Quality Culture: What You Can't See in an Audit
There's One Thing I Cannot Audit
21 years in the field, hundreds of audits, dozens of companies. And there's one thing that cannot be audited.
I can check procedures. I can check records. I can ask questions and cross-reference answers. But if I want to know if there's a true quality culture in an organization, I need to pay attention to the things that aren't written in any document.
Because here’s the simple truth: you can meet all the requirements of ISO 13485 and still not produce safe products.
You can write precise procedures that no one knows.
You can submit impressive reports that no one reads.
Quality culture isn't what's written. It's what happens when no one is looking.
The FDA Has Also Noticed
With the QMSR coming into effect in February 2026, the FDA has published its position on quality culture directly within the Final Rule - as part of the requirement.
The FDA expects company management to lead a culture of quality, defining it as the collection of behaviors, attitudes, activities, and processes.
This doesn't surprise me, because it's what I've been seeing in the field for years.
What Does That Actually Mean?
A quality culture is when a production line employee stops a process because they understand there's a problem and know it's the right thing to do, not because it's written in a procedure or work instruction.
It's when a department manager hears about a deviation and asks, 'What caused this?' and not 'Who is to blame?'.
It's when the quality policy isn't a document hanging on the wall but something managers can explain without reading it.
Regulation mandates systems, but it cannot enforce motivation.
What I Look For When I Enter a Company
Over the years, I've developed antennas. Not a checklist, but a sense for the organizational atmosphere.
There are a few things I notice very quickly.
Management asks questions, not just rubber-stamps. When managers come to a management review prepared, asking 'Why isn't this CAPA closed?' and 'What's the trend in the last quarter?', it sends a clear message to the entire organization that quality is important as a management decision, not just the responsibility of a specific department. When they stop asking, the employees stop asking too.
People talk about problems without trying to cover their backs. An organization where someone raises an issue and receives the response, 'Thank you, let's figure out what happened together,' builds trust. An organization where people hide deviations because they fear the reaction creates a distorted reality. The data that managers analyze there is simply not real.
Procedures are updated from the field, not just from the regulator. Every organization evolves, and if the procedures aren't updated accordingly, it's a sign that no one really works with them. A living quality culture creates a mechanism where employees point out gaps and the procedure is updated. The procedure should reflect what is happening, not what we wanted to happen.
Quality metrics belong to everyone, not just the Quality Manager. I've encountered organizations where the KPIs are a file saved only on the Quality Manager's computer. That's not culture. Culture is when metrics are accessible, presented in management meetings, and people are connected to the results. When people know that the work they did moved a metric, motivation increases.
Risk management is a mindset, not a form. When I ask an engineer, 'What is the risk in this change?' and I get a thought-out answer, that's risk management. When I get, 'We'll fill out an FMEA at the end,' that's an exercise in form-filling. A quality culture places risk management as a way of thinking that accompanies daily decisions in development, production, change management, and supplier selection.
Departments solve problems together, not against each other. Quality problems almost never reside in a single department. If each department manages 'its problem' separately, the real problem is never solved. A healthy quality culture fosters collaboration because people understand they are working on the same product and have the same goal - the company's success.
You Can't Fake Culture on Audit Day
An experienced auditor doesn't need to ask, 'Do you have a quality culture?'. They see the answer within an hour.
A management review that's been postponed three times because 'now is not a good time' says something. A corrective action that is repeatedly closed with 'the employee was retrained' without asking what caused the problem in the first place, also says something. A deviation documented as a 'one-time' occurrence for the third time in a row; an employee explaining an incorrect action with 'that's how we've always done it and we never got a finding from the notified body'; a manager looking for the relevant procedure during the audit and it turns out they've never opened it... all of these paint a picture of the organizational culture.
You can prepare documents, you can train employees for an audit, you can organize the folders. But the daily habits remain.
Compliance Is the Starting Point. Culture Is the Goal.
The QMSR requires a quality management system. ISO 13485 requires processes. ISO 14971 requires risk management. All these requirements are tools. A starting point.
An organization that meets all the requirements without an internal culture that drives people to do the right thing will only function when someone is watching it. And someone isn't always watching.
A few questions worth asking now, regardless of audit preparations:
What happened to the last employee who reported a problem? Did they receive feedback? When was the last time you updated a procedure based on feedback from the field, not due to an auditor's comment? In the last management review, was there a real conversation, or did they just read the summary and move on?
There are no right or wrong answers, only honest answers.
A Final Thought
One of the moments I love in my work is when I enter a company and realize that quality is already alive there because people talk about problems openly, managers understand why they ask questions, and there's someone who truly cares.
This happens because management decided it's important, not because regulation requires it.
Quality doesn't start in the field. It starts with a decision.