FDA Inspection Readiness: What to Expect During a QSIT Audit (And How to Prepare)

FDA Inspection Readiness: What to Expect During a QSIT Audit

An FDA inspection is not the time to discover gaps in your quality system. Yet for many medical device startups and small-to-mid-sized manufacturers, an unannounced or scheduled audit catches them flat-footed — scrambling for records, unsure which documents investigators will request, and uncertain how to respond when a Form 483 lands on their desk.

Understanding how FDA structures its device inspections — specifically through the Quality System Inspection Technique, or QSIT — gives your team a decisive advantage. This post breaks down exactly what to expect, which subsystems draw the most scrutiny, and the concrete steps you should take before an investigator walks through your door.

What Is QSIT and Why Does It Matter?

QSIT is FDA's primary framework for inspecting medical device manufacturers under 21 CFR Part 820, the Quality System Regulation (QSR). Introduced in 1999 and described in detail in FDA's Guide to Inspections of Quality Systems (QSIT Guide), the approach organizes the QSR into four major subsystems and three additional subsystems, allowing investigators to audit efficiently rather than reviewing every element of your quality management system in a single visit.

The four major subsystems evaluated during every Level 2 (abbreviated) inspection are:

• Management Controls — 21 CFR 820.20, 820.22
• Design Controls — 21 CFR 820.30
• Corrective and Preventive Action (CAPA) — 21 CFR 820.100
• Production and Process Controls — 21 CFR 820.70, 820.72, 820.75

The three additional subsystems — Records/Documents/Change Controls, Material Controls, and Facility and Equipment Controls — are typically folded into the major subsystem review. A Level 1 (comprehensive) inspection may cover all subsystems in depth, and that is exactly what first-time inspections of new manufacturers often look like.

Important 2024 update: FDA has begun transitioning enforcement to the updated Quality Management System Regulation (QMSR) finalized in February 2024, which aligns 21 CFR Part 820 with ISO 13485:2016. Full compliance is required by February 2026. If your QMS has not been updated to reflect these requirements, this should be your first priority.

How the Inspection Actually Unfolds

Most device manufacturers receive little to no advance notice. For routine surveillance inspections, FDA investigators typically arrive with credentials, conduct an opening meeting, and immediately begin requesting records. Here is a realistic sequence of events:

• Opening meeting: The investigator introduces themselves, explains the scope of the inspection, and requests your most recent management review minutes, organizational chart, and device list.
• CAPA subsystem review: Almost universally, investigators begin with CAPA. They will pull your CAPA log, select open and closed CAPAs, and trace them from complaint or nonconformance source through root cause analysis, corrective action, effectiveness verification, and closure. Weak root cause analysis is one of the most cited deficiencies across the industry.
• Design Controls deep dive: For combination products, novel devices, or companies with recent design changes, expect investigators to request the Design History File (DHF) for one or more devices. They will verify linkage between user needs, design inputs, design outputs, verification, validation, and design transfer records per 21 CFR 820.30.
• Record requests: Investigators may request device master records (DMR), device history records (DHR), complaint files, internal audit records, supplier qualification files, and training records. Have a system in place to retrieve any record within 15 minutes.
• Closing meeting: If deficiencies are found, investigators will verbally communicate them and issue a Form FDA 483 — Inspectional Observations — at the close of the inspection.

The Subsystems That Generate the Most 483 Observations

FDA's publicly available inspection data and CDRH annual reports consistently show the same repeat offenders. The subsystems generating the highest volume of 483 observations are CAPA, Complaint Handling (21 CFR 820.198), and Design Controls. Specifically, investigators cite:

• Failure to establish and maintain CAPA procedures (820.100(a))
• Complaints not evaluated to determine whether an MDR report is required (820.198(a))
• Design validation not performed under defined operating conditions (820.30(g))
• Corrective actions implemented without verification of effectiveness
• Supplier controls lacking objective evidence of qualification (820.50)

Five Practical Steps to Build Inspection Readiness

Inspection readiness is not a one-time project — it is an operational posture. These five steps form the foundation:

• Conduct a gap assessment against the QMSR: Map your current procedures to both the legacy QSR and the updated QMSR requirements. Identify where your documentation or processes fall short before an investigator does.
• Run internal QSIT-style mock audits: Structure your internal audit program to mirror the QSIT approach. Audit each major subsystem using the same linkage-tracing methodology an FDA investigator would use. Document findings and drive them through your CAPA system.
• Strengthen your CAPA process: Ensure every CAPA has a documented root cause analysis methodology (5-Why, fishbone, fault tree), a defined corrective action with owner and due date, and a structured effectiveness check with objective acceptance criteria.
• Train your inspection response team: Designate who speaks to the investigator, who retrieves records, and who documents every request and response in real time. Employees should know they may only provide accurate, factual responses — coaching employees to volunteer unsolicited information is a common mistake that widens inspection scope.
• Audit your complaint and MDR workflow: FDA investigators always check whether complaint handling and Medical Device Reporting (21 CFR Part 803) are integrated. Verify that every complaint is evaluated for MDR reportability and that your 30-day and 5-day reporting timelines are tracked and met.

What Happens After a Form 483

Receiving a 483 is not a catastrophic event — but your response is critical. You have 15 business days to submit a written response to the FDA District Office. A strong response acknowledges each observation without minimizing it, provides documented evidence of immediate corrections already implemented, and presents a realistic timeline for systemic remediation with named owners. Failure to respond adequately can escalate to a Warning Letter, which is publicly posted and can jeopardize contracts, investor relationships, and market access.

Partner With an Expert Before Inspection Day

At ADB Consulting & CRO Inc., we help medical device companies build audit-ready quality systems, conduct QSIT-structured mock inspections, and develop defensible 483 responses that demonstrate good faith and systematic correction to FDA. Whether you are preparing for your first inspection as a startup or remediating after a difficult audit cycle, we bring the regulatory depth and practical experience to get you to a position of confidence.

Ready to assess your inspection readiness? Book a free discovery call with Andre Butler today and get an honest evaluation of where your quality system stands — before FDA does it for you. Visit adbccro.com to schedule your call.