ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
A QMSR inspection does not work the way an FDA device inspection worked for the previous twenty-five years. On 2 February 2026 — the day the Quality Management System Regulation took effect — FDA stopped using the Quality System Inspection Technique and began inspecting under Compliance Program 7382.850. Preparation material written for QSIT no longer describes what will happen in your building.
This guide covers the six QMS Areas the new program uses, the four Other Applicable FDA Requirements alongside them, how investigators choose what to look at, and the records that are no longer off-limits.
FDA retired three documents on the same day: the Quality System Inspection Technique itself, Compliance Program 7382.845 (Inspection of Medical Device Manufacturers) and Compliance Program 7383.001 (PMA Preapproval and PMA Postmarket Inspections). One program replaced all three.
The change is not cosmetic. QSIT was built on the old Quality System Regulation’s subpart structure — the four-subsystem model of management controls, design controls, CAPA and production and process controls. That structure no longer matches the regulation, because the regulation now incorporates ISO 13485:2016 by reference. A QMSR inspection is organised around the standard’s clauses instead.
| QMS Area | Elements | What it is for |
|---|---|---|
| Change Control | 4 | Changes evaluated for risk and impact before implementation |
| Design and Development | 12 | Design activities produce a safe and effective device meeting intended use |
| Management Oversight | 14 | Top management maintains an effective system and uses risk-based decision making |
| Measurement, Analysis and Improvement | 10 | Monitoring and improvement identify and reduce risks |
| Outsourcing and Purchasing | 3 | Outsourced processes and purchased product are controlled |
| Production and Service Provision | 11 | Production and servicing produce a safe and effective device |
54 elements in total, each mapped by FDA to ISO 13485 clauses and, where relevant, to sections of 21 CFR Part 820.
Management Oversight carrying fourteen elements — more than any other area — is worth noting. It is a full inspection area, not the background check it was often treated as.
Alongside the QMS Areas, a QMSR inspection covers four Other Applicable FDA Requirements:
| OAFR | Part | Purpose |
|---|---|---|
| Medical Device Reporting | 803 | Device-related deaths, serious injuries and malfunctions identified, investigated, reported and documented in time |
| Reports of Corrections and Removals | 806 | FDA promptly notified of actions reducing a risk to health |
| Medical Device Tracking | 821 | Tracked devices can be located expeditiously |
| Unique Device Identification | 830 | UDI assigned and device information correctly recorded in GUDID |
Those are exactly the four parts section 820.10(b) bridges to. The regulation’s own cross-references and FDA’s inspection structure point at the same four, which is a strong hint about where to concentrate preparation.
A QMSR inspection also covers general items outside both groups: registration and listing, marketing authorisations, previous Form 483 or compliance issues, and anything specified in the assignment.
This is the biggest practical change. A QMSR inspection is risk-based. Investigators identify product risks that could adversely affect patients and users, and select elements to examine on that basis and on professional judgement — not by a standardised sampling table.
Your risk management documentation is therefore the roadmap for the whole inspection. If your risk file is thin, out of date, or disconnected from your complaint and servicing data, the inspection starts badly and stays there.
One inspection model requires a minimum of one element from each of the six QMS Areas, plus the OAFRs and general items. Every area will be touched, so preparing three areas thoroughly and hoping the others are skipped is not a strategy.
Records are chosen based on identified product risks and the investigator’s experience. In most cases multiple records are reviewed to give assurance that requirements are met and risks controlled. Where requirements are not met, the investigator collects the records that support the observation.
This is the change most likely to catch a quality system built under the old rule, and it should shape how you prepare for a QMSR inspection.
Former section 820.180(c) provided that the records-availability requirements did not apply to management review reports, internal quality audit reports, or supplier audit reports used to meet the supplier evaluation requirement. On request, an employee in management with executive responsibility could certify in writing that they had been performed and dated, and that corrective action had been undertaken. The reports stayed internal.
The QMSR has no section 820.180. The exemption went with it, and Compliance Program 7382.850 names Internal Audits (Clause 8.2.4) and Management Review (Clauses 5.6.1–5.6.3) as elements. Supplier evaluation sits inside the Outsourcing and Purchasing area.
Two consequences. First, a reflexive refusal to produce those records cannot be sustained, and the person who receives the request in the back room should not be the one deciding. Second, records written on the assumption nobody outside would read them may contain commentary that reads badly.
Do not respond by writing thinner reports. An audit programme that never finds anything suggests the audit is not being performed effectively, and that is visible to anyone reading the file.
Four things matter more than the rest.
Map your evidence to the elements. Build a map with a row per element across all six areas and the four OAFRs, recording what evidence exists, where it is, who owns it and how long retrieval takes. This mirrors the structure the investigator works from.
Measure retrieval time, do not estimate it. Run a mock inspection and time production of each record. Slow retrieval reads as poor control regardless of how good the record is.
Close open findings. Internal audit findings with target dates long past are now readable. Close them properly with evidence of effectiveness.
Brief the team on the protocol. One voice to the investigator, a scribe recording everything requested and produced, and a back room that checks documents before release and keeps a copy of exactly what was handed over.
FDA may also conduct a remote regulatory assessment rather than, or in advance of, an inspection. Under section 704(a)(4) of the Act it can require records in advance of or in lieu of an inspection, and an RRA is expressly not an inspection under section 704(a)(1). Records must be producible remotely in a usable electronic form, including audit trails — test that before you are asked.
Preparation is easier if you know the shape of the opening hours. Four things surface early in almost every QMSR inspection.
The risk management file. Because element selection is risk-based, this is the document the investigator reads to decide where to go. It should be current, cover the devices actually in production, and reconcile with what your complaint and servicing data say is going wrong.
The device list and classification. Which devices, which class, and — under 820.10(c) — whether design controls apply to each. A class I device that gained software and never had its determination revisited is a common finding.
Complaint and MDR records, side by side. The reconciliation between them is the analysis an investigator will perform if you have not: a complaint alleging death or serious injury with no corresponding reportability decision is exactly what that comparison surfaces.
Evidence that processes operate, not that procedures exist. Element-based inspection tests whether issues were identified, documented and effectively closed. A procedure with no records behind it demonstrates intent, nothing more.
Yes. FDA’s own guidance states it stopped using the Quality System Inspection Technique on 2 February 2026 and began using the process in Compliance Program 7382.850. Preparation material still organised around the four QSIT subsystems is describing a process that no longer runs.
No. In a QMSR inspection, investigators select elements based on product risk and judgement, with a minimum of one element per QMS Area under one inspection model. The point is that you cannot predict which elements, so evidence has to be ready across all six areas rather than concentrated where you feel strongest.
It is a factor an investigator discusses with a supervisor, but it does not substitute for the inspection. Map what MDSAP evidence genuinely covers and evidence the FDA-specific supplements separately — the 820.35 record elements and 820.45 labeling controls in particular.
Not on the basis of the old exemption, which no longer exists. If a genuine scope question arises, escalate it to the named authority in your inspection procedure rather than deciding at the point of request. The far better position is to have reports written to a standard that survives being read.
For the regulation the inspection tests against, see 21 CFR Part 820 section by section and the FDA QMSR guide. If your quality system predates February 2026, the QSR to QMSR transition maps the old sections across.
The current regulation text is on eCFR at 21 CFR Part 820.
Our FDA QMSR Toolkit includes an evidence map pre-loaded with all 54 elements and the four OAFRs, an internal audit checklist built on the same structure, the front and back room protocol, the document request log, and a disclosure readiness procedure for the records that used to be exempt. Preparing against FDA’s own structure is the difference between a QMSR inspection you can run and one that runs you.
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026