Can FDA inspectors now see management review, internal audit and supplier audit reports?

1What changed on 2 February 2026.

The Quality System (QS) regulation required device records to be “readily available for review and copying by FDA employee(s)”. Section 820.180(c) said that requirement did not apply to the reports of management reviews under § 820.20(c), quality audits under § 820.22, or supplier audits used to meet § 820.50(a), though it did apply to the procedures for them. Instead, on request, “an employee in management with executive responsibility shall certify in writing” that the reviews and audits had been performed and documented, on what dates, and that any required corrective action had been undertaken.¹

FDA’s final rule of 2 February 2024 replaced the QS regulation with the Quality Management System Regulation (QMSR), effective 2 February 2026.² Part 820 now requires a documented quality management system that complies with ISO 13485:2016, which it incorporates by reference, together with FDA’s own additions. Records are controlled under ISO 13485 Clause 4.2.5 and § 820.35. Sections 820.20 to 820.30, and the subpart that held § 820.180, are now reserved.³

FDA’s QMSR FAQ asks the question directly and answers: “Yes. The QMSR gives the FDA the authority to inspect management review, quality audits, and supplier audit reports. The exceptions that existed in the QS regulation at § 820.180(c) are not maintained in the QMSR.”⁴

2Why FDA dropped the exception.

Numerous comments on the proposed rule asked FDA to keep the 820.180(c) exceptions, or to clarify whether the records were exempt from inspector access. One noted that the QSIT guide also treated management review, internal audit and supplier audit records as exempt, and several argued that the exception was needed to keep audit and management review reports complete and useful.²

FDA disagreed, and gave these reasons in the preamble:²

• Harmonisation: the exceptions “are not available to manufacturers being inspected by other regulators or being audited by other entities (e.g., MDSAP auditing organizations)”, so those manufacturers face no extra burden.
• The records “are maintained in the regular course of business and should be readily available”.
• Investigators had already had access to the data that informs management review, such as nonconformances and complaints, and to corrective actions arising from internal and supplier audits.
• Robust management review and internal and supplier audit programmes are “fundamental to the culture of quality” that FDA expects firms to embrace.

3How inspections reach these records now.

On 2 February 2026 FDA stopped using QSIT and began inspecting under Compliance Program 7382.850, Inspection of Medical Device Manufacturers, which replaced Compliance Programs 7382.845 and 7383.001.⁴ The Compliance Program organises the QMSR into six QMS areas and four other applicable FDA requirements. Management review, ISO 13485 Clauses 5.6.1 to 5.6.3, is an element of the Management Oversight area; internal audits, Clause 8.2.4, belong to Measurement, Analysis and Improvement; and the purchasing process, Clause 7.4.1, to Outsourcing and Purchasing.⁵

Each inspection type uses one of two models. Under model 1, the investigator selects at least one element in each QMS area, guided by product risk. Under model 2, specific elements must be evaluated at minimum, and they include both Management Review and Internal Audits.⁵

Records are selected from the product risks the investigator has identified, and in most cases several are reviewed. Where requirements are not met, the investigator should collect the relevant records to support the observation.⁵ Surveillance inspections are not conducted at sites actively enrolled in the Medical Device Single Audit Program (MDSAP), though those sites may still receive compliance follow-up or for-cause inspections.⁵ An ISO 13485 certificate does not exempt a manufacturer from FDA inspection.⁴

4What device manufacturers should have ready.

FDA recommends that firms be prepared to discuss and provide records that demonstrate compliance with the QMSR, and says management review and audit records “should be readily available upon inspection”.⁴ Two further points from FDA’s text:

• Investigators may review records that are part of the manufacturer’s quality management system, including those created before 2 February 2026. FDA suggests a comparative analysis may help show that earlier documents and records meet the QMSR.⁴
• Records a manufacturer considers confidential may be marked to help FDA decide whether they can be disclosed under its public information regulation in part 20. FDA kept this provision from the old § 820.180.³²

5Whether the drug side is different.

The QMSR governs finished devices.³ For drugs, FDA’s CGMP records Q&A says that Parts 210 and 211 “do not specifically address the requirement to conduct, or to keep records of, internal quality assurance audits”. A firm may discard a routine audit report once all corrections have been verified, but documentation of any corrective action, and any investigation into affected batches, must be kept and is open to inspection. Investigations of complaints, vendor qualification, periodic reviews of records and failure investigations are not internal audits, and are subject to inspection.⁶

Compliance Policy Guide Sec. 130.300 applies to any regulated entity with a written quality assurance programme. In routine inspections, FDA “will not review or copy” reports and records from audits of that programme, and may seek written certification that they were performed and documented and that required corrective action was taken. FDA still reviews such reports in directed or for-cause inspections of a clinical investigation’s sponsor or monitor, in litigation, and under inspection or search warrants. It also keeps access to required records of quality control investigations into product failures and manufacturing errors. Its policy text still names audits under 21 CFR 820.22, a section the QMSR has reserved.⁷³ FDA’s 2006 quality systems guidance for drug manufacturers cites the same policy for internal audits.⁸ The CPG is still listed as final, and its page now carries a note that it was issued before the QMSR rule, that compliance policy guides are not binding, and a link to the QMSR FAQ.⁷

6How it runs in Seal.

Now that FDA can inspect these reports, it helps if each one can be traced to the records it summarises. In Seal’s audit management workflow, supplier and internal audits run from one programme, an evidence package references each source record at the version selected for it, and a finding links its assessment, change and verification as separate records, each with its own owner and state. Management review reads audit and inspection results from those records rather than from a summary assembled for the meeting.

During an inspection, inspection readiness keeps each request’s wording, owner, evidence, redactions and delivery, and a delivered package keeps its source record versions, reviewers and recipient, so you can show later exactly what was shared. For device makers, the medical device blueprint keeps supplier approvals, received lots and supplier changes connected to the specifications and configurations they reach. Mapping the configured system to the QMSR and ISO 13485 remains your team’s work, since a workflow does not itself demonstrate conformity.