How to Get Through an FDA Inspection in the QMSR Era: The Ultimate Guide, with a Cheat Sheet for Every Topic

Updated September 2026.

Since this guide was first published, the first Warning Letters under the QMSR have been issued, and every one of them cites clause 7.1.

Since the QMSR took effect on February 2, 2026, the FDA has retired the long-standing QSIT and replaced it with Compliance Program 7382.850. At the same time, ISO 13485:2016 has been incorporated by reference into 21 CFR Part 820.

The result is an inspection that is organized differently, moves differently, and examines things that used to be out of its reach.

Since the regulation took effect, we already have real data on what the FDA is finding and where companies are falling short.

Here is a practical guide to getting through an FDA inspection. First we will look at the big picture, then we will go over the actual findings from the field, and then I will give you a short, practical cheat sheet for each of the topics you need to get through.

Cut them out, stick them on the wall, and use them as you prepare for your next inspection.

The big picture: how the inspection is structured now

The inspection is organized around six quality system areas, plus four other applicable FDA requirements (OAFRs) and general areas that remain in place (establishment registration, device listing, marketing authorization and compliance history).

The six quality system areas:

  1. Management Oversight

  2. Measurement, Analysis and Improvement

  3. Design and Development

  4. Change Control

  5. Outsourcing and Purchasing

  6. Production and Service Provisions

The four other applicable FDA requirements (OAFRs):

  1. Medical Device Reporting (MDR)

  2. Corrections and Removals

  3. Device Tracking (where relevant)

  4. UDI

Note one important structural change:

The old CAPA subsystem has been split.

Corrective action, data analysis and preventive action are now separate assessment areas within Measurement, Analysis and Improvement.

You can no longer tick CAPA off as a single box.

One more change affects how you prepare: investigators no longer apply statistical sampling plans.

Under section 3.B.(3) of the program, records are selected according to the product risk that has been identified and the investigator's professional judgment.

For anyone preparing, this means there is no file you can assume will not be picked, and all the records in a process identified as high risk need to be at the same level.

The two inspection models: know which one you are walking into

This may be the most practical thing to understand, because it determines how deep the investigator will dig. The FDA works with two models:

Model

When it applies

Depth of review

Model 1

Non-baseline surveillance (routine surveillance), compliance follow-up, for-cause inspections, specific product risk assignments (SPRA), and PMA post-approval inspections

At least one element in each of the six areas, and at least one element in each relevant OAFR.

Model 2

Baseline surveillance (including a first inspection that establishes a baseline) and PMA pre-approval inspections

A defined list of minimum elements for each area, as shown in Figure 2 of the Compliance Program

The common mistake is to prepare with a one-size-fits-all checklist. A company facing its first inspection or awaiting PMA approval is in Model 2, which means a comprehensive review of all the elements, so it needs much deeper preparation than an established company under routine surveillance in Model 1.

Identify the model you can expect, and match the depth of your preparation to it.

What the FDA is actually finding: the top five findings

According to Keisha Thomas, Deputy Director at the FDA's Office of Product Evaluation and Quality (OPEQ), these are the deficiency areas that come up most often on Form 483 in the first QMSR inspections, in order of frequency:

  1. Risk management (first place, by a wide margin)

  2. Outsourcing and purchasing

  3. Complaint handling and feedback

  4. UDI

  5. Corrective actions

The FDA summed it all up in one phrase: "risk, risk, risk, risk."

Risk management is the axis that everything else hangs on.

If you remember one thing from this guide, let it be this: the investigator expects risk to be present in every decision and every process in the quality management system.

Now to the main part. Each topic has its own cheat sheet.

Cheat sheet 1: Risk management (deficiency no. 1)

What the investigator looks at: whether the risk management file is alive and kept up to date, and whether post-market information flows back into it continuously.

The FDA reviews the risk file before it even arrives on site.

How to prepare:

  • Make sure the risk file is a living document, not one that was signed once and forgotten.

  • Show an explicit link, such as a recent complaint or deviation that led to a documented reassessment of risk.

  • Make sure every risk decision is backed by objective evidence, not by an empty "we will continue to monitor."

  • Check that every key process in the quality management system refers to risk management and is shaped by it.

  • For combination products, make sure you meet the risk management and product realization requirements under 21 CFR Part 4.4.

Cheat sheet 2: Outsourcing and purchasing (deficiency no. 2)

What the investigator looks at: whether supplier control is risk-based, or a generic template that treats all suppliers the same way.

How to prepare:

  • Apply qualification and monitoring that are tiered by risk. A contract with a critical sterilizer calls for different controls than a packaging supplier.

  • Avoid uniform templates for all suppliers. The investigator spots a copy-and-paste approach immediately.

  • Make sure your supplier oversight records reflect proactive control rather than reactive, after-the-fact actions.

  • Be ready to show the supplier audit reports themselves (see Cheat sheet 6, as this is a significant change).

Cheat sheet 3: Complaint handling and feedback (deficiency no. 3)

What the investigator looks at: whether the complaint chain is complete and connected, from intake through CAPA and risk management.

How to prepare:

  • Strengthen your intake requirements: the device identifier (UDI), the failure mode, and a clear picture of the impact.

  • Sharpen your escalation rules: when a complaint becomes reportable as an MDR, and when it triggers a CAPA.

  • Document how a closed complaint feeds into risk management and CAPA decisions.

  • Test the chain end to end: complaint, feedback, data analysis, CAPA, and an internal audit that checks effectiveness. If the chain breaks at any point, you have found a gap before the investigator does.

Cheat sheet 4: UDI (deficiency no. 4)

What the investigator looks at: whether the UDIs are consistent across all systems and the configurations actually on the market.

How to prepare:

  • Align the UDIs across labeling, internal systems, the GUDID database and the configurations you actually market.

  • Update the UDIs every time a model or packaging configuration changes.

  • Carry out a proactive reconciliation before the inspection, not after the investigator points out a gap.

Cheat sheet 5: Corrective actions/CAPA (deficiency no. 5)

What the investigator looks at: a depth of root cause investigation that matches the severity of the problem, and whether CAPA is connected to the rest of the system.

How to prepare:

  • Match the depth of the root cause investigation to the severity of the problem. A serious problem calls for a deeper investigation.

  • Assess cross-product and cross-supplier implications (horizontal analysis) before closing the corrective action.

  • Remember that the area has been split: corrective action, data analysis and preventive action are reviewed separately. Make sure each of them stands on its own.

  • If you previously received an OAI (Official Action Indicated) or VAI (Voluntary Action Indicated) classification, make sure your corrective actions meet the QMSR and not the old QSR.

Cheat sheet 6: Records the FDA can now review (a dramatic change)

What has changed: the FDA can now review internal audit reports, supplier audit results and management review records. Until now, these were off limits. This narrows the gap between the mindset of an FDA inspection and that of an ISO or MDSAP audit.

How to prepare:

  • Make sure your management review records are complete, credible and internally consistent, and that they reflect a system that really works.

  • A recommended exercise: take your last three management review records and highlight every decision. For each one, ask: can I link it to objective evidence? If the same risks come up quarter after quarter with no clear action, that is very hard to defend once the record is open for review.

  • Reread your internal audit reports through the eyes of an FDA investigator. Do they identify the same problems that later surface in complaints or nonconformities? If not, the internal audit is not really checking effectiveness.

Cheat sheet 7: Quality culture and training effectiveness (what the FDA examines indirectly)

What the investigator looks at: quality culture shows up in decisions and actions, not in a dedicated document. Training effectiveness is measured against the level of risk.

How to prepare:

  • Do not build a "quality culture document." The FDA wants to see that actual decisions and actions reflect risk-based decision-making.

  • Do not create separate risk assessments for administrative processes. The FDA has said explicitly that this is not required. Instead, every decision about frequency, depth or scope in an administrative procedure should refer to the level of risk in the product's risk management file. For example, the frequency of refresher training is derived from the risk level of the process the employee performs, not from a single value for all employees.

  • Match your evidence of training effectiveness to the level of risk. High-risk processes call for strong evidence (supervisor assessment, proficiency tests, hands-on demonstration, performance monitoring). A simple knowledge test on its own is not enough.

  • Make sure your risk-based decisions are "well justified and documented." That is the phrase the FDA is looking for.

Cheat sheet 8: Remote regulatory assessments (RRA)

What has changed: the FDA has added remote regulatory assessments (RRAs) to its toolbox. Legally, an RRA is not an inspection, but it gives the FDA another way to gather information and shape its next steps without necessarily starting on site.

How to prepare:

  • Do not prepare only for an investigator who shows up at the reception desk. FDA involvement can start remotely.

  • Strengthen document control and record availability, so that whatever the investigator requests can be accessed quickly.

  • Define clear ownership of the response: who is responsible for providing what, and who coordinates.

  • Practice an organized, timely and consistent response, whether the interaction starts on site or remotely.

Cheat sheet 9: MDSAP is not a shield

What to remember: MDSAP remains relevant, and the FDA continues to use it in place of some surveillance inspections. However, it does not make you invisible.

How to prepare:

  • Do not assume MDSAP takes you off the radar. The FDA can still carry out a for-cause inspection, or an inspection related to PMA activity or a concern about a specific product.

  • If your product area has become a focus for the FDA, having MDSAP will not prevent the FDA's attention.

  • Treat MDSAP as part of the oversight landscape, not as a shelter from it.

The summary checklist: what to do now

Before the investigator sits down across from you (on site or remotely), go through these:

  • Replace the old QSIT checklist with preparation based on the six areas and Compliance Program 7382.850.

  • Run a mock audit under the new framework, covering both inspection models.

  • Carry out a gap analysis on records created before February 2, 2026, and make sure they meet the QMSR.

  • Identify the inspection model you can expect (1 or 2) and match the depth of your preparation to it.

  • Prepare your management review, internal audit and supplier audit records for review as if an FDA investigator were about to read them.

  • Check the links between complaints, customer feedback, data analysis and CAPA.

  • Put risk management at the center. It is deficiency no. 1, and it is the thread the investigator follows.

  • Prepare your team for a remote assessment, and for the possibility that the investigator may examine anything needed to confirm that your processes are effective.

Bottom line

If you take three things from this guide, let them be these:

Risk is the name of the game. It is deficiency no. 1, and it is what the investigator looks for in every area. If your risk file is not alive and not connected to complaints, CAPA and management reviews, that is where you will fall. Fix it first.

What was closed to the FDA is now open. Management reviews, internal audits and supplier audits are no longer protected. Go through them today with an investigator's eyes, and fix whatever would not hold up when an FDA investigator reads it.

Know which inspection you are walking into. A company facing its first inspection or a PMA (Model 2) needs far deeper preparation than an established company under routine surveillance (Model 1). Do not prepare with a single checklist for everyone.

The FDA is still the FDA, and its enforcement authority has not been softened one bit. What has changed is that the investigator sees more and looks more deeply at how the pieces connect. Do not waste energy on the debate over whether inspections have "really changed." Simply sit down, run through the checklists above, and close the gaps before the investigator finds them for you.