What the FDA Is Really Looking For: Risk Management and Quality Culture in the QMSR Era
At the RAPS quality conference held recently in Baltimore, two different talks carried the same message. One came from the FDA itself, from Keisha Thomas, Deputy Director for Compliance and Quality at CDRH. The other came from Kerry DiPietro, Chief Quality Officer of Integra LifeSciences, who guides organizations through end-to-end culture change. Both made the same point: the FDA is no longer asking, "Do you have an SOP?" It is asking, "Do quality and risk management really drive your decision-making?"
The distinction may look subtle, but its implications are massive.
Risk management: the number 1 finding under the QMSR
It has been four months since the QMSR (the updated Quality Management System Regulation) took effect, and the FDA is now running its new compliance program, CPM 7382.850, which replaces the old QSIT. It is too early to draw long-term trends, but a clear picture is already emerging. Risk management is the topic with the most findings, followed by corrective actions, the risk-based approach, complaint handling and the purchasing process.
That is not especially surprising. What is surprising is the reason for the findings.
According to Thomas, investigators are not finding companies without risk management files. They are finding companies that have the files and have the processes, but do not apply them systematically across all areas of the QMS. Risk management exists as a document, not as a culture.
That is the difference between "we have a Risk Management File" and "risk management is present in every decision we make."
What this means in practice: risk management as a living process
Thomas used a phrase worth keeping: "Your risk management system should be fluid, living, breathing, constantly evolving, in a state of continuous improvement all the time."
What does that mean day to day?
Risk management that lives and breathes includes, for example:
When a customer complaint comes in, the first question is not "How do we close the corrective action?" but "What does this say about the product's risk management file? Does our risk-benefit assessment still hold?"
When a supplier change is planned, the purchasing team asks risk-based questions, not only logistical ones
When a new manufacturing process is being planned, the FMEA is not a one-time exercise that gets filed away in a folder, but a document that is updated when failures or field data come in
When PMS detects a new signal, it is fed back into the risk management file and does not stay only in the PMS report
CAPA? The FDA no longer uses the word
Another change Thomas emphasized is that under the QMSR, corrective actions and preventive actions have been separated from each other. The FDA has gone as far as banning the use of the term "CAPA" within the agency.
The rationale is clear. In the past, preventive action almost always followed a corrective action, as one final part of the process. Under the QMSR, the expectation is that preventive actions are an inherent part of the quality management system and not an add-on to failures.
What this means in practice: your quality management system needs a preventive action mechanism based on data analysis, trends and PMS outputs, even when no failure has occurred.
In other words, the question is whether you analyze trends in field data and make preventive decisions before something happens.
The five levels: where does your company stand?
This is where DiPietro's insight comes in, complementing what Thomas presented from the regulatory angle.
DiPietro described five levels of quality culture at which companies operate:
Level | Character | What actually happens |
|---|---|---|
1 | Reactive | Driven by external events, many corrective actions, quality = training |
2 | Controlled compliance | Documented processes, basic controls, readiness for inspections. Problems keep recurring |
3 | Proactive | In-depth investigations, a risk-based approach, stronger KPIs |
4 | Integrated | Every function takes responsibility for quality, more effective corrective actions |
5 | Optimal | Predictive quality, leading indicators, real continuous improvement |
When the conference participants assessed themselves, 41% said they were at level 2. Only 3% were at level 5.
The painful point here is that level 2 is the one the FDA is issuing findings against. There is documentation and there are processes, but there is no real implementation.
What the FDA asks senior managers
Boyd, who served at the FDA for more than 30 years, put it this way:
The FDA will ask the company's managers how they assess and measure quality in their company, and what their plan for improvement is.
This is not a question you can answer with a procedure.
It is a question that requires the senior manager to explain, without a presentation, the current state of quality in the company, where they are heading, and how they know they are making progress.
The message is clear: quality culture is not only an internal matter. It is measured, and the regulator is paying attention.
So what do you do? A few action points
If you are a medical device manufacturer and want to understand what this means day to day, here are a few concrete action points:
In risk management:
Check that the link between PMS, complaints, corrective actions and the risk management file is explicit and documented, not something that is "taken for granted"
The risk management review should be a process with defined inputs (field data, open corrective actions, changes in use) and documented outputs
Risk management is not only part of development. It also belongs in operations, purchasing, supplier management, post-market management and more.
In preventive actions:
Add an explicit mechanism for identifying preventive actions to your trend analysis process
Document your prevention considerations as part of the management review, even when no failure has occurred
In quality culture:
Ask yourselves honestly which of the five levels you are at. Do not rely on the quality department alone; ask development, operations and the CEO
Build a roadmap for improvement. Culture change takes years, but it starts with a conscious decision
Summary: the inspection has changed
The QMSR did not just add a technical change to the requirements. It changed the way the FDA looks at companies. The new approach is risk-based and holistic, and it looks for evidence that quality management and risk management are a real part of business decisions, not just an architecture of documents.
The two RAPS talks described here show two sides of the same coin: what the FDA is finding in the field (Thomas), and how companies can build the foundation that prevents it (DiPietro). Their shared message is that compliance is necessary, but it is not enough. What the FDA is looking for now is a company where quality lives inside the organization, not only in its documents.