FDA QSR / QMSR Audit Prep
Operational playbook for FDA inspection preparation under Quality System Regulation (21 CFR 820) and the transitioning Quality Management System Regulation (QMSR, fully effective 2026, harmonizing with ISO 13485:2016).
When to use this skill vs. fda-consultant-specialist:
- This skill: FDA inspection imminent OR 483/Warning Letter received; need sprint
- fda-consultant-specialist: building / maintaining QMS; multi-quarter
When to use this skill
| Situation |
Skill applies |
| FDA inspection announced (or unannounced visit imminent) |
Yes — start immediately |
| Form 483 observation received |
Yes — scripts/qsr_readiness_score.py to assess + plan response |
| Warning Letter received |
Yes — plus engage outside FDA counsel |
| Annual readiness assessment |
Yes — periodic sprint |
| Building QMS from scratch |
Use ra-qm-team/fda-consultant-specialist |
| Medical device submission (510k / PMA) |
Use ra-qm-team/fda-consultant-specialist |
The audit-prep sprint at a glance
2-week sprint (announced inspection, mature QMS)
Week 1: Inventory, walkthrough rehearsal, gap remediation
Week 2: Inspection week (front room + back room operation)
8-week sprint (gaps identified, scheduled inspection)
Weeks 1-2: Readiness assessment + 483 / WL prior issue review
Weeks 3-6: Gap remediation (DHF, CAPA, complaint records, etc.)
Weeks 7-8: Mock inspection + final remediation + inspection prep
Reactive: 483 / Warning Letter response
- 483: 15 business days to respond (then ongoing)
- Warning Letter: 15 business days to respond (then full corrective action plan)
- Approach: Acknowledge + investigate root cause + corrective action plan + commitment + evidence
QSR / QMSR key audit areas
| 21 CFR 820 Subpart |
Topic |
Audit focus |
| Subpart B |
Quality system |
Management responsibility, quality policy, planning |
| Subpart C |
Design controls |
Design history file (DHF), design reviews, V&V |
| Subpart D |
Document controls |
Document approval, change control, distribution |
| Subpart E |
Purchasing controls |
Supplier qualification, agreements, evaluations |
| Subpart F |
Identification and traceability |
Product ID, lot/batch traceability |
| Subpart G |
Production and process controls |
Process validation, environmental controls, equipment maintenance |
| Subpart H |
Acceptance activities |
Receiving, in-process, finished device acceptance |
| Subpart I |
Nonconforming product |
Identification, segregation, disposition |
| Subpart J |
Corrective and preventive action (CAPA) |
CAPA process, root cause analysis, effectiveness verification |
| Subpart K |
Labeling and packaging |
Label inspection, packaging validation |
| Subpart L |
Handling, storage, distribution |
Procedures, shelf-life, distribution records |
| Subpart M |
Records |
Device Master Record (DMR), Device History Record (DHR), QSR records |
| Subpart N |
Servicing |
Servicing procedures, complaint review |
| Subpart O |
Statistical techniques |
Sampling, statistical methods |
QMSR transition (effective Feb 2026): Harmonizes 21 CFR 820 with ISO 13485:2016. Adds requirements for risk management (ISO 14971), software lifecycle (IEC 62304), usability (IEC 62366).
Clarify First
Before running the audit-prep, confirm these inputs. If any is unknown or vague, ASK — do not assume:
Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the readiness assessment.
Quick start
- Run readiness score:
python3 scripts/qsr_readiness_score.py --config qsr-controls.yaml
- Check DHF completeness for in-scope devices:
python3 scripts/dhf_completeness_checker.py --dhf device-dhf.yaml
- Pick sprint length based on score + known issues
- Execute sprint per references/fda-qsr-pre-inspection-checklist.md
Common FDA inspection findings (highest 483 / Warning Letter trigger)
- CAPA failures — root cause not addressed, ineffective corrective action
- Complaint handling — complaints not investigated, MDR (Medical Device Reporting) missed
- Design controls (Subpart C) — DHF incomplete, V&V gaps, no design reviews
- Process validation — processes not validated, validation stale
- Supplier controls — suppliers not qualified, agreements missing, evaluations skipped
- Document control — old procedures in use, no document approval evidence
- Management responsibility — no management review, no quality policy, no objectives
- Records (DHR) — incomplete records, missing lot traceability
See references/483-warning-letter-prevention.md for prevention patterns + response templates.
Inspection-week operations
Front room (where inspector works)
- Designated front room (conference room, not someone's office)
- Front-room lead (often Quality Manager) accompanies inspector all day
- All requests routed through front-room lead
- Inspector requests evidence; front-room asks back-room
Back room (where requests are fulfilled)
- Cross-functional team available
- Document retrieval, witness preparation, technical questions answered
- Inspector requests evidence; back-room delivers (filtered through front-room lead)
Daily debrief
- End of each inspection day: review what was inspected, observations, next-day topics
- Prepare overnight any evidence needed for next day
After inspection
- Form 483 review (if issued): consult with QA Lead + outside counsel
- 15 business days to respond
- Full corrective action plan
- Ongoing engagement with FDA office
Tooling
| Script |
Purpose |
scripts/qsr_readiness_score.py |
Score current QSR/QMSR state per subpart |
scripts/dhf_completeness_checker.py |
Validate Design History File completeness per device |
References
- fda-qsr-pre-inspection-checklist.md — full pre-inspection punch list per subpart
- 483-warning-letter-prevention.md — common triggers + prevention + response patterns
Related skills
ra-qm-team/fda-consultant-specialist — deep FDA program (510k, PMA, QMSR build)
ra-qm-team/quality-manager-qms-iso13485 — ISO 13485 QMS (QMSR harmonized)
ra-qm-team/risk-management-specialist — ISO 14971 (required for QMSR)
ra-qm-team/capa-officer — CAPA process specialist
ra-qm-team/qms-audit-expert — internal/external QMS audits
ra-qm-team/audit-prep/compliance-readiness — multi-framework readiness
1---2name: fda-qsr-audit-prep3description: FDA Quality System Regulation (21 CFR 820 / QMSR) audit-prep playbook for medical devices. Use when an FDA inspection is announced, when preparing for the new QMSR (2026), or when a 483 / Warning Letter response is needed.4license: MIT + Commons Clause5---6
7# FDA QSR / QMSR Audit Prep
8
9Operational playbook for FDA inspection preparation under Quality System Regulation (21 CFR 820) and the transitioning Quality Management System Regulation (QMSR, fully effective 2026, harmonizing with ISO 13485:2016).
10
11When to use this skill vs. fda-consultant-specialist:
12- **This skill**: FDA inspection imminent OR 483/Warning Letter received; need sprint
13- **fda-consultant-specialist**: building / maintaining QMS; multi-quarter
14
15---
16
17## When to use this skill
18
19| Situation | Skill applies |
20|-----------|---------------|
21| FDA inspection announced (or unannounced visit imminent) | Yes — start immediately |
22| Form 483 observation received | Yes — `scripts/qsr_readiness_score.py` to assess + plan response |
23| Warning Letter received | Yes — plus engage outside FDA counsel |
24| Annual readiness assessment | Yes — periodic sprint |
25| Building QMS from scratch | Use `ra-qm-team/fda-consultant-specialist` |
26| Medical device submission (510k / PMA) | Use `ra-qm-team/fda-consultant-specialist` |
27
28---
29
30## The audit-prep sprint at a glance
31
32### 2-week sprint (announced inspection, mature QMS)
33
34```
35Week 1: Inventory, walkthrough rehearsal, gap remediation
36Week 2: Inspection week (front room + back room operation)
37```
38
39### 8-week sprint (gaps identified, scheduled inspection)
40
41```
42Weeks 1-2: Readiness assessment + 483 / WL prior issue review
43Weeks 3-6: Gap remediation (DHF, CAPA, complaint records, etc.)
44Weeks 7-8: Mock inspection + final remediation + inspection prep
45```
46
47### Reactive: 483 / Warning Letter response
48
49```
50- 483: 15 business days to respond (then ongoing)
51- Warning Letter: 15 business days to respond (then full corrective action plan)
52- Approach: Acknowledge + investigate root cause + corrective action plan + commitment + evidence
53```
54
55---
56
57## QSR / QMSR key audit areas
58
59| 21 CFR 820 Subpart | Topic | Audit focus |
60|--------------------|-------|-------------|
61| Subpart B | Quality system | Management responsibility, quality policy, planning |
62| Subpart C | Design controls | Design history file (DHF), design reviews, V&V |
63| Subpart D | Document controls | Document approval, change control, distribution |
64| Subpart E | Purchasing controls | Supplier qualification, agreements, evaluations |
65| Subpart F | Identification and traceability | Product ID, lot/batch traceability |
66| Subpart G | Production and process controls | Process validation, environmental controls, equipment maintenance |
67| Subpart H | Acceptance activities | Receiving, in-process, finished device acceptance |
68| Subpart I | Nonconforming product | Identification, segregation, disposition |
69| Subpart J | Corrective and preventive action (CAPA) | CAPA process, root cause analysis, effectiveness verification |
70| Subpart K | Labeling and packaging | Label inspection, packaging validation |
71| Subpart L | Handling, storage, distribution | Procedures, shelf-life, distribution records |
72| Subpart M | Records | Device Master Record (DMR), Device History Record (DHR), QSR records |
73| Subpart N | Servicing | Servicing procedures, complaint review |
74| Subpart O | Statistical techniques | Sampling, statistical methods |
75
76**QMSR transition (effective Feb 2026)**: Harmonizes 21 CFR 820 with ISO 13485:2016. Adds requirements for risk management (ISO 14971), software lifecycle (IEC 62304), usability (IEC 62366).
77
78---
79
80## Clarify First
81
82Before running the audit-prep, confirm these inputs. If any is unknown or vague, ASK — do not assume:
83
84- [ ] **Trigger** — announced inspection, Form 483 received, Warning Letter, or annual readiness (chooses between the sprint track and the reactive 15-day response track, and sets deadlines)
85- [ ] **Framework** — legacy QSR (21 CFR 820) vs QMSR (ISO 13485-harmonized, effective Feb 2026) (changes which requirements and subparts apply)
86- [ ] **QMS maturity and known issues** — mature vs gaps, plus prior 483/WL findings (picks the 2-week vs 8-week sprint)
87
88Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the readiness assessment.
89
90## Quick start
91
921. **Run readiness score**: `python3 scripts/qsr_readiness_score.py --config qsr-controls.yaml`
932. **Check DHF completeness for in-scope devices**: `python3 scripts/dhf_completeness_checker.py --dhf device-dhf.yaml`
943. **Pick sprint length** based on score + known issues
954. **Execute sprint** per [references/fda-qsr-pre-inspection-checklist.md](references/fda-qsr-pre-inspection-checklist.md)
96
97---
98
99## Common FDA inspection findings (highest 483 / Warning Letter trigger)
100
1011. **CAPA failures** — root cause not addressed, ineffective corrective action
1022. **Complaint handling** — complaints not investigated, MDR (Medical Device Reporting) missed
1033. **Design controls (Subpart C)** — DHF incomplete, V&V gaps, no design reviews
1044. **Process validation** — processes not validated, validation stale
1055. **Supplier controls** — suppliers not qualified, agreements missing, evaluations skipped
1066. **Document control** — old procedures in use, no document approval evidence
1077. **Management responsibility** — no management review, no quality policy, no objectives
1088. **Records (DHR)** — incomplete records, missing lot traceability
109
110See [references/483-warning-letter-prevention.md](references/483-warning-letter-prevention.md) for prevention patterns + response templates.
111
112---
113
114## Inspection-week operations
115
116### Front room (where inspector works)
117
118- Designated front room (conference room, not someone's office)
119- Front-room lead (often Quality Manager) accompanies inspector all day
120- All requests routed through front-room lead
121- Inspector requests evidence; front-room asks back-room
122
123### Back room (where requests are fulfilled)
124
125- Cross-functional team available
126- Document retrieval, witness preparation, technical questions answered
127- Inspector requests evidence; back-room delivers (filtered through front-room lead)
128
129### Daily debrief
130
131- End of each inspection day: review what was inspected, observations, next-day topics
132- Prepare overnight any evidence needed for next day
133
134### After inspection
135
136- Form 483 review (if issued): consult with QA Lead + outside counsel
137- 15 business days to respond
138- Full corrective action plan
139- Ongoing engagement with FDA office
140
141---
142
143## Tooling
144
145| Script | Purpose |
146|--------|---------|
147| `scripts/qsr_readiness_score.py` | Score current QSR/QMSR state per subpart |
148| `scripts/dhf_completeness_checker.py` | Validate Design History File completeness per device |
149
150---
151
152## References
153
154- [fda-qsr-pre-inspection-checklist.md](references/fda-qsr-pre-inspection-checklist.md) — full pre-inspection punch list per subpart
155- [483-warning-letter-prevention.md](references/483-warning-letter-prevention.md) — common triggers + prevention + response patterns
156
157---
158
159## Related skills
160
161- `ra-qm-team/fda-consultant-specialist` — deep FDA program (510k, PMA, QMSR build)
162- `ra-qm-team/quality-manager-qms-iso13485` — ISO 13485 QMS (QMSR harmonized)
163- `ra-qm-team/risk-management-specialist` — ISO 14971 (required for QMSR)
164- `ra-qm-team/capa-officer` — CAPA process specialist
165- `ra-qm-team/qms-audit-expert` — internal/external QMS audits
166- `ra-qm-team/audit-prep/compliance-readiness` — multi-framework readiness