Manufacturers of medical devices are being warned by industry attorneys that the Food and Drug Administration (FDA) will be able to review findings and documents related to internal quality audits beginning next month thanks to the US agency’s new Quality Management System Regulation (QMSR).
William McConagha, a Partner in the Washington, DC, office of the law firm Latham & Watkins, pointed out that MedTech companies will likely find the FDA’s new authority around internal audits to be particularly jarring during a facility inspection by agency investigators.
“This is a major change,” McConagha said. “The FDA has historically across product lines encouraged companies to take a hard look at themselves through internal audits, and in exchange for that, said, ‘We’re not going to look at those internal audits. We don’t want companies pulling punches when they’re doing internal audits. We want you to feel free to take a hard look, and we’re not going to come in and look at your dirty laundry, so to speak.’ But the FDA is moving away from that now because of the QMSR as it relates … to medical devices and it’ll be very interesting to see how manufacturers, packagers, sterilizers, and the like deal with this.”
The FDA published its QMSR, which harmonizes the current decades-old Quality System Regulation (QSR) with international quality systems standard ISO 13485:2016, in 2024. The agency’s new, long-awaited rule goes into force on Feb. 2. (Related Story: “QMSR: FDA Answers 21 Burning Questions From MedTechs,” QualityHub, Jan. 2, 2026.)
The FDA’s ability to peek at audit findings because of the new QMSR is “the most important change that companies really should be prepared for.” – Jennifer Bragg
When it comes to quality audits, “the concern is that people may be less aggressive in their own internal audits because on some level there’s a concern that whatever they find is going to be seen” by FDA investigators, McConagha said. “An obvious takeaway from this is, whatever language is used in that internal audit, if you identify issues, there needs to be some evidence in your quality system that you’ve addressed them because FDA is going to be looking to connect the dots.”
Results of a device manufacturer’s supplier audit activities will also be an open book for the FDA under the QMSR. Because of this, McConagha urges companies to make sure quality teams are “doing their level best to ensure that suppliers are prepared for the transition” to the new quality systems rule. Supplier audit records will be “subject to review by investigators, [so] it’s worth asking [vendors] if they’re even aware of that and if they’re doing anything differently as a result.”
Further, he reminds industry that it’s the FDA’s “expectation under the QMSR that a finished device manufacturer will have supplier controls in place to oversee that components that are produced … are suitable for use.”
An ‘Important Change’ for MedTechs that ‘Creates Additional Plank’ for Documentation
Jennifer Bragg, also a Partner for Latham & Watkins, agrees with McConagha’s assessment, noting that the FDA’s ability to peek at audit findings and other related materials is “the most important change that companies really should be prepared for,” adding that it tacks on a level of transparency that will take a lot of manufacturers by surprise.
It also “creates an additional plank, if you will, for companies that I think really does deserve particular attention with respect to how those [documents] are going to be housed [and] how they’re going to be … incorporated into the paperwork that is going to be with FDA,” Bragg said. “But I think every bit as important [is] how companies are going to make sure they are incorporating those findings into their quality practices, whether they be through CAPAs [corrective and preventive actions] or other things, to be able to demonstrate to the FDA that the information is being incorporated.”
When it comes to FDA inspections, “companies might be concerned that [internal and supplier audit findings will be] some of the first things that the FDA may ask about when they walk in the door,” she said. “One way to look at it is, it’s … like FDA looking at your CAPAs. You must have them; they obviously show things that the company is working through. And historically the FDA hasn’t just used CAPA logs … to write 483s; they’re actually more focused, hopefully, on what the company is doing to … address those things.”
An FDA-483 is an inspectional observation form used by agency investigators to list deficiencies found when inspecting and is given to a manufacturer at the conclusion of an inspection.
As for internal audits, Bragg added that the FDA’s ability to review audit findings brings with it “a real benefit” for firms to be “thoughtful to make sure that what the company is receiving in its quality audits … is sort of contemporaneously making it through the quality system – whether as a CAPA that needs to be opened, or whatever – as a result. Because I think a part of what FDA is going to be looking at is, what is the feedback that you receive, No. 1, but more importantly, what have you done with that information?”
She pointed out that “usually where companies get caught [is] when there hasn’t been enough action taken in response to that information, so I think it’ll put a premium on making sure [companies are sifting] through that feedback and acting based on it.”
The comments from Bragg and McConagha came during a mid-December webinar on the QMSR sponsored by Latham & Watkins.