An FDA investigator arrives at a medical device manufacturing facility for a routine inspection.
The quality manager pulls up the Device History Record for the most recent production lot. The investigator reviews it methodically, page by page. Within fifteen minutes she has found three issues: a signature missing from a final inspection step, a nonconformance record that references a corrective action investigation but contains no investigation reference number, and a rework record that lists the work performed but not the re-inspection result.
None of these issues caused a defective device to reach a patient. The production records from the previous twelve months show a facility with consistent processes and low complaint rates. But the documentation tells a different story.
By the end of the inspection, the investigator has issued a Form 483 with four observations. All four are documentation-related. The most common finding in medical device inspections is not a process failure. It is a documentation failure.
Location: A mid-sized medical device manufacturer producing Class II diagnostic equipment.
Situation: Routine FDA inspection under the new Quality Management System Regulation (QMSR), effective February 2, 2026.
Hazard: Documentation practices that were acceptable under the previous inspection framework are now drawing closer scrutiny under the risk-based QMSR inspection approach.
Potential outcome: Form 483 observations, Warning Letter, consent decree, or import alert, depending on severity and repeat findings.
Consider your own documentation practices. If an FDA investigator reviewed your last ten Device History Records today, what would they find?
Hold that answer. We will return to it.
The Decision Point
The quality manager in this scenario faces a decision that many medical device quality professionals encounter: the documentation gaps are real, but the devices themselves are safe. The temptation is to characterise the findings as minor paperwork issues and explain them away during the closeout meeting.
What should the quality manager do?
Response A: Explain the gaps verbally. Tell the investigator that the missing signature was an oversight, the corrective action reference was filed separately, and the rework re-inspection was documented on a different form. Ask the investigator to note these explanations in the inspection record.
Response B: Provide corrective documentation during the inspection. Immediately locate the missing records, back-date the missing signature to the original date, and present the completed documents to the investigator.
Response C: Acknowledge the findings, provide available context, and commit to CAPA. Acknowledge each finding clearly. Provide any immediately available context without altering records. Commit to a formal CAPA response within the regulatory timeframe.
Response D: Challenge each finding. Dispute the investigator’s interpretation of each requirement and argue that the documentation meets the standard as written.
The Best Response
Acknowledge the findings clearly, provide available context without altering any records, and commit to a formal CAPA response.
Response A is incomplete. Verbal explanations during an inspection do not resolve 483 observations. The investigator will issue the observations regardless of the explanation provided. What matters is the written response submitted after the inspection.
Response B is a serious error. Backdating records is data falsification. Presenting backdated records to an FDA investigator during an active inspection is fraud. It transforms documentation findings into integrity findings, which are categorically more serious and carry personal criminal liability for the individuals involved.
Response D occasionally has merit for genuinely incorrect findings, but disputing all findings without evidence demonstrates a defensive culture that inspectors note. It rarely reduces the number of observations and often increases the investigator’s scrutiny.
Why Documentation Failures Are the Most Common FDA Finding
Documentation failures dominate FDA inspection findings across device manufacturers of all sizes for a predictable reason: the gap between what is required and what is convenient is widest at the point of documentation.
The device gets built. The process works. The quality check is performed. And then, at the moment of recording, something slips. The operator is already on to the next task. The form requires information they do not have at hand. The system is slow. The supervisor will fill it in later.
Under the QMSR, effective February 2, 2026, documentation expectations have not become more lenient. The FDA replaced the Quality System Inspection Technique (QSIT) with a new risk-based inspection approach under Compliance Program 7382.850. This approach organises inspection requirements into six QMS Areas and evaluates documentation not just for completeness but for whether it accurately reflects how processes function in practice.
A Device History Record that is technically complete but does not reflect the actual sequence of events is a documentation failure under this standard. Documentation that has been added, completed, or signed after the fact without being identified as a late entry is a data integrity finding.
The most common documentation findings in medical device inspections are not complex technical violations. They are missing signatures, incomplete entries, nonconformance records without resolution references, and rework records without re-inspection results. These are preventable with consistent procedures and adequate training.
Investigating the Root Causes
Why Was the Signature Missing?
The final inspection step required two signatures: the inspector and a verifier. The verifier had left for the day before the inspection was complete. The inspector noted the gap and intended to return the next day for the verifier’s signature. The next morning, a different lot moved to final inspection, and the previous record was filed without the signature.
The root cause is not the inspector’s intention. It is a procedure that does not prevent a record from being filed until all required entries are complete. The system allowed an incomplete record to proceed.
Why Was the CAPA Reference Missing?
The nonconformance had been investigated and a corrective action had been implemented. The corrective action was documented in the CAPA system. But the nonconformance record itself was never updated to reference the CAPA number. The two records existed in different parts of the quality management system with no link between them.
The root cause is a procedure that does not require cross-referencing nonconformance records to their associated CAPA records. The CAPA was real. The link was missing.
Why Was the Re-inspection Result Missing?
The rework procedure required re-inspection after rework was complete. The re-inspection was performed and passed. But the re-inspection result was recorded on a separate inspection traveller, not on the rework record itself. The rework record said the rework was done. The re-inspection record said the part passed. Neither record referenced the other.
The root cause is a documentation design that separates information that belongs together. An investigator reviewing the rework record alone cannot confirm re-inspection was completed.
Good Documentation Practices Under QMSR and ISO 13485:2016
Good Documentation Practices (GDocP) for medical device manufacturers are grounded in the ALCOA+ framework and the specific requirements of ISO 13485:2016, Section 4.2, now incorporated by reference into the QMSR.
What Changed Under QMSR: The Documentation Implications
The QMSR does not introduce entirely new documentation requirements. However, three changes have direct implications for how documentation is evaluated during inspections.
Under QMSR and ISO 13485:2016, documentation must reflect risk-based thinking. This means the level of documentation detail should be proportionate to the risk associated with the process or device. An inspection under the new Compliance Program 7382.850 evaluates whether documentation demonstrates that risk considerations influenced process design and execution, not just whether forms were completed.
Under the new inspection approach, FDA investigators may now review supplier audit reports during inspections. This extends documentation expectations into supplier qualification files. Supplier audit records, qualification decisions, and follow-up actions must be documented with the same rigour as internal production records.
The new Compliance Program explicitly includes cybersecurity as an inspection element for cyber devices and software-enabled devices. Manufacturers of connected devices must now maintain documentation demonstrating conformity with cybersecurity requirements. This is a new documentation category that did not exist under the legacy QSIT inspection framework.
Lessons Learned
For Operators
Documentation is part of the job, not a separate task that follows the job. The record must be created at the time the activity is performed. If a required entry cannot be completed at the time, stop and resolve the issue before moving on rather than leaving it for later.
If you notice a documentation gap, raise it immediately. Late entries made transparently are far less serious than gaps discovered during an inspection.
For Quality Professionals
Documentation design is as important as documentation training. If your forms and procedures make it easy to create complete records, operators will create complete records. If the system is designed in a way that makes gaps likely, gaps will occur regardless of training.
Review your Device History Records, nonconformance records, and CAPA records specifically for cross-referencing completeness. An FDA investigator will try to follow the chain from a nonconformance to its investigation to its corrective action to its effectiveness check. If that chain cannot be followed without calling someone to explain, the documentation system needs redesign.
For Management
Documentation quality reflects management’s commitment to quality systems. Facilities where documentation gaps are tolerated because the product is good have misunderstood the regulatory purpose of documentation.
Under QMSR, FDA inspectors are evaluating not just whether records exist but whether the quality management system functions as a coherent, integrated system. Documentation that is internally inconsistent or unlinked tells an inspector that the quality management system exists on paper but not in practice.
Knowledge Check
Test your understanding of good documentation practices before your next inspection.
No. The operator may not sign the record as if the signature were contemporaneous. If the signature is added now, it must be identified as a late entry with the current date, the operator’s signature, and an explanation of why the original entry was not made at the time. The quality manager should acknowledge the gap to the investigator, ensure the late entry is made correctly, and include this finding in the CAPA response submitted after the inspection. Presenting the signature to the investigator without these disclosures would constitute misrepresentation of the record.
Yes. A rework record that does not document or cross-reference the re-inspection result is incomplete. An FDA investigator reviewing the rework record alone cannot confirm that re-inspection was performed and passed. Under QMSR and ISO 13485:2016 Section 8.7, records of rework must demonstrate that reworked product meets acceptance criteria. A cross-reference to the re-inspection result is necessary to make the rework record complete.
This is a data integrity violation. Signing records for another person falsely attributes the activity to the wrong individual, violating the Attributable principle of ALCOA+. The quality manager must immediately stop the practice, document the extent of affected records, conduct a retrospective assessment of whether the activities were actually performed, and initiate a CAPA addressing the root cause. If FDA has a pending inspection or the records were already reviewed, the quality manager must consider whether disclosure to the investigator is required. The individuals involved may face disciplinary consequences, and the affected records must be assessed for impact on product quality.
Yes, with important context. The new Compliance Program 7382.850, effective February 2, 2026, explicitly includes supplier audit reports as elements subject to FDA review during inspections. This represents a change from the legacy QSIT approach. FDA’s Compliance Policy Guide Sec. 130.300, which previously indicated FDA would not review internal quality audit records during routine inspections, remains on the FDA website but its application under QMSR is now less clear. Manufacturers should assume that supplier audit files, qualification records, and related documentation may be reviewed and ensure they are complete, accurate, and retrievable.
Back to the Manufacturing Floor
The form 483 is issued. The facility has thirty calendar days to submit a written response.
The quality manager prepares a CAPA that addresses each finding with a documented root cause, corrective action, and effectiveness check. The response is thorough, specific, and supported by evidence.
Six months later, FDA reviews the response and closes the inspection without further action.
The facility’s devices were never unsafe. The documentation gaps reflected a quality management system that worked in practice but was not fully visible on paper. Under QMSR’s risk-based inspection framework, that gap between practice and documentation is exactly what inspectors are now trained to find.
The next inspection will look at the same records. Whether the findings recur depends on what changed after the CAPA, not what was written in the response.
Sources
- FDA: Quality Management System Regulation (QMSR), effective February 2, 2026
- FDA Compliance Program 7382.850: Inspection of Medical Device Manufacturers (January 2026)
- FDA: QMSR Frequently Asked Questions
- ISO 13485:2016: Medical Devices Quality Management Systems
- Ropes and Gray: A QMSR State of Mind: FDA Adopts New Inspection Approach (February 2026)