FDA Inspection Readiness: What to Really Expect During a QSIT Audit

FDA Inspection Readiness: What to Really Expect During a QSIT Audit

An FDA investigator knocks on your door — or sends a notice — and suddenly every quality procedure you meant to update last quarter becomes urgent. For medical device startups and small-to-mid-sized manufacturers, an FDA Quality System Inspection Technique (QSIT) audit can feel like an existential event. It doesn't have to be, provided you understand exactly how investigators approach it and where companies most often fall short.

This post breaks down the QSIT framework, the four subsystems FDA prioritizes, the documentation investigators will want immediately, and the practical steps your team should be taking right now — not the week before an audit.

What Is QSIT and Why Does It Matter?

The Quality System Inspection Technique is the structured methodology FDA investigators use when conducting inspections of medical device manufacturers under 21 CFR Part 820, the Quality System Regulation (QSR). With FDA's harmonization to ISO 13485:2016 through the updated Quality Management System Regulation (QMSR) — finalized in February 2024 and effective February 2026 — the underlying compliance standard is evolving, but the QSIT inspection approach remains the operative framework for how investigators conduct on-site evaluations.

FDA's QSIT guidance, published in 1999 and still operationally relevant, instructs investigators to assess four top-level subsystems first, then drill into supporting subsystems as findings warrant. Understanding this hierarchy is the foundation of any credible inspection readiness program.

The Four Primary QSIT Subsystems FDA Examines First

Investigators are trained to evaluate these four subsystems during every Level 2 (abbreviated) or Level 3 (full) inspection:

• Management Controls: Investigators assess whether senior leadership has established a functioning quality policy, defined organizational responsibilities, and conducts meaningful management reviews per 21 CFR 820.20. Rubber-stamp management review minutes with no action items are a red flag.
• Design Controls: Under 21 CFR 820.30, FDA expects a documented, traceable design history file (DHF) that covers design inputs, outputs, verification, validation, and transfer. For startups that moved quickly through development, the DHF is frequently incomplete or reconstructed after the fact — a pattern investigators recognize immediately.
• Corrective and Preventive Action (CAPA): Governed by 21 CFR 820.100, the CAPA subsystem tells investigators more about your quality culture than almost any other system. They will look for whether investigations identify root causes, whether effectiveness checks are documented, and whether CAPAs close within reasonable timeframes. Chronic open CAPAs or repetitive issues signal systemic failure.
• Production and Process Controls: Under 21 CFR 820.70, investigators examine whether your manufacturing processes are validated, documented, and followed consistently. Process validation records, equipment qualification data, and environmental controls are common focal points.

What Investigators Will Request on Day One

Before the formal subsystem review begins, expect investigators to request your Quality System Overview — a document or presentation that describes your organizational structure, product lines, and quality system scope. Many companies either don't have one or present a version that contradicts their actual procedures. That contradiction creates instant credibility problems.

Within the first hours, investigators typically also request:

• Your most recent management review records
• A list of all open and closed CAPAs from the past 12-24 months
• Complaint handling logs and MDR (Medical Device Reporting) files under 21 CFR Part 803
• Internal audit schedules and completed audit reports
• Device History Records (DHRs) for recently manufactured lots

Having these documents organized, indexed, and retrievable in under 15 minutes is not a luxury — it is an operational baseline that signals competence to the investigator before the substantive review even starts.

Where Small and Mid-Sized Companies Most Frequently Get Cited

Based on FDA's publicly available Form 483 observation data and Warning Letter trends, the most common deficiencies for smaller device companies include: incomplete or missing design verification and validation documentation, CAPA systems that document activities but fail to identify true root cause, supplier controls under 21 CFR 820.50 that exist on paper but aren't executed, and complaint handling procedures that don't consistently evaluate whether a complaint constitutes a reportable event under Part 803.

These aren't obscure technicalities. They are the predictable failure points for organizations that treat quality as a documentation exercise rather than a living operational system.

Practical Steps to Build Genuine Inspection Readiness

Inspection readiness is not a sprint you run in the 30 days after receiving an FDA establishment inspection notification. It is a continuous operating posture. Practically, that means conducting internal audits against QSIT subsystem criteria at least annually, running mock investigations as part of CAPA training, ensuring your DHF index maps directly to 21 CFR 820.30 requirements, and designating a back room coordinator role before any inspection arrives so document retrieval is never chaotic.

It also means understanding that FDA's transition to the QMSR — aligning 21 CFR Part 820 with ISO 13485:2016 — requires companies to review and update procedures to reflect risk-based thinking, process approach principles, and expanded supplier oversight requirements now, not after an inspector identifies the gaps.

You Don't Have to Navigate This Alone

At ADB Consulting & CRO Inc., we work directly with medical device founders, VP Quality, and regulatory affairs teams to build inspection-ready quality systems grounded in regulatory reality — not boilerplate templates. Whether you're preparing for a first FDA inspection, responding to a Form 483, or rebuilding a quality system after a Warning Letter, we bring the regulatory expertise and operational focus to protect your business and your patients.

Book your free discovery call today at adbccro.com and let's assess where your quality system stands before FDA does.