits are permissible when structured, but they must produce the same level of documented evidence as an on-site audit. A phone call with a supplier's quality manager is not an audit.
Incoming lot testing must be conducted by your organization independently of what the COA says. The COA documents what the supplier tested. Your incoming test documents what you received. For the nonwoven substrate, independent incoming bioburden testing on a statistically representative sample from each lot — including spore-former-specific testing — is the minimum defensible position. A lot that arrives with a compliant COA but fails your incoming bioburden testing is a supplier problem and a supply chain quality signal. A lot that fails and then passes your testing without explanation is a root cause investigation waiting to happen.
Annual supplier re-qualification is required. Trigger-based re-qualification — initiated when a supplier notifies you of a manufacturing process change, a facility modification, a raw material sourcing change, or a change in key quality personnel — must also be built into your supplier agreement and your internal change notification procedure. Under ISO 13485:2016 § 7.4, now QMSR-codified and FDA-inspectable, you need documented evidence of both planned re-qualification and change-triggered re-qualification events. The absence of either is now a direct inspection finding risk.
Building a Contamination Control Strategy That Holds Up to Inspection
The Contamination Control Strategy (CCS) concept entered mainstream regulatory vocabulary through EU GMP Annex 1's 2022 revision, where it was formally required for sterile product manufacturers. FDA has not mandated a CCS by name for all OTC drug manufacturers, but for products where contamination risk is documented and consequential — and where the active ingredient does not provide a last-line-of-defense kill step — the CCS framework is the strongest inspection defense available, and FDA investigators increasingly expect to see a holistic, documented approach.
A CCS for an antiseptic product manufacturer maps every contamination source (raw materials, water, environment, personnel, utilities), the specific control at each source (incoming testing, environmental monitoring, personnel training, HVAC qualification), the monitoring method and frequency for each control, the action trigger that initiates investigation or CAPA when a control signal is received, and the periodic review schedule that keeps the document current. It is a living document — not an annual report, but a controlled document that is updated when facility conditions change, when monitoring data reveals new signals, or when a contamination event (including a near-miss) prompts reassessment.
The CCS integrates facility design, equipment qualification, process validation, environmental monitoring, personnel training, and supplier controls into a single risk-based framework. Its value during an inspection is not compliance theater — it demonstrates to an investigator that the organization understands the contamination landscape of its own manufacturing operation and has a systematic, documented response to every identifiable risk. That is the difference between a facility that got lucky and a facility that built a system.
For a non-sterile OTC manufacturer, the CCS does not need to reach the complexity of an aseptic processing CCS. But it does need to exist, it does need to be specific to your facility and your products, and it does need to be traceable — the controls it documents need to correspond to active, documented programs, not aspirational statements.
The Compliance Checklist: Key Questions to Ask Before Your Next FDA Inspection
- Does your incoming raw material testing SOP for the nonwoven substrate specifically require heat-shocked bioburden plating to detect spore-forming organisms, distinct from your standard total aerobic count procedure?
- Is your bioburden test method validated or qualified under ISO 11737-1 using actual substrate material, with documented counteraction steps for substrate-derived inhibition?
- Does your environmental monitoring program include specific detection of spore-forming organisms in water systems, HVAC condensate, and manufacturing surfaces — not only in the standard total aerobic count?
- Are alert limits and action limits formally documented for each environmental monitoring location, statistically derived from your facility's own baseline data, and reviewed and approved at minimum annually?
- Is your environmental monitoring data formally trended — monthly and quarterly summaries by location, by organism type, and by operator — with documented review and sign-off by a qualified microbiologist or quality professional?
- Is your nonwoven substrate supplier in the highest risk tier on your Approved Supplier List, with a documented on-site or formally structured remote audit on file — not only COA review?
- Does your supplier agreement with the substrate supplier include a change notification obligation, and do you have a documented internal procedure for trigger-based re-qualification when notification is received?
- Do you conduct independent incoming lot bioburden testing on the nonwoven substrate, with spore-former-specific detection, separate from your reliance on the supplier COA?
- Have you reviewed your supplier qualification audit records for QMSR compliance — specifically, are those records organized and accessible in a way that is ready for FDA direct review, which is now permissible as of February 2, 2026?
- Is there a documented Contamination Control Strategy, or equivalent holistic framework, that maps contamination sources, controls, monitoring, action triggers, and review schedule for your antiseptic manufacturing operation?
- When the last environmental excursion occurred — or the last supplier COA deviation — was the investigation documented with root cause analysis, CAPA, and effectiveness verification? Is that documentation in a state you could hand to an investigator today?
- Does your management review include analysis of environmental monitoring trends and supplier quality performance data, with documented discussion and follow-up decisions?
The controls that would have prevented the Cardinal Health Webcol recall are not exotic or novel. They are bioburden testing requirements that exist in 21 CFR Part 211. They are supplier qualification requirements that have been in ISO 13485 for years and are now FDA-inspectable under the QMSR. They are environmental monitoring fundamentals documented in USP <1116> and PDA TR No. 13. The gap between those controls existing on paper and those controls being executed with enough specificity to catch spore-former contamination upstream is a quality program design and execution problem — and it is the kind of problem that is much easier to identify and fix before a six-month nationwide recall than after one.
If you manufacture OTC antiseptic products, medical devices, or other contamination-sensitive products under 21 CFR Part 211 or the new QMSR, and you want an honest assessment of where your contamination control program stands against current FDA expectations, that is exactly the kind of evaluation our team at Certify Consulting conducts. The gaps are usually findable. What matters is finding them first.
Last updated: 2026-04-03
Jared Clark
GMP Compliance Consultant | JD, MBA, PMP, CMQ-OE, CPGP, CFSQA, RAC
Jared Clark is the founder of Certify Consulting. He has worked with 200+ FDA-regulated manufacturers and maintains a 100% first-time audit pass rate across his client base. He consults on GMP compliance for OTC drug, medical device, dietary supplement, and food manufacturers.