Sterility Assurance Is Not a Line on a CoA: Reading the Tirzepatide Recall

On 8 October 2026 FDA classified as Class II a nationwide recall of compounded tirzepatide injection made by Apothecary Pharma LLC, a registered 503B outsourcing facility in Cary, North Carolina. The firm began the recall on 24 September 2026. The reason recorded is four words: lack of assurance of sterility. There was no press release and no company announcement on FDA's recalls page. If you were not reading the weekly Enforcement Report, you did not hear about it.

This article is educational. It is not medical, pharmaceutical or legal advice, and it does not recommend or disparage any product, supplier or dose.

What the record actually says

There are two entries, recall numbers D-0036-2027 and D-0037-2027, both appearing in the Enforcement Report dated 14 October 2026 and retrievable from FDA's enforcement data.

The first covers Tirzepatide Injection, 18 mg/mL, 4 mL sterile multi dose vial, NDC 85091-001-18: 22 vials across 22 lots in the range AP-202622 to AP-202644, with beyond use dates running from 7 October to 26 November 2026. The second covers a single vial of Apothecary NAD+ Injection, 200 mg/mL, 6 mL sterile multi dose vial, lot AP-202647, beyond use date 13 October 2026. Both are voluntary and firm initiated, both were distributed nationwide, and both were still listed as ongoing when this was written on 28 October 2026. Tirzepatide is the active ingredient in Eli Lilly's approved Mounjaro and Zepbound; neither approved product is involved here.

Twenty two vials sounds trivial, but a multi dose vial is not a single exposure, and those beyond use dates run into late November, so a vial dispensed in September can still be sitting in a patient's refrigerator. Note also that some press coverage states lot AP-202626 is excluded. The FDA record gives a range rather than an itemised list, so confirm the exact lots against the firm's recall letter, not against a news summary.

Class II is a defined term. Under 21 CFR 7.3 it describes a situation in which use of a violative product may cause temporary or medically reversible adverse health consequences, or in which the probability of serious adverse health consequences is remote. It is a judgement about likely consequence, not a finding that anything went wrong.

The enforcement record does not report confirmed contamination or any infection linked to these lots. That is worth stating plainly, and so is the limit of it. An absence of reports in a recall record is not a finding of safety. With an injectable, an infection is normally attributed to the patient's condition long before anyone thinks to look at the vial.

Why a Certificate of Analysis cannot answer this question

Under 21 CFR 211.167, every batch of a drug product purporting to be sterile must have appropriate laboratory testing to determine conformance. So a release Certificate of Analysis from an outsourcing facility will usually carry a sterility result, and often a bacterial endotoxin result as well. Both will say pass.

A compendial sterility test is a destructive test performed on a sample of units drawn from the batch and incubated in growth media. It can detect gross contamination. It cannot demonstrate that the units you actually received are sterile. Low level contamination, or contamination distributed unevenly through a batch, passes that test routinely. This is not a controversial point: it is the reason FDA's guidance on sterile drug products produced by aseptic processing builds sterility assurance out of facility design, validated aseptic process simulations, environmental monitoring, personnel qualification and gowning, rather than out of an end product test.

So read the recall language precisely. "Lack of assurance of sterility" is a statement about the process that produced the vial, not about a test result on the vial. A clean Certificate of Analysis and a sterility assurance failure are entirely compatible, and in a recall of this kind they usually coexist.

That does not make the CoA worthless. It is the right document for identity, assay, content, endotoxin against a stated limit, and lot and beyond use date traceability. It is simply the wrong document to ask about aseptic process control. A longer treatment is in our guide to reading CoAs.

The inspection record was public months earlier

FDA investigators inspected the Cary facility from 12 to 15 May 2025 and issued a Form FDA 483 on 15 May 2025. The agency then issued a warning letter dated 1 December 2025, posted publicly on 17 March 2026, finding that drug products intended or expected to be sterile were prepared, packed or held under insanitary conditions.

The specifics are not abstract. The letter describes an operator blocking first air by placing gloved hands directly over open sterile containers, personnel engaged in aseptic processing while exposing skin within the ISO 5 aseptic processing area, difficult to clean and visibly rusty equipment or surfaces, and gloves not disinfected or changed frequently enough for the operations being performed. It cites failures to establish and follow quality control unit procedures under 21 CFR 211.22(d), inadequate validation of sterilisation processes under 211.113(b), and inadequate systems for cleaning, disinfecting and maintaining equipment used to control aseptic conditions under 211.42(c)(10). FDA notes that the firm ceased sterile drug production as of 12 May 2025 and signalled an intention to resume on 1 August 2025. The Form FDA 483 itself is published.

The operational point: anyone who opened FDA's page on compounding inspections, recalls and other actions at any time after 17 March 2026 would have seen this facility listed with "Warning Letter Issued 12/01/2025" and "483 Issued 05/15/2025" beside its name. That check is free and takes about a minute.

What the public record does not establish

All of the following is as of 28 October 2026, and it should be stated rather than filled in with inference.

Whether any recalled vial was contaminated. FDA has published no finding of contamination.
Whether this recall arises from the same conditions cited in the May 2025 inspection. The enforcement record states a reason, not a root cause, and no root cause has been published.
Whether FDA has closed out the December 2025 warning letter, or what the firm's remediation status is. Not published.
The basis on which these lots were compounded. FDA determined the tirzepatide injection shortage resolved on 19 December 2024 and its enforcement discretion for outsourcing facilities ran only until 19 March 2025. The enforcement record is silent on the lawfulness of compounding these 2026 lots, and FDA has published no statement about it. Anyone who tells you the answer with confidence is guessing.
Where the product went. Distribution is recorded as nationwide. No downstream account, clinic or patient count has been published.

Diligence that would have flagged this

For prescribers, before routing volume to any compounding pharmacy:

Establish whether it is a state licensed 503A pharmacy or a 503B outsourcing facility, and check the latter against FDA's registered outsourcing facilities list. Registration under section 503B is a filing obligation and a set of conditions, not an approval and not a quality rating.
Read the compounding inspections and recalls page for that facility's name, and read it again periodically. Warning letters and 483s stay there.
Put a standing search on the Enforcement Report, through FDA's search tool or the open data endpoint, for the pharmacies you actually use. Most compounding recalls never get a press release. This one did not.
Ask for the release Certificate of Analysis for the lot you are dispensing, and read it for the attributes it can carry.
Ask separately for what a CoA cannot carry: media fill frequency and results, environmental monitoring trends and how action level excursions were handled, personnel and gowning qualification, how beyond use dates are justified, and whether sterility and endotoxin testing is in house or third party.
Record the lot number in the chart. If you cannot say which lot a patient received, a recall notice is information you cannot act on.

For pharmacy owners, that list read backwards is a sales asset. The firms that lose prescriber relationships after an event like this are usually not the ones with a finding against them. They are the ones who cannot produce the documentation within a day of being asked.

Where PEPTPlus and its pharmacies fit

PEPTPlus is a prescribing and fulfilment platform. It does not compound, it does not test lots, and it does not make any compounded preparation FDA approved. What it does is route a prescription to a licensed pharmacy and keep the record of that transaction intact and auditable: who prescribed, which pharmacy filled it, and when it shipped. That record is what turns a recall notice into a specific list of patients to call.

None of that substitutes for the diligence described above. Qualifying a pharmacy is a pharmacy function and a prescriber judgement, and it stays that way.

If you would like to see what documentation our partner pharmacies hold, or how lot level records flow through the platform, get in touch and we will walk you through it before you write anything.