Risk Management Tops FDA Citations of Device Makers Under QMSR, Official Says

Risk management remains the top reason FDA investigators cite medical device makers for failing to meet quality management requirements, a Center for Devices and Radiological Health official told the RAPS Quality Conference in Baltimore, Regulatory Focus reported on June 10.

Keisha Thomas, CDRH's associate director for compliance and quality, spoke about four months after the Quality Management System Regulation, or QMSR, took effect. According to the FDA's QMSR page, the rule became effective on February 2, 2026, and incorporates by reference the international standard ISO 13485:2016. On the same date the agency stopped using its Quality System Inspection Technique and began inspecting under compliance program 7382.850.

What investigators are citing

Based on the latest inspections and Form 483 observations, Thomas said the top QMSR issues cited against firms are risk management, followed by corrective action, risk-based approach, complaint handling and purchasing, according to the report. She said it was a little early to draw conclusions about trends, and that the agency is seeing the same citations it saw before the QMSR, but in a different order.

On risk management, investigators are citing firms for a lack of processes and evidence showing that risk management is rooted in their decision-making, Thomas said. Companies may have risk management files and processes but are not applying them holistically or systematically across all quality system areas, she said.

"Our inspection approach is risk-based, not only the selection model for determining who gets inspected, but also the approach itself," Thomas said. She said investigators review pre-inspection information such as medical device reports, recalls and complaints, that there are no standardized sampling tables, and that investigators now look at all six quality system areas rather than selected ones. Although the FDA has aligned with ISO 13485, she said, its inspections are not audits: they are meant to check compliance with FDA requirements rather than conformity to the standard.

Corrective and preventive actions decoupled

Thomas said that under the new standard, corrective actions and preventive actions have been separated, and that the agency is seeing poorly executed corrective actions. "You won't hear us say CAPA too much anymore," she said, according to the report.

She also said firms in the Medical Device Single Audit Program, which typically are audited rather than inspected, may now be inspected under the risk-based site selection model. "If we've got any type of signal that's telling us we should be there, [such as] increasing complaints, MDRs, number of recalls, those types of things may signal that an MDSAP firm probably needs a little bit of visibility for us," she said. She noted there are three times as many MDSAP audits each year as FDA inspections.

Asked how to define risk for every quality area, Thomas said the agency expected companies to treat each category with risk in mind. "It should be fluid and evolving, and I think that's the message that you take back," she said.