Inspections and audits
What does a mock FDA inspection cover?
A mock inspection is a rehearsal of the real one. Since February 2, 2026, the U.S. Food and Drug Administration (FDA) inspects medical device makers under the Quality Management System Regulation (QMSR), using the approach in Compliance Program 7382.850, which replaced the older Quality System Inspection Technique (QSIT). We run mock inspections the same way: the same document requests, the same interviews, the same pressure. The findings come to you first, ranked by risk, with time left to fix them. See mock FDA inspections.
What changed in FDA inspections under the QMSR?
The QMSR took effect on February 2, 2026 and brings ISO 13485:2016 into FDA's device quality rules (21 CFR Part 820). Investigators now organize inspections around quality system areas instead of the old QSIT subsystems, and choose what to look at based on each company's risks. One change surprises people: internal audit, supplier audit, and management review reports used to be off limits to FDA, and now they can be reviewed (FDA QMSR FAQ). Those reports should now be written to be read by an investigator.
How often should we run internal audits?
ISO 13485 requires internal audits at planned intervals, with the schedule based on how important each process is, its condition, and what earlier audits found. There is no fixed number. A common practice is to cover every quality system process at least once a year and the higher-risk areas more often. What matters more than the count is whether the audit tests records, not just procedures. See internal quality system audits.
Does every supplier need an on-site audit?
No. ISO 13485 and the QMSR expect supplier controls in proportion to the risk each supplier carries. A supplier program decides which suppliers are audited, how often, and how: on site, remotely, or by reviewing their documents. The program is what keeps finding problems; a single audit only finds them on one day. See supplier audits.
What is the Medical Device Single Audit Program (MDSAP)?
MDSAP lets one audit by an authorized auditing organization satisfy the device regulators of Australia, Brazil, Canada, Japan, and the United States. Canada requires an MDSAP certificate for most medical device licenses. Monica Burt took part in the MDSAP pilot and has stayed engaged with the program since.
What is quality due diligence?
It is a read of a target company's quality system before an acquisition or investment. It answers three questions: what the certificates actually prove, what the files actually contain, and what it will cost to fix. See quality due diligence.
FDA 483s, warning letters, and CAPA
How quickly do we need to respond to an FDA Form 483?
FDA generally allows 15 business days. A response that arrives in that window gets a detailed review before FDA decides whether to issue a warning letter; a late one generally does not (Federal Register, August 11, 2009). FDA can still issue a warning letter at any time. The response should be specific, owned by named people, and dated. See FDA 483 and warning letter response.
What is the difference between a Form 483 and a warning letter?
A Form 483 lists what an FDA investigator observed during an inspection. It is handed over at the close of the inspection. A warning letter is more serious: it is FDA's formal notice that it considers the problems significant violations, it is posted publicly on FDA's website, and it asks for a written response. Either way, the work is the same: a structured response, a corrective action plan, and remediation carried through to closure.
When is a CAPA really closed?
A corrective and preventive action (CAPA) is closed when the problem stays gone and you can show it. That takes a root cause your team can verify, an action built around that cause with an owner and a date, and an effectiveness check that proves the action worked. The effectiveness check is the step investigators ask about, and the one most often skipped. See CAPA and root cause analysis.
Working with MB&A
Who does MB&A work with?
Medical device companies at three stages: early-stage startups heading toward a 510(k) and first launch, mid-size device makers and contract manufacturers from $40M to $300M in revenue, and large device makers above $300M, mostly on supplier quality. We also work with acquirers and private equity firms on quality due diligence. See who we serve.
Does MB&A use AI on audits?
On the audits where it fits, yes. We use Qualera, the audit intelligence platform Monica Burt founded in 2025. It gives the auditor a first read of a company's documents and records, and an MB&A lead auditor reviews and decides every finding.
Where is MB&A based, and where do you work?
We are based in Memphis, Tennessee, and work with medical device companies across North America.
How do we get started?
Call or write and tell us what you are facing: an FDA 483, an audit finding, an inspection coming up, a deal under letter of intent. We will tell you how we would handle it. Request a call.