Medical device makers: what an audit looks like
Since February 2, 2026 FDA inspects device manufacturers to the QMSR under a risk-based compliance program that replaced QSIT. This page lists the records investigators and MDSAP or ISO 13485 auditors ask for and the observations that recur in FDA's own data.
help
Who comes, and how often
FDA (Office of Inspections and Investigations)
Risk-based inspections under Compliance Program 7382.850: surveillance, compliance follow-up, for-cause, specific product risk, and PMA preapproval or postmarket. Investigators evaluate the six QMS areas and four Other Applicable FDA Requirements.
MDSAP auditing organization
One regulatory audit that satisfies participating regulators. FDA uses MDSAP audit reports in place of its own surveillance inspections for manufacturers that volunteer, and keeps the right to run non-surveillance inspections.
ISO 13485 certification body (accredited)
Audits to ISO 13485:2016 for customers and markets that ask for the certificate. FDA has said such an audit can complement internal audits of the QMSR requirements without replacing them.
What they ask to see
Risk management files and reports
Investigators use risk management documentation as the roadmap for the inspection and may review risk analyses that identify hazards and harms, records showing how risk controls were implemented, and evidence that the controls work.
Compliance Program 7382.850, Part III.B(1) and (2); ISO 13485 clauses 7.1 and 4.1.2(b)Source ↗
Management review, internal audit and supplier audit records
The former exemption for these records is gone. Baseline surveillance and PMA preapproval inspections are expected to review them, and other inspections may, depending on the elements selected.
Compliance Program 7382.850, Attachment A (Management Oversight, Measurement, Analysis, and Improvement); ISO 13485 clauses 5.6 and 8.2.4; QMSR preamble comment 55Source ↗
Complaint files and feedback records
Investigators may ask for the complaint database early. Records of review, evaluation and investigation carry the device name, date received, UDI, complainant details, nature of the complaint, any correction and any reply.
21 CFR 820.35(a); 21 CFR 820.10(b)(3); ISO 13485 clauses 8.2.1 to 8.2.3Source ↗
Corrective action, preventive action and nonconforming product records
Baseline surveillance covers corrective action, preventive action, control of nonconforming product and analysis of data as minimum elements.
Compliance Program 7382.850, Inspection Model 2 and Attachment A; ISO 13485 clauses 8.3, 8.4, 8.5.2 and 8.5.3Source ↗
Outsourcing and purchasing records
Records of how outsourced processes and purchased product are controlled, including the purchasing process, purchasing information and verification of purchased product.
Compliance Program 7382.850, Attachment A (Outsourcing and Purchasing); ISO 13485 clauses 4.1.5 and 7.4Source ↗
Design and development file and medical device file
For class II, class III and listed class I devices, investigators can review design inputs, outputs, review, verification, validation, software validation and transfer, and the medical device file.
21 CFR 820.10(c); ISO 13485 clauses 4.2.3 and 7.3Source ↗
Personnel competence and training records
Competence is judged on education, training, skills and experience, and the manufacturer evaluates whether the actions taken worked. FDA says higher-risk processes may need evidence beyond a completed quiz.
ISO 13485 clause 6.2, as discussed in FDA CDRH town hall of April 1, 2026Source ↗
What they pick on the day
Elements chosen from product risk
In most inspections the investigator selects at least one element in each of the six QMS areas, guided by the risk management file. Baseline surveillance and PMA preapproval inspections cover a defined minimum set of elements.
Records picked by risk and investigator judgment
FDA says investigators do not apply a statistical sampling plan. They choose records based on identified product risk and review multiple records, adding more if the first ones raise questions.
The four Other Applicable FDA Requirements
Medical device reporting, reports of corrections and removals, tracking and unique device identification are evaluated on each inspection unless they do not apply. Investigators also sample device listings for accuracy.
Floor walk, process observation and staff interviews
Investigators tour the facility, ask to see how products and processes work, review quality data and documents, interview staff and observe processes in action.
What gets cited, with counts where they are published
Corrective and preventive action (21 CFR 820.100)
342 of 2,660 device citations (12.9%) FY2025 (inspections ending Oct 1, 2024 to Sep 30, 2025)
The most cited area on device Form 483s. Of the 342 citations, 279 were for lack of or inadequate CAPA procedures and 63 for CAPA activities or results that were not documented.
Design controls (21 CFR 820.30)
315 of 2,660 device citations (11.8%) FY2025 (inspections ending Oct 1, 2024 to Sep 30, 2025)
Citations cover design change procedures, risk analysis within design validation, missing design control procedures and the design history file.
Complaint handling (21 CFR 820.198)
286 of 2,660 device citations (10.8%) FY2025 (inspections ending Oct 1, 2024 to Sep 30, 2025)
211 of the 286 citations were for lack of or inadequate complaint procedures, and 32 were for complaint files that were not adequately maintained.
Purchasing controls (21 CFR 820.50)
190 of 2,660 device citations (7.1%) FY2025 (inspections ending Oct 1, 2024 to Sep 30, 2025)
115 citations were for purchasing procedures. The rest cover supplier evaluation, supplier records, supplier oversight and supplier notification of changes.
What is not published
FDA's inspection observations for fiscal 2026 are not published yet, so the counts are fiscal 2025 and use the older numbering of the Quality System Regulation. No public MDSAP nonconformity statistics turned up.
Where written policies come in
A documented QMS and older records
21 CFR 820.10(a) requires a documented quality management system that meets ISO 13485. FDA does not expect records made before February 2, 2026 to be rewritten, but investigators may still review them.
Management review, internal audit and supplier audit procedures
These are now open to review, and FDA says an ISO 13485 audit does not replace an internal audit of the QMSR requirements. The internal audit procedure the firm wrote is the one it will be held to.
Training effectiveness
Clause 6.2 asks the manufacturer to evaluate the effectiveness of actions taken to achieve competence. FDA says this goes beyond whether training was completed, and the evidence should fit the risk of the process.
Document and record control
The Management Oversight area covers control of documents and records under 21 CFR 820.35, 820.45 and ISO 13485 clauses 4.2.1, 4.2.4 and 4.2.5. FY2025 Form 483s carried 64 citations for document control procedures.
Dates that matter
| Date | What happens | Status |
|---|---|---|
| February 2, 2026 | QMSR takes effect; FDA inspects under Compliance Program 7382.850 and stops using QSIT Source ↗ | Done |
Questions people ask
Does FDA still use the Quality System Inspection Technique?
No. FDA stopped using QSIT for device inspections on February 2, 2026 and now follows Compliance Program 7382.850. It replaced Compliance Programs 7382.845 and 7383.001.
Will FDA investigators follow the MDSAP audit approach?
FDA has said no. Investigators follow the risk-based approach in Compliance Program 7382.850. For manufacturers that participate in MDSAP, FDA may continue to accept MDSAP audit reports in place of routine inspections.
Do records created before February 2, 2026 need to be recreated to match the QMSR?
No. FDA does not expect older records to be revised or to cite ISO 13485 language. It does expect firms to find process gaps against the QMSR and plan to close them, and investigators may still review older records.
Can an ISO 13485 or notified body audit stand in for the internal audit?
FDA's answer is that such an audit may complement the internal audit but may not replace it, because the internal audit must cover the QMSR requirements and follow the firm's own documented procedure.
What has FDA reported from the first QMSR inspections?
At the FDLI annual conference on May 6, 2026, a CDRH official said FDA had completed just north of 100 QMSR inspections. Risk management was the top observation, followed by outsourcing, complaint handling and UDI, with corrective action fourth.
Sources
- fda.gov /media/80195/download
- fda.gov /media/191960/download
- fda.gov /medical-devices/postmarket-requirements-devices/quality-managem…
- fda.gov /inspections-compliance-enforcement-and-criminal-investigations/…
- fda.gov /media/190190/download
- ecfr.gov /current/title-21/part-820
- ecfr.gov /current/title-21/section-820.35
- fda.gov /media/166672/download
- fda.gov /medical-devices/cdrh-international-affairs/medical-device-singl…
- european-accreditation.org /
- raps.org /resource/fda-official-details-top-observations-from-qmsr-inspec…
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.