For years, medical device manufacturers operated under a clear understanding with FDA: internal audit reports and the detailed outputs of management reviews were generally considered off-limits during inspections.
FDA's rationale made sense. The agency recognized that companies needed a safe environment to honestly identify weaknesses, investigate problems, and discuss quality system deficiencies. If manufacturers believed FDA would routinely scrutinize every internal audit finding or management review discussion, there was concern that organizations would become less candid, less thorough, and ultimately less effective at self-policing their quality systems.
That era is ending.
With FDA's Quality Management System Regulation (QMSR) harmonizing U.S. requirements with ISO 13485:2016, one of the most significant—and perhaps underappreciated—changes is FDA's ability to review records and evidence associated with internal audits and management reviews.
Many in the industry have not fully appreciated the magnitude of this shift.
Under the legacy Quality System Regulation (21 CFR Part 820), FDA inspectors typically did not request internal quality audit reports during inspections.
The agency's longstanding position was rooted in the belief that companies should be encouraged to conduct robust internal audits without fear that every identified weakness would become an inspection finding. Similarly, management review discussions were generally afforded a degree of confidentiality that allowed leadership teams to openly discuss quality system shortcomings and improvement opportunities.
The result was a regulatory environment where organizations could be relatively candid about their problems while maintaining confidence that internal quality oversight activities would remain primarily internal
FDA's QMSR incorporates ISO 13485:2016 by reference and aligns U.S. quality system requirements with the globally recognized medical device quality management standard.
Under ISO 13485, internal audits and management reviews are not simply recommended quality activities—they are fundamental elements of the quality management system that must be planned, executed, documented, and maintained as objective evidence of compliance.
As FDA transitions to a harmonized framework, inspectors are expected to verify that these processes are effective. To do that, they may review the records generated by those processes.
In practical terms, this means:
This represents a fundamental change in FDA's visibility into an organization's quality oversight processes.
Many organizations still operate under assumptions developed during decades of traditional FDA inspections.
Some quality teams continue to write internal audit reports with the expectation that FDA will never see them.
Others conduct management reviews with minimal documentation, relying on historical inspection practices rather than current regulatory expectations.
These assumptions now create risk.
An ineffective internal audit program can no longer hide behind confidentiality.
A management review that consists of little more than a meeting agenda and attendance sheet may no longer be sufficient.
Most importantly, inconsistencies between what a company identifies internally and what it actually corrects can become highly visible.
For example:
Under the harmonized framework, inspectors may have greater visibility into this sequence of events and may question why known issues remained unresolved
The focus should not be on avoiding findings in internal audits.
In fact, organizations should be concerned if their internal audits never identify meaningful issues.
Strong quality systems find problems.
Strong management reviews discuss problems.
Strong leadership teams allocate resources to solve problems.
What FDA will increasingly evaluate is whether these activities are effective.
Can the organization demonstrate that:
These are the questions that matter under the QMSR framework.
Organizations should revisit their internal audit and management review processes with fresh eyes.
Consider the following questions:
Internal Audits
Management Reviews
Quality System Integration
While some organizations may view this change as a loss of privacy, there is another way to look at it.
The harmonization effort is pushing manufacturers toward the same expectations already common throughout much of the global medical device industry.
Organizations with mature quality systems should welcome the change.
A robust internal audit program and an effective management review process are among the strongest indicators of a healthy quality culture. When properly implemented, these activities demonstrate that the organization is capable of identifying and addressing problems before regulators, customers, or patients are impacted.
At RQMIS, we work with medical device manufacturers to design, implement, assess, and improve quality management systems that align with both FDA requirements and international standards.
As FDA's QMSR implementation continues, organizations should ensure that their internal audit and management review processes are not merely compliant on paper, but capable of standing up to regulatory scrutiny.
The organizations that adapt early will be best positioned for successful inspections and sustainable quality system performance.
The days of FDA avoiding your "dirty laundry" may be over. The good news is that organizations with effective quality systems should have nothing to hide—and every reason to demonstrate that their quality processes are working exactly as intended