QMSR Inspections: Your Management Review Is Now Evidence

For years, many quality teams treated management review minutes, internal audit reports and supplier audit reports as internal documents that an FDA investigator would not ask to read. Under the old Quality System Regulation that was largely true, because former 21 CFR 820.180(c) kept those records out of routine inspection. That exemption ended on February 2, 2026, when the Quality Management System Regulation (QMSR) took effect and FDA retired the QSIT inspection technique. Nine months in, I still meet teams that updated their procedures but never reread their own records the way an investigator now can. In this post I walk through what changed, how the new inspection program uses those records, and how I help clients get ready without rewriting history.

What changed on February 2, 2026

FDA published the final rule amending Part 820 in the Federal Register on February 2, 2024, with a two-year transition. The rule incorporates ISO 13485:2016 by reference, along with clause 3 of ISO 9000:2015 for vocabulary. Part 820 now keeps only a few FDA-specific sections, including 820.10 on QMS requirements, 820.35 on control of records and 820.45 on labeling and packaging controls. Most of the old section text is reserved and points to the standard.

On the same effective date, Compliance Program 7382.850, Inspection of Medical Device Manufacturers, replaced QSIT as the basis for how investigators plan and run device inspections. The timeline below shows how those milestones put records in scope that most teams never wrote for an outside reader.

Records that used to stay in the drawer

The end of the 820.180(c) exemption is the change I spend the most time on with clients. Management review, internal audit and supplier audit records are now open to inspection. Published commentary on the compliance program indicates investigators are expected to review them on baseline surveillance and PMA preapproval inspections and may review them on other inspection types. Records written before the effective date are not off limits if an inspection leads to them.

That changes who these records are written for. Most were written for an internal audience, often in shorthand and often with candid language about problems the team already knew about. Candor is healthy, and I would not want teams to lose it. What matters now is whether the same record also shows the follow-through.

How the new inspection program reads them

The compliance program organizes an inspection around six QMS areas instead of the QSIT subsystems:

• Management Oversight
• Design and Development
• Production and Service Provision
• Outsourcing and Purchasing
• Change Control
• Measurement, Analysis and Improvement

It also covers other applicable FDA requirements such as medical device reporting, corrections and removals, tracking and UDI. The approach is risk-based. Investigators use your risk management documentation to decide where to look and how deep to go, and they can move between areas as the evidence leads them.

Management review sits at the center of that, because it is where top management is supposed to see the quality data from every other area. ISO 13485 clause 5.6.2 lists the required inputs, including feedback, complaint handling, reporting to regulators, audits, process and product monitoring, corrective and preventive action, and changes that could affect the QMS. Clause 5.6.3 expects documented outputs on needed improvements, changes and resources. Clause 8.2.4 covers internal audit, and clause 7.4.1 covers supplier evaluation and monitoring.

Where I see the gaps

When I read management review and audit records the way an investigator working through the six areas would, the same patterns come up:

• Inputs listed as agenda items with no data behind them, so the record shows a meeting happened but not what top management actually saw.
• Outputs recorded as discussed, with no decision, owner or due date, which reads as awareness without action.
• Internal audit findings closed by retraining with no check that the fix worked, which invites questions under clause 8.5.2 on corrective action.
• Supplier audit reports that never feed back into supplier evaluation or the risk file, so the outsourcing story and the risk story do not match.
• No traceable thread from a management review action to the CAPA, change or resource decision it produced.

Practitioner note: At one mid-size device manufacturer I supported, the management review minutes were thorough on complaint trends but silent on a software supplier whose audit had found weak change notification. Neither record was wrong on its own. Read together, they showed that top management never saw a known supplier risk that later contributed to a field correction. The fix was not rewriting the old minutes. We made supplier audit outcomes a standing review input and linked every review action to its CAPA or change record.

Preparing without rewriting history

Commentary on the program indicates manufacturers are not expected to rewrite records produced under the old rule, and I advise against it. Edited history is worse than imperfect history. Instead I focus on three things:

• Make the next management review complete against clause 5.6.2, with data attached to each input and a decision, owner and due date on each output.
• Close the loop, so every audit finding and review action traces to a CAPA, a change record or a documented rationale for taking no action.
• Where an older record reveals a gap, open a correction plan now, so an investigator who follows the thread finds you already did.

If you are still working through the transition, my QMSR and 21 CFR 820 guide covers what changed from the old QSR and how inspections now differ.

Closing perspective

The QMSR did not invent new expectations for management review or internal audit. ISO 13485 has asked for both for a long time. What changed is that FDA can now read the evidence directly, so management oversight is no longer something an investigator has to infer from everything else. Teams that write these records as working tools, with data, decisions and follow-through, will find inspections under the new program far less eventful. If you want a second set of eyes on your management review, internal audit or supplier audit records before your next inspection, reach out at softwarequality.guru/contact.