Risk Management, Corrective Actions Lead Device Inspection Findings

Risk-management deficiencies and inadequate corrective action procedures were the most frequently recorded problems in FDA medical device inspections conducted under the agency's new Quality Management System Regulation (QMSR), according to an FDA Webview analysis of 2026 inspection data.

FDA cited failures to document risk-management processes associated with product realization in 63 inspections, representing 9.1% of the 696 device inspections included in the agency's publicly available inspection dataset for the period 2/2 through 10/25. Deficiencies involving corrective action procedures ranked second, appearing in 47 inspections, or 6.8% of the total.

The analysis is part of a broader FDA Webview examination of FDA's 2026 inspection records, prompted by the agency's recent release of 198 Form FDA-483 reports. The disclosures, reported 10/23 and 10/25, led to separate analyses of drug manufacturing (see story) and medical device inspections to identify the deficiencies cited most frequently.

The findings provide an early look at FDA's inspection observations under the QMSR, which took effect 2/2 and incorporated ISO 13485:2016 into the agency's medical device quality-system requirements. The regulation replaced the previous Quality System Regulation framework and introduced a revised inspection process under FDA Compliance Program 7382.850, replacing the longstanding Quality System Inspection Technique.

FDA Webview analyzed FDA's publicly available 2026 medical device inspection records to identify the most frequently cited deficiencies. Each inspection was counted only once for each type of deficiency, so the rankings reflect the number of inspections in which a deficiency appeared rather than the total number of citations. Of the 696 device inspections identified, 355, or 51%, had at least one recorded citation.

Most Frequently Cited Device Inspection Deficiencies

Percentages are based on 696 distinct device inspections in FDA's public dataset. Categories are not mutually exclusive.

Risk Management Prominent Under QMSR
Three of the four leading citation categories involve risk management or risk-based quality-system controls. The most frequently recorded deficiency concerns ISO 13485:2016 Clause 7.1, which addresses risk-management processes associated with product realization.

FDA separately cited failures to maintain records of those activities and deficiencies in applying a risk-based approach to quality-management-system processes under Clause 4.1.2. Corrective action requirements were also common findings. Investigators cited inadequate corrective action procedures in 47 inspections and failures to take required corrective actions in another 31.

The findings also provide quantitative context for observations by Hogan Lovells Cadwalader attorneys Jodi Scott and Mike Heyl, who described FDA's increasingly holistic approach to QMSR inspections in an analysis previously reported by FDA Webview. The attorneys said investigators appeared to be examining how risk management, complaint handling and corrective action systems function together, rather than assessing procedural compliance in isolation.

Warning Letter Illustrates Deficiencies
An 8/21 Warning Letter to Lion Street Medical, doing business as Pensar Medical, illustrates several of the deficiencies identified in the broader inspection analysis. FDA inspected the Houston manufacturer of negative-pressure wound therapy systems 4/14–28, citing deficiencies involving risk-management documentation, software design changes and corrective action procedures.

According to the Warning Letter, the company's risk-management documentation lacked completed or verified controls for certain identified hazards, while required failure mode and effects analyses were missing for some products.

Investigators also identified software changes implemented without adequate records demonstrating verification or validation.

FDA cited deficiencies in the company's corrective action system, including incomplete root-cause investigations and missing effectiveness verification. The agency said several responses submitted after the inspection had not adequately addressed the problems.

The letter also identified Medical Device Reporting and corrections-and-removals violations, including an adverse-event reporting deficiency. Those findings are separate from the quality-system citation rankings.

Additionally, FDA's inspection data show recurring deficiencies involving complaint handling and Medical Device Reporting. Inadequate written MDR procedures under 21 CFR 803.17 appeared in 32 inspections. Deficiencies involving undocumented complaint-handling procedures appeared in 31 inspections, while another 23 involved procedures missing required elements.

Early Findings, Not a Historical Trend
The analysis provides an initial picture of the deficiencies appearing most frequently in FDA's publicly disclosed inspections under the revised quality-system framework. They do not establish that FDA has increased its emphasis on risk management compared with previous years. The transition to ISO 13485-based citations and a revised inspection process complicates direct comparisons with inspections conducted under the former Quality System Regulation.

The rankings also measure citation frequency rather than severity. Multiple deficiencies may be recorded during the same inspection, and different citation descriptions can address related quality-system weaknesses.

FDA's public databases are not comprehensive. Some inspections and citations may be absent because of reporting limitations, pending enforcement proceedings or delays in finalizing inspection records.

Nevertheless, the findings provide a year-to-date picture of recurring quality-system deficiencies documented during FDA's first months of inspections under the QMSR.