As medical device manufacturers continue aligning quality systems with the US Food and Drug Administration’s (FDA) Quality Management System Regulation (QMSR), companies are facing clearer expectations around how risk should drive corrective and preventive action (CAPA) activities.
Christina Arnt, QualityHub’s VP of Medical Device Compliance, said the regulation formalizes what the FDA had long implied under its legacy Quality System Regulation (QSR): CAPA investigations and actions should scale according to patient and product risk. (Related Story: “5 Pro Tips for a Strong, Vibrant CAPA System,” QualityHub, Dec. 18, 2025.)
That shift is changing how companies think about the structure and depth of CAPA investigations, particularly when differentiating between lower-risk quality events and higher-risk ones that could directly affect patient safety.
“That means the FDA expects you to apply risk within your quality systems, like CAPA,” Arnt said. “They’re looking for differences in investigation complexity and rigor of containment depending on whether it’s a documentation issue versus something that could impact the patient.”
Arnt said many manufacturers historically operated with a one-size-fits-all CAPA process, regardless of the severity of an issue. Under the QMSR, she believes companies now have a stronger regulatory basis to differentiate between low- and high-risk events.
“This is now an opportunity to embrace what came out of the Medical Device Innovation Consortium’s ‘Make CAPA Cool’ program and leverage what companies call ‘CAPA light’ or ‘fast-track CAPA,’ versus a full traditional CAPA,” she said.
Revisiting MDIC’s ‘Make CAPA Cool’
Given an official thumbs-up by the FDA in 2023, the Make CAPA Cool initiative and the MDIC’s 57-page white paper on the topic reframed the CAPA process as a risk-based approach so device firms can solve their most pressing problems first.
Under the Make CAPA Cool model, CAPA is a continuous improvement tool rather than a place where problems go to linger, be ignored, and never die. It begets a process that filters through a company’s problems so it can put its resources where they’ll have most impact.
The framework also pushes device makers to focus on the most important events that could impact product quality and patient experience, rather than dumping every event, regardless of risk or significance, into their CAPA system.
“The FDA was always very supportive of incorporating risk and wanted medical device companies to do so. They were just not as direct about it as they are now.” – Christina Arnt
A pre-2023 Make CAPA Cool pilot program, involving medium- to large-sized MedTech manufacturers, ran for two years. Some of industry’s largest companies – including Medtronic, Boston Scientific, Stryker, BD, Zimmer Biomet, and Edwards Lifesciences – took part in the pilot, which was “extremely successful,” Arnt said. “Companies are still using it today.”
Arnt noted that concerns initially existed around whether FDA investigators would accept a more flexible, risk-based CAPA model. But in practice, manufacturers participating in the pilot found the agency supportive when procedures clearly defined the approach.
She further emphasized that risk-based thinking was never absent from FDA expectations, even before the QMSR came into force.
“The FDA was always very supportive of incorporating risk and wanted medical device companies to do so,” Arnt said. “They were just not as direct about it as they are now.”
CAPA Deficiencies Easier for FDA to Cite Under QMSR
While the core CAPA challenges facing manufacturers may not have changed significantly, Arnt says the QMSR is making deficiencies easier for investigators to document during facility inspections.
Historically, companies have struggled with improperly scoped investigations, non-systemic fixes, and/or investigations lacking appropriate depth.
“Now that the FDA is being very explicit that a company’s actions should reflect risk, some of these issues are going to become very easy for investigators to write up during an inspection,” Arnt said.
Under the QMSR, risk considerations are expected throughout the quality system. Arnt said that gives investigators broader flexibility when citing deficiencies tied to insufficient CAPA investigations or weak risk assessments.
“The new QMSR says risk is incorporated in everything you do,” she said. “Instead of writing you up against what was the limited [QSR Sec.] 820.100 for CAPA with regard to investigating a quality issue, now an investigator can simply say you didn’t execute a process appropriately on the basis of risk, anywhere within your Quality Management System.”
Arnt pointed out that manufacturers with strong quality systems likely already integrate risk into decision-making through complaints, internal audits, post-market surveillance, and risk management activities.
“If they have a mature quality system, no,” she said when asked whether companies are changing how they use quality data under the QMSR. “But if they have an immature quality system, that’s forcing some discussions around understanding and looking at things through the lens of risk.”
Inspections Will Still Have Distinct FDA Approach
Arnt cautioned manufacturers against assuming FDA inspections under the QMSR will mirror ISO 13485 or MDSAP audits.
MDSAP, the Medical Device Single Audit Program developed by the International Medical Device Regulators Forum (IMDRF), allows manufacturers to undergo a single regulatory audit covering requirements in the US, Australia, Japan, Brazil, and Canada. ISO 13485:2016, meanwhile, is the international quality management system standard for device manufacturers published by the International Organization for Standardization (ISO).
“A lot of companies are assuming that an FDA inspection is now going to look like a notified body inspection, and that could not be further from the truth,” Arnt said. “That’s one of many reasons why it’s essential to have a healthy, compliant CAPA system, and more generally, quality system.”
For MedTech quality leaders, Arnt’s message is clear: use the QMSR as an opportunity to make CAPA systems – and more broadly, quality systems – more agile and focused on risk.
Those leaders “should take advantage of applying risk to their CAPA system,” she said. “That way, not only can they keep patients safe, but they can be agile and spend time on the highest-risk issues, and not treat every CAPA the same.”
