Name: FDA QMSR Enforcement: What Recent Inspection Findings Are Revealing
Uploaded: 2026-10-15T14:41:07.909Z
Duration: 25 min 8 s
Description: FDA QMSR Enforcement: What Recent Inspection Findings Are Revealing

Transcript for "FDA QMSR Enforcement: What Recent Inspection Findings Are Revealing": Hello and welcome and thank you for joining us today. QMSR has been enforceable for several months now and we're starting to see what happens when quality systems move from planning into practice. Recent FDA findings continue to point to familiar themes, documentation and records, risk management, supplier controls, CAPA, UDI and post market processes. These aren't new topics, as you know, but they continue to create inspection risk when organizations can't clearly demonstrate how their systems are working in practice. Today, I'm delighted to be joined by three NSF industry experts who work very closely with medical device organizations on quality systems, inspection readiness and regulatory expectations. We're going to discuss what FDA findings are showing since QMSR enforcement began, why familiar gaps continue to appear, what FDA's new one day inspection announcement means for readiness and where organizations need to focus if they're looking to strengthen their approach. So let me introduce our panel today. I'm joined by Janet Book. Welcome, Janet. Good to have you with us. Thank you, Brian. I'm looking forward to today's session. Great. And and Jacob Foster is with us as well. Hi, Jacob. Good morning. How are you doing? Happy to be here. Good to see you again, Jacob. And also NSF Sarah Moore. Sarah, you're very welcome. Thank you so much, Brian. We're excited to be here. Good. So, Sarah, I'm actually going to start with you. Let's look at the, what we call the big picture view, to start off with. So what does QMSR look like in practice since enforcement began? Well, as you said, when we, were starting the session, the themes are very much the same as they have been. The core of the requirements, the core of the expectations that the FDA has on medical device manufacturers hasn't really changed a lot. But what has really changed, I believe, is the avenue through which the FDA is coming to these findings, and that really is centered on risk management. So what we're now seeing is both CAPA and complaints and post market surveillance continue to rise up in inspection, observations, but they're coming by way of risk. And I think this is a key, a key learning for the industry to understand. You know, we really have to pull the puzzle pieces together, show how your processes are connected, and, be very active in those demonstrations. So that's that's what we're seeing. A lot of it is not new. It's a lot the same, but it's how those, observations are being revealed. Okay. So as organizations move from implementation into the day to day execution, we're beginning to see some patterns. I think you mentioned that. And see these patterns emerge from the actual inspections and the findings. So, Sarah, when you look at the recent FDA findings, what are the most prevalent patterns and what are the ones that matter the most and why why do they matter? Yeah. You know, risk is very much tied to the safety of the public. And I I think the FDA is really wanting to highlight that the safety of devices as they're in use becomes the critical... A critical piece. And we're really moving away from the checklist exercises of, yes. I completed that document. I completed that record, or I have this procedure, and it's more about demonstrating how that's working together collectively. And, really, how it's working is to demonstrate that it's safe and it's effective for the public. So so we're seeing more of those types of observations coming through, and it's more about function and and effectiveness of the systems. And it's less about the disjointed observations that, maybe we've been more accustomed to in the past. So I I think those are the patterns. You know, something we've talked about, we talked a lot as we as we anticipated QMSR is how will your records begin to reveal, the the health of your quality system, and being ready to reveal more of those records because the FDA can now look at management review and internal audits. And all of these records are really the demonstration of how your system is functioning together collectively as a whole. So I think that's really the the shift of the focus. It's less about these individual observations, and it's more about looking at the whole of of your functional quality management system. It's interesting you mentioned that because as as you were talking, I just jotted down some some notes. And one is around evidence and the other is around records. And organizations might have processes in place, but they still need to demonstrate that the processes are controlled, that they're being followed, and they're actually being documented. And, Janice, I'm gonna come to you on this. Why do documentation and record issues continue to appear time and time again? Yeah. That's a great question, Brian. And I think that one of the things that, people have to recognize is is that with the new the new inspection, technique of the of the FDA and the fact that it's all based on risk, data integrity becomes a priority in those, you know, in maintaining your quality system. So it's not a matter of just making sure that our records are legible or that they're readily accessible or available, But it's more about making sure that we've tied all the pieces together as Sarah was alluding to to making sure that we... We've got a whole system in place. So data integrity becomes a priority And and making sure that we're recording the correct information at the right times at the right places and and seeing those those items through... Excuse me. A lot of times, you know, we... In the past, we've we've always told people, you know, if you see scraps of paper laying around, the FDA is gonna pick up on that, sticky notes, those kinds of things. And that's still prevalent, and that's still one of the things that you wanna safeguard against. But now it comes down to being more of, you know, how accurate is your data. Are you actually following good documentation practices by having it attributable, legible, you know, complete, original, making sure that you're keeping that data. And the other thing is is that a lot of times what we see is is that, people put down to, you know... And we'll talk a little bit, I think, about this with Jacob, about root cause analysis and and Kappas, where they they document a practice, but then they don't ever bother to actually... They make a change, but they don't document how that change has been implemented and how... And then to go back and talk about the effectiveness. So I think that, you know, again, we're we're taking a look at those documents from a much different perspective now than we had in the past. And, I I think that, you know, one of the things that I always tell people when I'm talking about auditing in particular, is is that is that it... If if you... It's always easy to find documentation issues in a in a in a in an inspection or during an audit because a lot of times we just fail to do the right things in documenting what we're doing. And that includes doing it in a timely manner, remembering everything that we've done, signing and dating where necessary and when necessary, and by people who have the authority to sign and date, those those records and documents. So I think that, you know, we're not seeing anything different, but I think that data integrity... If if I have to put it down to two words, data integrity is is the key here for the FDA now. That's interesting what you said. And, Jacob, I'm gonna come to you because Janet volunteered you for the next question, really. On the documentation piece, you know, as Janet said, it's where the FDA starts. But inspections very quickly expand into how effectively the other processes are working across the quality system. What makes supplier controls or CAPA vulnerable during an FDA review? Yeah. Kinda, as Sarah led off, this, acknowledgement that risk is propagated through our extended supply chain. So many of our critical components that go into our medical devices and products actually are manufactured under less rigor than we have in our internal systems. So recognizing that risk that comes from downstream processes and being able to pull that, I'd say, rigor of, acceptance activities that would, meet the same rigor as our internal validation process. So supplier quality and purchasing controls is actually a big target and recognizing that many of those risks to the finished goods actually start downstream in the supply chain. And then as far as CAPA, as a central post for our quality system, it's a pivot point for the recognition of actioning of of problems as Janice says. So many times, in the old CUSIP model, it was easy to see weaknesses in validation or other process controls and what was present in CAPA. Now recognizing that, unaction risk also show an absence of CAPA activities, is another big signal for the agency. So on action risk, I just wanna make a note of this. And did you say the absence of capital is making an issue for for companies now? That's that's quite interesting because I I was reading something recently about a company, that had been visited by the FDA, and there was a lot around the whole CAPA issue and the nondocumentation of some issues around that. So there are areas where organizations need to demonstrate or often need to demonstrate not just that a process exists, but that it can withstand the scrutiny when evidence is requested. And that readiness discussion has become more relevant, particularly with the changes in the FDA inspections and their notifications. So, Janice, just on the one day piece, which has garnered a lot of media attention and a little bit of, trepidation, I think, in the market as well. How should companies interpret that FDA one day inspection announcement from... Particularly from a from a readiness perspective? Well, Brian, I think that I think that I think that people are not necessarily understanding directly what the one day inspections are all about. The re... The reality of it is is that FDA always had the ability to do one day inspections. But now what we're seeing is is that the FDA is purposefully going out and targeting, one day inspections assessments to lower risk, medical device companies or or companies, in particular. And that, you know, across, you know, across the gamut. It's not just medical devices. And I think that one of the other things is is that they're they're looking at a particular product type. But you have to remember that the FDA has a lot of information available to them to basically determine whether or not they're going to even engage in a one day, assessment or a one day inspection. They've got the mod database. They have they have, MDRs that that, reportable events that maybe the company has, submitted. If they have complaints, and and... So there's a a plethora of data out there that the FDA has available to them before they ever get on-site. And the other thing is is that once they do get on-site, they may they may make a determination that this is not going to be a one day, inspection, and they have every right to do that. If they come in and see that you're not necessarily prepared, you're not necessarily... You don't have some system in place to, you know, for example, welcome the FDA. And and I do mean welcome them into your facility and and to, you know, begin to provide them with information like your, you know, your, registration information, the list of products, a list of documents, so on and so forth, that they're going to... They're gonna they're gonna get... They're not gonna get those warm fuzzies that that you are really capable of of, complying with the regulations. And that one day that one day, assessment or or, investigation, may turn into a a regular standard, FDA visit, which means it could go on for for quite some time. And, again, we... They do have the ability to escalate. So if they see one thing even during that one... You know, if it's initially a one day and they start to see things, they... They're going to escalate that very quickly into a regular inspection or even come back later with maybe a for cause, you know, for cause investigation. So it's against... Again, they're focusing on verification activities for those one day, inspections, not necessarily exploration of the entire documented quality system. But the moment that they see that you cannot validate or verify your system, they're gonna jump right into a regular, regular inspection. I I wanna... If I... If you don't mind, Brian, I'd like to jump back to... With, maybe a couple of things on... For example, we talked about the whole entire quality system. And I think that one of the things, especially with the verification activities of these inspections, is is that they're verifying that that activities are taking place. But most importantly, they're wanting to see that you're making the connections within your own quality management system. So it's not just good enough to to, for example, have a cap on a particular problem that you've identified. They're gonna start looking to make sure that you've not just fixed a symptom of the issue, that you've truly done root cause analysis, that you've looked at all of your systems to see whether or not other other systems have been impacted or other products have been impacted and how that may actually, affect the product that may be out on the market. You know? Okay. We've made a correction here, but did we need to actually make a correction for other product that are similar or retrospectively placed on the market? So I think that when we talk about those one day inspections, people are gonna be surprised that it... That it's not necessarily what they think it is. It's really... They're looking to make sure that you're really system thinking here and you're process oriented, and they're verifying that those systems have... Are robust and complete. Yeah. And that... Sorry. Go ahead, Sarah. Well... And I was just gonna, jump in also and say, Janet, then don't you think that the the conversation we had about records and documentation Yeah. Is so so, essential to really facilitating an effective, Yeah. Inspection. So if they come in and they are thinking we're gonna do a one day here because it's a low risk device, have your documentation ready, have it on point, be ready to provide. And if you can do that, then, you know, the possibilities of of satisfying those... That inquiry in a day is much greater. But if if it's disjointed, if it's not available, if it isn't... Yeah. If there's less integrity, that's where I think the weakness comes in. Absolutely, Sarah. Totally agree with that. It's just amazing how much confidence you can get by seeing somebody who's well prepared versus a company that seems to be scrambling. You know, and that... And and the and, you know, the FDA are people too, and they're gonna notice that. And if they don't get those warm fuzzies, they're gonna stay. Right? Okay. Well, that shift puts even more emphasis based on, you know, what you were saying, Janet, and what you were saying, Sarah, that having systems, records, evidence, and having it readily accessible, particularly at any point, particularly on the first day for that one day piece, is particularly important. Janet... Sorry, Jacob, I'm gonna come to you... I'm sorry. I'm I'm sorry. Brian, just... I'm... I'm sorry. One more thing about a one day inspection. Just just like regular regular inspections, they do not need to announce one day inspections. They can show up at your door with a four eighty two and, hopefully, you're ready for them. So just just to make sure that everybody's clear, not every inspection is announced and that continues to be the case. It's actually a really interesting point because I think a lot of companies don't actually know or aren't aware of that they can just turn up with their four eighty two. Jacob, if a company had, let's say, thirty days to improve their readiness, what would you be testing first if you were at that company now? Kindly, a lead in from Janet's conversation, recognizing the value of your records and your evidence, but specifically internal review to to make sure that my quality system is promoting the appropriate actions when necessary. This whole focus around risk, have we moved to the appropriate action when the risk indicators throughout the process of the QMS, reveal themselves. So for instance, unplanned deviations, maybe you needed an action to actually update procedures and documentation. When I have post market signals that indicate a new risk in the field, does that show up as action items within my management review? So evidence of actions, I would really focus on post market surveillance signals and then, really, the conclusive evidence that my quality system is promoting the appropriate action action of response throughout the organization when necessary. Okay. Well, that's fantastic, Jacob. Thanks very much, everyone. This has been a really good discussion because I think that there's a a common thread throughout today's conversation is that many of the findings we're seeing aren't exactly new concepts. There are things that people have been tripped up on and been found for over many years. So, you know, as I said at the start, documentation, risk management, supplier controls, CAPA, UDI, post market processes. And these have long been critical elements of a quality system. And what FDA findings continue to show is the importance of execution, demonstrating the processes are working as intended and that they're supported by evidence and that the organizations, your organization, can readily show how quality decisions are made. Thanks to Janice, Sarah, and Jacob today for sharing insights and their practical perspectives. And thanks most of all to you for joining us today. We hope you found the discussion useful and it gives you a framework for evaluating your own readiness efforts and identifying areas worth testing before the FDA turns up and asks for evidence. Thanks for joining us, and have a great day.