QMSR Readiness: Prep for the FDA’s New Inspection Expectations

When most teams think about QMSR, the focus goes straight to documentation. Gap assessments, procedure updates, alignment to ISO 13485, and while those are necessary steps, they are not where the most meaningful change is happening. Jeff Cody, Quality Executive with Square-1 Engineering, framed QMSR in a different way. Not as a documentation exercise, but as a shift in how the FDA evaluates a quality system during inspection.

From Checklists to Risk Signals
Historically, FDA inspections followed a structured and largely predictable path. Documentation was reviewed against a defined framework, and the inspection moved step by step through that structure. Under QMSR, however, that approach is evolving. Inspectors are now trained to identify risk signals before the inspection begins. Complaints, MDRs, product complexity, and prior inspection history all inform where they start and how they navigate the system, and from there, they follow those signals.

This creates a very different dynamic. The inspection is no longer confined to discrete sections of a quality system. It becomes a connected exercise, tracing how risk is understood, communicated, and controlled across functions. In that environment, gaps are less about missing documents and more about weak connections.

Risk Management as a System, Not a Function
One of the clearest themes from the session was the expansion of risk management. Under QSR, risk often lived primarily within design controls. It was important, but somewhat contained. QMSR changes that expectation. Risk is now meant to be integrated across the full product lifecycle and embedded in routine decision-making. It should influence how organizations manage suppliers, prioritize CAPAs, evaluate trends, and allocate resources. That shift also raises the standard for the risk management file itself. It is no longer sufficient for it to exist as a static artifact. It must be current, actively maintained, and aligned with what is happening across the business. When inspectors follow a risk signal, they will expect to see that alignment.

Management Review as Evidence of Leadership
The QMSR preamble makes a point that carries significant weight. Management review, along with internal and supplier audits, is described as fundamental to a company’s culture of quality. That language is intentional. It signals that these activities are no longer viewed as procedural requirements, but as indicators of how an organization is actually run. Management review, in particular, takes on a different role under this lens. It is not enough for it to function as a periodic update, it must demonstrate that leadership is actively engaged in understanding risk, setting priorities, and making decisions that affect product safety and effectiveness. Inspectors will be looking for that involvement, not just the presence of meeting minutes.

Internal and Supplier Audits Under Scrutiny
Another important shift is the visibility of records that were previously treated as internal. Internal audit reports, supplier audits, and quality agreements may now be requested during an inspection. This alone changes how they need to be approached. Internal audits, especially, carry more weight. They are expected to identify meaningful risks and systemic issues within the quality system. If those issues exist and are not reflected in internal audit outputs, that disconnect becomes significant. In effect, the internal audit function becomes part of the evidence the FDA uses to assess whether a company understands its own risks.

Inspection Readiness as an Ongoing State
A practical challenge that Jeff highlighted is the difference between preparing for an inspection and sustaining a state of readiness. Many organizations can mobilize around an upcoming inspection. Fewer have systems that consistently demonstrate control and effectiveness without that external pressure.

QMSR pushes toward the latter. Readiness is no longer a phase. It is a byproduct of how the system operates on a daily basis. Risk management files are maintained as changes occur. CAPAs are evaluated for true effectiveness, not just closure. Trends are monitored and acted upon. Leadership decisions reflect the risk profile of the business. These are not new activities, but the expectation for consistency is higher.

The Bottom Line
QMSR is often introduced as a regulatory update. And while that framing is accurate, it's incomplete. It represents a shift in how the FDA evaluates quality systems, moving from a documentation-centered approach to one that follows risk across the organization. The question is no longer limited to whether the right procedures exist. It is whether the system, as a whole, demonstrates control, awareness, and effectiveness. And under QMSR, that answer is revealed by how well risk is understood and managed in practice.

---

Looking for more support?
If you have questions about this topic or want to explore how our team can help with your MedTech project, contact us here.
Want to see what we do?
Visit our Services page or contact us directly to talk through your project and see if we’re the right fit.