What to expect during a US FDA medical device inspection

What to expect during

a US FDA medical

device inspection

How the QSR inspection is structured, creating a

pre-audit checklist, and how to follow up on ndings

October 2023

Linda Chatwin

Lead Quality and

Regulatory Affairs Consultant

linda.chatwin@ul.com

Page 2 of 14EmergobyUL.com

WHITE PAPER

Preparing for FDA and MDSAP inspections

How the MDSAP program impacts the Quality System Inspection Technique (QSIT), how to participate

and follow up on ndings, and the impending incorporation of ISO 13485:2016 Medical devices –

Quality management systems into the Quality System Regulation

The U.S. Food and Drug Administration (FDA) participates

in the Medical Device Single Audit Program, which

impacts how the Quality System Inspection Technique

(QSIT) is implemented in routine and non-routine

inspections. MDSAP was implemented by the

International Medical Device Regulators Forum

(IMDRF) with ve international partners:

• Therapeutic Goods Administration of Australia

• Brazil’s Agência Nacional de Vigilância Sanitária

• Health Canada

• Japan’s Ministry of Health, Labour and Welfare, and the

Japanese Pharmaceuticals and Medical Devices Agency

• U.S. Food and Drug Administration

MDSAP Audits are performed by recognized Auditing

Organizations (AOs) and are structured using ISO

13485:2016 as the quality system basis, while adding

on country-specic requirements. After a three-year

pilot program to test the success of the program, the

FDA determined that the MDSAP audit reports would be

accepted as a substitute for routine agency inspections.

The FDA hosts and maintains web pages for the

MDSAP documents

Here, policies, procedures, templates and forms can

be located. These provide the tasks that AOs use

for conducting audits. The audit approach consists

of the following:

• Chapter 1 – Management (11 tasks)

• Chapter 2 – Device Marketing Authorization and

Facility Registration (three tasks)

• Chapter 3 – Measurement, Analysis and

Improvement (16 tasks)

• Chapter 4 – Medical Device Adverse Events and

Advisory Notices Reporting (two tasks)

• Chapter 5 – Design and Development (17 tasks)

• Chapter 6 – Production and Service Controls (29 tasks)

• Chapter 7 – Purchasing (12 tasks)

In addition, six annexes cover specic information related

to (1) auditing product/process-related technologies and

technical documentation, (2) auditing requirements for

sterile medical devices, (3) medical device adverse events

and advisory notices reporting processes (timelines),

(4) expectations for written agreements for regulatory

purposes, (5) Japanese quality management system (QMS)

revisions and relationships and (6) acceptable exclusions

from scope of certication.

Time for inspection

WHITE PAPER

The audit framework includes a Stage 1 documentation

review and evaluation of preparedness for the Stage

2 audit. Stage 2 involves a complete evaluation of

QMS implementation and effectiveness and will use

all the MDSAP audit process tasks as applicable to the

organization. MDSAP audits are scheduled with the AO

contracted by the organization to perform the audits.

The MDSAP audit sequence follows a process approach

and has four primary processes:

• Management process

• Measurement, Analysis and Improvement process

• Design and Development process

• Production and Service Controls process with links to

the Purchasing process

The MDSAP audit process has two additional supporting

processes: Device Marketing Authorization and Facility

Registration and Medical Device Adverse Events

and Advisory Notices Reporting. These processes

are necessary to fulll specic requirements of the

participating MDSAP regulatory authorities.

The FDA reserves the right to inspect if there are areas

of concern highlighted in the MDSAP audit report or

for other types of inspections, such as inspections for

pre-market approval, follow-up, or for-cause inspections.

For those types of inspections, FDA inspectors will audit in

accordance with the QSIT. In addition, for manufacturers

who are not in the MDSAP program, FDA still uses the

QSIT for inspections. In these types of inspections, the FDA

will provide U.S.-based companies with some advance

notice, usually two to ve business days.

Picture a scenario where you are busily answering emails

and then the phone rings. The person on the other line

is with the local FDA ofce, letting you know that they

will be at your facility in the next few days to perform an

inspection. This notice is meant to give time to prepare

for the arrival of the inspector. If the system is not fully

compliant, this is likely not enough time to correct all

deciencies. However, it does allow you to prepare

logistically. More about that later. If your company is

outside of the United States, you usually have a bit more

time, as the FDA will plan the inspection around others in

the area and will need to prepare travel plans.

This paper will suggest activities leading up to the

inspection, what to expect during an inspection, and what

a company should do after the inspector leaves the facility.

Hopefully, these suggestions will help dispel inspection

fears and prepare the organization to be inspection-ready.

Of course, these preparations also apply to

MDSAP inspections.

Page 3 of 14EmergobyUL.com

Page 4 of 14EmergobyUL.com

WHITE PAPER

Regulatory requirements

The rst aspect we should discuss is the actual set of requirements a company would be expected to comply with

regarding manufacturing and distributing a nished medical device. For the FDA, the primary regulation that must be

followed is the Code of Federal Regulations Title 21 CFR 820, Quality System Regulation (QSR)

. However, there are

other regulations that must be followed and are often forgotten as manufacturers are concentrating on QSR requirements.

These include the following:

• 21 CFR 801, Labeling

• 21 CFR 803, Medical Device Reporting

• 21 CFR 806, Reports of Corrections and Removals

• 21 CFR 807, Establishment Registration and Device Listing

• 21 CFR 809, In Vitro Diagnostic Products for Human Use

• 21 CFR 810, Medical Device Recall Authority

• 21 CFR 830, Unique Device Identication

All these regulations must be followed as applicable to the organization. When the phrase “as applicable” is mentioned,

this relates to the fact that throughout the regulations there may be requirements that are not applicable or appropriate for

an organization. As an example, if an organization distributes a single-use device, then servicing of the device, i.e., 21 CFR

820.200, would not be applicable. It is important that organizations understand the application of the FDA regulations and

compliance expectations when adhering to these regulations.

It is also important to recognize that on Feb. 23, 2022, the FDA announced a proposed rule, Quality System Regulation

Amendment, which would primarily incorporate by reference ISO 13485:2016 into the medical device regulation. While

the proposed regulation will incorporate ISO 13485:2016 as the foundational quality management system requirements,

the additional FDA-specic requirements will remain intact. Furthermore, the QSIT will remain in place for FDA inspections,

revised as applicable to incorporate the requirements of the proposed rule.

Page 5 of 14EmergobyUL.com

WHITE PAPER

The FDA developed the QSIT

methodology for performing inspections during the release of the QSR regulations in 1996.

The QSIT guide, which is to be used in conjunction with the various compliance program guides, regulations, and guidance

documents, provides a foundation for performing QSR inspections.

FDA designed the QSIT as a “top-down” approach; it focuses on the organization’s entire quality system to identify

potential quality issues within the company.

The QSIT focuses on four major subsystems of the quality system shown below that establish the basis for an FDA

investigator to review procedures, processes and quality records. The FDA published the QSIT guide to demonstrate

what they will review during an inspection: therefore, organizations should read and study the QSIT guide and apply its

principles when they review and audit their quality system.

FDA QSR Subsystems

Management Controls: Quality Manual, Quality Policy, Quality Planning, Management Commitment, Management

Reviews, Training and Personnel, Internal Audits

Corrective and Preventative Action (CAPA): Sources of Data, Nonconformities, Customer Complaints, Medical Device

Reporting, Follow-up Activities

Design Controls: Design Planning, Design Inputs, Design Outputs, Verication, Validation, Risk Management, Design

Reviews, Device Master Record

Production and Process Controls: Product Realization (Device Master Record), Manufacturing, Process Validation,

Calibration, Identication, Traceability, Device History Record, Labeling, Packaging, Storage, Delivery, Servicing

Inspection

technique

Page 6 of 14EmergobyUL.com

WHITE PAPER

One of the most effective ways to support a successful FDA inspection is to

always be inspection-ready. Even though the FDA generally pre-announces

inspections, a few days or even a few weeks are not enough time to correct

fundamental compliance issues in a quality system. This is the reason why a

medical device manufacturer should always be inspection-ready, which follows

the main theme that procedures have been established and successfully

implemented, records are being maintained to show conformance and, when

applicable, that issues identied are being corrected.

The primary method for accomplishing this is to have a robust internal audit

program. Emergo by UL frequently advises organizations to utilize their

internal audit process to locate quality system problems rst rather than

letting FDA inspectors nd them. These services are also available and helpful

for preparing for MDSAP inspections. Even though these inspections are

scheduled each year, having the assistance of an outside party can augment

the preparation process.

Conrm that the internal audit program is unbiased and that personnel in the

organization are forthcoming when describing their processes. Personnel

should be trained in the internal audit process, and its value in continuous

improvement of the quality system. The worst cases arise when personnel hide

issues from their internal auditor because they do not want to get reprimanded.

This helps no one when the FDA identies these issues during an inspection.

Mock audits that mimic FDA inspections can help uncover fundamental

compliance issues.

Never be surprised — know where the skeletons are buried. All companies

have events/mistakes or documentation that they are not proud of, but

hopefully these have been addressed and not repeated. Auditors/inspectors

have a way of nding these, so be prepared to address them condently: “Yes,

we know, and here’s what we did to mitigate this. Here’s why there is no risk to

the product, and here’s the corrective action.”

Another good method is to have your quality system periodically

reviewed by an independent third party, as internal auditors may

get too close to their own quality system. As Benjamin Franklin

said, “By failing to prepare, you are preparing to fail.” The best

method for a successful inspection is to always be prepared.

Always be prepared

WHITE PAPER

Before the inspection

Assuming your quality system is in good shape and your

internal audit procedure is followed closely, you may be

wondering what to do once you receive the rst call from

the FDA. You may not have much time to prepare for the

investigator’s arrival but don’t panic. Refer to the U.S. FDA

Audit Checklist at the end of this paper for a step-by-step

pre-audit checklist.

For MDSAP inspections, a good tool for preparation is to

use the MDSAP audit model that the FDA includes on its

webpage: MDSAP Medical Device Single Audit Program

Audit Approach, Document No. MDSAP AU P0002.

This

document provides insight into the tasks that auditors will

use when auditing to the MDSAP and includes country-

specic requirements, which allows companies to tailor

their internal audit program for the countries they include

in the MDSAP audits they will undergo.

EmergobyUL.com Page 7 of 14

Page 8 of 14EmergobyUL.com

WHITE PAPERWHITE PAPER

The company should have a procedure whereby an inspection coordinator or an individual to escort auditors is identied

to guide the inspection and answer the main questions when inspectors arrive at the facility. This individual should be

knowledgeable about the organization. A room should be designated for such opening meetings, which should be attended

by pertinent personnel and management. After the opening meeting, the organization should provide an overview of the

company and its operations. This helps inspectors orient to the business conducted at the site. Typically, a tour of the facility

will be included before the nuts and bolts of the inspection begin. It is best practice to have a tour route determined prior to

the audit, and any operations/personnel visible to the inspectors should be forewarned.

Once introductions have been made and background information on the organization has been described, the investigator

gets right to business by requesting documentation, commonly referred to as objective evidence. Quality records must

support the manufacturer’s ongoing activities, support how the procedures are written, and show that the processes have

been implemented. The bulk of the inspection activity involves the investigator asking for a procedure, interviewing personnel,

asking questions about the process, and reviewing records that are generated across all facets of the quality system.

If this is a full QSIT inspection, the inspector will generally cover each of the four major subsystems of the QSIT, at a rate of

approximately one per day. An example of inspection ow is shown in Figure 1. It is important to understand that for domestic

inspections (those performed in the United States), an FDA inspector can extend the time required for the inspection if they

observe quality issues that need further investigation. If the audit is not a full audit, generally, two of the subsystems will be

chosen by the FDA for audit.

MDSAP audits are based on a three-year audit cycle. The initial certication audit is a complete audit of the quality

management system. The initial audit is followed by a partial surveillance audit in each of the following two years, and a

complete re-audit/certication in the third year. The audit schedule is provided by the AO prior to the audit. In FDA or MDSAP

audits, the inspector must collect a sampling of documents and records, which must be readily available. For this reason,

setting up a back room to manage document requests and keep records of documents provided is highly recommended.

A notetaker should be appointed to maintain a record of proceedings.

WHITE PAPERWHITE PAPERWHITE PAPER

Day 4

Basic ow of an FDA inspection over four days — note this is just an example as each investigator may shift the subsystems around or

take more time per subsystem.

Day 1 Day 2 Day 3

• Facility Entry

• Introductions

• Opening Meeting

• Management Controls

• Corrective and

Preventive Action

• Customer Complaints

• MDR Report

• Production and Process

Controls

• Sterilization Processes

• Validations

• Design Controls

• Closing Meeting

• (Issuance of Form 483)

During the inspection

Page 9 of 14EmergobyUL.com

WHITE PAPER

The auditors’ purpose is to assess compliance with the QSR or MDSAP

requirements as applicable. The FDA publishes metrics identifying problem areas

of quality system compliance annually on its website. The list in the sidebar sums

up areas that continually receive the most observations during FDA inspections

as listed on FDA Form 483.

According to SAI Global, the three most common nonconformances found when

conducting MDSAP audits are

• Document control and documentation errors

• Risk management and risk-based thinking

• Purchasing and supplier control

Medical device manufacturers can expect that these areas will be continually

reviewed with more scrutiny by inspectors. This should prepare an organization for

concentrating its efforts and resources on ensuring that these processes are fully

compliant within the organization.

Most frequent Form 483 observations

Corrective and preventive action, 21 CFR 820.100: Lack of/inadequate

procedures

Customer complaints, 21 CFR 820.198: Lack of/ inadequate procedures

Process validation, 21 CFR 820.75: Lack of/ inadequate validations

Purchasing controls, 21 CFR 820.50: Lack of/ inadequate procedures

Nonconforming product, 21 CFR 820.90: Lack of or inadequate procedures

Medical device reporting, 21 CFR 803: Lack of/ written MDR procedures

The FDA inspector should follow the process from the QSIT guide, but if they

discover quality issues during the inspection, then this may lead to a much more

detailed review of specic aspects of the product quality and/or the quality system.

To prepare for an inspection, your internal audit program

should challenge the documentation system, ensuring

documents can be provided in a timely manner.

Page 10 of 14EmergobyUL.com

WHITE PAPER

Inspectors conduct a closing meeting with the organization that summarizes the inspection ndings. The FDA will

issue an FDA Form 483 and AOs will issue a recap of ndings based on a grading sheet used for MDSAP ndings

These will list objectionable ndings made during the inspection. The list of observations will be reviewed in the closing

meeting by the auditors to determine that there is no clarication required and to give the company an opportunity to

discuss them as necessary.

Timelines for responses will be addressed in the closing meeting. The observation(s) can be annotated to state what the

company promises to correct as part of their response.

What to do afterward

If the organization has received an FDA Form 483 with objectionable items

listed, it is imperative that a response is sent to the FDA within 15 calendar

days. For MDSAP responses, the timelines may vary, depending on the gravity

of the ndings. The FDA has often commented in public forums that if a

response is not received within the required timeframe, then a Warning Letter

will be issued. Responses to the observations must be clearly addressed in

detail, describing the plan for correcting the items.

A basic structure of the response process is shown in the sidebar, including

the content currently expected by the FDA. Deciencies in the response,

including missing information, not providing supporting records, or lacking true

commitment to making the corrections, may result in a Warning Letter from

the FDA, or unfavorable follow-up action by the MDSAP auditing organization.

FDA Warning Letters are publicly posted on the FDA website

, allowing

customers and, more importantly, competitors, to see deciencies in your

quality system.

Note that MDSAP audit reports go to all the regulatory authorities, so the FDA could also act on a poor MDSAP audit report,

which could result in the FDA performing their own inspection.

After 60 days, the organization should put in a request through the Freedom of Information Act

to receive a copy of the

Establishment Inspection Report (EIR). This is a narrative created by the FDA investigator that details what was reviewed,

the persons interviewed and comments made during the inspection. This should always be obtained after an inspection is

performed to understand any implications or signicant comments made regarding an observation by the investigator.

Exit/closing meeting

There is usually no negotiating the content of a Form 483 or Warning

Letter after it has been issued, so it is important for an organization

to stay continually vigilant in the compliance of their quality system.

Steps to address FDA

Inspection observations

Correction: Actions taken

immediately to correct an observation

Root cause analysis: Identify the true

root cause; utilize root cause analysis

tools such as the Five Whys

Retrospective review: Review the

activities not just related to the

observation, but what is being done

to review information in the past

Corrective action plan: Actual

corrective action that is short or long

term to remove the nonconforming

situation

Effectiveness check: Describe how

the organization will assure the

correction is sufcient

Timeline: When all the activities

are to be completed

Page 11 of 14EmergobyUL.com

WHITE PAPER

U.S. FDA and MDSAP Audit Checklist

Notify all staff and

employees.

Inform your entire staff that an audit is coming and the dates the inspector will

be on-site. Assure that the key individuals are available during the inspection

or identied as designated individuals.

Distribute external audit

procedures to key staff.

If you already have a procedure for handling inspections, your employees

should be familiar with the inspection process. However, provide them with a

review of the external audit procedure to avoid any surprises.

Reserve audit space and

equipment.

Designate a space on-site for the investigator to conduct the inspection,

such as a large ofce or conference room. Consider a secondary room as a

backroom for preparing material for the investigator.

Designate an Inspection

Coordinator.

Identify a member of your staff to be the inspector’s point of contact while they

are on-site. This person should be a senior member of your quality team, so

they are familiar with your organization and able to answer main questions.

Block off time for senior

managers to be available,

if needed.

Executives and senior managers should arrange their schedules to be on-site

and available during the audit. Auditors do not like to be kept waiting and

it could be detrimental if a member of your senior staff is not available to

interview with the investigator.

Make all documentation

readily available.

Your documentation should already be prepared and organized, so this should

be easy. However, you should ensure les and documents related to the Quality

System are readily accessible to be provided to the investigator in a timely manner.

Identify interviewees and

subject matter experts

(SMEs).

Alert department representatives and SMEs that they may be interviewed

during the audit. Provide any coaching or mentoring for how to interact with

the investigator.

Review interview

strategies and question

styles.

Mock interviews should be part of your internal audit procedure but take

the time to review interviewing techniques that will allow you to complete a

successful inspection.

U.S. FDA Audit Checklist

Page 12 of 14EmergobyUL.com

WHITE PAPER

This paper provides a brief discussion about what to expect before, during, and after an FDA QSR inspection or MDSAP QMS

audit. However, there are many things that can and do occur during an inspection that cannot be fully detailed in this paper.

The important thing to remember is that your organization must always be prepared for an inspection because the FDA can

visit your facility at any time.

Utilize the internal audit program and corrective action system to ensure that deciencies are identied internally, corrected

and support compliance with the requirements. A well-prepared organization can face the challenge of audits with the goal

of not receiving any FDA Form 483 observations or MDSAP ndings, as applicable, and knowing they are providing safer,

higher quality products to their customers.

Summary and

conclusion

Page 13 of 14EmergobyUL.com

WHITE PAPER

References

1. https://www.fda.gov/medical-devices/medical-device-single-audit-program-mdsap/mdsap-documents

2. https://www.fda.gov/media/166672/download?attachment

3. https://www.fda.gov/media/166672/download?attachment

4. https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-system-qs-regulationmedical-

device-good-manufacturing-practices

5. www.fda.gov/media/73166/download

6. www.fda.gov/media/166672/download?attachment

7. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/inspection-references/

inspection-observations

8. https://saiassurance.com/3-most-common-non-conformances-to-mdsap-audits

9. www.fda.gov/media/147462/download?attachment

10. https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/compliance-actions-and-

activities/warning-letters

11. https://foia.state.gov/

Learn more

Need help with U.S. FDA compliance? Emergo by UL helps medical device companies with regulatory compliance and market

access in the United States and other markets worldwide. Here’s how we help:

• U.S. FDA 510(k) preparation

• FDA QSR 21 CFR 820 implementation and training

• U.S. FDA Agent Representation

To learn more visit EmergobyUL.com/services/united-states.

About the author

Linda Chatwin - United States, Lead Quality and Regulatory Affairs, has obtained approvals for a wide range of

products, remains involved in changing requirements for medical devices worldwide. Linda has over 35 years of

experience with medical products. Through years of watching regulations evolve and change, she knows how to

navigate the global regulatory maze and bring products to market. Ms. Chatwin has obtained approvals for a wide

range of products, remains involved in changing requirements for medical devices worldwide. She has navigated many

FDA inspections, and other regulatory authority audits, and negotiated favorable outcomes with the FDA. Currently,

she assists clients with regulatory issues and challenges, including implementation of UDI processes, mock audits,

in-depth training on regulatory requirements, and consulting on quality system development and improvement and the

MDSAP audit model. She has also conducted numerous trainings and gap assessments for the new MDR as well as

SaMD requirements.

PLC23CS1263497

EmergobyUL.com

Emergo by UL and the Emergo by UL logo are trademarks of Emergo Global

copied or distributed, in whole or in part, without express written permission

from Emergo by UL. It is provided for general information purposes only and

is not intended to convey legal or other professional advice.