Your quality system is inspection-ready only when your records prove that controlled processes work every day, product risks are managed, and known problems are corrected before they spread. FDA doesn’t issue a simple pass-or-fail grade; medical-device inspections are classified as No Action Indicated, Voluntary Action Indicated, or Official Action Indicated based on the findings, their public-health importance, and the manufacturer’s response.
This article focuses on medical-device manufacturers regulated under 21 CFR Part 820. You’ll learn how to test your quality management system the way an investigator can test it: by following evidence across connected processes rather than admiring a polished quality manual. The goal is to find weak links now, when you can still correct them under controlled conditions.
Has Your Quality System Been Updated for the QMSR?
Your system needs to meet the Quality Management System Regulation now in force, not the older Quality System Regulation that many procedures still quote. The QMSR took effect on February 2, 2026, incorporates ISO 13485:2016 by reference, and retains added FDA requirements under Part 820.
Start by mapping every controlled procedure, form, work instruction, and record type to the requirements that apply to your devices and activities. A document can remain usable after the regulatory change, but its terminology, responsibilities, record requirements, and cross-references need review. FDA has said investigators may examine QMS records created before February 2, 2026, and manufacturers may find a comparative analysis useful for showing that older records meet current requirements. A gap assessment that stops at document titles won’t reveal whether the daily process changed with the written procedure.
Test the updated system against your actual regulatory scope. Part 820 requires a documented QMS that meets applicable ISO 13485 provisions plus added FDA duties involving identification, traceability, reporting, corrections and removals, design and development, and certain life-supporting or life-sustaining devices. Your applicability matrix should explain what applies, what doesn’t, and the reason for each decision. Inspectors shouldn’t have to reconstruct your regulatory logic from scattered emails or personal knowledge.
Can Your Records Prove That Procedures Are Actually Followed?
A procedure tells FDA what your organization says it does; records show whether the process works. Inspection readiness depends on accurate, retrievable evidence that matches the procedure, the device risk, and the decisions your team made.
FDA replaced QSIT with a new risk-based inspection process on February 2, 2026. Investigators can review linked areas covering change control, design and development, management oversight, measurement and improvement, outsourcing and purchasing, production and service, plus other applicable FDA duties. They can expand their review when one record points toward a weakness elsewhere. That means an unexplained complaint trend can lead into CAPA, risk management, supplier controls, process validation, and management review during the same inspection.
Run a traceability exercise before the inspection. Select one marketed device and follow it from current specifications through approved suppliers, incoming controls, production records, release, distribution, complaints, servicing, and postmarket actions. Then select a known quality problem and follow it backward to the data source, risk evaluation, investigation, action, approval, implementation, and effectiveness check. Missing links, contradictory dates, unexplained overrides, and records stored in personal folders are signs that the written system and operating system have drifted apart.
Do Complaints, Nonconformities, and CAPA Connect?
They must connect through documented decision rules, risk evaluation, data analysis, and timely escalation. A complaint system that closes tickets without asking whether the issue is reportable, recurring, or tied to a wider product problem is not inspection-ready.
FDA’s inspection program directs investigators to use complaint data, customer feedback, postmarket surveillance, servicing data, product and process trends, and risk records when identifying hazards and selecting records. Current Part 820 also requires complaint records to capture defined information, including device identification, complaint details, corrective action, and the reply to the complainant when applicable. If a similar complaint was investigated earlier, the file needs a documented reason for not repeating the investigation. A repeated “no investigation required” outcome without supported reasoning can expose a weak escalation process.
Review whether your data streams meet at a controlled decision point. Complaints, nonconforming product, supplier failures, audit findings, process deviations, service reports, and returned-product analysis should feed trend review under defined thresholds. CAPA records should show the problem statement, containment, investigation method, root-cause evidence, risk assessment, chosen action, implementation, and an effectiveness check tied to measurable acceptance criteria. Closing a CAPA because tasks were completed is weaker than showing that the unwanted condition stopped, fell within an approved limit, or no longer creates the same risk.
Can You Show That Risk Controls Stay Current After Release?
Your risk file must operate as a living control record for the marketed device. FDA’s current inspection method uses product risk and risk-management documentation to guide what investigators review and how far they follow connected records.
Compare the current risk-management file with real postmarket evidence. New failure modes, complaint trends, service findings, use errors, supplier changes, process deviations, and corrective actions should prompt a documented review of hazards, estimated risk, existing controls, and residual risk. The test is whether field information can change a design control, production control, label, training requirement, supplier requirement, or surveillance plan when the evidence calls for it. A risk file that remains unchanged for years can be defensible only when documented review shows that new information did not alter the prior assessment.
Check whether your risk controls can be verified at the record level. If the file names an inspection, alarm, software limit, material specification, sterilization parameter, or label warning as a control, you should be able to find the approved requirement and evidence that it remains implemented. Confirm that changes to those controls trigger review of verification, validation, production documents, training, and postmarket monitoring. This record chain lets you show control of the device rather than a risk document maintained as a separate regulatory artifact.
Are Design, Process, and Software Changes Assessed Before Approval?
Every quality-system, product, process, supplier, and software change needs a controlled review of risk and downstream impact before release. FDA’s new inspection model names change control as a distinct QMS area and includes software changes, product and process changes, purchasing changes, and QMS changes within its inspection map.
Examine recent changes instead of reviewing the procedure alone. Each change record should identify the reason, affected requirements and documents, product impact, risk impact, regulatory impact, needed verification or validation, approval authority, implementation date, and training or communication needs. The selected evidence should match the change: a dimensional revision calls for different proof than an algorithm update, supplier transfer, packaging change, or sterilization-cycle adjustment. Retrospective approvals and vague statements that a change has “no impact” invite deeper questioning when the file contains no supporting evaluation.
Pay close attention to tools used inside the QMS. Spreadsheets, scripts, databases, and electronic workflows can influence complaint trending, CAPA decisions, calibration, acceptance activities, labeling, or release. Your records should show intended use, risk tied to failure, testing or assurance activities, access control, version control, change history, and issue handling at a level that fits the tool’s use. A small spreadsheet can create a large compliance problem when a hidden formula error changes a reportable-event decision or product-release result.
Can You Defend Supplier and Outsourced Process Controls?
You need evidence that supplier controls match the risk of the supplied product, service, or outsourced process. Purchasing approval alone won’t show that the supplier remains capable of meeting your defined requirements.
FDA’s inspection program includes outsourcing and purchasing as a QMS area, with attention to outsourced activities, purchasing controls, purchasing information, and acceptance of purchased product. Build supplier files around objective selection criteria, written requirements, risk level, initial qualification, performance monitoring, change notification, re-evaluation, and escalation. A contract manufacturer, sterilization provider, test laboratory, software vendor, or critical component supplier should receive controls suited to the effect its failure could have on the finished device. FDA’s stated purpose for this inspection area is to verify that outsourced work and purchased product are monitored and controlled so finished product meets specified requirements.
Review supplier data together rather than in separate folders. Incoming failures, late deviations, audit findings, supplier corrective actions, complaint links, concessions, delivery performance, and unauthorized changes can reveal a pattern that individual records hide. Confirm who can approve a supplier, who can accept a deviation, when quality agreements require notification, and what event triggers requalification or removal. Your company retains responsibility for the finished device when an outside party performs the work.
Does Management Oversight Produce Decisions and Follow-Through?
Management oversight is inspection-ready when leaders can show how quality data leads to priorities, resources, assigned actions, and verified results. Attendance at a scheduled review meeting does not prove effective oversight.
The QMSR ended the former inspection exception for management-review, internal-audit, and supplier-audit reports. FDA states that investigators may now inspect these records, and they should be readily available. Review the reports for unresolved findings, repeated postponements, weak action ownership, and statements that conflict with complaint, CAPA, supplier, or production data. Records written only to satisfy an audit calendar often reveal little about how leaders control quality risk.
Your management review should show decisions, not a slide deck full of counts. Leaders should assess quality objectives, audit results, customer feedback, process performance, product conformity, corrective and preventive actions, supplier performance, resource needs, regulatory changes, and prior action status at the level required by the system. Internal audits should test implementation and effectiveness, then drive correction when they find a weakness. Inspectors can compare what management knew, when it knew it, what it funded, and whether the action worked.
Could Your Team Handle the Inspection Room Without Creating New Problems?
Inspection readiness includes disciplined communication, controlled document retrieval, and accurate answers from trained personnel. A sound QMS can still look unstable when the inspection team gives conflicting explanations, produces uncontrolled copies, or can’t track requests.
Create an inspection procedure that assigns a host, subject-matter contacts, a document-room lead, note takers, reviewers, and senior-management availability. Use a request log to record the investigator’s wording, owner, documents supplied, version, time delivered, follow-up questions, and any promised items. Review each copy for relevance, legibility, approval status, confidential markings, and consistency with the original record before release. Never create, alter, backdate, or “clean up” a record for the inspection.
Train employees to answer the question asked, describe the process they perform, and state when they need to verify an answer. Do not obstruct access or create avoidable delays; FDA’s device inspection program notes that delaying, denying, limiting, or refusing an inspection can carry regulatory consequences. A mock inspection should test live retrieval, facility walkthrough behavior, escalation, remote records, electronic access, and the team’s ability to reconcile conflicting information. The best rehearsal uses recent records with real defects rather than a staged set of perfect files.
What Happens If FDA Issues a Form 483?
A Form 483 records objectionable conditions observed during the inspection, but it is not FDA’s final decision that a violation occurred. Your response should address the cited condition, its wider system impact, corrective action, evidence, ownership, and timing.
FDA presents and discusses the observations with senior management at the close of the inspection. The agency then considers the Form 483, the Establishment Inspection Report, evidence gathered during the inspection, and the company’s response before deciding what further action is warranted. Treat each observation as a possible system problem, not an isolated wording dispute. A narrow correction can leave related products, records, sites, or processes exposed.
Build the response around containment, correction, root-cause analysis, corrective action, preventive action where warranted, retrospective review, effectiveness checks, and supporting evidence. Separate completed actions from planned actions, assign dates you can meet, and explain any product-risk evaluation. FDA’s current inspection program says inspection classifications consider the public-health importance of deficiencies and the manufacturer’s response, including corrective actions. Timely, accurate communication and proof of a controlled QMS carry more weight than promises without records.
How Do You Know If Your QMS Is FDA Inspection-Ready?
- Current QMSR procedures
- Linked, retrievable records
- Risk-based CAPA decisions
- Controlled design and process changes
- Qualified, monitored suppliers
- Documented management oversight
Inspection Readiness Lives in the Evidence
Your quality system is ready when any meaningful record can be followed through the decisions, controls, and follow-up it triggered. Update the system for the QMSR, then test real records across complaints, CAPA, risk, design, production, suppliers, audits, and management review. Fix gaps in operation before rewriting documents merely to sound compliant. Train your team to retrieve records and explain the work without guessing or reshaping history. The strongest inspection position is a QMS that finds its own problems early, acts at the right level, and proves that the action worked.
References
- U.S. Food and Drug Administration. Quality Management System Regulation Frequently Asked Questions
- U.S. Food and Drug Administration. Quality Management System Regulation
- Electronic Code of Federal Regulations. 21 CFR § 820.10 — Requirements for a Quality Management System
- U.S. Food and Drug Administration. Compliance Program Guidance Manual: Inspection of Medical Device Manufacturers
- U.S. Food and Drug Administration. Medical Device Manufacturer Inspection Program
- U.S. Food and Drug Administration. FDA Form 483 Frequently Asked Questions