What a Regulatory Inquiry Looks Like
Regulatory inquiries targeting hemp ingredient supply chains can come from several directions, and they don’t always arrive in the form you might expect. Some are formal written requests from federal agencies (FDA, USDA, FTC). Others are initiated by state agricultural departments or state attorneys general. Some arrive as retailer-initiated compliance questionnaires that have regulatory backing. A few come through the legal process — subpoenas, civil investigative demands, or requests for information in the context of litigation.
Regardless of the form, the experience of receiving an unexpected regulatory inquiry is stressful. Teams that have thought through their response process in advance are dramatically better positioned than those who are figuring it out in real time.
This article covers what to do — and what not to do — when you receive an inquiry about your hemp ingredient supply chain.
Step 1: Don't Panic, But Do Take It Seriously Immediately
The most common mistake organizations make when receiving a regulatory inquiry is one of two extremes: dismissing it as routine and responding slowly, or panicking and responding hastily with information that creates more problems than it solves.
The correct response is prompt, organized, and deliberate. Most regulatory inquiries have a response deadline — sometimes 30 days, sometimes 10 business days, sometimes 48 hours in urgent situations. Missing a deadline is worse than the underlying issue the inquiry is about.
Immediate actions upon receipt:
- Identify the agency, department, and specific individual who sent the inquiry
- Record the date received and any stated response deadline
- Preserve all related documents and communications immediately (institute a litigation or document hold if one isn’t already in place)
- Notify your legal counsel before taking any other action
- Do not respond, even to acknowledge receipt, until you have spoken with legal counsel
Step 2: Understand Exactly What Is Being Asked
Before you can respond to a regulatory inquiry, you need to understand precisely what it is asking — which is not always as obvious as it seems. Regulatory inquiries are often drafted in formal or technical language that requires interpretation, and the scope of what is being requested may be broader or narrower than an initial reading suggests.
With legal counsel, identify:
- What documents or information are specifically requested?
- What time period is covered by the request?
- What is the legal basis for the inquiry (voluntary compliance request, statutory authority, court order)?
- Is this a routine industry-wide inquiry or is it targeted at your organization specifically?
- Are there any narrowing arguments that would legitimately reduce the scope of documents you need to produce?
Understanding the scope before you begin responding prevents over-disclosure (providing more information than required) and under-disclosure (which can be construed as non-cooperation).
Step 3: Inventory Your Supply Chain Documentation
Once you know what’s being asked, you need to assess what you have. A regulatory inquiry about your hemp ingredient supply chain will typically involve:
Certificates of Analysis: COAs for the hemp ingredient lots in question, from DEA-registered, ISO 17025-accredited laboratories. If your COAs are from non-qualifying laboratories, this is the moment that gap becomes visible to regulators.
Chain of custody records: Documentation showing the path of the hemp ingredient from producer through your receiving. Gaps in chain of custody are among the most common documentation deficiencies regulators identify.
Supplier qualification records: Your GMP audit, supplier quality agreement, and approved vendor list documentation for the supplier of the ingredient in question.
Receiving inspection records: Your internal records showing that the lot was received, inspected, and accepted with the required documentation.
Production records: Batch records showing how the hemp ingredient was incorporated into finished products, including lot numbers, quantities, and formulation records.
Assemble these materials systematically. Missing records are better disclosed to your legal counsel now so they can advise on the implications, rather than discovered after a response has been submitted.
Step 4: Evaluate the Disclosure Decision
Not every inquiry requires the same response strategy. With legal counsel, evaluate:
Is this a voluntary request or a mandatory requirement? FDA Form 483 observations, warning letters, and USDA compliance letters typically require response. Informal questionnaires from state agencies may have more flexibility. Court orders are mandatory.
What privileges may apply? Attorney-client privilege protects communications with legal counsel and may protect certain internal compliance analyses. Work product doctrine may protect documents created in anticipation of litigation. Your counsel can identify what is and isn’t protected.
Are there third-party confidentiality considerations? If you’re being asked to disclose information about your hemp ingredient supplier, there may be confidentiality obligations in your supplier agreement that need to be addressed.
Step 5: Prepare and Submit a Complete, Accurate Response
The response to a regulatory inquiry must be complete and accurate. Partial responses, omissions, or inaccurate statements — even inadvertent ones — can escalate an inquiry into a more serious investigation. Best practices:
- Assign a single point of contact within your organization for the inquiry response
- Review all documents before submission to confirm they are accurate and relevant
- Include a cover letter that clearly identifies the documents being produced and the scope of the response
- Confirm the method and format of submission with the agency before sending
- Retain copies of everything submitted, with submission confirmation
If you cannot fully respond by the deadline — for example, if document collection will take more time than available — contact the agency through your legal counsel to request an extension before the deadline passes. Proactive communication about timelines is treated very differently from missed deadlines.
Step 6: After the Response — Use It to Improve
Regulatory inquiries reveal documentation gaps that would otherwise remain invisible. Whether or not the inquiry results in any formal action, the documentation inventory you conducted during your response process is valuable:
- Document which records were easy to locate and which required extensive search
- Identify any gaps that the inquiry exposed (missing COAs, incomplete chain of custody, expired supplier qualifications)
- Use the gaps to update your standard document management procedures
- Build a documentation retrieval protocol so the next inquiry — if there is one — takes hours, not weeks
The Best Preparation: Documentation Readiness Before the Inquiry Arrives
The organizations that handle regulatory inquiries best are the ones that maintain documentation readiness as an ongoing practice, not a crisis response. If you can answer the following questions affirmatively right now, you are well-positioned:
- Can you produce a complete COA from a DEA-registered, ISO 17025-accredited laboratory for every active hemp ingredient lot within 24 hours?
- Can you produce chain of custody documentation from farm to your receiving dock for every lot within 48 hours?
- Is your supplier qualification documentation (GMP audit, quality agreement, allergen statement) current and filed in an accessible location?
- Do your production batch records clearly identify which hemp ingredient lot was used in each production batch?
If any of these answers is “no” or “probably,” the documentation work to close those gaps is more valuable than almost any other compliance investment you can make before November 12.
