ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
QMSR management review is the periodic meeting in which top management evaluates whether the quality management system of a medical device manufacturer is suitable, adequate and effective. Under the FDA Quality Management System Regulation, which took effect on 2 February 2026, it matters more than it did under the old Quality System Regulation.
The QMSR incorporates ISO 13485:2016 by reference, and ISO 13485 clause 5.6 sets out the management review requirements. Published analyses of FDA’s new inspection approach note that management review, internal audit and supplier audit records are now explicitly inspectable, where they were previously excluded from routine inspection under the QSR.
This guide explains what to review, what to record and how to prepare. It is general information, not legal advice, so check the regulation and FDA’s current inspection materials for your situation.
Management review is the top-level check on the quality system. Senior management looks at performance data, decides what needs to change and commits resources. It is not a status meeting for the quality department. It is a leadership decision point.
Under the QMSR, the regulation builds on ISO 13485:2016 and adds FDA-specific requirements. The FDA’s page at FDA QMSR page states the effective date and explains that the regulation incorporates the international standard by reference. For background on the regulation, see FDA QMSR and 21 CFR Part 820.
The difference between this regime and the old one is discussed in QSR to QMSR transition and QMSR vs ISO 13485.
Under the QSR, FDA investigators generally did not review management review reports, internal audit reports or supplier audit reports, except in certain circumstances. Commentary on the new inspection approach reports that these records are now within the scope of inspection. That means investigators may read what leadership discussed and decided.
This changes behavior. Minutes that previously described problems loosely may now be read as evidence of what management knew and when. The right response is not to write less. It is to run real reviews, document decisions clearly and follow up on actions.
Expect investigators to look for consistency: if complaints are rising, does the review show it? If an audit raised a finding, does the review show the response? Gaps between data and decisions are what draw questions.
| Element | What ISO 13485 clause 5.6 expects | Evidence |
|---|---|---|
| Frequency | Planned intervals, documented | Review schedule |
| Inputs | Audits, feedback, complaints, process and product data, CAPA, changes, recalls, regulatory updates | Input summary pack |
| Outputs | Decisions on improvement, changes and resources | Action list with owners |
| Records | Minutes, decisions, actions | Signed minutes |
| Follow-up | Actions tracked to closure | Action log |
ISO 13485 clause 5.6.2 lists the inputs. They include feedback, complaint handling, reporting to regulatory authorities, audits, monitoring and measurement of processes, monitoring and measurement of product, corrective action, preventive action, follow-up actions from earlier reviews, changes that could affect the quality system, recommendations for improvement and applicable new or revised regulatory requirements. Supplier performance is not listed as a separate input, but it usually enters through audits and process monitoring, and most manufacturers include it.
Prepare a concise pack, with trends rather than raw data: complaint rates, nonconformance trends, CAPA status and ageing, audit findings, supplier performance and post-market signals. Include data on the effectiveness of past actions.
Link each input to its source record, such as QMSR CAPA, FDA complaint records, QMSR internal audit and QMSR supplier controls.
Outputs should be decisions, not observations. The standard expects outputs about the improvement needed to maintain the suitability, adequacy and effectiveness of the system, about changes needed in response to new requirements and about resource needs. Each output should become an action with an owner, a due date and a way to verify completion.
Minutes should state who attended, what was reviewed, the conclusions, the decisions and the actions. Keep them factual. Avoid speculation and avoid recording unverified opinions as facts.
Maintain the records so they can be retrieved. The regulation expects records to be legible and readily retrievable, and FDA may request them during an inspection, as discussed in QMSR inspection.
The standard requires reviews at documented planned intervals. Many manufacturers hold them at least once a year, and more often for higher-risk products or during periods of change. Choose a frequency that matches your risk and keep to it. Missing planned reviews is easy for an inspector to spot.
Top management must take part, which normally means the senior executive responsible for the company and the heads of key functions: quality, regulatory, operations, design, supply chain and customer support. If top management delegates the meeting entirely, the record will not show real oversight.
Record any absences and how missed decisions were handled. Consider a short interim review after major events such as a recall or a significant audit finding.
A mid-sized device maker holds its annual review in March. The input pack shows that complaints about one accessory rose by 30 percent over two quarters, that two supplier audits found late corrective actions and that a CAPA has been open for 200 days. The review concludes that the accessory needs a design change and the supplier requires a formal performance plan.
Outputs: approve a design change project with a named lead and budget, put the supplier on a monitored status with monthly reviews, and assign a resource to close the ageing CAPA within 60 days. The next review tracks all three. The numbers are invented, yet the pattern of data, decision and follow-up is what a QMSR management review should document.
Notice that each action is specific and traceable. That is what reads well in an inspection.
Gather the last three years of review minutes, input packs and action logs. Check that they are complete, consistent and signed. Check that actions were closed and that the evidence is easy to find.
Brief senior managers. They may be asked to explain how they oversee quality. A leader who can describe recent decisions and their results shows that the system works. Practice the narrative, without rehearsing scripts.
Connect the review to the rest of the system. The inspection approach described in commentary uses a risk-based model, so be ready to show how management review ties to CAPA, complaints, audits and supplier controls. Labeling and record supplements are covered in FDA device labeling controls.
The most common mistake is treating the meeting as a formality: a slide deck presented in thirty minutes, minutes copied from last year and no real decisions. Inspectors can see when minutes are templated, and so can your own auditors. The second mistake is showing only good news. If the data contains problems, the review has to acknowledge them and decide what to do.
A third mistake is weak follow-up. Actions without owners or dates do not get done, and the next review then repeats the same discussion. A fourth is data without analysis: presenting hundreds of numbers but no trend, cause or recommendation. Finally, keep records secure but accessible. A QMSR management review record that nobody can find on inspection day is nearly as bad as one that was never made.
Build a simple checklist for the review itself: inputs complete, attendees confirmed, decisions recorded, actions assigned, minutes approved within two weeks.
Use the review to check progress against quality objectives and to revisit risk. If complaint trends, field actions or audit findings point to a product risk that is higher than expected, the review should trigger a reassessment and, where needed, changes to design, process or supplier controls. Record the trigger, the decision and the follow-up so the thread is visible from data to outcome. A short section in the minutes titled risk and opportunities helps keep the QMSR management review aligned with the risk-based thinking in ISO 13485.
You can design the agenda, the input pack and the minutes from scratch, but consistent templates save time and reduce omissions. A prepared set of documents gives you a base to adapt.
The FDA QMSR Toolkit provides 73 editable templates for 21 CFR Part 820, including the FDA layer on top of ISO 13485 and inspection readiness materials. Adapt the management review agenda, input pack and minutes to your company and your products.
Whichever route you take, run a practice review before the next planned date and ask whether an outsider could follow the logic from data to decision.
The FDA Quality Management System Regulation became effective on 2 February 2026.
Yes. The QMSR incorporates ISO 13485:2016, whose clause 5.6 requires management review at planned intervals.
Published analyses of FDA’s new inspection approach state that management review, internal audit and supplier audit records are now inspectable. Check the current FDA materials for details.
At documented planned intervals. Many manufacturers do so at least annually, more often for higher-risk products or periods of change.
Top management, supported by the heads of key quality-related functions.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026