FDA has completed its first 100+ inspections under the QMSR, and the agency’s top observation area isn’t a paperwork technicality — it’s risk management. Clara looks at what “risk as a living system” actually means, why your beautifully bound risk file might be the problem, and how to find out where you stand.
Internal audits exist so you find your own problems before someone with a badge does. Here’s what ISO 13485 §8.2.4 actually asks of you, why “pass the audit” is the wrong goal, and why the QMSR makes honest auditing more important than ever.
An internal audit program isn’t a calendar with one entry on it. Here’s what ISO 13485 §8.2.4 and ISO 19011 actually expect from a risk-based audit schedule — and why FDA can now check whether yours is real.
A common QMSR procedure scopes §7.5.9.2 out with “we don’t make implants.” That justification works under ISO 13485 alone. Under the QMSR’s §820.10(d) cross-reference, it doesn’t hold up if your device supports or sustains life. Here’s the trap, the definition, and how to write a non-applicability statement that survives an FDA inspection.
ISO 13485 §7.5 is the longest clause in the standard — eleven subclauses that absorbed what the old QSR scattered across Subparts F, G, L, and parts of H and K. Here’s a tour of what changed, what’s genuinely new (customer property, anyone?), and where the gaps tend to live before an FDA inspection.
Section 820.50 is gone from the QMSR — quietly retired into “Reserved” status. ISO 13485 §7.4 took over, with three subclauses, more risk language, and supplier audit reports that FDA can finally read. Here’s what changed and what to fix in your procedures.
ISO 13485 §7.3 keeps the design controls discipline you knew from §820.30 — but threads risk management through every step, treats V&V plans as actual deliverables, and renames your DHF in the process. Here’s what changed and what to do about it.
Most people skim past ISO 13485 §7.1 and §7.2 to get to design controls. That’s a mistake — those two clauses introduced requirements the old QSR didn’t really have, and an FDA inspector auditing to ISO 13485 will know exactly where to look.
ISO 13485 Clause 6 turns training into competence, widens infrastructure to include the server closet, and makes contamination control a written procedure. Here’s what the resource clause actually requires — and where the old QSR wasn’t paying close enough attention.
ISO 13485 Clause 5 is more directive than the old §820.20 — measurable objectives, specified management review inputs and outputs, and a management representative with real authority. And with §820.180(c) gone, those records are now FDA-readable.