Medical Device QMSR FDA Inspection CP 7382.850

Why CP 7382.850 Resembles the Pre-QSIT Risk-Based Inspection Approach

Investigators who worked before QSIT and later trained in QSIT may recognize familiar risk-based principles in CP 7382.850. Earlier inspections relied heavily on investigator judgment, product risk, complaint and MDR information, manufacturing controls, and evidence of system effectiveness. QSIT later standardized coverage through defined subsystems and a top-down method. It still required judgment and did not function as a simple checklist. CP 7382.850 now organizes QMSR requirements into six QMS areas and four OAFRs, using two inspection models. Investigators apply critical thinking, review risk-management documentation, and follow connections among processes when selecting or expanding coverage. Although the Agency does not describe this as a return to pre-QSIT methods, experienced investigators may recognize important similarities. A mock FDA inspection should combine that practical judgment with the current program’s required structure, inspection model, and applicable requirements.

Why Pre-QSIT Inspection Experience Remains Relevant

Investigators who worked before QSIT may bring valuable experience with directed, risk-focused inspections and evidence-based judgment. That background can help them follow product risks across complaints, manufacturing, design, change control, and postmarket information. Their later QSIT experience can add familiarity with structured subsystem reviews and top-down assessment. These capabilities remain relevant under CP 7382.850, which requires critical thinking and permits flexible movement among connected QMS areas. However, prior experience alone does not establish how every current inspection will proceed. Inspectors must follow CP 7382.850, QMSR, the assigned inspection type, the applicable model, and current Agency procedures. It is more accurate to say that pre-QSIT experience offers a useful perspective than to claim that those investigators are uniquely qualified. Current-program training and knowledge remain essential for accurately preparing manufacturers.

Why This Matters for FDA Inspection Readiness

CP 7382.850 replaces the QSIT subsystem structure with inspections organized around connected QMS areas, product risks, and applicable requirements. Manufacturers should not prepare each area as though it operates independently. The Agency expects top management to integrate QMS processes and ensure that applicable requirements are met. However, CP 7382.850 does not require “real-time control” or review of every lifecycle activity during every inspection. Investigators use critical thinking, risk-management documentation, complaints, MDRs, recalls, process data, and other evidence to select and expand coverage. Preparation should therefore test how procedures work in practice and how issues move across connected processes. Experience with earlier risk-focused inspections can provide a useful perspective when anticipating investigative paths and identifying gaps. A mock FDA inspection should also prepare personnel for onsite record requests and possible remote requests under section 704(a)(4).

Risk-Based FDA Inspection Process

How FDA Inspections Work Under 7382.850

CP 7382.850 uses a risk-based inspection process aligned with QMSR. It encompasses a total product lifecycle assessment. Investigators identify product risks and applicable requirements by reviewing roles, products, processes, risk documentation, and data. Sources include inspection history, complaints, MDRs, recalls, postmarket information, and facility walkthroughs. The Agency assigns one of two inspection models according to the inspection type. Model 1 requires at least one element from every QMS area and applicable OAFR. Model 2 requires review of the specified minimum elements. Investigators may expand coverage when findings or connected requirements warrant further review. They must also follow the inspection assignment and Agency procedures. RRAs remain separate remote assessments, although their results may inform inspection planning. Classification and regulatory decisions consider evidence, public-health significance, and manufacturer responses. A mock FDA inspection should reproduce the applicable inspection type, model, and required coverage.

Inspection Model 2 — Specified Minimum Elements

Generally used for:

• Baseline surveillance inspections

• PMA preapproval inspections

Minimum coverage:

• Specified elements within each QMS area

• Applicable OAFRs during baseline surveillance inspections

• Applicable general items and assignment instructions

PMA preapproval exception:

PMA preapproval inspections focus on the subject device and generally exclude the four OAFRs. Investigators follow any additional instructions in the assignment.

Approach:

• Identify product risks and associated controls

• Review the elements specified by the model

• Expand coverage when findings or insufficient information warrant further review

Key takeaway:

Model 2 establishes a different minimum scope. It is not automatically deeper or more demanding than Model 1, and it does not require review of every QMS element.

Assignment instructions may specify a different approach for a particular inspection.

Risk-Based FDA Inspections Across the Total Product Lifecycle

CP 7382.850 encompasses a total product lifecycle assessment and uses a risk-based inspection process aligned with QMSR. Investigators begin by understanding the manufacturer’s roles, products, processes, product risks, and associated controls. They review risk-management records and information such as complaints, MDRs, recalls, compliance history, and postmarket surveillance. The applicable inspection model establishes minimum coverage. Investigators may review additional requirements when findings or connected processes warrant expanded coverage. QMS areas and OAFRs do not require evaluation in a fixed order. However, risk-based flexibility does not remove model requirements or assignment instructions. QMSR expects top management to integrate QMS processes and ensure applicable requirements are met. It does not establish universal “real-time control” across all operations. A mock FDA inspection should test risk controls, process connections, and required records under the applicable model.

What Is a Remote Regulatory Assessment?

An RRA examines an Agency-regulated establishment, its records, or both. The Agency conducts the assessment entirely remotely to evaluate compliance with applicable requirements. RRAs may be mandatory or voluntary. A mandatory RRA relies on legal authority requiring participation, including certain records requests under the FD&C Act § 704(a)(4). A voluntary RRA may involve teleconferences, screen sharing, or livestreamed video. An establishment may decline or withdraw from a voluntary RRA. The Agency may use an RRA to prepare for an inspection, follow up on concerns, or verify corrective actions. It may also support review of a marketing submission. An RRA is not an inspection under § 704(a)(1) or § 704(a)(5). During a § 704(a)(4) RRA, the Agency does not issue Form FDA 482 or Form FDA 483. Information obtained may inform inspection planning, compliance assessments, and regulatory decisions.

RRA vs. Onsite FDA Inspection

Remote Regulatory Assessments and onsite inspections can help the Agency evaluate compliance, but their legal status and procedures differ. An RRA occurs entirely remotely and may include record review, teleconferences, screen sharing, or livestreamed video. Some RRAs are mandatory records requests, while interactive activities generally remain voluntary. An onsite inspection involves physical entry by Agency personnel. Investigators may observe operations, interview employees, examine records, and collect evidence. The Agency issues Form FDA 482 when initiating an onsite inspection and may issue Form FDA 483 for inspectional observations. It does not issue either form during a § 704(a)(4) RRA. The Agency may use an RRA to prepare for an inspection, verify corrective actions, or follow up on concerns. It may also support regulatory decisions. RRA information may lead to an inspection or support regulatory action, but those outcomes are not automatic.

How to Prepare for a Remote Regulatory Assessment

Preparing for an RRA starts by confirming whether participation is mandatory and identifying the authority, scope, format, and deadline. Assign one coordinator to manage communications, requested items, and a submission log. A mock FDA inspection can test document retrieval, review workflows, technology, and response accuracy before an RRA. Records should be accurate, legible, complete, and readily retrievable. Submit only responsive materials after knowledgeable personnel verify completeness, consistency, confidentiality, and required translations. Preserve original records and promptly explain unavailable information or proposed alternative timelines. For electronic records, maintain controls appropriate to applicable requirements, including access controls, change control, and audit trails when required. Train subject-matter experts for remote discussions and screen sharing. The Agency may use submitted information to assess compliance, plan inspections, verify corrective actions, or support regulatory decisions. An incomplete or untimely mandatory response may create additional compliance risk.

PMA Preapproval and Postmarket Inspections Under 7382.850

CP 7382.850 places PMA preapproval and postmarket assignments within one compliance program, but they remain distinct inspection types. Unless an assignment states otherwise, investigators use Inspection Model 2 for preapproval inspections and focus on the subject device. They review the PMA manufacturing section and verify completion of every required process validation. For a subject device not yet marketed in the United States, investigators exclude the model’s OAFR elements. Postmarket inspections generally use Inspection Model 1 and also focus on the subject device. Investigators confirm that approval commitments have been completed or remain underway as agreed. They review relevant recalls, MDRs, complaints, UDI data, significant device or manufacturing changes, and responses to prior FDA 483 observations. All four applicable OAFRs require review during the postmarket inspection. A mock FDA inspection should therefore match the applicable PMA assignment and inspection model.

Process Validation and Manufacturing Controls

At a PMA inspection, investigators expect the manufacturer to have completed every process validation required for the subject device. An FDA mock inspection should confirm that status before simulating the preannouncement. If the manufacturer reports unfinished validation, the Agency may delay the preapproval inspection. Discovery of unsuccessful or incomplete validation during the inspection may cause the investigator to end the review early. Coverage can include validation protocols and results, approved parameters, monitoring, acceptance activities, equipment controls, and change-related revalidation. For sterile devices, preapproval coverage includes applicable sterilization and sterile-barrier-system requirements within Production and Service Provision. The evidence should demonstrate that validated processes achieve planned results and remain controlled during routine production. Manufacturers should also connect outsourced processes to supplier controls and maintain the records needed for inspection.

PMA Approval Commitments and Postmarket Changes

PMA postmarket inspections confirm whether the manufacturer completed its approval commitments or has them underway as agreed. Readiness reviews should trace each commitment to its owner, status, supporting records, and applicable reporting obligation. Investigators also evaluate significant changes to device specifications, manufacturing specifications, processes, and the QMS. When a change may require a PMA supplement, the investigator coordinates with the appropriate review office before citing the issue. Postmarket coverage includes relevant recalls, MDRs, feedback, complaints, UDI and GUDID data, and responses to previous Form FDA 483 observations. Investigators must review all four OAFRs and apply their requirements as applicable. Manufacturers should demonstrate appropriate evaluation, approval, validation, and regulatory submission of changes when required. A mock FDA inspection should connect approved device requirements with current production, postmarket performance, and regulatory submissions.

Electronic Records, Signatures, and Data Integrity

CP 7382.850 directs investigators to follow Agency procedures when examining electronic records and electronic signatures. Part 11 applies when manufacturers maintain or submit regulated records electronically within its scope. Regardless of Part 11 enforcement discretion, manufacturers must satisfy applicable predicate-rule record requirements. Investigators may assess whether required records remain accurate, complete, protected, retrievable, and available for review and copying. Controls may include validated systems, authorized access, backups, change history, and audit trails, based on applicable requirements and documented risk. Readiness testing should verify retrieval of native or human-readable records while preserving metadata and relationships among records. Firms should also demonstrate that electronic signatures remain attributable to authorized individuals. Avoid claiming that every electronic system requires identical controls; requirements depend on the system, record, intended use, and regulatory context.

Production, Process Validation, and Sterilization Controls

Production and Service Provision covers planning, monitoring, and control needed to produce safe and effective devices. An FDA mock inspection should match coverage to the selected elements and risks of the inspected products and processes. Investigators may evaluate infrastructure, maintenance, work environment, contamination control, production records, identification, traceability, and measuring equipment. Process validation applies where the resulting output cannot be verified by subsequent monitoring or measurement. Evidence should show approved methods, acceptance criteria, qualified personnel and equipment, results, changes, and revalidation when needed. For sterile products, investigators may review sterile-device controls, sterilization validation, and sterile-barrier-system validation. They also examine whether routine production follows validated parameters and whether deviations receive appropriate evaluation. Sterilization controls apply to sterile products. Process validation applies only when the governing requirements require it.

UDI, QMS Traceability, and Medical Device Tracking

UDI, QMS traceability, and medical device tracking are related but separate requirements. Device labelers generally must place a UDI on labels and packages. They must also submit device identifier information to GUDID, subject to exceptions or alternatives. Investigators may compare device labeling with AccessGUDID, assess AIDC readability, and review label-control procedures. QMSR also requires identification and traceability records under applicable ISO 13485 clauses and Part 820 additions. Medical device tracking under 21 CFR Part 821 applies only after the Agency issues a written order. Tracked-device procedures must support the required information and location or notification needs. A mock FDA inspection should first confirm which obligations apply, then test labeling, GUDID accuracy, traceability records, and tracking responses. Part 821 does not apply to every device, and QMSR does not require patient-level tracking for every product.

Inspection Classifications and Possible Agency Actions

Form FDA 483 lists inspectional observations; it is not an enforcement action or the Agency’s final determination. After review, the Agency classifies an inspection as NAI, VAI, or OAI. OAI means documented conditions support a recommendation for advisory, administrative, or judicial action. It does not guarantee a specific action. A mock FDA inspection should prepare management to respond with timely corrections, a credible corrective-action plan, evidence, and appropriate resources. Compliance reviewers consider the public-health significance of deficiencies, quality data, compliance history, management commitments, responses, and applicable benefit-risk factors. Possible follow-up includes an Untitled Letter, Warning Letter, regulatory meeting, administrative detention, or recall-related order. Other options include civil money penalties when statutory criteria apply, import action, seizure, injunction, or prosecution. For PMA applications, the Agency may also withhold approval pending resolution of QMSR deficiencies.

What Early QMSR Warning Letters Reveal About FDA Inspection Priorities

QMSR became effective on February 2, 2026. Since then, the Agency has issued at least three Warning Letters identifying QMSR violations. Each letter cites ISO 13485:2016 requirements directly, confirming that investigators now evaluate implementation against incorporated clauses. Risk management under Clause 7.1 appeared in all three letters. Other observations involved design changes, corrective actions, rework, nonconforming product, supplier controls, process validation, calibration, infrastructure, complaints, and UDI compliance. These cases show that written procedures alone cannot establish compliance. Manufacturers must connect risk decisions with design, production, suppliers, CAPA, complaints, recalls, and postmarket information. A mock FDA inspection should therefore test objective evidence, actual practices, and interactions across the quality management system. Reviewers should also verify that personnel follow procedures, document decisions, evaluate changes, and complete effective corrective actions without undue delay. Early preparation can expose weak linkages before the Agency arrives.

Mock FDA Inspection for CP 7382.850 Readiness

A mock FDA inspection for CP 7382.850 readiness should mirror the Agency’s risk-based approach without claiming to be an official inspection. Reviewers should evaluate applicable QMSR areas, relevant Other Applicable FDA Requirements, and PMA controls when appropriate. The exercise can include an opening meeting, targeted document requests, facility observations, employee interviews, and a closing discussion. Teams should demonstrate timely record retrieval, explain system linkages, and support decisions with reliable evidence. Reviewers should test risk management, design and production controls, CAPA, complaints, supplier oversight, data integrity, and postmarket processes according to the assignment’s scope. Findings should distinguish regulatory gaps from improvement opportunities and prioritize remediation by product and patient risk. Because CP 7382.850 also addresses authorized records requests under section 704(a)(4), preparation should test secure electronic document production. This supports onsite inspections and RRAs without guaranteeing avoidance of regulatory inspection findings.

Strengthen Inspection Readiness With Experienced FDA Consultants

Inspection readiness requires more than templates, checklists, or a last-minute document review. Our consultants bring former Agency inspection experience and practical knowledge of how investigators evaluate risk, evidence, and quality-system performance. We tailor each engagement to your devices, operations, compliance history, and current business pressures. A mock FDA inspection can uncover gaps, test personnel, and establish defensible remediation priorities before regulatory interaction. We also help management understand potential exposure, allocate resources, and maintain progress after the assessment. Contact us for independent, candid guidance that strengthens decision-making, prepares your team, and converts QMSR requirements into focused actions your organization can implement.