From Observation to Action: What FDA Expects After a 483

Well, and welcome, everybody, to MedTech Leading Voice and Lean RAQA Present 483 Letters. And, I'm excited, really excited, about today's presentation, with Michelle and Tiana, and, Yeah, this is gonna be super informative, Couple of housekeeping announcements before we jump into this. One, this webinar will be recorded, and slides will be made available to everybody tomorrow. So if you've registered, you will get an email that has the, Recording in the slides. Second of all, if you would like a certificate of, participation, please put your name as you would like it to appear, and your email address in the chat, so that we can make sure that you get your certificate of attendance.

Third is please use the chat function to communicate with me, whereas the Q&A function to ask questions of the speakers. It's important that you cut and paste in to… that you… that you put your questions to them in the Q&A, so that they can actually see them and respond to them. Otherwise they… they won't be able to, see them. And, Let's see, Chumoro. We're doing a medical device sterilization, thing on, Friday in Focus. If you don't know what Friday in Focus is, feel free to… send me a message and say, what are you talking about? And then lastly, what I want to say is, like, we've had, like, 4,100 votes for the MLV100, for 2026, and lots of nominations.

The, voting and nominations are open until tomorrow. I'd really love to hit 5,000, just as a personal goal. So, if you're on this call, what I'd like you to do is go to mlvx.ai slash MLV100 and be sure to vote. I'm sure that Michelle wouldn't mind if you voted for her, so please feel free to stick in a vote for Michelle, and Not sure if Tiana's on there, but feel free to write her in as a write-in candidate. If you want to write yourself in, go ahead and write yourself in, or somebody that you feel like is worth following. This has been a really, interesting thing with lots of feedback and lots of participation.

I also understand that, Lean has some interesting stuff coming up. Why don't you tell us about it?

Well, first off, we've started an online class for, not only the QMSR requirements, but then all the subsystems and what the 43s had been like in the past, so that you can help do a gap analysis against what's going to be the expectations moving forward in those subsystems. We will also be at several conferences this year, be watching my LinkedIn so that maybe we can hook up and, have coffee or a cocktail. And yeah, so what else do we have going on, Ty, that's pretty exciting these days?

Yeah, we're gonna be doing, probably in late July, a webinar on culture of quality, which has become a re… a new area that FDA has re-emphasized with QMSR coming out specifically in the comments, which you wouldn't know if you just read the QMSR and understood its incorporation on its own. So that's also in the pipeline for us at LeanRAQA.

Awesome, and I think that it's worth mentioning that the, QMSR course that you put together is, what, 6 parts? And, and you're gonna be, producing it in, in cooperation with RAPS, and…

Yeah.

So it will be available through the Lean website and through… but if you'd like details on that, just write details in the chat now, and I'll make sure that you get details on it when it's available. I think that's it, I think we're ready to get started, are we? Did I forget anything?

Yes, no, you did not, we're ready to get started.

Okay. It's the right screen.

Yep. Okay, so today we're going to talk about an observation process, how you could give to a 483, and what, how 483s can be escalated, and what FDA is going to expect to see there. So, most of you know me already. I am Michelle Lott. I've been in this area for over 20 years. I don't want to date myself, but I think I might be pushing 25 or 30 now. Fda, I was an industry representative for the FDA Good Manufacturing Practices Advisory Committee, and my role here is a Master Grief Counselor because, most people go through all the stages of grief, you know, with bargaining, denial, etc, about these regulatory requirements.

And Ty here is my senior REQA Manager and Project Manager, and I'll let her tell you a little bit about her Chaos Coordinator role.

Yep, I'm a biomedical engineer by training, but have spent the majority of my career in regulatory and quality compliance for medical devices. I am the chaos Coordinator at Lean, which means that I wear a lot of different hats and handle a lot of different conversations, all… Throughout the day, which makes me kind of an expert on everything. And Michelle has our sweet suite… our C-suite here, if you want to introduce them.

Yep. So, right now, these are… this is my executive leadership team, my ELT, and they are currently napping, but if this serial killer mailman or UPS comes, just brace yourself for all chaos to break loose. So, for today, we're going to go through what I'm calling the Highway to Hell, which is how 483s get issued and responded to, and then get escalated. We're going to talk about the inspection process, how to manage it, what FDA is also expecting that leads to a 483. Then we'll talk about what actually is a 483, and we'll close with 43 inward and letter metrics.

So, on the highway to Hell, this usually starts with a FDA 43 observation following the FDA inspection. Then you get Go ahead.

Sorry, my thing…

I got it. Okay. And so then you get an opportunity to respond. And in your response, which is due… your initial response is due in 15 days, they can either determine your response is adequate, and they can close the case, or it can be escalated if the agency determines that it's an inadequate response. So then that's going to lead to further discussions with the FDA. And then from there, you can have an adequate response if you get the issues cleared up and you get on the same page with the FDA, or they can consider that your response is inadequate again, and then that escalates to a warning letter.

And then you can get… you can have an adequate response to that warning letter, and that can close it out. But if to that warning letter, you continue to respond inadequately or inappropriately, then you're going to get escalated further into a consent decree. So, how did we end up getting here on this highway to hell? Well, let's go back in time a little bit and look at how… what the inspection process looks like. So, the inspection, it's more than just semantics. FDA actually conducts an inspection, whereas ISO and MDISAP is an audit.

It's more checklist-based as opposed to a system interaction-based. The… when… to start the audit, FDA inspectors have to present what's called a Form 482 for a notice of inspection to start the audit. And so, typically, the, they will start by introducing themselves and showing you their actual credentials and their badges. And then another thing you need to be aware of, that 482 is specific to the facility they're at. It does not give them free range to go to sister companies or suppliers in and of itself. Now, they can go there, but they have to get a different 42 for those other entities, and they have to be able to get them in their workflow, which is already planned.

You know, in advance at the beginning of the fiscal year.

Something else to keep in mind is that there are some specific rules when interacting with FDA inspectors that is different from ISO MDSAP audits. There's specific rules about, you know, lunch and snacks and… and, you know, not… picking them up from the airport. So there's very specific logistic rules that kind of give a different feel to FDA inspections as well, and on that Form 482, FDA will define what type of inspection it is, and we'll talk about that a little bit later in the presentation.

So, this is FDA's risk-based inspection technique. It is called the Q-SIT, which they retired on February 2nd of this year, but you can see they have this kind of wagon wheel of how the systems interact. And so, this is… I've kind of overlaid the graphic here, so that you can kind of really see and understand what they're… they're expecting out of the new inspection technique. They're expecting that patients and users are at the center of every decision that you're making as a medical device company. And the way you ensure patients and users are safe is through your risk management process. And so,

And then, from there, it goes into those similar subsystems, but the subsystems are now broken down by the sections of, basically the ISO 1345, and then, other applicable requirements that are specific to the FDA, like labeling and packaging. and documents and signatures. There are 4 other areas where they're gonna also inspect that aren't covered specifically with the ISO technique.

Yeah, and something that's really interesting is under the quality system inspection technique, which we showed, just briefly on this slide, they had management at the center, and no longer is that kind of where audits start. It's really now risk management. And you'll see that in how 483s are being written, and what kind of observations are being found out. So… I mentioned and alluded to inspection types. So, there's basically 7 different categories of inspection that FDA can come to your facility for. There's non-baseline surveillance, there's baseline surveillance, a compliance follow-up, a for-cause.

Specific product risk assignment, which is a very, very interesting category. This is how FDA decides, hey, your product code or type of device is just of particular interest to FDA, so we're gonna come in. That was really popular with, menstrual cups, additive manufacturers, custom manufacturers of certain components. A few years ago. And then there's PMA's pre-approval inspection, and then PMA post-market approval inspections. So… here are kind of… this is mostly for reference, but the reason FDA will come to your facility. So, for a non-baseline surveillance, basically that means that you'd had a previous

FDA inspection or MDISAP inspection, and they're just coming back as kind of part of routine surveillance. But this is not an initial inspection by FDA. Then there's baseline surveillance, where FDA has no quality history from your company, meaning you do not have a previous FDA inspection, you have no MDSAP audit report for FDA to look at, and you aren't currently enrolled in an MDSAP. These other categories, the compliance follow-up, is pretty self-explanatory. The fore cause is also pretty, self-explanatory, but what's interesting here is that FDA also uses the term signal, which means that they can come in because they've seen signals in the marketplace.

There's no…

It doesn't even have to be about your company in particular, like Ty was talking about with the other type of audit. And so this is the first time I've seen FDA use the term signal, and so, you know, shortly after releasing the inspection methodology, they also started a program for early alerts to consumers.

Yep, and something that we've seen at Lean, because we're closely monitoring all this, is back in November, December, there were a lot of early alerts around glucose monitors. So FDA has been doing inspections on a specific product type across competitors because they found an internal signal or some other area of concern. So FDA does use these, they're just not always the most transparent in how Or why they're coming to your facility. And then… pre-market approval, or PMA approval inspection, pretty self-explanatory. You have to get an inspection specifically around design and production as a heavy emphasis before you get your PMA approved.

And then one year after your approval, FDA will come in and re-inspect, expecting that you're using the rest of your quality management system. There's two inspection models, you'll see this, and we're gonna go into just some light detail, and this matters because it can impact how FDA writes up your 483s. But basically, you have this inspection Model 1, which gives FDA the flexibility to only audit one element of each of these six subsections, and then your other applicable regulations. So basically…

It sounds odd for him to say, like, this one element or whatever, but, they are using this, the inspector, because we had several clients with audits already. And so, what they're doing is starting in that element. And then seeing where it goes into the other spokes of that wheel. So this is a little bit misleading.

Yeah.

So it's not like, okay, so for design and development, it's not like they're gonna start with design Inputs, and then not go look at the outputs, and etc. They're going to follow that one element that they picked to start with, and how it's supposed to be interlinked to every other part of the quality management system.

Yeah, and it's in… what they've retained with the risk-based inspection technique that ISO audits don't necessarily have, or MDISEP audits don't necessarily have, is the ability to walk in and out of subsystems when you find a chain, because it's not a checklist still. It is still that flexible kind of Q-SID approach. So, Inspection Model 2 is kind of the full quality management system audit that you would expect, and there's two categories that really get it as designated, which is baseline surveillance. So, if you've never had an FDA audit and you do not have an MDISAP audit report, you will get a full quality management system audit, per the risk-based inspection technique. And then if you are getting a pre-approval inspection, now, even in the guide, they under… they demonstrate that

You will not have a full quality management system with records, because you are not doing things like post-market surveillance complaint yet, but they want to see that you have The processes in place for when that does become live. So…

Sorry.

I don't know.

Speaking of blast from the past…

Yeah, so they've fixed this now, but when Michelle and I were first reading the risk-based inspection technique, this was the resolution of what they defined the elements as. It's clearly from an old HTML document, and very hard to read, so we're poking fun here, but what's really important to know is that FDA is using these inspection models to Audit specific elements that they are saying. So, if you look on this screenshot.

Nope.

that management oversight has 3 elements. There's management review, the medical device file, and the planning of product realization. That can be a little bit misleading, and I'll show you why on the next slide, but Michelle, what were you going to add?

I was gonna say, like, you can just tell from the screenshot and the blurry, it looks like a copy of a copy of a copy that was screenshotted, but this came out of… therefore, this had to have come out of one of the original inspection models. And it shows you that FDA has really been looking for these things all along. Whether they told us or not, that they were… they were following something very similar.

So, the devil's in the details. Make sure you're reading the fine print. So, remember, in that management oversight, we said there's three elements, which is management review, medical device file, and then planning of product realization. This, in the appendix, is what they really consider management oversight. It's all of these ISO clauses.

get misled by the term element, because they're using it kind of loosely when you see inspection model one, and you only have to do one.

one.

one element. But if that one is management review, this is all the evidence that they feel like supports management… effective management oversight. And then these are all the requirements on the right, and where they came from in the standard. So you could… technically, if you read ISO 1345, it's large… management oversight is largely defined, in Section 4. And then, if you look here, though, look at all these clauses you could be written up against, that are… that the FDA considers directly linked to management oversight. So you could get management oversight for, like, say, this 6.1, or 5.3, or any of the like.

Yeah, and 6.2 is training and competency, so they're gonna write up training competency for management review. Because, you know, management is really in this clause, but also the risk-based approaches in here, the quality policy, quality objectives, so just be really mindful that I think, personally, the appendix is how FDA is mapping all the requirements. And it should be what you are kind of following, and when you're looking at your own quality management system, that's how they're going to be looking at your quality management system to meet all the ISO requirements. So, FDA announced that they are going to do one-day inspections to better enable the access to more facilities and gathering critical insights without compromising regulatory rigor. They're trying to make the most of their internal resources.

So, it's just something to be mindful of, that FDA is now driving for these one-day inspections to help strengthen FDA oversight. We'll see how this actually ends up playing out, because it was just announced in April, but we thought we'd bring it up here.

And just because you have, go back… just because you have, inspection during this pilot program, this one-day pilot program. that… and it could even go well, but they're going to use all of that data. They can come back and do a full audit if they didn't feel like, in the one-day audit, they captured all the information that they needed to review, or that they had some concerns. So don't think this is, like, a pass out of a full FDA audit.

Yeah, and we didn't have a note on this, but also, same with your MDISAP report. Don't think that that can necessarily always get you out of the audit, because if it's not for a baseline surveillance, if it's for any of those compliance or risk or whatever, FDA can determine that they won't accept it and will still come on site for your facility.

Wait, hold on a second. So, and then this last bit is interesting. Okay, no, I'm sorry, what I was going to say is on a different slide. Go ahead.

So. After the inspection, basically there's three, classifications of what FDA will put, and they will say either there's no action indicated, you went through everything super squeaky clean, there's voluntary action indicated, which usually means that you have a 483, and then there's official action indicated, which means that there's, you know, serious, serious concerns that they're gonna… Make you either stop distributing or whatever. After the inspection, you need to be responsive. You have 15 business days to respond with a plan, and we'll talk about what is a 483 and how do you respond to one adequately.

You need to provide… you need to conduct systematic review and corrective actions, provide clear, organized responses. be reasonable with your updates, and the progress of your closure, and then if FDA determines it's necessary, they will re-inspect for formal closure, or if it's, you know, low risk, they'll use your MDISAB report if you have one. So, Michelle, what is a 483?

Well, a 43… first off, the nomenclature is just the specific form that FDA uses internally, or template that they can, That they'll write their observations in and issue them to you in separate 43s per item that they found. So it's important to know. A 483 in and of itself is not a warning letter, unless they find something pretty egregious and feel like there's a high risk to public safety, is the only way I could see it escalating to the warning letter in practicality. But it's so… it's equivalent to what other types of audits and inspections call observations or nonconformances. So, 43 is… that's what you need to be thinking of as interchangeable terms for what it does.

You're given a chance to respond. Like Ty mentioned, you get 15 days to get them that plan, and that plan needs to demonstrate that you have the ability to correct the problem, and that you properly scoped the problem. Yeah. So… What to do in a 15-day response time as the clock starts ticking. The first thing you should start with is getting clarity and alignment with FDA on what the observation is, and restate the observation if necessary, but to get alignment with what FDA was trying to achieve when they wrote it up. And be clear about what requirement was not met. They will be mapping these, again, to specific elements of the, ISO standard.

The next thing is to contain the issue. You need to take immediate action to determine if… do you have product in the field that needs to be, that you need to communicate about. Do you have inventory that could be affected? Do you have labeling? So, just make sure that you're taking the steps to… to kind of put a fence around what you've defined the problem to be. Then from there, you elevate the… you evaluate the impact and the scope. By that, I mean you're… you're looking at other products, other lots and batches, and suppliers, to… to verify that, again, you got that… you casted that net wide enough to get all the possible inputs.

Into, where the failures might have come, or the disconnects in the quality management system.

This is probably where FDA gets the most inadequate responses, is that they will see that your scope is not wide enough, because, you know, you think that you can just correct the issue that they found without doing a proper investigation, and FDA will not accept that.

Right and that's another way we see things escalated to, .

On that highway to hell.

Yeah, exactly. So next, defying root cause. This is, this is the beginning of the CAPA plan creation, so you have to determine the true root cause and assess whether it's… the issue is isolated or system… systemic, and if you feel like it's isolated, you need to make sure that you have all of the, That you have all the scoping activities defined of why you don't think anything else is affected by it. Yep. And so, what is containment and correction? So, containment or correction is the immediate action that a company takes to control the problem and prevent further risk while the root cause is being investigated.

And most of the time, this starts in-house with product that's in-house, but if you… it doesn't fix the root cause, it's not a CAPA plan, it just stabilizes the situation.

Yep.

don't get confused, because it is, with the term correction, because FDA also uses it, a part of their, recall adverse events, for correcting the product in the field. So, if you have to do any correction to product that's already in distribution. then… then that falls within the, I believe it's 803 part of the CFR for, field actions. So that's, you know, you've got Two sides of a coin to that term, correction can be misleading.

Yeah, so this is something that we do cover in our QMSR course, is how to interpret the terminology and the hierarchy of definitions, but yeah, make sure your procedures are really well defined in what you are calling a correction. Industry always called it containment to kind of avoid this conflicting definition of correction, but FDA has you know, publicly stated that they are going to adopt ISO 1345's definition of correction, and maintain 806's definition of correction. So, just make sure your procedure is really clear, and your forms are really clear in what you're doing, because if FDA sees correction, and they're expecting a field correction, and in term of full recall strategy plan.

You might get in a little bit of hot water if you're not prepared to explain, okay, no, this is just a containment correction.

So, Ty, we've got a couple of questions, that I think would be appropriate now. One of them is how to handle a 43 based on we would like to see, which is above and beyond what is required by the standard, the only one we received. Go ahead.

That's… I mean, that's a tricky one. I think, there's a couple of different ways to handle it, and it really is gonna depend on what your business strategy is. You know, if it's a like to see, and it's easy to incorporate, and you see value in what they're asking, then you can get the brownie points in getting that infrastructure in place to do best practice. That being said, we work with a lot of startups and small companies, and, you know, what's possible for them is different than what's possible for a Phillips or Striker or Medtronic. If it's not an appropriate observations, there's a couple of different ways that you can escalate it. You can respond with OBSBOSMIN and say, hey, we disagree with this finding. It is based off of best practice and not requirements, and that would be your other option. Either you address it, or you escalate it to OBSBusmin's.

Yep, and they need to have a very specific reference about what they are writing you up against, and they have to support it with objective evidence, which doesn't fit in the scope of, we would like to see. Yeah. And so I would just be polite, say we will take it under advisement, make sure whoever's taking their notes, you know, sets that one apart so that you can follow up later. And like Ty said, if it was some… lower-hanging, fruit, and it's not going to be burdensome to your quality management system. Sometimes you just make the change, and you… you save the energy for… and the fight for it for the other day.

And then if they did that, also, it's unlikely for a 43 to get escalated.

Yeah.

So it's… you also have to think, okay, what is this… the impact of this 43 actually is? And then, like Ty said, if you really come to impasse, you can call the ombudsman, which is supposed to be the industry advocate.

Yep.

We got another question. At our last inspection, we received one NAI and one VAI. We did not respond with a corrective action response to them, but did initiate an internal CAPA. During the ISO audit, the auditor wanted to document a NC, since we did not provide FDA with a response. Was the ISO auditor correct?

The ISO… I would say, very technically, that the ISO auditor is correct, because there is a requirement that you have to notify regulatory authorities as appropriate. And it is unusual that FDA did not demand your 15-day response, but that is a requirement. Michelle, would you agree? I think it's a little bit like ISO, when you have to do a notification of change, when you have updates to your tech file or anything like that, or MDR reporting. There is an industry… there is a regulatory expectation from the organization to notify FDA of your 15-day response, and failure to do that would be written up under the ISO auditor with that notification to regulatory authorities.

Well, that… that could be if that… but then the whole regulatory section where it's mentioned, I think it's one of the only times in ISO it talks about regulatory, but, like, to meet regulatory requirements of whatever country you're in.

Yeah.

Okay, maybe we park in line some of these for… until we finish the presentation. We've got some… Good question.

So…

I'll just go read through them real quick, and then we'll have them in our minds, and we can revisit them if we don't cover it. So, how are the FDA detecting signals from post-market event reporting? Hold on, let me…

That's later, we've got that covered.

Yup. Okay, I think that that's all the ones that ended up… in the chat instead of Q&A. Now I'm looking for where the Q&A is. So, carry on.

Okay. While Michelle's doing that, I'll keep going. Gathering evidence. So we talked about, okay, contain the problem, make sure that you're not having any more safety effectiveness issues. Gathering evidence, we just threw this slide in here because, that inner wheel used to be kind of what QSR was required as, you know, what your investigation inputs are, but under QMSR, there's even more. So just be mindful that you are looking at all the sources of data, and not just specific data, you know, not just your NCR process, and not just your servicing records, make sure you're looking at the DHR, interviewing personnel, looking at your trends. Trends, trends, trends. Trends is huge in ISO.

Because this could be part of your post-market surveillance.

And there's the whole new clause on feedback for… in Section 8.

So…

Trends are really big. Michelle mentioned this, but determine your root cause. There's… here's a handful of tools for evaluation, the 5 Whys, the Ishikawa fish bone, interviewing, fault tree analysis, all very classic. And then there's basically 3 types of root cause, plus a little star here, which is you didn't have a process, your process wasn't followed, and your process was ambiguous. There's also a little star for design, because sometimes, and this is, you know, different schools of thoughts, sometimes design controls themselves are not sufficient for the root cause, and maybe your design was inadequate.

Some people argue that that means that your design control process isn't good enough, but that's a side note. I add design. your CAPA plan. Make sure your CAPA plan that you present to FDA, or your response to FDA, has a clear Actionable scope. It defines who's going to be responsible within your organization, what is the specific corrective and preventive actions to be taken. how you are going to do those, and how they're going to be implemented, and what is your timeline? When are you going to do it? Your Kappa has to address the root cause, not just a symptom. Make sure that you are not just doing a single issue correction if that's not appropriate. Sometimes it is appropriate, you know, sometimes it's like, okay, I just need to update my procedure.

or I need to correct a record. But make sure, if that's the case, that you have all the evidence to justify this. Michelle, you want to talk about risk and risk-based approach? Because this is really hot and popular.

I was like, no pun intended, but this is a hot topic under QMSR. Okay. So, the risk-based approach is defined under the QMSR in ISO 1345, and FDA now expects companies to apply risk-based thinking throughout the entire quality management system. Then your action plan should determine that that issue that was evaluated based on its potential impact, and then your response needs to be appropriate to the level of risk to the quality, safety, and the patient. Now, this is also where FDA is going to start writing up culture for quality, because they're going to say, if we find all of these… these elements in these different areas to be insufficient, and it looks like your quality management system is not being effective.

then that ultimately falls under management oversight and culture of quality. So that's where the culture of quality is going to come in. I think we're going to see, you know, kind of out of the blue, some things that FDA never wrote up before, and they're going to tell you, well, we always expected you to do this way. And so, I've been told that, by one person I spoke to in the FDA during one of the audits I was managing. that, Oh, I lost my train of thought, Ty. Where was I? Coach, probably. Oh, that they were surprised… FDA was surprised how unprepared industry was since they have been working with the TC210, the Technical Committee for ISO 1345, since its inception.

And… and that they've grown together in terms of expectations and clarity. And so, I just thought that that was really interesting, that FDA was taken aback, that industry, after being told and told and told for so long, that it's coming, and now it's really here, and people are in denial about it. But that's… that's where we're going to link back into Culture of Quality. So, after FDA accepts your response, what's next? Well, FDA acceptance is… it's not the end. It just means your plan is acceptable, and now you must execute that plan. Via corrective actions as planned and promised. Complete required validation verification activities.

Especially for process-related, manufacturing process-related issues. Perform, effectiveness checks, which is the standard part of, doing a CAPA properly, and then monitor to make sure that issues do not re-occur.

Basically, you should follow your CAPA process, you know? The plan is all well and good, but if you don't actually execute it, then it's kind of pointless when the FDA inevitably comes back.

And I, turn in my plan in 15 days, and then I typically give, especially if it's something a little bit meatier, I will give them updates every month as we are working towards, you know, the different CAP I've planned and the root cause analysis and the verification checks.

Yeah, as you're getting… because, you know, 15 days is kind of tight to do a proper investigation if it's really, really impactful. So FDA does kind of understand that there's some updates that you're going to be providing to them if the scope of the 483 is large.

So then, hypothetically, you get an establishment inspection report, EIR, which is the FDA's final written report documenting the inspection overall outcome. So what they do is they take their 483s that they gave you, and the notes that they took while they were there. And, then, like, somebody higher than them. like, reviews and is the one that issues the EIR themselves. Now, I've seen it happen where The companies either didn't get an EIR or went for 2 or 3 years before they got their EIR from the previous inspection.

Yeah, technically you're supposed to… according to the guidance documents on EIRs, you're supposed to get them 45 calendar days after close, but… practice is always different, or you get them after FDA has concluded whatever for your voluntary action indicated, or required action indicated. And something else that's really interesting in that guidance document is that it does mention specifically that FDA can release a redactive narrative portion. Which is just kind of an interesting… Thing to keep in mind, because it could mean that whenever FDA comes back, there's additional information that you're not privy to that they wrote up to follow up on your facility.

So, re-inspection readiness, This is, you know, assume FDA is going to verify your corrections were implemented and are effective, so make sure you've completed that implementation, make sure you're adhering to your process changes and whatever the new changes are, and make sure your effectiveness check is not… this is my soapbox about effectiveness checks. Make sure they're real. Don't make them a checkbox activity. Make sure that you're actually preventing recurrence, because… You know, it's easy to get lost and make sure that they are just done, but if it does recur, it's a lot better that you're catching it yourself and realizing that your cap is ineffective than other people catching it for you.

So, we're talking a lot about 483… and what they are, and FDA's inspection. Well, why does it really matter to you as an organization, or people who are representing organizations? We're going to talk about all the metrics, but most importantly, QMSR has come out. It is effective. They are auditing using their new risk-based inspection technique, and we're already seeing in the data FDA shifting how they're writing things up. So… These, historically, are the top 5 483 areas. It's Kappa, design controls, complaint files, purchasing controls, and then the fifth one, there's kind of some movement. It's usually non-conforming product or production and process.

These all link to direct areas within ISO, but we're also seeing FDA is having more 483s issued. So, in the fiscal year of 2024, they did 672. In fiscal year of 2025, there was 791. Michelle, what were you gonna say?

Can you go back a slide, please? So, the reason why we think that these are significant, these are all written up underneath the quality system regulation, and these were obviously all pre the transition to the QMSR. So, if industry as a whole is already consistently doing these elements poorly. poorly enough to get 483s, then, you can only expect that the… how high the bar's been raised with the QMSR and the ISO 1345, that these are going to continue to be problematic areas. And now we have to throw in culture of quality and management oversight, which, in my recent experiences with it, and risk management, all of these, I think, are going to shoot up, for these areas that FDA rarely wrote anything up for.

That's a great point. So… Yeah, so we're… we're seeing already an increase, and we're gonna see even… I think, Michelle and I think, we're gonna see even more of an increase, because the QMSR gives FDA a way to write up what their expectations always were, that they sometimes felt like their hands were tied. So, the typical reason or short citation that they use is the lack of an inadequate process or lack of inadequate complaint procedures. It's all about lack of procedures. That's how FTA writes them up in the official 483 database. So usually they're writing up the process as a whole in a 483. That's just something to keep in mind.

Okay, so QMSR has come out. These are the 2026 metrics, post-QMSR only. You can see they are quite different, because the number one reason that companies are getting cited is that they do not have a risk management process. And the risk management process is either not documented or inadequate. At the very bottom. is kind of an additional one that we added, because I think this is going to get a lot of write-ups, which is that there's no risk-based approach applied to the QMS process as a whole. The risk-based inspection technique and ISO 1345 talk about a risk-based approach to the quality management system. That means you need to incorporate

you know… risk control ideas in all of your processes. You know, do you have critical suppliers versus non-critical suppliers? What level do you control suppliers at, based off of the risk that they present to your device? That's that kind of thinking. For newbies, or for people who kind of have been trying to chomp at the bit, product realization risk management. is under 14,971, and that is now getting hugely written up. they're technically different concepts, but I think both of them are going to get the industry's gonna get tremendous write-ups for them, because they're not having a risk management process in place.

Complaint handling is also seeing an increase, and what we are seeing an increase of is that FDA is specifically writing up where your complaint handling process is not feeding into your product risk management process. And now you can see Kappa has dropped down. four levels. So, there's gonna be a big shift here, which means that the way you're responding to 483s, and the way FDA audits were done, are gonna take a big shift, and I think we're gonna see a lot more 483s that are different. Going forward. So knowing how to adequately respond to one is more important than ever. Warning letters, we just kind of have this data because warning letters are the natural outcome of quality system 43s that don't get resolved. One thing that's really…

Interesting to note here is that in 2024, when they announced QMSR, you see that there's a big increase in the number of warning letters that were issued for insufficient risk management and change control. So before 2023, it was 2. In 2024 and 2025, you see that there's 8 or 7. Warning letters are also issued for regulatory reasons. This is usually without an inspection, but when FDA is kind of trolling the internet or becomes aware of illegally marketed devices. Another trend that we are seeing in the warning letters is that testing data, testing facilities, the data integrity and reliability is also getting heavily reviewed.

So those are signals that you can be aware of, because if you have Biocomp data, or sterility data, or packaging validation data from one of these test labs. FDA might use that as a reason to come into your facility for an audit, so just be mindful of This increase in, you know, calling out test labs that could impact your product. And again, warning letters, this is just highlighting that a high percentage of the warning letters correlate directly to the 483 topics that we talked about. And I think we're gonna see a shift and much more for risk management.

Can we cover all these things in depth in those classes that we provided, or the package that will be available soon? Yeah. Yeah, I think it's going to be really handy to navigate some of these expectations.

Yep. Warning letter statements, there's basically two statements that FDA always says, which is, you know, your firm needs to take prompt action to address the violations in this letter. Failure to address this will result in regulatory action, and also you have 15 business days from the date you received this letter. It's basically, you're on that highway to hell, and you can't see a way to get off it. One. Final concluding slide about warning letters, which none of you should be getting here, because you all know how to adequately respond to a 483, is that this warning letter just released a couple weeks ago, maybe a month ago, and it… it's in that transition period where they were still on… because warning letters lag about 6 months.

they were still under the QSR regulation. However, FDA expects, because of the timing, that you are implementing corrective actions to the QMSR requirements in effect, which means, okay, you need to have heavier emphasis on addressing your risk-based approach in your CAPA plan itself, making sure that you have documented risk evaluation for the scope of the activities you're going to do. So just keep that in mind. If you have an Open 483 and it's kind of been in the works for a while, that you're… A good practice you can do to set yourself up for success is making sure you're documenting how it complies with the new QMSR requirements.

Now is a good time for questions. I'm checking the time. We do have an excellent warning letter kind of escalation, but I think we don't have time for it. You'll have to catch us talk about the core pack scenario in another webinar. But Michelle, what kind of questions do we have? Or I can stop sharing and… Pull them up, whatever your preference is.

just leave it… leave it there. So, we have, as cybersecurity is a specific header in the new methodology, could you comment on what all is required? So that one could be a bit in-depth, but I could tell you that overall, whether it's cybersecurity or whatever, that they are usually starting with a risk management file. And if you read through the E-Star about the documents that are expected around risk management, and the product change control plans, and all of that, they are… I think it will help you Figure out which documents in your system need to be tightened up, because not only are those things important in the actual submission.

the… the person that's coming in to do the inspection, while they don't… they're not authorized to have a regulatory opinion, they are authorized to take all those files that you turned in and trace what you… what you said you were going to do, to what you did, to what you changed, and how all that fits within your… your actual procedures. And cybersecurity is one that's kind of lumped in there with software that I see people grossly under-document. Because software and cybersecurity are things that they think that they do under Agile, and Agile is document adverse. And, and so… but at the end of the day, the FDA reviews a document.

So, yeah.

I think what you mentioned could be a key indicator for… for people who are struggling with the cybersecurity requirements and making sure your documentation is good is use the eStar. The help context on it is really, really quite good for cybersecurity.

Yep. And this is our buddy Tom. How do you respond when you re… when you reject a 43 from the FDA? You know, I think you have to follow the full appeals process through, okay, trying to resolve it with the inspector, which I know you're hitting a brick wall, but then move up to his supervisor, move up to division chief. And then, if you don't get resolution at either of those levels, then, I would go to the ombudsman with it.

Yep.

Okay, how do FDA and ISO terms align? How do FDA and ISO aligns on… or differs from in terms of verification, the concept of verification, validation?

So, FDA specifically, and you can read this in the comments, they specifically said they are not going to define, like, process validation, process verification, but in general, they are kind of following the same process. So, depending on how verification is. you know, one thing that FDA did really well is that ISO usually borrowed their design controls documentation and kind of the design control process, so if you are compliant under ISO, you are likely to be compliant under FDA. The verification terms align pretty closely.

Why is ISO 1345 certification not considered as part of the evidence of QMSR implementation by FDA's inspectors?

I mean, FDA just decided that they're not going to accept ISO 1345 certification like they accept… well, the ISO 1345 report, because let's be clear, MDISAP reports are accepted, not the certificate. And I think the reason that they don't is because ISO 1345 is appropriately broad. It has a lot of outs, where it just says you need to be following applicable regulatory requirements. We cover this in our course, but applicable regulatory requirements means country-specific requirements. ISO 1345 on its own is not compliant with QMSR. And that is something that I think industry will struggle to understand. It is…

ISO 1340.

45, plus these additional requirements, plus regulations that don't even get mentioned. 21 CFR 803, 806, Part 11 for signatures, the labeling requirements. They're not in 21 CFRE.

Right.

the old one, or the new one.

FDA said for those terms… parts he… he… they kept, therefore, ISO 1345 compliance in and of itself is not adequate, because if you remember that little wheel I put up, you know, one whole section of it was related to,

Other applicable requirements. There's four.

Right, there's 4.

called out.

Okay. Within how many days do you have to respond to a 483?

15. You have 15 days to give them at least your first class of a plan, and say, hey, okay, this is the information we've gathered so far. If you aren't done with your investigation, you need to have a good reason why, telling them that you're going to other systems, or you're waiting for product to come back for investigation, things like that. So you have 15 days.

Do these new expectations or principles extend to our notified body's processes when they conduct their annual MDISEP audit?

So, FDA did talk about MDSAP audit, and the MDASP audit model, how it might get impacted. FDA just had the Ready Conference, they do have a whole section on it, but basically. they said that MDISAP is not going to change that much. They've removed some tasks and then just add those 5 specific, subparts into the MDISAP model. But I don't anticipate that it's going to change your MDISAP experience that much, if I'm honest.

I'm just scanning through here.

Yeah.

Okay, that looks like… How do I know when the plan is accepted? And is there a formal response of acceptance? This is a mix.

Should you be told that it's accepted? Yes. Do they sometimes go into…

Do they sometimes… acknowledge. Yeah.

No.

Yep.

It's kind of like, I mean, for people who are doing notifications of change during EUMDR, sometimes the inspectors are just so busy that it goes into the black hole, but the best you can do is keep the evidence that you did, in fact, communicate it, and say, hey, I emailed them, here's the evidence, I didn't receive a response. And then, I mean, let it go.

Yeah.

Doesn't mean you don't have to do it, you still have to do it, though.

Yeah. Yeah, whether they… and if they don't respond to you, carry on with your plan. That's… that's my advice.

Well, we're right at the top of the hour, so I want to thank both of you, for giving up your time today, and for all the work that you put into this. I think that you did an excellent job. I'm sure the audience will agree with me. Please feel free to agree with me, and… or… or disagree privately. But, the, And I'd like to thank everybody who gave up their time today and showed up. You know, your participation means a lot, and I would like to remind you that if you're interested in getting details about the upcoming, course on QMSR, please put Kyomasar details in the chat, and we'll make sure that you get it. Look forward to,

What is the quality one coming up?

The next course that's coming out is Risk Management, so…

the… the webinar in July.

Oh, culture of quality. Yeah, we're gonna talk all about what FDA calls the culture of quality.

Right, okay, so that's gonna be exciting. And I just found out that we're doing, not with Lean, but, with a, Canyon Labs and ClareMed, we're gonna do a packaging webinar in, In June. She'll look forward to details on that. Also a good topic.

Yep, I think that one's gonna be, like, a hot topic. I think we're gonna have even more data and information to kind of, project what we think is happening around the culture of quality and the FDA expectations in, subsequent 483s against that area.

Yeah, and thank you, everyone, for the really good questions. It's always nice when we get really good, thought-provoking questions at the end of a webinar.

And if you didn't get your questions answered today, please feel free to reach out to Michelle and Tiana directly, through LinkedIn, or contact me if you don't know how to get ahold of them. I'm happy to help out. Thanks again. Please take the, survey, and we look forward to seeing you hopefully tomorrow.

just reiterate when and how people are going to get the recording and PowerPoint and whatnot.

Right. Oh, so, yeah, Diana, please send me this version of the PowerPoint, and we will make sure that this version of the PowerPoint and, the recording goes out tomorrow by… via Zoom, email, so the same registration email that I came in with. And someone says, I never get the slides and recording, just write to me and I'll make sure you get them. Please.

Alright, well, thank you very much, everyone.

Thank you all.

Yeah, okay.

Cheers.

Have a great day, everybody. Thanks for your time.

Bye, everyone!