What DSCSA Inspectors Ask First, and How Your Pharmacy Should Answer

The small dispenser exemption now runs to November 27, 2027, but inspections aren't waiting. These are the questions inspectors open with, what a good answer sounds like, and how to get your team ready.

The short answer: Inspectors checking DSCSA start with the basics. Michigan's state pharmacy inspectors open with four questions: What is DSCSA? How do you confirm a product is legitimate? What do you do if you doubt a product? Where is your quarantine area? They often also ask who your DSCSA vendor is. Every pharmacy can be asked these today, including small dispensers, because the exemption to November 27, 2027 covers only the enhanced electronic tracing requirements. Authorized trading partners, product verification and suspect product handling already apply.

Does the small dispenser exemption stop DSCSA inspections?

No. On August 6, 2026, FDA extended the small dispenser exemption to November 27, 2027, but the exemption is narrow. It covers only the enhanced drug distribution security requirements: interoperable, electronic, package-level tracing. It is not a pause on DSCSA.

Every pharmacy, exempt or not, must already:

• buy only from authorized trading partners;

• receive and keep transaction information and transaction statements;

• handle suspect and illegitimate product, including notifying FDA and trading partners within 24 hours of determining a product is illegitimate;

• keep DSCSA records for six years.

A dispenser qualifies as small if, as of November 27, 2026, the company that owns it has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians. Qualifying pharmacies do not need to apply or notify FDA. They do need to be able to answer an inspector.

What are the first four questions DSCSA inspectors ask?

Inspectors start with the basics, not your software. Michigan's state pharmacy inspectors, for example, open with four questions. The gap they find most often is the same across chains, independents and health systems: staff who cannot answer them.

1. What is DSCSA?

This is the question that catches the most pharmacies, because it tests your whole team, not your compliance lead. If the only person who can explain DSCSA is off that day, the answer is "we don't know." Train every pharmacist and technician to give the same two-sentence answer.

2. How do you confirm a product is legitimate?

A good answer has two parts. First, sourcing: you buy only from authorized trading partners, meaning partners with a valid state or federal license, and you can show how you checked. Second, receiving: you look at the product identifier on the package and match what arrived to the transaction data your supplier sent.

A wholesaler's portal is not the whole answer. It only covers that wholesaler's data, and FDA holds the pharmacy, not the wholesaler, responsible.

3. What do you do if you doubt a product?

Inspectors want to hear a procedure, not an improvisation. A sound suspect product procedure runs in this order:

1. Pull the product and place it in quarantine.

2. Contact the supplier and inspect the package visually.

3. Verify the product identifier with the manufacturer, through the Verification Router Service (VRS) where available.

4. If the product is illegitimate, notify FDA using Form FDA 3911 and notify affected trading partners within 24 hours.

5. Document every step, including the specific product identifiers involved.

4. Where is your quarantine area?

This is the easiest question to fail and the easiest to fix. Designate a physical area, label it, and make sure staff know quarantined product never goes back to the shelf without a documented decision.

What else do inspectors look for?

Once the four questions are answered, inspectors look at whether DSCSA is part of how the pharmacy actually runs.

• SOPs your staff know. A binder of procedures nobody has read does not count. Staff should be able to describe what the SOP tells them to do.

• Accountability at the top. The pharmacist in charge is accountable for DSCSA compliance even when not on shift.

• No single point of failure. DSCSA can't depend on one person being in the building.

• Documentation. An undocumented decision is treated as a decision that never happened. Record what you did, when and why.

• Records you can produce. Transaction data kept for six years, retrievable when an inspector or FDA asks.

What if product arrives without DSCSA data and a patient is waiting?

There is no single right answer, which is exactly why you need a written one. A defensible approach: follow your SOP, contact the supplier, inspect the package, verify the product identifier through VRS, then document the decision and the specific product identifiers. The pharmacist's license is on the line, so the documentation matters as much as the decision.

How is DSCSA enforcement changing?

Enforcement is moving downstream to dispensers, and it is becoming routine. According to Abha Kundi, former DSCSA program lead in FDA's Office of Compliance and now counsel at ArentFox Schiff, speaking at the Forum:

• DSCSA observations on FDA Form 483 rose sharply in 2025, and routine inspections now check DSCSA.

• FDA is also using remote regulatory assessments.

• FDA had issued four DSCSA warning letters by August 2026. The latest went to a med spa that dispensed more Botox than it had legitimately bought; the investigator used an AI tool on site to compare purchase and dispense volumes.

The violation themes she ranked are a practical checklist in reverse: inadequate verification systems, missed 24-hour illegitimate product notifications, buying from partners that aren't authorized, missing six-year records, late responses to information requests, and having no interoperable system.

How do you get your pharmacy inspection-ready?

Work through this list before an inspector does it for you:

• Every pharmacist and technician can explain DSCSA in two sentences

• You can show that every supplier is an authorized trading partner, with license checks on file

• Your receiving process checks product identifiers and transaction data

• A written suspect product SOP exists, and staff have been trained on it, with training records

• A labeled quarantine area exists and staff know where it is

• You know how to file Form FDA 3911 and who files it

• DSCSA records go back six years and you can retrieve them quickly

• At least two people can run the DSCSA process

• Your vendor's role, and its limits, are written into your SOP

Why not wait for November 2027?

Because most of what an inspector checks is already required, and because implementation takes longer than it looks. Pharmacies that have gone live describe three to six months for selection, then a pilot, setup, scanner testing and staff training. FDA is also using the exemption period to assess whether systems are accessible and affordable for small dispensers, so planning around another extension is a risk, not a plan.

Frequently asked questions

1. What do DSCSA inspectors ask first? ‍

They start with the basics. Michigan's inspectors ask what DSCSA is, how you confirm a product is legitimate, what you do if you doubt a product, and where your quarantine area is. They often ask who your DSCSA vendor is.

2. Can a small dispenser be cited for DSCSA violations before November 27, 2027? ‍

Yes. The exemption covers only the enhanced electronic tracing requirements. Authorized trading partner, transaction data, suspect product and record-keeping requirements already apply to every pharmacy.

3. Who qualifies as a small dispenser? ‍

A dispenser whose owning company, as of November 27, 2026, has 25 or fewer full-time employees licensed as pharmacists or qualified as pharmacy technicians. Qualifying pharmacies do not need to apply to FDA.

4. What should a pharmacy do with a suspect product? ‍

Quarantine it, contact the supplier, inspect and verify it, and document every step. If it is illegitimate, notify FDA on Form FDA 3911 and notify affected trading partners within 24 hours.

5. Does my wholesaler's portal make my pharmacy DSCSA compliant? ‍

No. A portal only covers that wholesaler's data, and FDA holds the pharmacy responsible for its own compliance, including receiving checks, suspect product handling and six-year records.

6. How long must pharmacies keep DSCSA records? ‍

Six years.

Closing notes

Rehearse your answers before an inspector asks. Explore our Pharmacy Forward webinars that help pharmacies implement and operationalize DSCSA. We also offer CE-accredited bootcamps which offer hands-on training in a simulated pharmacy environment covering the fundamentals of DSCSA and the policies and procedures your staff will actually follow. See upcoming sessions.

‍