Your management review minutes are now FDA evidence

For decades, one short provision in 21 CFR Part 820 gave device manufacturers a specific and unusual protection: management review records, internal quality audit reports and supplier audit reports were generally not subject to review by an FDA investigator during a routine inspection. The reasoning was sound — candid self-assessment is more valuable than defensive self-assessment, and organizations will only be candid if candour is not immediately punished.

That protection did not carry over into the Quality Management System Regulation. FDA has stated the position directly in its own guidance material. As of 2 February 2026, those records are inspectable.

Why this is a bigger change than it looks

The obvious consequence is that an investigator can now ask for the minutes. The less obvious — and more significant — consequence is that a decade of records were written on the assumption that no external reader would ever see them.

Management review minutes in most organizations are internal shorthand. They reference issues by nickname. They record decisions without the reasoning. They contain action items assigned to initials, with dates that moved and were never restated. Internal audit reports often use grading conventions that make sense only to the audit team, and findings frequently sit open long past their committed closure dates because internal audit closure was never externally visible.

None of that was negligent. It was rational under the previous rule. It is now a body of evidence.

What an investigator will actually look for

Management oversight is one of the six QMS Areas under the current device inspection compliance program, which means it is not an incidental line of enquiry. The questions are predictable:

• Does management review happen at the defined interval, and is that interval justified?
• Do the reviews cover the required inputs — audit results, feedback and complaints, process and product conformity, corrective and preventive action status, follow-up from previous reviews, changes affecting the quality system, regulatory requirement changes, and recommendations for improvement?
• Do the reviews produce decisions and actions, or do they produce a status update?
• Are actions from previous reviews closed, and is closure evidenced?
• Where a known problem existed, did management review see it — and what did management do?

The last question is the sharp one. If an investigator finds a systemic problem, and management review minutes show the problem was visible to executives for two years without effective action, the finding shifts from a process failure to a management failure. That is a different category of citation.

Internal audit is the same exposure

Internal audit reports carry the same change and a similar risk. A mature internal audit function finds real problems — that is what it is for. The exposure is not the findings; it is findings that were raised, agreed, assigned and then left open. An open internal audit finding past its committed date is a self-authored citation.

The right response is not to weaken internal audit. An audit program that stops finding things is worse than useless, because it removes the organization’s own early warning while leaving the underlying problems in place. The right response is to close what you raise, on time, with evidence.

What to do about the records you already have

There is no requirement to rewrite history, and attempting to do so would be its own problem. There is, however, a reasonable programme of work:

• Review the open items. Every open management review action and every open internal audit finding, with its original date. Close what can be closed on existing evidence. Re-baseline the rest with realistic dates and a documented rationale for the change.
• Check that recorded decisions are intelligible. Minutes that say “discussed and agreed” should say what was agreed and on what basis. Going forward, write minutes that a competent outsider could follow.
• Verify the inputs are complete. If the standard requires an input and your review has not covered it, that gap is visible in the record.
• Prepare the executives. Management oversight questioning is directed at management. Executives who have never been asked to explain a quality decision to an investigator should rehearse doing so.

The uncomfortable part

Some organizations will respond to this change by making their management review records blander. That is a mistake, and a visible one. A management review that records no problems, in an organization with open CAPAs and audit findings, tells an investigator either that management is not being informed or that the record is not honest. Neither reading helps.

The better response is to make the record complete rather than comfortable: problems named, decisions reasoned, actions assigned, closure evidenced. That record defends the organization. The sanitized version does not.