FDA Inspection Readiness: What to Expect During a QSIT Audit (And How to Prepare)

FDA Inspection Readiness: What to Expect During a QSIT Audit

An FDA inspection is not the time to discover gaps in your quality system. Yet for many medical device startups and small-to-mid-sized manufacturers, an unannounced or scheduled audit catches them flat-footed — scrambling for records, unsure which documents investigators will request, and uncertain how to respond when a Form 483 lands on their desk.

Understanding how FDA structures its device inspections — specifically through the Quality System Inspection Technique, or QSIT — gives your team a decisive advantage. This post breaks down exactly what to expect, which subsystems draw the most scrutiny, and the concrete steps you should take before an investigator walks through your door.

What Is QSIT and Why Does It Matter?

QSIT is FDA's primary framework for inspecting medical device manufacturers under 21 CFR Part 820, the Quality System Regulation (QSR). Introduced in 1999 and described in detail in FDA's Guide to Inspections of Quality Systems (QSIT Guide), the approach organizes the QSR into four major subsystems and three additional subsystems, allowing investigators to audit efficiently rather than reviewing every element of your quality management system in a single visit.

The four major subsystems evaluated during every Level 2 (abbreviated) inspection are:

• Management Controls — 21 CFR 820.20, 820.22
• Design Controls — 21 CFR 820.30
• Corrective and Preventive Action (CAPA) — 21 CFR 820.100
• Production and Process Controls — 21 CFR 820.70, 820.72, 820.75

The three additional subsystems — Records/Documents/Change Controls, Material Controls, and Facility and Equipment Controls — are typically folded into the major subsystem review. A Level 1 (comprehensive) inspection may cover all subsystems in depth, and that is exactly what first-time inspections of new manufacturers often look like.

Important 2024 update: FDA has begun transitioning enforcement to the updated Quality Management System Regulation (QMSR) finalized in February 2024, which aligns 21 CFR Part 820 with ISO 13485:2016. Full compliance is required by February 2026. If your QMS has not been updated to reflect these requirements, this should be your first priority.

How the Inspection Actually Unfolds

Most device manufacturers receive little to no advance notice. For routine surveillance inspections, FDA investigators typically arrive with credentials, conduct an opening meeting, and immediately begin requesting records. Here is a realistic sequence of events:

• Opening meeting: The investigator introduces themselves, explains the scope of the inspection, and requests your most recent management review minutes, organizational chart, and device list.
• CAPA subsystem review: Almost universally, investigators begin with CAPA. They will pull your CAPA log, select open and closed CAPAs, and trace them from complaint or nonconformance source through root cause analysis, corrective action, effectiveness verification, and closure. Weak root cause analysis is one of the most cited deficiencies across the industry.
• Design Controls deep dive: For combination products, novel devices, or companies with recent design changes, expect investigators to request the Design History File (DHF) for one or more devices. They will verify linkage between user needs, design inputs, design outputs, verification, validation, and design transfer records per 21 CFR 820.30.
• Record requests: Investigators may request device master records (DMR), device history records (DHR), complaint files, internal audit records, supplier qualification files, and training records. Have a system in place to retrieve any record within 15 minutes.
• Closing meeting: If deficiencies are found, investigators will verbally communicate them and issue a Form FDA 483 — Inspectional Observations — at the close of the inspection.

The Subsystems That Generate the Most 483 Observations

FDA's publicly available inspection data and CDRH annual reports consistently show the same repeat offenders. The subsystems generating the highest volume of 483 observations are CAPA, Complaint Handling (21 CFR 820.198), and Design Controls. Specifically, investigators cite:

• Failure to establish and maintain CAPA procedures (820.100(a))
• Complaints not evaluated to determine whether an MDR report is required (820.198(a))
• Design validation not performed under defined operating conditions (820.30(g))
• Corrective actions implemented without verification of effectiveness
• Supplier controls lacking objective evidence of qualification (820.50)

Five Practical Steps to Build Inspection Readiness

Inspection readiness is not a one-time project — it is an operational posture. These five steps form the foundation:

• Conduct a gap assessment against the QMSR: Map your current procedures to both the legacy QSR and the updated QMSR requirements. Identify where your documentation or processes fall short before an investigator does.
• Run internal QSIT-style mock audits: Structure your internal audit program to mirror the QSIT approach. Audit each major subsystem using the same linkage-tracing methodology an FDA investigator would use. Document findings and drive them through your CAPA system.
• Strengthen your CAPA process: Ensure every CAPA has a documented root cause analysis methodology (5-Why, fishbone, fault tree), a defined corrective action with owner and due date, and a structured effectiveness check with objective acceptance criteria.
• Train your inspection response team: Designate who speaks to the investigator, who retrieves records, and who documents every request and response in real time. Employees should know they may only provide accurate, factual responses — coaching employees to volunteer unsolicited information is a common mistake that widens inspection scope.
• Audit your complaint and MDR workflow: FDA investigators always check whether complaint handling and Medical Device Reporting (21 CFR Part 803) are integrated. Verify that every complaint is evaluated for MDR reportability and that your 30-day and 5-day reporting timelines are tracked and met.

What Happens After a Form 483

Receiving a 483 is not a catastrophic event — but your response is critical. You have 15 business days to submit a written response to the FDA District Office. A strong response acknowledges each observation without minimizing it, provides documented evidence of immediate corrections already implemented, and presents a realistic timeline for systemic remediation with named owners. Failure to respond adequately can escalate to a Warning Letter, which is publicly posted and can jeopardize contracts, investor relationships, and market access.

Partner With an Expert Before Inspection Day

At ADB Consulting & CRO Inc., we help medical device companies build audit-ready quality systems, conduct QSIT-structured mock inspections, and develop defensible 483 responses that demonstrate good faith and systematic correction to FDA. Whether you are preparing for your first inspection as a startup or remediating after a difficult audit cycle, we bring the regulatory depth and practical experience to get you to a position of confidence.

Ready to assess your inspection readiness? Book a free discovery call with Andre Butler today and get an honest evaluation of where your quality system stands — before FDA does it for you. Visit adbccro.com to schedule your call.

FDA Inspection Readiness: What to Really Expect During a QSIT Audit

An FDA investigator knocks on your door — or sends a notice — and suddenly every quality procedure you meant to update last quarter becomes urgent. For medical device startups and small-to-mid-sized manufacturers, an FDA Quality System Inspection Technique (QSIT) audit can feel like an existential event. It doesn't have to be, provided you understand exactly how investigators approach it and where companies most often fall short.

This post breaks down the QSIT framework, the four subsystems FDA prioritizes, the documentation investigators will want immediately, and the practical steps your team should be taking right now — not the week before an audit.

The Four Primary QSIT Subsystems FDA Examines First

Investigators are trained to evaluate these four subsystems during every Level 2 (abbreviated) or Level 3 (full) inspection:

• Management Controls: Investigators assess whether senior leadership has established a functioning quality policy, defined organizational responsibilities, and conducts meaningful management reviews per 21 CFR 820.20. Rubber-stamp management review minutes with no action items are a red flag.
• Design Controls: Under 21 CFR 820.30, FDA expects a documented, traceable design history file (DHF) that covers design inputs, outputs, verification, validation, and transfer. For startups that moved quickly through development, the DHF is frequently incomplete or reconstructed after the fact — a pattern investigators recognize immediately.
• Corrective and Preventive Action (CAPA): Governed by 21 CFR 820.100, the CAPA subsystem tells investigators more about your quality culture than almost any other system. They will look for whether investigations identify root causes, whether effectiveness checks are documented, and whether CAPAs close within reasonable timeframes. Chronic open CAPAs or repetitive issues signal systemic failure.
• Production and Process Controls: Under 21 CFR 820.70, investigators examine whether your manufacturing processes are validated, documented, and followed consistently. Process validation records, equipment qualification data, and environmental controls are common focal points.

What Investigators Will Request on Day One

Before the formal subsystem review begins, expect investigators to request your Quality System Overview — a document or presentation that describes your organizational structure, product lines, and quality system scope. Many companies either don't have one or present a version that contradicts their actual procedures. That contradiction creates instant credibility problems.

Within the first hours, investigators typically also request:

• Your most recent management review records
• A list of all open and closed CAPAs from the past 12-24 months
• Complaint handling logs and MDR (Medical Device Reporting) files under 21 CFR Part 803
• Internal audit schedules and completed audit reports
• Device History Records (DHRs) for recently manufactured lots

Having these documents organized, indexed, and retrievable in under 15 minutes is not a luxury — it is an operational baseline that signals competence to the investigator before the substantive review even starts.

Where Small and Mid-Sized Companies Most Frequently Get Cited

Based on FDA's publicly available Form 483 observation data and Warning Letter trends, the most common deficiencies for smaller device companies include: incomplete or missing design verification and validation documentation, CAPA systems that document activities but fail to identify true root cause, supplier controls under 21 CFR 820.50 that exist on paper but aren't executed, and complaint handling procedures that don't consistently evaluate whether a complaint constitutes a reportable event under Part 803.

These aren't obscure technicalities. They are the predictable failure points for organizations that treat quality as a documentation exercise rather than a living operational system.

Practical Steps to Build Genuine Inspection Readiness

Inspection readiness is not a sprint you run in the 30 days after receiving an FDA establishment inspection notification. It is a continuous operating posture. Practically, that means conducting internal audits against QSIT subsystem criteria at least annually, running mock investigations as part of CAPA training, ensuring your DHF index maps directly to 21 CFR 820.30 requirements, and designating a back room coordinator role before any inspection arrives so document retrieval is never chaotic.

It also means understanding that FDA's transition to the QMSR — aligning 21 CFR Part 820 with ISO 13485:2016 — requires companies to review and update procedures to reflect risk-based thinking, process approach principles, and expanded supplier oversight requirements now, not after an inspector identifies the gaps.

You Don't Have to Navigate This Alone

At ADB Consulting & CRO Inc., we work directly with medical device founders, VP Quality, and regulatory affairs teams to build inspection-ready quality systems grounded in regulatory reality — not boilerplate templates. Whether you're preparing for a first FDA inspection, responding to a Form 483, or rebuilding a quality system after a Warning Letter, we bring the regulatory expertise and operational focus to protect your business and your patients.

Book your free discovery call today at adbccro.com and let's assess where your quality system stands before FDA does.