Failure Investigations for Medical Device Manufacturers

Failure investigations are the point at which a medical device manufacturer’s quality system either demonstrates genuine effectiveness or reveals its limitations. They are among the most consistently cited areas in FDA medical device inspections, and they are the mechanism through which manufacturers are expected to demonstrate that quality problems are identified, understood at their root cause, corrected, and prevented from recurring.

This guide covers the full failure investigation process under 21 CFR Part 820 and the Quality Management System Regulation (QMSR) effective February 2026: what triggers an investigation, the seven-step process, CAPA requirements, MDR obligations, and the common execution gaps that produce repeat FDA citations.

Key regulatory context: FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, incorporates ISO 13485:2016 by reference into 21 CFR Part 820. For complaint handling and CAPA, the substantive requirements under ISO 13485 align closely with current 21 CFR 820 requirements. Manufacturers should review existing procedures against ISO 13485 language to ensure alignment before the effective date.

In This Guide

What triggers a failure investigation

7-step investigation process

Root cause analysis methods

CAPA: corrective and preventive action

Verification of effectiveness

MDR reporting obligations

QMSR 2026 transition

Common investigation mistakes

What Triggers a Failure Investigation?

Under 21 CFR Part 820, failure investigations are triggered by several types of quality events:

Investigation triggers under 21 CFR 820

Complaints Under 21 CFR 820.198 and ISO 13485 Clause 8.2.2, manufacturers must review, evaluate, and investigate all complaints involving possible device failure or deterioration that could cause or contribute to a serious injury or death.

OOS results In-process and finished product test results outside established specifications trigger investigation. The scope must assess whether other lots or products are affected.

Nonconforming product Discovery of product that does not meet specifications at any manufacturing stage triggers nonconformance procedures, which may escalate to formal CAPA depending on the nature and frequency of the event.

MDR events Malfunctions, serious injuries, or deaths involving a device trigger both an internal investigation and potential MDR reporting obligations under 21 CFR Part 803. These run in parallel, not sequentially.

Internal audit findings Systematic deficiencies identified during internal audits may require formal CAPA depending on their nature, significance, and whether they represent systemic versus isolated failures.

Trend data A pattern of complaints, nonconformances, or service calls that individually may not trigger formal investigation but collectively represent a signal requiring root cause analysis and corrective action.

Step-by-Step: Conducting a Failure Investigation

Step 1: Identify and Document the Event

All complaints, nonconformances, and potential failure events must be captured and documented at intake. The documentation should record: what was reported or observed, by whom, on what date, involving which product (lot, serial number, configuration), and the nature of the event in the reporter’s own words before any interpretation.

Timeliness matters: Under MDR regulations (21 CFR 803), certain events involving death, serious injury, or malfunction must be reported to FDA within 30 days of becoming aware. The internal investigation does not need to be complete before submitting an initial MDR. If the required information is not yet available, a supplemental report can follow. Do not delay MDR submission pending investigation closure.

Step 2: Assess Whether a Formal Investigation is Required

Not every complaint requires the same depth of investigation. The assessment should be commensurate with the significance of the event and the risk associated with the device. 21 CFR 820.198(b) states that if no investigation is conducted, the reason must be documented and the signature of a responsible individual recorded.

Decision framework: does this complaint require formal investigation?

!Does it involve possible failure, malfunction, deterioration, or labelling deficiency?

!Could it cause or contribute to serious injury or death?

!Is this a pattern (third or more similar event) that changes individual risk assessment?

✓If no investigation: document the decision, the rationale, and the responsible person’s signature.

Step 3: Determine Scope and Containment

Before root cause analysis begins, define the investigation scope: which products, lots, processes, or sites are potentially affected. Containment actions (quarantine, hold, field action) should be considered at this stage if product quality or patient safety is at risk.

Critical: A 2024 Warning Letter issued to Jiangsu Caina Medical Co. illustrates this gap directly. FDA found that after the manufacturer confirmed a nonconformance in one device family, it failed to assess whether the same failure mode could affect other device families manufactured under similar processes. Scope assessment must be explicit and documented, not assumed.

Step 4: Conduct Root Cause Analysis

Root cause analysis (RCA) is the technical core of a failure investigation. The objective is to identify not just what happened, but why the conditions existed that allowed it to happen, and why existing controls did not prevent it.

RCA methods: when to use each

Method

Best used for

Limitation

5 Whys

Simple, linear cause chains

Can miss multiple causal paths; stops at the first plausible cause without verifying it

Ishikawa / Fishbone

Complex events with multiple causal categories

Requires structured facilitation; does not inherently rank causes by likelihood

Fault Tree Analysis

Design or system failures with multiple failure modes

Time-intensive; most appropriate for high-risk device failures

FMEA review

Checking whether the failure was anticipated in design risk analysis

Retrospective use; does not replace prospective risk management

Common Assessment Finding

In medical device CAPA audits, the most consistent gap is not in the RCA method chosen but in how far the analysis is taken. “Human error” and “operator not following procedure” are the two most common conclusions cited as inadequate in FDA 483 observations. These describe the proximate cause, not the root cause. The analysis must continue: why did the operator not follow the procedure? Was training inadequate? Was the procedure poorly written? Was there production pressure? Those answers are the root cause.

Step 5: Implement Corrective and Preventive Actions

Based on the root cause, define specific corrective actions (addressing the current problem) and preventive actions (addressing the risk of similar events from related causes). CAPA must be verified or validated prior to implementation, documented in the controlled document system, and assigned clear ownership and completion dates.

Corrective action

Addresses a deficiency that has already occurred. Specific to the identified root cause. Must directly prevent recurrence of the same failure mode.

Preventive action

Addresses potential problems that have not yet occurred. Based on data analysis, trend review, or risk assessment identifying failure modes before they manifest.

Common CAPA failure

Actions defined but not implemented. Actions implemented but not entered into the controlled document system. CAPA closed before implementation is verified. No effectiveness check planned.

Step 6: Verify Effectiveness

Verification of Effectiveness (VoE) is the step most frequently skipped or treated as a formality. The VoE check confirms that the corrective action actually prevented recurrence — not just that the action was completed.

Key Takeaway: Under 21 CFR 820.100(a)(6), manufacturers are required to verify or validate corrective and preventive actions to ensure they are effective and do not adversely affect the finished device. An effectiveness check must specify: what evidence will be collected, over what time period, by whom, and what the acceptance criterion is. “No further complaints received” is not a sufficient effectiveness criterion unless it is defined in advance with a specific follow-up window.

Step 7: Close the Investigation and Update Records

Once the CAPA is implemented and effectiveness is verified, close the investigation file with a documented summary of findings, root cause, actions taken, effectiveness evidence, and conclusions. Under 21 CFR 820.198 for complaints, investigation records must be maintained at the manufacturing establishment or a designated location and be available for FDA inspection.

Medical Device Reporting (MDR) Obligations

Failure investigations and MDR obligations are closely connected but are separate processes. Under 21 CFR Part 803, device manufacturers must report to FDA:

MDR reporting timelines

30 daysEvents where a device may have caused or contributed to death or serious injury, or malfunctions that would be likely to cause or contribute to serious injury if they recurred

5 daysEvents requiring remedial action to prevent unreasonable risk of substantial harm to the public health, or events FDA has required 5-day reporting for

SupplementalAdditional information that becomes available after the initial report was submitted; must be filed when new reportable information is obtained

The complaint handling and investigation records that support MDR decisions are inspectable by FDA under 21 CFR 803.18. Manufacturers cannot submit an MDR and then conduct an inadequate investigation — the investigation record will be reviewed alongside the MDR submission.

QMSR Transition: February 2026

The QMSR, effective February 2, 2026, incorporates ISO 13485:2016 by reference into 21 CFR Part 820. For complaint handling and CAPA, ISO 13485 Clauses 8.2.2, 8.5.2, and 8.5.3 align closely with the current 21 CFR 820 requirements. The substantive content of what is required does not change dramatically, but the language and structure does.

Manufacturers should review existing procedures against ISO 13485 language before February 2026. Key areas where procedural alignment may be needed include: the definition of “complaint” (ISO 13485 uses slightly different framing), the documentation requirements for CAPA source data analysis, and the requirements for advisory notice (field action) procedures.

Common Mistakes

Accepting “human error” as a final root cause

Human error is a proximate cause, not a root cause. The analysis must continue: why did the conditions exist that allowed the error? What system or process failed to prevent it?

Investigating only the failed batch or device

The investigation scope must assess all lots, products, and sites that could have been affected by the same root cause. Narrow scope is one of the most common 483 observations in device CAPA audits.

Closing CAPA before effectiveness is verified

CAPA implementation is not CAPA closure. Effectiveness verification requires defined criteria, a monitoring period, and evidence that the failure mode has not recurred.

Delaying MDR submission pending investigation closure

MDR reporting timelines run from the date the manufacturer becomes aware of the event, not from investigation closure. An initial MDR can be submitted with available information; supplemental reports follow.

Supplier CAPA accepted without verification

When a root cause involves a supplier, the corrective action belongs to the supplier but the verification obligation belongs to the device manufacturer. Accepting a supplier’s written CAPA response without verification is insufficient.

Frequently Asked Questions

Does every complaint require a formal investigation?

No. 21 CFR 820.198 requires investigation of complaints involving possible failure to meet specifications, possible malfunction that could cause or contribute to serious injury or death. If no investigation is conducted, the reason must be documented and signed by a responsible individual. The decision not to investigate must itself be a documented, defensible decision.

What is the difference between a corrective action and a preventive action?

Corrective action addresses a problem that has already occurred, focusing on preventing its recurrence. Preventive action addresses a potential problem identified through data analysis or risk assessment before it occurs. In practice, most CAPA records include both: the corrective action for the current failure and preventive actions addressing related risks identified during the investigation.

Does the QMSR change CAPA requirements materially?

Not substantially. ISO 13485 Clauses 8.5.2 and 8.5.3 align closely with the current 21 CFR 820.100 requirements. The main procedural change is in the source data analysis requirement (ISO 13485 specifies that CAPA procedures must include analysis of data from processes, work operations, concessions, quality records, and customer complaints) and the documentation of any updates to quality management system procedures resulting from CAPA.

Who is responsible for the failure investigation?

The Quality Unit has oversight responsibility and must review and approve investigation conclusions and CAPA decisions under 21 CFR 820.22. Investigations typically involve cross-functional teams: quality, production, engineering, R&D depending on the failure type. Final sign-off authority rests with the Quality Unit; production cannot close an investigation without QU approval.

Failure Investigations for Medical Device Makers