Inspections after QSIT: a practical read of the current compliance program

Almost every device manufacturer in the United States has an inspection readiness procedure organized around the four QSIT subsystems: management controls, design controls, corrective and preventive action, and production and process controls. Front-room scripts, back-room retrieval maps, subject matter expert assignments and rehearsal plans are all built on that structure.

FDA retired QSIT and the legacy device compliance programs when the QMSR took effect. Inspections now run under a new compliance program, and the structure is different enough that procedures built on the old one no longer describe what will happen.

What replaced the four subsystems

Inspections are now organized around six QMS Areas:

• Change control
• Design and development
• Management oversight
• Measurement, analysis and improvement
• Outsourcing and purchasing
• Production and service provision

Alongside these sit four other applicable FDA requirements that are not part of the QMSR itself but are covered in the same inspection: medical device reporting, corrections and removals, device tracking, and unique device identification.

Two of the six are worth pausing on. Change control is now a named area in its own right rather than an element inside other subsystems — which reflects how often change management sits underneath findings elsewhere. And management oversight is now a named area at a moment when management review records have become inspectable. Those two changes interact.

Inspection models

The program describes more than one approach. In broad terms, most surveillance and for-cause inspections allow the investigator to select elements on a risk basis, covering at least one element in each QMS Area. A second, more prescriptive model applies to certain baseline surveillance and premarket approval pre-approval contexts, where specific elements are mandatory.

The practical implication is that you can no longer predict the inspection path from the inspection type alone. Preparation that covers only the areas an investigator “always” looks at is preparation for a program that no longer exists.

The end of statistical sampling

Under QSIT, record review followed defined sampling conventions. That structure is gone. Record selection is now discretionary and risk-driven, and an investigator can expand the scope of an inspection while it is in progress based on what the records show.

This changes back-room work more than front-room work. Under a sampling regime, a team could reasonably anticipate which records would be pulled. Under a risk-driven regime, the practical requirement is that any record within a covered area can be retrieved quickly and is complete when it arrives. Retrieval time is now a compliance signal, because slow retrieval invites more requests.

Findings are cited against ISO clauses

Observations now reference ISO 13485 clauses. That has three consequences worth planning for:

• Your procedures should be traceable to clauses, not only to CFR sections, so a citation can be mapped to an owner immediately.
• Staff who know the regulation by its old subpart numbering need to know the clause structure well enough to follow the questioning.
• Your internal audit program should already be auditing against the clause structure. If it is not, your internal findings and FDA’s will not be expressed in the same language, which makes trend comparison useless.

What to change in your readiness procedure

Front room

Rebuild the subject matter expert map against the six QMS Areas and the four other applicable requirements. Confirm who speaks to change control as a topic in its own right — in many organizations, nobody currently owns that narrative. Prepare management for direct questioning under management oversight.

Back room

Test retrieval, not just availability. Pick records at random within each QMS Area and time the retrieval end to end, including any approval step. Where retrieval depends on one person, that is a single point of failure that an inspection will find.

Rehearsal

A mock inspection built on QSIT rehearses the wrong thing. Run the mock against the current program: risk-based element selection, discretionary record requests, and at least one deliberate mid-inspection escalation to test how the team responds when the scope widens.

Records that are now visible

Management review minutes, internal audit reports and supplier audit reports are inspectable under the QMSR. Review the open items in all three before an investigator does.

The underlying point

The program change is not a trap. It is a shift from a checklist that could be rehearsed to an approach that follows evidence. Organizations whose quality systems are genuinely governed will find the new approach no harder than the old one, and possibly easier, because a risk-driven investigator following good evidence tends to find good evidence.

Organizations that were prepared for QSIT specifically — rather than prepared in general — will find out during the inspection.