FDA’s Policy Shift: Management Review and Audit Reports Now Subject to Inspection

Regulatory Background

On January 31, 2024, the U.S. Food and Drug Administration (FDA) published the final rule for the “Quality Management System Regulation” (QMSR) under 21 CFR Part 820. This final rule, officially published in the Federal Register on February 2, 2024, represents a significant harmonization effort to align the current Quality System Regulation (QSR) with ISO 13485:2016, Medical devices—Quality management systems—Requirements for regulatory purposes. The effective date is set for February 2, 2026, providing a two-year transition period for medical device manufacturers to achieve compliance.

The QMSR represents more than a simple renaming from QSR to QMSR. It fundamentally restructures the regulatory framework by incorporating ISO 13485:2016 by reference through a new section §820.7, while retaining certain FDA-specific requirements to ensure consistency with the Federal Food, Drug, and Cosmetic Act (FD&C Act) and other applicable FDA regulations. Most sections of the original Part 820 have been replaced or designated as “Reserved,” directing manufacturers to ISO 13485:2016 for detailed requirements, while specific sections such as §820.3 (Definitions), §820.10 (Additional QMS requirements), §820.35 (Claims), and §820.45 (Device labeling and packaging controls) have been retained or added to address FDA-unique requirements.

Update to Inspection Procedures

The FDA is currently in the process of revising its inspection methodology to align with the new QMSR framework. The Quality System Inspection Technique (QSIT), which has served as the inspection manual under the current QSR, will be officially withdrawn on February 2, 2026, when the QMSR becomes effective. The FDA has confirmed that QSIT will not be replaced by a “QSIT 2.0” or similar standalone document.

Instead, the new inspection process will be documented in a revised version of the Compliance Program (CP), titled “Inspection of Medical Device Manufacturers.” This revised CP will be effective on February 2, 2026, and will be made available on the FDA’s device Compliance Program webpage no later than the QMSR effective date. The updated inspection approach is expected to emphasize a more risk-based, systems-level evaluation that assesses the integration and effectiveness of quality management system subsystems, rather than solely focusing on procedural documentation and checklist-based reviews.

Elimination of Inspection Exemptions

Previous Exemptions Under QSR

Under the current QSR §820.180(c) and the QSIT guidance, certain documents were specifically exempted from FDA inspection requirements:

• Management review meeting minutes and reports (required under §820.20(c))
• Quality audit reports (required under §820.22)
• Supplier audit reports (used to meet requirements of §820.50(a), “Purchasing controls—Evaluation of suppliers, contractors, and consultants”)

While these documents were exempt from direct inspection, §820.180(c) required that the procedures established under these sections remain subject to inspection. Furthermore, when requested by designated FDA employees, executive management with enforcement responsibilities was required to provide written certification that management reviews, quality audits, and, where appropriate, supplier audits had been conducted and documented, including the dates of execution and confirmation that required corrective actions had been implemented.

Complete Removal of Exemptions in QMSR

The QMSR eliminates §820.180(c) in its entirety, removing all previous exemptions for management review reports, internal quality audit reports, and supplier audit reports. These documents are now fully subject to FDA inspection authority.

FDA’s Rationale for the Change

The FDA provided detailed responses to numerous public comments expressing concern about the removal of these exemptions. The Agency’s rationale, as stated in Comment 55 response in the Federal Register final rule preamble, includes the following key points:

International Harmonization and Regulatory Equity

One of the primary objectives of this rulemaking effort is to achieve the closest possible alignment with global harmonization and regulatory coordination. From an international perspective, the exemptions referenced in the comments are not available to manufacturers undergoing inspections by other regulatory authorities or audits by other organizations, such as Medical Device Single Audit Program (MDSAP) audit organizations. Consequently, manufacturers operating in global markets are already required to make these records available to non-U.S. regulatory authorities and third-party auditors, meaning they will not face additional burden by providing these records to the FDA.

Operational Practicality

The FDA recognizes that these records are maintained in the normal course of business operations and should be readily accessible to manufacturers. Therefore, making these records available for inspection should not impose a significant burden on manufacturers who may have previously utilized the exemption under the QSR.

Existing Indirect Access to Information

FDA investigators already have access to the data used to inform management reviews, including records of non-conformities, complaints, corrective actions resulting from internal and supplier audits, and other quality system inputs. This existing access meant that the practical impact of the exemption was somewhat limited, as investigators could indirectly evaluate management review and audit effectiveness through related quality system records, particularly through Corrective and Preventive Action (CAPA) documentation.

Foundation of Quality Culture

The FDA emphasizes that robust management review, internal audit, and supplier audit programs constitute fundamental elements of the quality culture described throughout this rulemaking—elements that the Agency expects from all medical device manufacturers. A mature quality culture requires comprehensive oversight, proactive identification of quality issues, and evidence-based decision-making at the management level, all of which are reflected in these previously exempt records.

Implementation Flexibility

The FDA further stated that it intends to revise the inspection process to be consistent with the QMSR and does not consider this rulemaking to be the appropriate mechanism for describing future implementation activities, including detailed inspection processes. This approach provides the Agency with flexibility to develop risk-based, efficient inspection methodologies that focus on system effectiveness rather than procedural compliance alone.

Implications for Medical Device Manufacturers

Preparation for Enhanced Scrutiny

Manufacturers must recognize that internal audit reports, supplier audit reports, and management review records should now be prepared with the understanding that they will be subject to FDA review during inspections. Organizations that previously leveraged the §820.180(c) exemption to facilitate particularly candid discussions regarding quality issues, strategic challenges, or sensitive supplier performance matters must reconsider their documentation practices and communication approaches to balance transparency with regulatory readiness.

Documentation Best Practices

While maintaining open and honest internal communications remains essential for effective quality management, manufacturers should ensure that all audit reports and management review documentation:

• Accurately reflect objective findings and risk-based assessments
• Demonstrate systematic investigation of quality issues with appropriate depth
• Show clear linkages to CAPA initiation when warranted by risk and significance
• Document management decisions with adequate scientific and risk-based rationale
• Maintain traceability across quality system subsystems (complaints, CAPA, risk management, post-market surveillance)
• Reflect proactive identification of trends and systemic issues, not merely reactive responses

Risk-Based Quality Management System Integration

The elimination of these exemptions aligns with the broader QMSR emphasis on risk-based decision-making throughout the quality management system. FDA investigators will likely evaluate whether management reviews demonstrate:

• Systematic analysis of QMS performance data, including key performance indicators and trends
• Integration of risk management principles in strategic decision-making
• Appropriate resource allocation based on product risk and QMS performance
• Timely and effective escalation of quality issues
• Evidence of continual improvement initiatives driven by data analysis

Manufacturers should implement or enhance mechanisms to ensure that their management review process not only meets ISO 13485:2016 Clause 5.6 requirements but also demonstrates sophisticated understanding of their products’ risk profiles, post-market performance, and quality system effectiveness.

Supplier Quality Management

With supplier audit reports now subject to FDA inspection, manufacturers must ensure their supplier management programs demonstrate:

• Risk-based supplier evaluation and qualification methodologies
• Comprehensive audit planning based on supplier risk classification
• Objective assessment of supplier quality system capabilities
• Appropriate follow-up and verification of corrective actions
• Regular re-evaluation based on supplier performance data
• Clear escalation criteria for supplier quality issues

Conclusion

The transition from QSR to QMSR represents a paradigm shift in FDA’s approach to medical device quality system regulation, moving toward greater international harmonization while maintaining Agency-specific requirements that reflect U.S. statutory obligations. The elimination of inspection exemptions for management review reports, internal quality audit reports, and supplier audit reports reflects the FDA’s commitment to comprehensive quality system oversight and equitable treatment of manufacturers regardless of their market focus (U.S.-only versus global).

Manufacturers should view this change not as an increased compliance burden but as an opportunity to demonstrate the maturity and effectiveness of their quality culture. By preparing these previously exempt documents as inspection-ready records that reflect objective, risk-based quality management practices, manufacturers can position themselves for successful QMSR compliance and more efficient FDA inspections under the new regulatory framework.

The February 2, 2026 effective date is rapidly approaching. Organizations must complete gap analyses, update quality system documentation, train personnel on ISO 13485:2016 and risk-based quality management principles, and ensure their management review and audit programs reflect the comprehensive, data-driven, and integrated approach expected under QMSR. Proactive preparation during this transition period will be essential for demonstrating compliance and maintaining uninterrupted market access for medical devices in the United States.

Additional Resources

For the most current information on QMSR implementation:

• FDA QMSR Final Rule: Federal Register Vol. 89, No. 23 (February 2, 2024)
• FDA QMSR Frequently Asked Questions: https://www.fda.gov/medical-devices/quality-system-qs-regulationmedical-device-current-good-manufacturing-practices-cgmp/quality-management-system-regulation-final-rule-amending-quality-system-regulation-frequently-asked
• FDA Device Compliance Programs: https://www.fda.gov/medical-devices/compliance-and-enforcement-medical-devices/cdrh-compliance-programs
• ISO 13485:2016: Medical devices—Quality management systems—Requirements for regulatory purposes
• QMSR-specific inquiries: QMSR-Rule@fda.hhs.gov