fda-qsr-audit-prep

---
name: fda-qsr-audit-prep
description: Use when prepping an annual internal FDA QSR audit or inspection readiness review, or responding to a Form 483, Warning Letter, MDR event, or recall decision.
category: Compliance
version: 1.0.0
tools: []
---

# FDA QSR Audit Prep

Six forcing questions for US medical-device QSR work (21 CFR 820, substantially harmonized with ISO 13485 post-Feb 2026), applied before internal audits, FDA inspections, Form 483 responses, or recall decisions.

## When to run

Before the annual internal QSR audit; before a pre-FDA-inspection readiness review for any device commercially distributed in the US; after receiving Form 483 observations; after a Warning Letter; after an MDR-reportable event; before a recall decision (voluntary vs. FDA-initiated); or before submitting a 510(k)/PMA where QSR posture affects the approval timeline.

## The six questions

### 1. Show the complaint files from the last quarter — and the corresponding MDR reports.
21 CFR 820.198 plus 21 CFR 803 is the most-cited FDA inspection area. Check the complaint log for completeness (who/what/when/device/batch), investigation closure within a reasonable timeline, the MDR-reporting decision tree (death OR serious injury OR malfunction-that-could-cause = MDR), the 30-day timeline for most MDR reports (5 days for certain serious events), and whether complaint trending feeds management review.

### 2. When was process validation (IQ/OQ/PQ) last revalidated per 21 CFR 820.75?
Cross-walks ISO 13485 Clause 7.5.6. Check for initial validation at process introduction, revalidation triggers (process/equipment/material change or a periodic schedule), and statistical techniques per 21 CFR 820.250 where applicable.

### 3. Show the Device History Records for products commercially distributed in the last 2 years.
21 CFR 820.180 requires 2-year retention from commercial distribution — check sampling for completeness. Each DHR needs dates of manufacture, quantity manufactured, quantity released, acceptance records, primary identification label, device identification, and control number. Sample stratified by product class, and verify DHR closeness to the Design History File (DHF).

### 4. Show CAPAs from the last 6 months with effectiveness verification.
21 CFR 820.100 is substantially harmonized with ISO 13485 Clause 8.5.2. Check root-cause-analysis depth (5-Why minimum), effectiveness verification as measurable evidence rather than "we updated the procedure," a documented containment/correction/corrective-action distinction, closure approval by the appropriate authority, and flag any CAPA aging past 90 days.

### 5. Show labeling review (21 CFR 801) for the most recent product launch.
An FDA-specific overlay not present in ISO 13485. Check labeling against 21 CFR 801 (plus 21 CFR 800-series sectoral overlays for specific device types), Unique Device Identification per 21 CFR 830, and that promotional materials were reviewed for accuracy and non-misleading claims.

### 6. If a Form 483 was issued in the last 3 years, show the closure status.
A Form 483 is an FDA observation, not equivalent to an ISO nonconformity. Check for a response within 15 working days, documented corrective and preventive action with a timeline for each observation, and effectiveness-verification evidence. Warning Letters need a separate response track and potentially an FDA meeting.

## What to produce

Name the decision being made (programme-plan / inspection-readiness / 483-response / MDR-decision / recall). Cover: complaint and MDR posture (complaints last quarter, MDR-reportable events, % filed within timeline against a 100% target, whether trending reaches management review); process-validation status under 21 CFR 820.75 (% on schedule, stale validations, whether statistical techniques are applied); DHR completeness under 21 CFR 820.180 (sample size, completeness %, 2-year retention compliance, stratification by product class); CAPA health under 21 CFR 820.100 (sample size, root-cause depth, effectiveness-verification status, count aging past 90 days); labeling under 21 CFR 801 (products reviewed, accuracy, UDI compliance per 21 CFR 830); and Form 483/Warning Letter history (counts over 3 and 5 years respectively, closure status, thematic pattern across observations). Add the ISO 13485 cross-walk showing which findings are shared evidence versus FDA-specific overlays remaining (labeling, complaint handling, MDR reporting, recall procedures).

Close with a verdict — INSPECTION-READY / GAPS-IDENTIFIED / NOT-READY — the top 3 actions with an owner and an FDA-cited timeline (15 days, 30 days, etc.) each, and a flag for anything needing outside counsel: Warning Letter response, recall decisions, or 510(k)/PMA strategy disputes.

## Escalate to a teammate

For the multi-framework view, the ISO 13485 cross-walk pair, GDPR questions if a connected device handles personal data, or Warning Letter response coordination, @mention the relevant compliance or legal teammate.