Operations Must Be Consistent with the Regulatory File
A COFEPRIS inspection tests whether documentation, procedures, and actual operating conditions are aligned. We examine how an establishment should prepare for and conduct the inspection while preserving evidence and responding appropriately to the health authority.
HEALTH REGULATION - COFEPRIS
A health regulatory inspection is one of the moments when regulatory compliance is no longer assessed solely on the basis of documents.
During an inspection, Mexico’s Federal Commission for Protection against Health Risks (COFEPRIS) may review and compare permits, procedures, records, and documentary evidence against the actual operating conditions of the establishment.
This is where a fundamental distinction becomes visible.
A company may formally hold the required licenses, notices, procedures, logs, and responsible personnel. During an inspection, however, the authority will also assess whether the documented compliance framework corresponds to the facilities, processes, equipment, products, and practices that actually exist in the operation.
During a COFEPRIS inspection, the regulatory record and the actual operation must tell the same story.
For that reason, preparation should not begin when the inspector arrives at the establishment.
Our experience in regulatory and health inspection matters has shown that a significant portion of regulatory risk can be reduced well in advance by identifying applicable obligations, correcting inconsistencies, and establishing how the organization should respond to an inspection, including appropriate training for the personnel who may interact with the authority.
The Inspection Order Is More Than an Entry Formality
One of the first documents that should be reviewed is the inspection order itself.
Mexico’s General Health Law (Ley General de Salud) requires inspectors to carry a written order identifying the place or area to be inspected, the purpose of the inspection, its scope, and the legal provisions on which the authority relies.
The order is therefore more than a document that must simply be received.
It legally defines the scope of the inspection.
Before the inspection begins, the company should identify which establishment is subject to review, the purpose of the inspection, the matters covered by the order, and the legal provisions under which COFEPRIS will act.
This does not mean obstructing the inspection.
The establishment is legally required to allow access and provide the facilities and information necessary for the authority to carry out its duties.
The difference lies between properly receiving the authority and doing so without an internal understanding of what is being inspected, who should respond, and what documentation is being made available.
Complex Inspections Require Coordination, Not Improvisation
At regulated establishments, an inspection may simultaneously involve the Responsible Sanitary Officer, Quality, Regulatory Affairs, Production, Warehousing, Maintenance, Human Resources, Operations, and Legal.
Those functions should not become multiple independent points of contact during the inspection.
The company should determine in advance who will coordinate the inspection internally and which individuals have sufficient knowledge and responsibility to address each technical issue.
If the authority asks about equipment calibration, traceability, storage conditions, training, or a particular procedure, the explanation should come from someone who understands the process and can support the response with documentation.
An approximate answer given by someone unfamiliar with the matter can create an inconsistency that did not previously exist.
For that reason, properly managing an inspection is not simply about training personnel to “answer COFEPRIS.” It is about ensuring that each function understands its responsibilities and can demonstrate compliance with them.
The Internal Regulatory Record Should Explain How the Establishment Actually Operates
One of the most common mistakes is treating regulatory compliance as a collection of documents.
Depending on the specific activity, relevant evidence may include health authorizations, regulatory notices, appointment of responsible personnel, product registrations, procedures, logs, training records, maintenance records, calibration records, supplier controls, traceability systems, storage conditions, and other evidence required under the applicable regulatory framework.
Not every item applies to every establishment.
That is precisely why a serious preventive review should not rely on a generic checklist.
It must begin with the actual operation.
The relevant question is not:
“Is our COFEPRIS file complete?”
The better question is:
“Can we demonstrate how our operation complies with each regulatory obligation that applies to it?”
That is an important distinction between simply possessing documents and maintaining a defensible compliance system.
Evidence Should Also Be Controlled During the Inspection
A regulatory inspection may last for hours or, in certain cases, even days, and may generate a substantial volume of information.
Documents may be requested, procedures reviewed, multiple areas visited, and several members of the organization involved.
For that reason, in addition to the official inspection report prepared by the authority, it is advisable for the company to maintain a contemporaneous internal record of what occurs.
In our practice, we approach this through what may be described as a parallel inspection record or “mirror file.”
This becomes particularly useful when the official inspection report is being finalized, because the company can compare the authority’s account against its own contemporaneous record and, where appropriate, make formal statements or observations before the report is closed.
This internal file is not a statutory document and is not something that must be provided to COFEPRIS.
It is an internal traceability tool.
It should allow the company to reconstruct, among other matters:
who conducted the inspection;
which inspection order was presented;
when the inspection began and ended;
which areas were visited;
which personnel addressed each subject;
which documents were requested;
which documents were actually shown or delivered;
which versions and time periods those documents covered;
what observations or findings were raised during the inspection;
which samples were taken, where applicable; and
what other relevant circumstances occurred during the inspection.
The purpose is not to bureaucratize the inspection.
It is much more practical:
to be able, before the inspection is formally closed, to reconstruct what occurred and what evidence the authority actually reviewed, reducing the risk of factual misunderstandings or inaccurate descriptions in the official inspection report and preserving traceability for any subsequent proceeding.
Weeks later, when a finding recorded in the inspection report must be analyzed, that traceability can become highly significant.
Knowing Which Document the Authority Reviewed Can Be as Important as Having the Document
During an inspection, it is not enough simply to locate documents quickly.
The company should also maintain control over the evidence it is presenting.
Complex operations may have current and superseded versions of procedures, records covering different periods, multiple warehouses, several production lines, or documents generated by different functions.
For that reason, the company should be able to answer:
Which document was shown? Which version? What period did it cover? What was it intended to demonstrate?
This becomes particularly relevant if a finding must later be challenged.
There is a significant difference between arguing:
“The company did have the relevant procedure.”
and being able to establish:
“This was the procedure in force, this was the document shown during the inspection, and this was the evidence available when the authority raised the finding.”
Where appropriate, that point can also be formally placed on the record through the statements made by the person attending the inspection before the official report is closed.
That is where a fact-based regulatory defense begins.
Responses During the Inspection Should Be Accurate and Supportable
A COFEPRIS inspection can create significant operational pressure.
Inspectors ask questions, personnel search for records, ordinary business activities continue, and technical observations may arise at the same time.
Under those conditions, improvisation is particularly risky.
Responses should be truthful, precise, and supportable.
Where an issue requires checking a record, reviewing a technical specification, or involving the individual responsible for a particular activity, it is preferable to verify the information properly rather than replace that review with speculation.
A seemingly harmless statement such as:
“I think that equipment is never calibrated.”
can become especially problematic if the organization actually maintains a documented calibration program.
The principle is straightforward:
The person responding should understand the subject on which they are responding, and the company should be able to support the response.
The Official Inspection Report Can Become a Central Element of the Defense
When the inspection is coming to an end, attention often begins to decline.
That is a serious mistake.
Under Mexico’s General Health Law, the official inspection report must record the circumstances of the inspection, deficiencies or irregularities identified, samples taken, and, where applicable, any sanitary safety measures imposed by the authority.
The inspection report is therefore not merely evidence that COFEPRIS visited the establishment.
It may become the factual foundation for subsequent administrative action and may be difficult to rebut if relevant facts or clarifications were not placed on the record at the appropriate time.
For that reason, the contents of the report should be reviewed carefully before the inspection is formally concluded.
Once the report is finalized and signed, its contents cannot simply be rewritten to reflect matters that were not properly recorded during the inspection.
The General Health Law expressly allows the inspected party to make statements in its own interest at the conclusion of the inspection and requires those statements to be incorporated into the report.
That opportunity has significant legal value.
It should not be wasted by mechanically stating “no comments.”
At the same time, it should not be used to engage in an extended or improvised argument with the inspector.
Where appropriate, it can be used to place objective facts on the record, including:
documents that were actually shown;
circumstances that occurred during the inspection;
specific clarifications; or
differences between what was observed and the manner in which a particular point was recorded.
Refusing to Sign Is Not a Defense Strategy
A refusal to sign the inspection report is sometimes viewed as a possible response to a difficult inspection.
Mexican health law expressly provides otherwise.
If the inspected party refuses to sign the report or receive a copy of the report or inspection order, the refusal must be recorded, but it does not invalidate either the inspection report or the inspection itself.
The key question is therefore not simply:
“Should we sign?”
The more important question is:
“What happened, what was placed on the official record, and what documentary position did the company establish before the inspection was concluded?”
Sampling Adds a Separate Technical and Evidentiary Dimension
When the inspection includes product sampling, the matter requires additional care.
The General Health Law establishes specific formalities for sanitary sampling and, as a general rule, provides for samples from the same batch, production run, or container, properly identified, closed, and sealed.
The general procedure contemplates three samples:
one sample retained by the inspected party for its own analysis;
one control or witness sample held in its custody and made available to the authority; and
one sample designated for the official analysis.
Specific rules may apply to particular categories of products, and Mexican health law also provides mechanisms for challenging certain analytical results.
Accordingly, where sampling occurs, particular attention should be paid to:
product identity, batch or lot number, quantity, identification, seals, sampling conditions, documentation, and preservation of the samples.
At this stage, coordination between legal and technical teams becomes especially important.
A sample may become an independent evidentiary line within the health enforcement proceeding.
A Finding in the Inspection Report Is Not Yet a Final Sanction
The different legal stages should also be distinguished.
A finding included in an inspection report does not, by itself, constitute the final resolution of the administrative proceeding.
Based on the results of the inspection, the authority may order measures intended to correct identified irregularities.
Where the reported irregularities lead to a subsequent administrative proceeding, the affected party must be given an opportunity to make legal submissions and offer evidence within the period established by the authority under the applicable legal framework.
The specific administrative act issued by COFEPRIS —and the deadline expressly granted in that act— must therefore be reviewed carefully.
The defense following an inspection should not begin by immediately drafting arguments.
When an inspection produces significant findings, our methodology begins by reconstructing the matter.
The legal and technical review should determine, at a minimum:
what the authority was authorized to inspect; what actually occurred; what was recorded in the report; what evidence existed during the inspection; which documents were shown; which findings have technical support; which may be clarified; what circumstances require corrective action; and what legal consequences each finding may produce.
This separation is fundamental.
A sound defense should not indiscriminately deny every finding.
Nor should it automatically accept every statement recorded by the authority as an established regulatory violation.
The analysis must distinguish among:
facts, the authority’s interpretation, applicable legal requirements, and technical evidence.
The response should be built from that distinction.
How We Structure a Defense Against Health Regulatory Findings
In inspection matters, the legal and technical analyses often need to proceed in parallel.
We first review the legality and scope of the authority’s action, including:
the inspection order, jurisdiction and authority, stated purpose, procedural formalities, and contents of the official inspection report.
We then compare each finding against the provision that COFEPRIS alleges was violated.
The next question is evidentiary:
What evidence exists to demonstrate the actual condition of the establishment?
Relevant evidence may include:
documents shown during the inspection;
contemporaneous records;
written procedures;
logs;
technical evidence;
photographs;
traceability documentation;
supplier information; and
evidence generated by the different operational areas of the organization.
The next step is to determine whether an actual deviation exists that requires correction and, where appropriate, how the corrective actions implemented can be technically demonstrated.
This methodology avoids two equally problematic extremes:
defending what cannot reasonably be defended, or, at the opposite end, accepting an alleged irregularity that the evidence does not support.
A serious regulatory defense requires knowing the difference.
Sanitary Safety Measures and Administrative Sanctions Are Not the Same Thing
In certain circumstances, an inspection may result in sanitary safety measures.
Mexican health law treats these measures as mechanisms intended to protect public health and expressly provides that their application is without prejudice to any administrative sanctions that may subsequently be imposed.
Accordingly:
a sanitary safety measure and an administrative sanction are not the same legal concept.
Nevertheless, a suspension, product seizure, or other safety measure may have immediate consequences for business continuity.
When that occurs, the strategy must be both prompt and precise.
The company must determine exactly:
what was affected by the measure, the legal basis relied upon, the conditions that led to its imposition, the corrective actions required, and the technical and legal evidence necessary to seek its lifting when legally appropriate.
At that stage, the defense is no longer purely procedural.
It may require coordination with Quality, the Responsible Sanitary Officer, Engineering, Laboratories, Maintenance, or other technical specialists depending on the nature of the finding.
This is precisely where legal strategy loses effectiveness if it is disconnected from the technical reality of the establishment.
After the Inspection, Preserving Evidence Is as Important as Correcting Deviations
The physical inspection may have ended, but the administrative file may only be beginning.
Once the official inspection report has been received, the company should immediately preserve the documentation related to the inspection and develop a matrix linking:
findings → applicable provisions → available evidence.
At the same time, the appropriate corrective actions should be identified.
Both objectives should be managed together.
Correcting a deviation should not result in destroying the evidence needed to understand and explain the condition of the operation at the time of the inspection.
In complex matters, that distinction can be decisive.
Effective Preparation Takes Place Before COFEPRIS Arrives
Experience shows that genuine preparation occurs before an unannounced regulatory inspection takes place.
A prepared organization should already know:
a) who receives the authority;
b) who coordinates the inspection internally;
c) which technical areas need to participate;
d) where the relevant regulatory documentation is maintained;
e) how the evidence shown to the authority will be controlled;
f) how the inspection will be documented internally; and
g) what internal protocol will apply if findings, sampling, or sanitary safety measures arise.
The purpose is not to rehearse scripted answers.
It is to prevent the inspection from becoming the moment when the organization begins discovering how its own compliance system actually works.
SALGADO MARETTE Perspective
Our experience in regulatory matters has shown that the most complex COFEPRIS inspections are rarely resolved solely from a legal desk.
A single finding may simultaneously involve regulatory interpretation, formal documentation, actual operating conditions, technical records, internal processes, and evidence generated by different functions within the organization.
For that reason, properly managing a COFEPRIS inspection requires the integration of three dimensions:
regulatory compliance, technical expertise, and legal control of evidence.
When those dimensions are aligned, the company is in a stronger position to manage the inspection in an orderly manner and respond subsequently on the basis of verifiable facts.
When they are not aligned, even an organization with extensive documentation may struggle to demonstrate how its compliance system actually operates.
The regulatory strength of an establishment is not demonstrated merely by producing permits and authorizations. It is demonstrated when its records, processes, and actual operations can withstand regulatory scrutiny together.