How to Avoid Major FDA Inspection Mistakes

FDA has decreased the length of time between inspections in recent years, thus requiring medical device companies to be prepared to accommodate the inspector’s more frequent visits and quickly respond to possible findings.

In 2008, Class II manufacturers were inspected once every five years, and U.S. Class III manufacturers once every three. Then the political environment changed, and FDA’s funding resources increased. Now FDA is required by statute to inspect U.S. Class II and III medical device establishments once every two years. FDA spent most of 2009 recruiting, hiring and training new inspectors. By 2010, the agency increased the number of inspections by 25% (2,550 in 2009 and 3,174 in 2010).

This article focuses on the three biggest mistakes that companies make during an FDA inspection. For further resources, the FDA inspection manual, QSIT, is available online.

Mistake #1: Responding in >15 days

OEMs fear FDA because FDA has the ability to take legal action against a company and its managers if the company is not compliant with regulations. Usually, failure to comply results in the issuance of 483 observations, and the company must respond by implementing CAPAs to address each observation. The worst possible mistake a company can make is to fail to respond to a 483 observation within 15 business days. Therefore, make sure you confirm which days the inspector considers business days. If FDA receives your corrective action plan in 16 business days, it will not even open your company’s response. Instead, the agency will automatically issue a warning letter.

Immediately after an FDA inspection, the management of your company should establish a team to address each of the 483 observations. This team must do the following in less than 15 business days:

  1. Contain (i.e. quarantine) nonconforming product or materials associated with the observation—if any. If affected product has left the direct control of the company, correction and removal (i.e. a recall) may be required. (1st business day after inspection)
  2. Implement corrections for each observation. This may be done in parallel with the investigation(s). (1st business day after inspection)
  3. Assign investigation responsibility to one person, with appropriate qualifications and authority, for each observation. (2nd business day after inspection)
  4. Investigate each observation using one or more root cause analysis tools and document your investigation in each CAPA record. (3rd business day after inspection)
  5. Identify the root cause of each observation, and document the root cause in each CAPA record. (6th business day after inspection)
  6. Develop a corrective action plan that is reasonable, and that you can complete in an appropriate amount of time. Procedural changes should be made in days or a few weeks, while process and design changes may take months to revalidate. For lengthy corrective action plans, major milestones should be identified. (8th business day after inspection)
  7. Have an independent expert review each of your corrective action plans within 24 hours. This expert should be aware of the potential need for this service as soon as you are notified of FDA’s request to inspect your facility. The expert may be an internal expert or an outside consultant—depending upon the size and resources of your company. (10th business day after inspection)
  8. Make final revisions and edits to the corrective action plan and send it to FDA—using overnight delivery and with signature confirmation. (12th business day after inspection)

Mistake #2: Talking too much
FDA inspectors are trained to interview people in order to gather the most amount of information. One of the most popular interviewing techniques is to pause and say nothing after the interviewee has answered a question. The silence is uncomfortable for most people, and interviewees will typically offer more information in the hopes of satisfying the inspector. This is a huge mistake.

FDA only knows what you tell them and what they are able to gather from the FDA database. In addition to your company’s website, this information includes:

  1. Medical Device Reporting (Form 3500/3500A)
  2. Corrections & Removals (i.e. recalls)
  3. Registration & Listing
  4. 510(k) Submissions
  5. Previous Inspection Reports

During your internal audits, internal auditors should identify any employees who are too talkative and not comfortable with silence. FDA should be steered away from these employees. Employees who handle silence like a stone statue should be identified as the preferred individuals to speak with FDA.

If FDA asks for a specific record associated with an MDR, the person who provides this record should provide the record and identify the various documents that comprise the record. The person should not explain the record or attempt to justify any gaps in the record, because FDA is probably not aware of what is missing from the record—unless it is included in the MDR.


If your company recently had a recall, FDA may sample corrective actions associated with the recall. Therefore, these records should be ready for review by an inspector as quickly as possible. The FDA inspector only knows the information that was communicated already. This information should match the information included in any corresponding CAPA records, and interviewees should not volunteer additional information.

One of the hardest areas to audit is design controls. Any product that received a 510(k) clearance letter since the previous audit is a strong candidate for sampling. The inspector is likely to request the Device Master Record (DMR) for that new 510(k) product, but it may be extremely difficult to identify major design changes that occurred after the initial launch simply by reviewing the DMR. The best approach is to provide the DMR and identify the various documents included, but interviewees should let the inspector ask questions about specific changes instead of volunteering information about design changes.

Mistake #3: Not knowing what to have ready at all times
FDA inspectors have a QSIT Manual that defines the inspection process, and therefore many of the document requests from inspectors are predictable. Therefore, there are six areas of Quality System documentation you should always have ready for an inspector:

  1. Completed CAPAs related to 483 observations from the last FDA inspection
  2. Your CAPA procedure and CAPA log—especially identifying all closed CAPAs since the last inspection
  3. Your complaint handling procedure and complaint log
  4. Your internal auditing procedure, your internal audit schedule and CAPAs resulting from completed audits
  5. Your supplier quality management procedure, your approved supplier list (ASL), your schedule for supplier audits and any SCARs resulting from completed audits or nonconforming material reports
  6. Your management review procedure, the dates of your last several management reviews, the agenda for each of those management reviews, evidence of required attendance and CAPAs initiated in response to the management reviews

Most companies know that FDA is not supposed to have access to your internal audit reports, supplier audit reports or your management review meeting minutes. However, FDA inspectors will frequently ask for items four, five and six in order to verify that these processes are fully implemented and that there are CAPAs resulting from each of these processes.

CAPAs related to 483 observations from the last FDA inspection are critical to have complete and ready for review. If your company fails to complete the corrective action plan that was submitted to the FDA inspector during the previous inspection, your company is likely to receive a warning letter immediately—and a much longer inspection.

The CAPA process is considered the “heart” of the Quality System, and all processes should feed back to CAPA. CAPA is also one of the more common processes that receive 483 observations. Therefore, maintaining your CAPA process and records should be a priority at all times. When CAPA plans begin to fall behind schedule, the situation should be escalated to senior management immediately and resources should be re-allocated to ensure that overdue CAPAs are prioritized.

Finally, FDA issued 399 observations (483s) in FY2012 for inadequate complaint handling procedures and inadequate medical device reporting (MDR) procedures. MDR was the #3 problem (3% of 483s issued), and complaint handling was the #2 problem (5.56% of 483s issued). Therefore, you can expect FDA to review any adverse events reported on Form 3500A or Form 3500 to be reviewed prior to the inspection. The FDA inspector will verify that each of these adverse events has a completed complaint file that meets the requirements.

For more on this topic, read Mr. Packard’s previous blog “10 FDA Inspection Strategies that DON’T Work.” The article covers misguided inspection strategies that some companies use to mislead and distract inspectors.

The ten strategies he DOES NOT recommend, include:

1. Stalling when the investigator makes a request

2. Suggesting records for the investigator to sample

3. Outsourcing processes to subcontractors

4. Trying to correct problems during the inspection

5. Writing a “letter to file”

6. Shutting production down

7. Storing all records offsite

8. Identifying information as confidential

9. Hiding records from FDA

10. Asking the inspector to show you where that is required

Robert Packard of Packard Consulting is a regulatory consultant with 20 years of experience developing products and managing projects in the medical device, biotechnology and pharmaceutical industries. His experience includes research, product development, operations management, manufacturing engineering, equipment design, regulatory affairs, quality assurance and fund-raising. Rob’s passion is training others. Specific questions about ISO 13485 Certification or Quality System training can be directed to Mr. Packard at This email address is being protected from spambots. You need JavaScript enabled to view it..

Medical Device Academy
www.medicaldeviceacademy.com