US Food and Drug Administration (FDA) officials have offered insight into how investigators will evaluate medical device manufacturers under the agency’s Quality Management System Regulation (QMSR), emphasizing a risk-based approach that prioritizes real-world evidence of compliance, from risk management documentation to a leadership-driven Culture of Quality.
During an April 1 FDA Town Hall webinar, agency officials answered a handful of questions from industry regarding facility inspections conducted under the FDA’s updated Compliance Program Manual (CPM) for the Inspection of Medical Device Manufacturers. (Related Story: “3 Must-Know Things From FDA’s Town Hall on Medical Device Inspections,” QualityHub, April 1, 2026.)
The updated CPM 7382.850 lays bare for investigators what they should look and ask for during a facility inspection, among other activities. (Related Story: “Takeaways From FDA’s Retooled Compliance Manual for MedTech Inspections,” QualityHub, March 27, 2026.)
The FDA’s Town Hall speakers included:
- Kimberly Lewandowski-Walker
- Regulatory Officer, FDA Inspections and Regulatory Audits Team, Office of Regulatory Programs, Office of Product Evaluation and Quality (OPEQ)
- Tonya Wilbon
- Assistant Director for Post-Market Industry, Education and Consumer Education, Division of Industry and Consumer Education (DICE)
Below are six industry questions answered by Lewandowski-Walker and Wilbon. [Editor’s Note: The Q&A was lightly edited by QualityHub for clarity and brevity.]
1️⃣ What documentation or objective evidence will FDA investigators prioritize during QMSR inspections, particularly for risk management activities?
Tonya Wilbon: The specific documents and evidence investigators review will depend on the risk that’s associated with the manufacturer’s device and the priorities for that inspection. Investigators typically will examine the documentation needed to verify that manufacturers meet the QMSR requirements for the elements being evaluated. [Editor’s Note: There are seven elements on which investigators can focus during an inspection, including Management Oversight; Production and Service Provision; Design and Development; Change Control; Outsourcing and Purchasing; Measurement, Analysis, and Improvement; and Other Applicable FDA Requirements (including adverse events/Medical Device Reports, product recalls, Medical Device Tracking, and Unique Device Identification).]
When it comes to risk management activities, specifically, investigators may review risk management files and reports for selected products, including risk analyses that identify your hazards and harms, as well as documentation showing how risk controls were implemented. Investigators may also even look for evidence that risk controls are effective and records that demonstrate risk management throughout the product lifecycle.
2️⃣ How will the new approach for device inspections be used for drug/device combination product pre-approval inspections that use the drug Good Manufacturing Practice (GMP) streamlined approach?
Kimberly Lewandowski-Walker: Inspections of drug/device combination products that use the drug streamlined approach by showing compliance with drug GMPs at 21 CFR, Parts 210 and 211 will also need to comply with applicable provisions of the QMSR, which are set forth at 21 CFR, Part 4.4(b)(1).
In particular, implementing risk management and product realization is part of 4.4(b)(1)(ii), and as it reads … the “organization shall document one or more processes for risk management in product realization. Records of risk management activities shall be maintained.”
3️⃣ Investigators will be looking for signs of a Culture of Quality and leadership accountability across a company, not just within the manufacturer’s quality department. How will this be assessed and how can companies be prepared to demonstrate that they indeed have a Culture of Quality?
KLW: The FDA will assess Quality Culture by examining the decisions manufacturers make and the actions they take throughout their Quality Management System [QMS]. The regulation emphasizes that leadership must embrace a Culture of Quality as essential to manufacturing safe and effective medical devices. So, the FDA expects manufacturers, led by individuals with executive responsibility, to embrace a Culture of Quality as a key component in ensuring the manufacture of safe and effective medical devices that otherwise comply with the FD&C [Federal Food, Drug, and Cosmetic] Act.
“Manufacturers don’t need to take special steps to document a Quality Culture for an FDA inspection. Rather, Quality Culture will be reflected in the decisions made and the actions taken as part of Quality Management System operations.” – Kimberly Lewandowski-Walker
A Culture of Quality meets regulatory requirements through a set of behaviors and attitudes and activities and processes, and then top management ensures that applicable regulatory requirements are met through the integration of the QMS processes. So, during inspections, FDA investigators will look for evidence of a Culture of Quality in how the manufacturers operate. Using information from relevant Quality Management System processes, including risk management to make appropriate risk-based decisions, demonstrates behaviors and attitudes consistent with that Culture of Quality. So, in effect, manufacturers don’t need to take special steps to document a Quality Culture for an FDA inspection. Rather, Quality Culture will be reflected in the decisions made and the actions taken as part of Quality Management System operations. (Related QHub Expert White Paper: “Building a Culture of Quality in Medical Device Organizations: Best Practices for QMSR Compliance,” QualityHub, March 2026.)
4️⃣ How will the FDA assess effectiveness of training during inspections? Will investigators look for documented evidence such as supervisor evaluations or skill assessments that go beyond a simple quiz?
TW: Under ISO Clause 6.6 of the ISO 13485 standard, personnel shall be competent on the basis of appropriate education, training, skills, and experience, and the manufacturers must evaluate the effectiveness of any actions taken to achieve or maintain that competence. So, you get to decide how best to evaluate that. The method used to check the effectiveness of these actions should be appropriate or proportionate to the risk associated with that work. The risk of the processes and product should be a factor in determining both the competency required of personnel performing the work that could affect product quality, as well as the method used to evaluate the effectiveness of actions taken to achieve or maintain that competence. (Related Story: “The Evolution of Medical Device Industry Training Requirements,” QualityHub, Feb. 24, 2026.)
The type of evidence needed to demonstrate effectiveness will thus depend on the risk level. Evaluating training effectiveness goes far beyond just evaluating whether or not training was completed. You can’t just do a checkbox. So, for those higher risk processes, manufacturers may need more robust evidence beyond simple quizzes, such as supervisor evaluations, skill assessments, or even practical demonstrations may be necessary or ongoing performance monitoring. You may need to monitor their performance afterwards.
For lower risk types of processes, simpler verification methods may be appropriate. The FDA will assess whether the manufacturer’s approach to evaluating the effectiveness of training or other actions thus is appropriate for the level of risk that is involved.
5️⃣ How should manufacturers prepare for a QMSR risk-based inspection?
TW: The best way to prepare for an FDA inspection is simply to meet the FDA requirements that apply to your FDA-regulated product. That’s plain and simple. The FDA recommends that firms be prepared to discuss and provide records that demonstrate compliance with all the applicable QMSR requirements.
“One helpful action may be to ensure your internal audit program evaluates how risk management is integrated throughout your product realization, as well as whether or not you’re applying a risk-based approach to control your QMS processes.” – Tonya Wilbon
Because the QMSR has an explicit emphasis on integrating risk management throughout the product lifecycle, one helpful action may be to ensure your internal audit program evaluates how risk management is integrated throughout your product realization, as well as whether or not you’re applying a risk-based approach to control your QMS processes. This may involve evaluating whether risk controls are effective by tracing them through your process, starting with identified patient risk and then following the associated risk controls through each impacted process.
Finally, I would recommend that you be prepared to demonstrate that risk-based decisions were well justified and documented and that you took appropriate actions when needed.
6️⃣ When might an FDA inspection expand beyond the review of minimum required elements?
KLW: This is a very timely question. I’m going to stress two words, one of them being “minimum” and one of them being “flexible.” So, both inspection models in the Compliance Program define the minimum requirements investigators must evaluate and the approach is intentionally designed to be flexible, so it’s completely normal and expected for investigators to examine additional elements beyond the minimum requirements as part of the standard evaluation. [Editor’s Note: See our QHub Brief, “Interpreting FDA’s QMSR Compliance Program: FDA Inspection Types & Corresponding Models,” to learn more about inspection Models 1 and 2 outlined in the FDA’s updated CPM.]
This should not really be thought of as expanding the scope of the inspection, but rather how the risk-based inspection approach is intended to work. So, for Model 1, the requirement of one element per QMS area ensures broad coverage across the Quality Management System, rather than concentration in one area. Investigators routinely cover more elements based on what’s necessary to verify that manufacturers have established effective processes to identify and control risks. The approach encourages investigators to examine whatever elements are needed to understand how well the manufacturer meets QMSR requirements and manages device-related risks.
