The structure changed significantly while the underlying compliance obligations largely stayed intact. Here is what your quality team needs to understand.

What is 21 CFR Part 820?

21 CFR Part 820 is the section of the Code of Federal Regulations that establishes the minimum current good manufacturing practice (cGMP) requirements for the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished medical devices sold in the United States. The original Quality System Regulation (QSR) under Part 820 went into effect on December 18, 1978, and was last substantively updated in 1996.

For roughly 28 years before the QMSR transition, the QSR operated as a standalone FDA framework, separate from international standards like ISO 13485. That gap between US and global requirements created a dual-compliance burden for manufacturers selling into both US and international markets.

What is the QMSR?

The QMSR (Quality Management System Regulation) is the revised version of 21 CFR Part 820, published by FDA on February 2, 2024, in the Federal Register, with a two-year compliance window that ended February 2, 2026.

The QMSR's central change is that it incorporates ISO 13485:2016 by reference as the core compliance framework. Rather than maintaining a separate FDA-specific quality system standard, the QMSR treats ISO 13485 as the baseline, with FDA supplemental requirements layered on top. According to FDA's QMSR FAQ page, the agency made conforming edits to 21 CFR Part 4 as well to address combination product oversight.

What changed: the major differences

Structure and framework

The legacy QSR was a standalone document with its own clause structure, definitions, and requirements. The QMSR replaced that structure with ISO 13485:2016 as the incorporated standard, meaning manufacturers now work within an internationally recognized framework rather than a purely FDA-specific one.

For manufacturers already certified to ISO 13485, this simplifies dual compliance significantly. The two frameworks address the same quality system domains but used different terminology and clause numbering. QMSR eliminates much of that redundancy.

Terminology and definitions

The old QSR used terms like "finished device," "quality audit," and "quality system record" in ways that did not always map cleanly to ISO 13485 vocabulary. The QMSR aligns terminology with ISO 13485, which means quality system documentation may need updates to reflect current regulatory language.

According to the Federal Register final rule, FDA received comments recommending full alignment of definitions with ISO 13485, and the agency made significant adjustments in response.

FDA supplemental requirements

Even though ISO 13485 is now the core, FDA retained supplemental requirements that go beyond the international standard. These include requirements specific to complaint files and Medical Device Reports (MDRs), Unique Device Identifier (UDI) integration requirements, provisions addressing combination products under 21 CFR Part 4, and specific requirements for software validation tied to FDA's Computer Software Assurance (CSA) framework.

The NSF analysis of QMSR notes that QMSR makes ISO 13485:2016 "the core set of requirements," with FDA additions that enhance or clarify the international standard rather than replace it.

Design controls

Design controls remain mandatory under QMSR, but the requirements now flow through ISO 13485 Section 7.3. The substantive obligations are similar to the old 21 CFR 820.30 design control requirements, but the structure and documentation expectations reflect ISO 13485 conventions.

Risk management

The QMSR places greater emphasis on risk management by aligning with ISO 13485's risk-based approach. Manufacturers should ensure their risk register and associated risk management documentation meet ISO 14971 integration requirements, which are referenced in ISO 13485 and by extension in QMSR.

What stayed the same

The core compliance obligations that FDA has enforced for decades remain in place.

Document control remains required: all quality system documentation must be reviewed, approved, and controlled. The process does not change materially, though the clause references update to ISO 13485 numbering.

CAPA requirements carry forward. FDA inspectors continue to scrutinize CAPA programs closely, and the expectation for thorough root cause investigation remains unchanged.

Complaint handling persists: manufacturers must still maintain complaint files and evaluate each complaint for potential reportability as an MDR. The threshold for determining reportability has not changed.

Audits of the quality system remain required. The audit trail requirements for electronic records under 21 CFR Part 11 also remain in effect.

Supplier qualification and management requirements persist. The QMSR continues to require that manufacturers evaluate and select suppliers capable of meeting quality requirements.

Records retention timeframes and requirements carry over with limited modification.

What QMSR means for companies already certified to ISO 13485

For manufacturers who hold ISO 13485:2016 certification, the transition to QMSR compliance is primarily about understanding where FDA's supplemental requirements go beyond the international standard and ensuring those gaps are addressed in your quality system.

The Morgan Lewis QMSR readiness guide from October 2024 identified the key areas requiring attention as: MDR-specific complaint file requirements, UDI integration in records, software validation under CSA guidance, and combination product-specific provisions.

If your ISO 13485 certification scope covers those areas and your procedures reflect current FDA expectations, the transition documentation burden is manageable.

What QMSR means for companies that relied only on the old QSR

Manufacturers who built their quality system around the legacy QSR without maintaining ISO 13485 alignment face a more significant gap analysis. The clause structure is different, the risk management expectations are deeper, and the terminology in procedures and records may need updating.

FDA's own FAQ confirms that manufacturers were expected to have full systems in place by February 2, 2026, and that inspectors will evaluate compliance against the new QMSR framework. An FDA Form 483 observation citing QMSR non-compliance carries the same weight as any other observation, and repeated findings can escalate to warning letters.

The practical gap analysis: where to start

A QMSR transition gap analysis typically covers five areas.

First, map existing procedures to QMSR/ISO 13485 clause numbers. Identify procedures that reference old QSR sections by number and update those references.

Second, confirm that risk management documentation meets ISO 14971 requirements as integrated into ISO 13485 Section 7.1.

Third, verify supplier qualification files reflect QMSR requirements for supplier evaluation and re-evaluation.

Fourth, confirm that your computer system validation approach aligns with FDA's CSA guidance, which applies under QMSR.

Fifth, ensure the complaint process clearly identifies the MDR reporting decision point and documents that determination in the complaint record.

How a modern QMS platform supports QMSR compliance

Maintaining QMSR compliance requires a quality system that connects CAPA, complaints, document control, supplier qualification, risk management, and audit management in a single traceable environment. Disconnected spreadsheets and paper-based systems make it difficult to demonstrate the integrated quality system FDA now expects.

Cloudtheapp's cloud-based QMS gives medical device manufacturers a pre-validated, FDA-compliant platform with 60+ applications covering every QMSR domain. The platform supports ISO 13485 alignment out of the box, with built-in audit trail functionality, automated CAPA workflows, and electronic records that meet 21 CFR Part 11 requirements.

If your quality system needs a structural update to support QMSR compliance, schedule a demo to see how Cloudtheapp can accelerate your transition.

Frequently asked questions

When did QMSR go into effect?

The QMSR became effective February 2, 2026. FDA published the final rule in the Federal Register on February 2, 2024.

Does QMSR replace 21 CFR Part 820?

The QMSR revises 21 CFR Part 820, rather than replacing the regulatory citation. Part 820 still exists as the regulatory address, but the content now incorporates ISO 13485:2016 by reference.

Do I need ISO 13485 certification to comply with QMSR?

Certification is not required. ISO 13485 certification demonstrates conformance but is not mandated by FDA. The QMSR requires compliance with the substance of ISO 13485, not the certification credential.

What happens during an FDA inspection under QMSR?

FDA inspectors will evaluate your quality system against QMSR requirements, which include ISO 13485 obligations plus FDA supplemental requirements. Inspectors may ask to see gap analysis documentation from the transition, particularly for companies that previously operated under the old QSR without ISO 13485 alignment.

How long does a QMSR gap analysis take?

The timeline depends on the size and complexity of your existing quality system. A manufacturer with an ISO 13485-aligned system may complete the gap analysis in weeks. A manufacturer rebuilding from a QSR-only baseline may need three to six months.

This post created by and appeared first on Cloudtheapp

The FDA’s Quality Management System Regulation (QMSR) took effect on February 2, 2026, replacing the old Quality System Regulation (QSR) that had governed 21 CFR Part 820 since 1996. The regulation number stayed the same — 21 CFR Part 820 — but the substance changed significantly. The core shift: the FDA incorporated ISO 13485:2016 by reference, making it the backbone of U.S. medical device quality system requirements for the first time. For manufacturers already certified to ISO 13485, many obligations now overlap with FDA expectations. For those who were not, the QMSR represents a broader set of documented requirements than the old QSR demanded.

What the QMSR actually is

The QMSR is the revised version of 21 CFR Part 820. The FDA published the final rule on February 2, 2024, giving manufacturers exactly two years to prepare before enforcement began. The rule did not create a new regulation from scratch. It amended the existing Part 820 by incorporating ISO 13485:2016 and ISO 9000:2015 Clause 3 (definitions) by reference, while adding FDA-specific requirements where ISO 13485 alone was insufficient to meet the statutory expectations of the Federal Food, Drug, and Cosmetic Act.

The old regulation was informally called the Quality System Regulation or QSR. The revised version carries a new name: the Quality Management System Regulation, or QMSR. The underlying legal authority — Section 520(f) of the FD&C Act — did not change. What changed is how the FDA defines what a compliant quality system looks like in practice.

According to the FDA’s QMSR page, the agency determined that ISO 13485:2016 requirements are, taken in totality, substantially similar to the old QSR requirements, providing an equivalent level of assurance that devices are manufactured safely and consistently.

What changed from the old QSR

Incorporation of ISO 13485:2016

The most consequential change is structural. Under the old QSR, the FDA maintained its own standalone quality system requirements. Under the QMSR, ISO 13485:2016 is incorporated by reference, meaning compliance with the QMSR requires compliance with ISO 13485 unless FDA-specific provisions say otherwise. Manufacturers can access the standard in read-only format through the ANSI Incorporated by Reference Portal at ibr.ansi.org.

This harmonization aligns the U.S. with regulatory authorities in Canada, the European Union, Japan, and other markets that have used ISO 13485 as the baseline standard for years. A manufacturer certified to ISO 13485:2016 by an accredited certification body will find that a large portion of their existing documentation already addresses QMSR obligations, though FDA-specific additions still apply.

Expanded FDA inspection authority

Under the old QSR, Section 820.180(c) exempted internal quality audits from FDA inspection — including supplier audits and management review reports. The QMSR eliminates this exemption entirely.

As of February 2, 2026, FDA investigators can request and review:

• Internal audit reports
• Supplier audit reports and findings
• Management review meeting records and outputs

The FDA’s rationale, stated in the final rule preamble, is that manufacturers already provide these records to other regulatory bodies under ISO 13485, so making them available to FDA investigators does not create additional burden. For manufacturers whose internal audits have historically been informal or underdocumented, this change creates a real compliance gap. An audit trail that shows systematic, structured internal reviews is now essential to inspection readiness.

New inspection process replacing QSIT

The Quality System Inspection Technique (QSIT), which FDA investigators used for decades to structure device inspections, was withdrawn on February 2, 2026. The new inspection process is described in the updated Compliance Program 7382.850 (Inspection of Medical Device Manufacturers), implemented on the same date the QMSR took effect.

Manufacturers preparing for their first post-QMSR inspection should review this compliance program and understand how their quality system documentation maps to QMSR requirements rather than the old QSIT subsystem framework.

Combination product requirements clarified

The FDA also made conforming edits to 21 CFR Part 4 to clarify quality management system requirements for combination products (devices combined with drugs or biologics). These edits did not change the underlying CGMP requirements for combination products but provide additional clarity for manufacturers operating at the device-drug or device-biologic boundary.

What stayed the same

The fundamental obligations of a quality management system for medical devices did not change. Manufacturers must still:

• Establish, document, implement, and maintain a quality management system
• Define and control processes for design, production, and post-market activities
• Conduct internal audits at planned intervals
• Control nonconforming products and initiate corrective and preventive actions
• Maintain document and record control systems
• Qualify and monitor suppliers

The FDA was explicit in the final rule: the requirements of the QSR and the QMSR are substantially similar. A manufacturer that maintained a well-run quality system under the old regulation should find the transition manageable. Records created before February 2, 2026 remain valid, and the FDA has indicated that investigators may find it useful when manufacturers complete a comparative analysis showing that pre-QMSR records meet QMSR requirements.

The statutory basis and enforcement authority also stayed the same. The FDA still conducts risk-based inspections. A FDA Form 483 observation under the QMSR carries the same weight as it did under the old QSR. The path from inspection observation to warning letter to consent decree follows the same escalation pattern.

MDSAP (Medical Device Single Audit Program) continues as a voluntary third-party audit program. Holding an MDSAP certificate does not exempt a manufacturer from FDA inspection, and the FDA will not issue ISO 13485 certificates of conformance. FDA inspections assess compliance with federal regulations; third-party MDSAP audits assess conformance to the ISO standard.

What the QMSR means for ISO 13485-certified manufacturers

If your facility holds a current ISO 13485:2016 certification, a significant portion of your quality system already aligns with QMSR requirements. The areas to examine carefully are the FDA-specific additions: requirements that clarify expectations beyond what ISO 13485 alone specifies, particularly around electronic records under 21 CFR Part 11, combination product documentation, and the now-eliminated inspection exemptions for audits and management reviews.

ISO 13485 certification is not a substitute for QMSR compliance, and the FDA will not accept a certification certificate as evidence of compliance. The FDA’s inspection program operates independently from third-party certification schemes.

What the QMSR means for manufacturers who were not ISO 13485-certified

The transition is more substantial for facilities that built their quality systems to the minimum QSR requirements without pursuing ISO 13485 certification. ISO 13485 is more prescriptive in certain areas — particularly risk management integration, supplier qualification, and formal management review documentation.

Areas that commonly require additional work include:

• Risk management documentation and integration with design and production processes
• Supplier qualification and audit programs (now fully subject to FDA inspection)
• Formal management review records with documented outputs and follow-up actions
• Process validation with documented evidence across all production stages

The two-year transition period from February 2024 to February 2026 was intended to allow manufacturers to close these gaps. Manufacturers still working through their gap analysis should prioritize the areas most likely to surface during an inspection visit: internal audit records, supplier controls, management review minutes, and corrective action systems.

How an eQMS supports QMSR compliance

The shift to QMSR compliance is, at its core, a documentation and traceability challenge. Every process change, corrective action, audit finding, supplier evaluation, and management review decision must be recorded, controlled, and available for review on demand.

Paper-based or fragmented quality systems create serious risk in this environment. When an FDA investigator arrives and requests your supplier audit reports from the past three years, a quality management system that stores documents in shared drives or physical binders cannot produce them quickly or consistently.

Cloudtheapp’s cloud-based eQMS is built for exactly this operating model. With 60+ purpose-built applications covering audits, supplier qualification, CAPA, document control, and management review, Cloudtheapp gives quality teams a single source of truth for every record that matters under the QMSR. The platform is validated to FDA computer system validation guidelines and supports 21 CFR Part 11 electronic records and signatures, so your digital records meet the same evidentiary standards as paper records in an FDA inspection.

Manufacturers transitioning from the old QSR to the QMSR use Cloudtheapp to map their existing quality system documentation against QMSR requirements, identify gaps, and build the processes needed to close them — without rebuilding their system from scratch.

See how Cloudtheapp supports QMSR compliance

Common questions about 21 CFR Part 820 and the QMSR

Does 21 CFR Part 820 still exist?

Yes. The regulation number 21 CFR Part 820 did not change. The QMSR is the updated version of Part 820, published under the same citation. References to “21 CFR Part 820” after February 2, 2026 refer to the QMSR.

When did the QMSR become mandatory?

February 2, 2026. The final rule was published on February 2, 2024, and the two-year transition period ended on the effective date. FDA inspections conducted on or after that date assess compliance with the QMSR, not the old QSR.

Do I need ISO 13485 certification to comply with the QMSR?

No. ISO 13485 certification from a third-party body is voluntary. The QMSR incorporates ISO 13485:2016 requirements by reference as the substantive content of the regulation. You must meet those requirements, but the FDA does not require a third-party certificate.

What happened to the QSIT inspection process?

The Quality System Inspection Technique (QSIT) was withdrawn on February 2, 2026. FDA device inspections now follow the updated Compliance Program 7382.850.

Can FDA now inspect my internal audit records?

Yes. The exemption that previously protected internal quality audits, supplier audits, and management review reports from FDA inspection was eliminated under the QMSR. These records are now subject to review during FDA device inspections.

Conclusion

The QMSR kept the same regulation number but changed the underlying framework in ways that matter for daily quality operations. ISO 13485:2016 is now legally embedded in 21 CFR Part 820. Internal audits and management reviews are fully visible to FDA investigators. A new inspection process governs how those investigations unfold.

Manufacturers with well-documented quality systems built on ISO 13485 are in a strong position. Those whose quality systems were structured around the minimum QSR requirements have more work ahead, particularly in supplier qualification, audit documentation, and risk management.

The practical path forward is a documented gap analysis against QMSR requirements, followed by a systematic plan to close the identified gaps before your next FDA inspection visit. An eQMS like Cloudtheapp makes that process faster and gives you the documentation infrastructure to sustain it.

Request a demo to see how Cloudtheapp supports QMSR compliance

This post created by and appeared first on Cloudtheapp

In regulated industries such as medical devices, pharmaceuticals, and biotechnology, internal audits are required by law and by certification standards. Missing an audit cycle, conducting one without documented evidence, or failing to follow up on findings are all observations that appear in FDA Form 483 reports and warning letters.

What an internal audit actually does

Most quality teams understand that internal audits are required. Fewer treat them as an operational tool rather than a compliance checkbox.

The practical function of an internal audit is to surface the gap between what your procedures say and what your processes actually do. Written SOPs describe the intended operation of a process. An internal audit tests whether the people, systems, and records in the organization reflect that description. When they don't — and they often don't in specific, concrete ways — the audit finding creates an obligation to investigate and correct.

Done consistently, an internal audit program gives quality leadership early visibility into process drift, documentation gaps, and compliance exposures before those same gaps surface during an FDA inspection or a third-party certification audit.

The regulatory requirement across ISO 13485, ISO 9001, and the QMSR

ISO 13485:2016, Clause 8.2.4

ISO 13485 requires medical device manufacturers to plan, establish, implement, and maintain an audit program that covers all processes in the QMS. Clause 8.2.4 specifies that audits must be conducted at planned intervals, that criteria and scope must be defined for each audit, auditors must be selected to ensure objectivity and impartiality, and results must be reported to management and documented. Records must be retained as evidence of the audit program.

The standard is explicit that organizations must not allow auditors to assess their own work.

ISO 9001:2015, Clause 9.2

ISO 9001's internal audit requirements follow the same structure. Clause 9.2 requires organizations to conduct audits at planned intervals to determine whether the QMS conforms to the organization's own requirements and to the standard itself, and whether the system is effectively implemented and maintained. Audit programs must take into account the importance of the processes, changes affecting the organization, and the results of previous audits. Nonconformities found must be corrected without undue delay.

The QMSR and what changed in February 2026

The FDA's Quality Management System Regulation (QMSR), which replaced 21 CFR Part 820 on February 2, 2026, incorporated ISO 13485:2016 by reference. One of the most significant operational changes this created: FDA inspectors can now access internal audit reports, management reviews, and supplier audit records during an inspection.

Under the previous QSR framework, internal audit records were generally protected from FDA review. That protection no longer exists. If your internal audit records are missing, incomplete, or show findings that were never addressed, an FDA investigator reviewing those records during an inspection will see exactly that. (FDA QMSR FAQ, February 2026)

What auditor independence means in practice

Both ISO 13485 and ISO 9001 require that auditors be objective and impartial. The practical meaning: auditors must not evaluate their own work, their own area, or processes they are directly responsible for maintaining.

In a small quality team, this creates a real scheduling challenge. A team of three quality engineers who each own different QMS processes can audit each other's areas. A team of one has a structural problem — they cannot independently audit anything they manage, which in a lean organization is often everything.

The common solutions are cross-functional auditors (trained employees from operations, manufacturing, or R&D), contract auditors, or auditor pools built across sites. Whatever the approach, the independence requirement is not flexible. An audit conducted by someone assessing their own procedures is not compliant and will not hold up to regulatory scrutiny.

Planning an internal audit program

An internal audit program is not a single event. It is an annual or multi-year schedule that ensures every process and requirement in the QMS gets audited over a defined cycle, with higher-risk or higher-change areas audited more frequently.

The planning process involves defining the audit scope for the cycle: which processes, departments, and regulatory requirements will be covered, and how often. A risk-based approach means CAPA management, change control, and supplier qualification typically get more attention than lower-risk administrative processes.

From there, the team builds an audit schedule with specific dates, assigned lead auditors, and defined objectives. The schedule should be documented and approved by quality management.

Each individual audit within the program requires its own inspection plan, including the applicable regulatory clauses, specific questions to be answered, and records to be reviewed. A pre-planned checklist is not bureaucracy — it is evidence that the audit was conducted against a defined scope, which is what regulators check when they review your audit records.

Communicating the schedule to process owners in advance is standard practice for internal programs. The goal is to evaluate how processes actually run, not to catch people unprepared.

What happens during an audit

An internal audit follows a defined sequence. The opening meeting establishes scope, objectives, and logistics with the area being audited. The audit itself involves records review, process observation, and interviews with the people who perform the work.

Records review focuses on whether documented evidence matches what procedures require. If a procedure says deviations must be reviewed within five business days of occurrence, the auditor pulls deviation records and checks the timestamps. If the SOP requires two-signature document approval, the auditor verifies that electronic or wet-ink signatures are present on controlled documents.

Process observation is where internal audits surface findings that records review often misses. Watching a process in real time — how operators actually perform a procedure, how they handle exceptions, whether they reference the current revision of an SOP or a printed copy from six months ago — often reveals the gap between the documented process and the performed one.

Interviews with personnel serve as a check on both records and observation. If a team member cannot describe the process they perform, or describes it in a way that differs from the written procedure, that discrepancy needs to be explored.

The closing meeting summarizes preliminary findings with the auditee before the formal report is written. This is an opportunity to correct any factual errors in the auditor's notes before the written record is finalized.

Documenting findings and closing the loop

Every audit finding must be documented with enough specificity that a corrective action can be written against it. "Document control needs improvement" is not a finding. "Revision 3 of SOP-012 was found posted at Workstation 4, but the current approved version is Revision 5 per the document management system" is a finding. One of these generates an actionable CAPA. The other generates confusion.

Findings are classified as major nonconformities (the process is not operating in compliance), minor nonconformities (isolated gaps or incomplete implementation), or observations (opportunities for improvement that don't rise to the level of a nonconformity). The classification drives the timeline and depth of the required response.

Once the audit report is issued, the quality team and the responsible process owner agree on corrective actions and timelines. Those actions need to be tracked in your CAPA system, not in an email thread or a spreadsheet. The audit trail connecting the original finding to the root cause analysis and the verification of effectiveness is the evidence that your program actually closes the loop.

A root cause investigation is required for nonconformities. Correcting the immediate symptom without understanding what caused it means the same finding will surface in the next audit cycle.

A process audit versus a system audit: the distinction worth knowing

A process audit evaluates a specific process against defined criteria — the inputs, outputs, controls, and resources that make the process work. A system audit evaluates the entire QMS against a standard such as ISO 13485 or ISO 9001. Both are part of a complete internal audit program, and they serve different purposes.

Process audits tend to surface operational issues: a step skipped in a manufacturing process, a record not captured at the right point, a control that exists on paper but is not actually applied. System audits tend to surface structural issues: procedures that don't reference the correct regulatory requirements, elements of the standard that were implemented in one area but not across the organization, or management review inputs that are incomplete.

A mature audit program uses both.

Where most internal audit programs break down

Most internal audit programs are designed adequately on paper. The breakdowns tend to be operational.

Audit schedules get delayed when the auditor is pulled into a product launch, a customer complaint response, or inspection preparation. By the time the calendar year closes, several planned audits were never completed, creating a gap in audit coverage that the next external audit will find.

Findings sit in a report that was never formally entered into the CAPA system. Corrective actions were discussed at the closing meeting and the process owner implemented a fix, but no verification of effectiveness was documented. The finding technically remains open with no evidence that the corrective action worked.

Auditor pools are never developed. The same two people conduct every audit for five consecutive years, and there is no succession if either one leaves.

A program that cannot demonstrate consistent execution, documented findings, and closed-loop corrective actions is not a functioning QMS element. It is a documentation liability that will surface in the first external review that looks closely.

How a QMS platform supports an internal audit program

Running an internal audit program on spreadsheets and email is manageable for a small team with a narrow scope. For any organization operating across multiple sites, product lines, or regulatory frameworks, the operational overhead becomes significant enough that audit schedules slip and findings lose their follow-through.

A purpose-built QMS handles the infrastructure of the audit program: scheduling, checklists, finding documentation, CAPA generation, assignment and follow-up tracking, effectiveness verification, and management review inputs. Auditors access checklists in the system during the audit, log findings directly, and the system routes those findings to responsible owners with defined due dates. Nothing sits in an email.

When an FDA investigator arrives on-site and requests your audit records under the QMSR framework, the response is not a search through shared drives. It is a report generated from the system showing every scheduled audit, every completed audit, every finding logged, and every corrective action taken — with timestamps and electronic signatures throughout.

Cloudtheapp's Audit Management application covers the full audit lifecycle inside a single FDA-validated platform. Audit programs, individual audit plans, findings, nonconformity classification, CAPA linkage, and effectiveness verification all connect in one system with 60+ configurable applications built for regulated industries. Because the platform is configured to your specific processes and regulatory requirements, the audit checklists reflect your actual SOPs rather than generic templates.

Schedule a demo to see how Cloudtheapp manages the complete internal audit lifecycle in your environment.

This post created by and appeared first on Cloudtheapp

Somewhere between the intent to improve a manufacturing process and the actual implementation, quality systems fail. A formulation is adjusted to reduce costs. A supplier swaps a raw material. A software update changes how a batch record is generated. Each of these is a change, and in regulated industries, each one carries the potential to affect product safety, efficacy, or compliance if it happens without proper control.

Change management in a quality management system (QMS) is the structured process for proposing, evaluating, approving, implementing, and documenting changes before they affect production or released products. Under FDA regulations, ISO standards, and ICH guidance, it sits alongside CAPA and complaint handling as one of the three most critical post-market quality processes.

This article covers what change management requires across the main regulatory frameworks, the types of changes that need formal control, and where most organizations accumulate risk by treating some changes as exempt.

What Change Management Actually Covers in a QMS

Change management in a quality context covers more than product design updates. It applies to any modification that could affect:

• Product safety, performance, or efficacy
• Manufacturing processes, equipment, or facilities
• Quality system procedures, work instructions, or specifications
• Software used in production or quality data management
• Supplier-provided materials, components, or services
• Labeling, packaging, or storage conditions

The breadth of this scope is where organizations run into compliance problems. Teams often understand that design changes require formal approval. They are less consistent about applying the same rigor to facility changes, software updates, or supplier-initiated substitutions.

The Regulatory Framework

Medical Devices — QMSR and ISO 13485

Under the FDA's QMSR (21 CFR Part 820, effective February 2, 2026), change management for medical devices is governed by ISO 13485:2016, which the QMSR incorporates by reference. The relevant clauses cover change control at multiple levels:

ISO 13485 clause 7.3.9 (Design and development changes): Design changes must be identified, documented, reviewed, verified, validated (as appropriate), and approved before implementation. The review must assess whether the change affects in-process and finished products already delivered. For changes that affect regulatory submissions or the device's intended use, the review must also determine whether re-filing or regulatory notification is required.

ISO 13485 clause 6.3 (Infrastructure changes): When infrastructure changes affect product quality, organizations must evaluate and document the impact before implementation.

ISO 13485 clause 7.6 (Changes to control of monitoring and measuring equipment): Any change to the equipment or software used in measurement activities requires documented evaluation of impact on prior measurement results.

ISO 13485 clause 5.4 (QMS planning): When the organization determines that changes to the quality management system are needed, those changes must be planned and implemented in a way that maintains the system's integrity.

Under the QMSR, design change records must be retained in the Design History File, and any change affecting a cleared or approved device may require submission of a process change notification or a new 510(k) or PMA supplement to FDA, depending on whether the change affects safety or effectiveness.

Pharmaceutical cGMP — 21 CFR Part 211 and ICH Q10

For pharmaceutical manufacturers, change control requirements appear throughout 21 CFR Part 211 and are explicitly addressed in ICH Q10 (Pharmaceutical Quality System), which FDA adopted as guidance.

21 CFR 211.68 requires that changes to computerized systems be validated before implementation. 21 CFR 211.100 requires that written procedures for production and process controls be reviewed, approved, and dated before use, and that any revision follow a documented review and approval process.

ICH Q10 addresses change management directly in section 3.2, placing it as a core element of the pharmaceutical quality system alongside complaint management and CAPA. The guidance specifies that the change management system should:

• Define the scope of changes subject to formal control
• Include an assessment of potential impact on product quality, process capability, and regulatory status
• Require documented approval before implementation
• Ensure that changes are communicated to affected personnel before they go live
• Provide for post-implementation verification that the change achieved its intended effect

ICH Q10 also distinguishes between changes that require prior regulatory approval and those that can be implemented through internal notification. For post-approval changes to drug products, FDA's guidance on annual product reviews (21 CFR 314.81) and supplements (21 CFR 314.70) governs what must be filed versus what can be handled internally.

ISO 9001:2015 for General Manufacturing

ISO 9001:2015 addresses change management in two separate clauses that operate at different levels.

Clause 6.3 (Planning of changes): When an organization determines that changes to the QMS are needed, those changes must be carried out in a planned manner. The planning must consider the purpose of the change, potential consequences, the integrity of the QMS, the availability of resources, and responsibility and authority for the change.

Clause 8.5.6 (Control of changes): For production and service provision, organizations must review and control changes to the extent necessary to ensure continued conformity with requirements. They must retain documented information describing the results of the review, the personnel who authorized the change, and any necessary actions arising from the review.

Together, these clauses mean that ISO 9001 requires both high-level QMS planning for changes and operational controls at the production level.

Types of Changes That Require Formal Control

Most quality teams have a clear mental model of what requires change control: a design modification to a device, a new manufacturing process, a change to a critical raw material specification. The changes that get missed tend to fall into categories that feel routine:

"Equivalent" material substitutions. A supplier notifies a manufacturer that a component is moving to a new lot or grade but claims it is functionally equivalent. Without a formal evaluation, that substitution bypasses risk assessment and may not be captured in the Device History Record or Batch Record.

Software updates. Updates to ERP systems, LIMS, or QMS platforms that affect how production data is recorded, calculated, or reported require validation under 21 CFR Part 11 and ICH Q7. Many organizations apply patches without documenting the change's potential impact on data integrity.

Facility and utility changes. Moving a manufacturing line within a facility, adding HVAC capacity, or changing water system parameters each has the potential to affect product quality. These changes frequently skip change control because they are categorized as "infrastructure," not "product."

Procedure revisions. Updates to SOPs and work instructions that alter how a critical process is performed — even if the underlying requirement hasn't changed — should go through change control. FDA inspectors look at the version history of procedures associated with 483 findings to determine when a deficient practice was introduced.

Supplier-initiated changes. Under ISO 13485 clause 7.4 and 21 CFR Part 820, suppliers are required to notify manufacturers of changes that could affect product quality. But that notification is only useful if the manufacturer has a process for capturing it and routing it through change control.

The Change Control Process

A complete change control process follows five stages regardless of the industry or regulatory framework:

1. Change proposal. The requestor documents the proposed change, its rationale, and the scope of what will be modified. The proposal should identify the product, process, document, or system affected and provide enough detail for the impact assessment team to evaluate it.

2. Impact assessment. The evaluation determines how the change affects product safety, efficacy, process capability, regulatory submissions, validation status, and the existing risk register. For design changes under ISO 13485, the assessment must specifically determine whether the change invalidates prior verification or validation activities. For pharmaceutical changes, the assessment must identify whether the change triggers regulatory filing obligations.

3. Review and approval. The change request and its impact assessment are reviewed by appropriate functions — typically quality, regulatory, engineering, and operations, depending on the scope. Approval must be documented with reviewer names, roles, and dates.

4. Implementation. Once approved, the change is implemented according to the documented plan. This includes updating all affected documents, training affected personnel, updating validation records as required, and communicating the change to relevant parties — including suppliers and customers where appropriate.

5. Verification and closure. After implementation, the QMS must verify that the change was carried out as approved and that it achieved the intended effect without introducing new problems. This includes updating the audit trail with closure documentation, confirming that any required regulatory submissions were made, and archiving all change control records.

The "Minor Change" Exemption Problem

The most common change management failure pattern in FDA warning letters is not that companies have no change control process. It is that their change control procedure carves out a "minor change" or "administrative change" category, and that category gradually absorbs changes that should receive full review.

A labeling change is administrative — until it involves a claim that affects the device's intended use. A process parameter adjustment is minor — until it creates an out-of-spec rate. A software update is routine — until it changes how electronic signatures are applied to batch records.

When FDA inspectors examine change control records, they specifically review changes that were routed through the minor-change pathway. They look for evidence that the minor designation was justified by a documented rationale, not just assumed because the requestor didn't want to go through a full review.

Organizations with strong change management programs define "minor" with specific, enumerated criteria rather than a general description. If a proposed change doesn't fit the specific criteria, it goes through full review regardless of how simple it seems at submission.

Where Change Management Goes Wrong

Beyond the minor-change problem, change control failures in regulated industries tend to cluster around four patterns:

Retroactive documentation. Changes implemented first and documented after the fact. This is particularly common when engineering or operations teams make adjustments during production to solve an immediate problem. The fix works, but the change control record is filed after the batch has already shipped.

Incomplete impact assessments. Change proposals approved without a documented evaluation of impact on regulatory submissions, validation status, or supplier agreements. The most common version: a process change is assessed for product quality impact but no one checks whether it requires a 510(k) supplement or prior approval supplement for a drug application.

No post-implementation verification. Changes approved, implemented, and closed without documented evidence that the change achieved its intended effect. Under ICH Q10, post-implementation verification is explicitly required. Many organizations close change records at the point of implementation, not at the point of verified effectiveness.

Training not completed before implementation. Changes to procedures or processes go live before affected personnel are trained. This is identifiable during FDA inspections when training records show completion dates after the change implementation date.

Audits and Change Management Integration

Change management does not function in isolation. A well-built QMS connects change records to the documents, processes, and records they affect. When an internal audit identifies a gap, the corrective action often involves a procedure change — and that change needs to go through change control. When a complaint investigation reveals a product quality issue tied to a recent process adjustment, the link between the complaint, the root cause investigation, and the change record needs to be preserved and visible.

Organizations that manage change control in a spreadsheet or standalone system lose these connections. The change record exists, but it has no link to the CAPA it generated, the updated procedure it produced, or the validation records it modified.

Change Management in Cloudtheapp

Cloudtheapp's Change Management application manages the full change control workflow from proposal through impact assessment, approval, implementation, and verified closure. All records include electronic signatures with date and timestamp, meeting 21 CFR Part 11 requirements for audit trail integrity.

The platform connects change records directly to the documents, CAPA records, validation activities, and supplier records they affect. When a change modifies a procedure, the document control system automatically requires the updated version to go through its own review and approval workflow. When a change triggers a CAPA, the two records are linked and both must be closed before either is considered complete.

Cloudtheapp's built-in analytics surface open changes by status, age, type, and product, so management review meetings have documented input rather than verbal updates.

For quality teams managing change control across device and pharma portfolios, Cloudtheapp supports configurable workflows that match the specific requirements of QMSR, ISO 13485, ISO 9001, and ICH Q10 environments.

To see how a connected QMS handles change management from proposal to verified closure, request a demo at https://www.cloudtheapp.com/demo/.

This post created by and appeared first on Cloudtheapp

Complaint handling sits at the intersection of patient safety, post-market surveillance, and regulatory accountability. For medical device manufacturers and pharmaceutical companies, a complaint is not simply a customer service matter. It is a formal quality event with specific documentation, investigation, and reporting obligations that FDA inspectors review on nearly every site visit.

Getting this wrong carries real consequences. In FY2025, complaint handling deficiencies ranked among the top three FDA 483 observations for medical device manufacturers, trailing only CAPA gaps in frequency. FDA Form 483 observations tied to complaints have appeared in recent warning letters to companies including Noah Medical Corporation (April 2025) and Royal Philips (September 2025), where outsourced complaint handling functions lacked adequate oversight and MDR reporting timelines were missed.

This article covers what complaint handling requires under the current regulatory framework, how complaints connect to MDR obligations and CAPA, and where most organizations run into problems.

How the FDA Defines a Complaint

Under 21 CFR Part 820 (the Quality Management System Regulation, or QMSR), a complaint is any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution.

That definition is intentionally broad. A call from a hospital biomedical technician saying the device "didn't perform as expected" during a procedure qualifies as a complaint. An email from a distributor noting that packaging arrived damaged qualifies. A sales rep relaying that a customer mentioned difficulty calibrating the device qualifies — even if the customer never contacted the company directly.

The breadth of this definition is where many companies undercount their complaint volume. Organizations that only log formal written complaints from end users routinely miss verbal and field-reported events, which then surface as uncaptured complaints during FDA inspections.

Regulatory Framework: What the Rules Actually Require

Medical Devices — QMSR (21 CFR 820.35)

The FDA's QMSR, which took effect on February 2, 2026, replaced the legacy QSR under 21 CFR Part 820 and harmonized U.S. requirements with ISO 13485:2016. Complaint handling now lives at 21 CFR 820.35, which incorporates ISO 13485 clause 8.2.2 by reference.

The QMSR requires manufacturers to maintain procedures for receiving, reviewing, and evaluating complaints. Specifically, the regulation requires:

• A designated unit with written complaint handling procedures
• An evaluation of every complaint to determine whether it warrants investigation
• Documentation of the reason when a complaint is not investigated
• For complaints that are investigated: documentation of the device name, lot or batch number, date received, name and address of the complainant (if obtainable), nature of the complaint, reply to the complainant (if any), the dates and results of the investigation, and any corrective action taken
• Evaluation of whether the complaint represents an event that must be reported under 21 CFR Part 803 (Medical Device Reporting)

Complaints involving possible malfunction, injury, or death that fall under MDR criteria must be reviewed against reporting thresholds. Under 21 CFR Part 803, manufacturers must submit a 30-day MDR for deaths and serious injuries, and a 5-day report for malfunctions involving a device likely to cause or contribute to serious injury or death if it recurs.

Pharmaceuticals — 21 CFR Part 211 and ICH Q10

For pharmaceutical manufacturers, complaint handling requirements appear in 21 CFR Part 211.198 (for drug manufacturers) and are reinforced by ICH Q10, the pharmaceutical quality system guidance that FDA formally adopted.

21 CFR Part 211.198 requires:

• Written procedures for handling written and oral complaints about drug products
• Designated responsibility for review and evaluation of complaints
• Investigation of any complaint involving the possible failure of a drug product to meet its specifications, or any complaint involving contamination or an unexpected adverse reaction
• Review of complaint records at regular intervals to identify trends that may require corrective action
• Retention of complaint records for at least one year after the expiration date of the batch or lot

ICH Q10 places complaint management within the pharmaceutical quality system's continual improvement framework. Section 3.2 of ICH Q10 lists complaint, deviation, deviation CAPA, and change management processes as core elements of the quality system. The guidance makes clear that trending complaints for signals is expected behavior, not an optional practice.

ISO 13485 Clause 8.2.2

For medical device manufacturers operating under ISO 13485:2016, clause 8.2.2 covers complaint handling as part of feedback from post-production. The standard requires organizations to establish a procedure for handling complaints that includes:

• Determination of whether the event requires reporting to regulatory authorities
• Timely handling of complaints
• Root cause investigation and corrective action where appropriate
• Communication with regulators when required

ISO 13485 also connects complaint handling to post-market surveillance (clause 8.2.1), which requires manufacturers to collect and analyze data from post-production experience, including customer complaints, field service reports, and publicly available data.

The Five Core Steps of an Effective Complaint Handling Process

Regardless of whether a company operates under QMSR, 21 CFR Part 211, or ISO 13485, an effective complaint handling process follows the same logic:

1. Capture and intake. Every complaint must be logged, regardless of source. This includes verbal reports from sales reps, field service technicians, customer support calls, distributor feedback, and social media reports where they can be tied back to a product performance issue. The intake record should capture the date received, product identity, lot or batch, and nature of the event.

2. MDR/regulatory reportability determination. For device manufacturers, every complaint must be evaluated for MDR reportability before investigation begins. The review should be documented. If the complaint does not meet MDR criteria, the reason must be recorded. MDR evaluations have specific clock starts — for death or serious injury events, the 30-day window begins from the date the manufacturer becomes aware, not the date the complaint is formally logged.

3. Investigation decision. The QMS must document whether each complaint warrants full investigation. When the decision is "no investigation required," the reason must be explicitly recorded. FDA inspectors look specifically at not-investigated complaints to check whether companies are using that designation appropriately or using it to suppress inconvenient events.

4. Investigation and documentation. Investigated complaints require documentation of findings, the device or lot involved, any adverse event investigation performed, and any corrective action taken. Investigation timelines should be defined in your procedure. An open-ended complaint investigation with no closure date is a common 483 finding.

5. Trending and CAPA escalation. Individual complaints feed into periodic trending reviews. When trend analysis identifies a pattern — same failure mode, same product family, same market geography — the QMS must have a mechanism to escalate that pattern into a formal CAPA process.

When a Complaint Becomes an MDR

Not every complaint triggers an MDR submission. The MDR threshold under 21 CFR Part 803 requires the event to involve a device that may have caused or contributed to a death or serious injury, or a malfunction that would likely cause or contribute to serious injury if it recurred.

In practice, the MDR evaluation is where complaint files most often fail during inspections. Common failure patterns include:

• Events logged as complaints but MDR evaluation never documented
• MDR evaluation performed but the 30-day clock calculated from the wrong date (investigation close date instead of awareness date)
• Complaints closed without MDR review because they were categorized as "use error" rather than device malfunction, without documented rationale
• Outsourced MDR functions where the contract manufacturer performed the submission but the device manufacturer lacked oversight documentation — the Royal Philips situation in September 2025

Companies that manage MDR evaluations inside their complaint handling workflow — rather than as a separate manual process — have fewer 483 observations in this area. When MDR evaluation is a discrete documented step in the complaint record itself, with a checkbox and a date, it is much harder to miss.

Complaint Trending and Its Role in CAPA

Trending is where complaint handling moves from a reactive documentation task to an actual quality management function.

Under both QMSR and ICH Q10, manufacturers are expected to analyze complaint data at defined intervals to detect signals. That means periodic reviews — typically monthly or quarterly — that look at complaint volume by product, complaint type, failure mode category, market geography, and lot.

A single complaint about a catheter detaching during use may not trigger a CAPA. Fifteen complaints about the same catheter lot over six weeks should. The question FDA asks is whether your trending process would have caught that pattern and whether your procedure defines the threshold at which a trend escalates to formal corrective action.

The risk register for a product should also be updated when trending data reveals failure modes not anticipated during the original risk analysis. Complaint data is a post-market input to risk management under both ISO 13485 and QMSR.

Trending records belong in the audit trail. If you review complaint data monthly and make documented trend decisions, those decisions need to be preserved with timestamps and review signatures. An undocumented verbal review of complaint trends satisfies no one during an FDA inspection.

Where FDA 483 Observations Come From

Based on FDA inspection data and published warning letters from 2024 and 2025, the most frequent complaint handling deficiencies observed by inspectors cluster around five failure patterns:

Undercounting complaints. Companies that train only their quality team to recognize complaints — rather than field service, sales, and customer support — routinely miss events. FDA inspectors specifically ask to interview non-quality employees to test whether the intake training is working.

Inadequate investigation documentation. Investigation records that say "complaint reviewed, no action required" without documenting what was reviewed, what data was examined, and what rationale was used for the no-action determination. The Noah Medical Corporation warning letter in April 2025 cited procedures that described investigation steps but lacked documented evidence those steps were performed.

MDR timing failures. Complaints evaluated for MDR reportability with the clock starting from investigation close rather than date of awareness. FDA calculates MDR timeliness from when the manufacturer had information suggesting the device may have caused the event.

Closed complaints with open CAPA. Complaints marked closed in the system while the associated corrective action is still in progress. The complaint record should remain open or linked until the corrective action is verified effective.

No complaint trending program. Companies that evaluate individual complaints but have no documented periodic trend analysis. This is most often found in smaller manufacturers where QA resources are limited and trending is handled informally.

What a Well-Functioning Complaint Handling System Looks Like

Organizations with low complaint-related 483 observations share a few structural characteristics. Their complaint intake process reaches every customer-facing function, not just quality. Their MDR evaluation is a documented step within the complaint record, with a checkbox and a date, not a downstream process that runs parallel and disconnected.

Their investigation timelines are procedurally defined — typically 30 or 45 days for standard complaints, shorter for potential MDR events — and complaint records do not close without documented investigation outcomes. Trending runs on a fixed calendar with documented outputs that connect directly to the CAPA process when thresholds are crossed.

The QMS captures all of this in one system. When complaint handling, MDR evaluation, CAPA, and trending live in separate spreadsheets or disconnected databases, the linkages break down, and that is exactly what FDA inspectors find.

Complaint Handling in Cloudtheapp

Cloudtheapp's Complaints application within the eQMS platform manages the full complaint handling workflow from intake through MDR evaluation, investigation, and CAPA escalation. All records include a complete, tamper-evident audit trail that meets 21 CFR Part 11 electronic records requirements.

The platform's built-in analytics surface complaint trends by product, lot, failure category, and time period, so trending reviews produce documented outputs rather than informal summaries. When a trend crosses a defined threshold, a CAPA can be initiated directly from the trend record, preserving the link between post-market signal and corrective action.

For teams managing both medical device and pharmaceutical complaint obligations, Cloudtheapp supports configurable workflows that match the specific procedural requirements of QMSR, ISO 13485, and ICH Q10 environments.

If your complaint handling process is built around spreadsheets and manual MDR tracking, request a demo at https://www.cloudtheapp.com/demo/ to see how a purpose-built QMS handles the workflow from first report to closed corrective action.

This post created by and appeared first on Cloudtheapp