CP 7382.850: The Six QMS Areas and How to Prepare for FDA Inspection

CP 7382.850 is FDA’s Inspection of Medical Device Manufacturers compliance program: instructions to FDA staff for evaluating medical-device manufacturers. Effective February 2, 2026, it describes the risk-based inspection process aligned with the Quality Management System Regulation (QMSR). It is not a new standalone regulation, and it should not be confused with an ISO certification audit checklist.

The practical preparation task is to make connected evidence easy to retrieve and explain. An investigator may follow a patient-risk issue across multiple processes. Six isolated binders are therefore less useful than a record trail linking changes, development, suppliers, production, complaints and management decisions. This article identifies the six official areas and translates them into a preparation workflow.

The six official QMS areas—not a generic ISO chapter list

FDA’s official CP 7382.850, Part III and Attachment A, organizes QMSR requirements into these six QMS areas: Change Control; Design and Development; Management Oversight; Measurement, Analysis, and Improvement; Outsourcing and Purchasing; and Production and Service Provision.

Other Applicable FDA Requirements, or OAFRs, are separate: Medical Device Reporting, Reports of Corrections and Removals, Medical Device Tracking Requirements, and Unique Device Identification. Registration/listing and marketing authorizations are also addressed as general inspection items. Do not count OAFRs as a seventh quality-system area, or replace Outsourcing and Purchasing with a generic resource-management heading.

Our QMSR complete implementation guide explains the underlying quality-system transition. This article focuses specifically on what to retrieve and how to demonstrate linked implementation.

An actionable six-area evidence table

The examples below are preparation suggestions, not an exhaustive list of FDA-requested records. Use the program’s actual elements, applicable requirements, inspection type and product risks to determine scope. A manufacturer should not assume that supplying one document per row completes an inspection.

Choose samples that expose interfaces. A supplier-related failure can connect purchasing specifications, incoming acceptance, manufacturing performance, complaints and corrective action. Treat that connection as the main preparation exercise, rather than a reason to create duplicate copies in every folder.

Change Control: show the whole decision

Select a meaningful change, such as a material substitution or revised software function. Retrieve the reason, affected device configuration, risk assessment, required testing, approvals and implementation evidence. Include the regulatory assessment where the change could affect marketing authorization requirements.

Check that release records match the approved revision. If verification identified an exception, show its disposition and impact assessment rather than hiding it behind the final report. The ability to explain why a change remained controlled is more persuasive than a long list of closed change requests.

Design and Development: connect requirements to V&V

Choose a requirement that matters to patient or user safety. Follow it from intended use and design inputs through outputs, review, risk controls, verification, validation and transfer. Keep test acceptance criteria, tested configuration and result interpretation visible.

A report titled validation is not enough if the tested configuration cannot be matched to the released device. For AI-enabled products, evaluate applicable software and algorithm change interfaces; our PCCP guide helps distinguish planned change-control work from assumptions about what an FDA-authorized plan permits.

Management Oversight: demonstrate decisions and resources

Prepare the quality-system scope, responsibilities, medical device file and relevant management-review records. Explain how significant risks or recurring issues reach leadership, what decisions were made and whether promised resources were supplied.

A meeting slide does not by itself establish effective oversight. Look for decisions, owners and follow-up outcomes. If a recurring supplier problem remained open, show how management evaluated the issue and what controls were applied while longer-term action proceeded. Avoid treating management review as ceremonial evidence detached from actual operations.

Measurement, Analysis, and Improvement: follow the feedback loop

Select a complaint or nonconformance with a meaningful investigation trail. Review intake, device identification, investigation, reportability assessment, trend analysis and corrective action where warranted. Verify that effectiveness criteria address the original problem rather than simply confirming training attendance.

Distinguish a correction to an individual problem from corrective action aimed at its cause. Show how new information feeds risk management and product or process changes. Our compliance guide provides the wider context for quality, risk and regulatory interfaces without replacing the source requirements.

Outsourcing and Purchasing: show control beyond the contract

For a critical supplier, retrieve qualification rationale, agreed requirements, relevant monitoring and acceptance evidence. Evaluate whether supplier changes are communicated and assessed before they affect finished-device quality. Outsourced design, software or manufacturing work must remain connected to the manufacturer’s quality system.

A current certificate may contribute evidence, but it does not answer every question about a specific supplied component or service. Choose a recent deviation or change and show how the team decided whether the supplier’s output remained acceptable.

Production and Service Provision: reconstruct a real release

Trace one batch through relevant production instructions, equipment controls, process validation, acceptance activities, identification, labeling and release. For sterile devices, include applicable sterilization and sterile-barrier controls. For servicing, retrieve applicable service records and their links to feedback.

Confirm that the release decision rests on approved evidence from the correct configuration and process. Where electronic records support these steps, the Part 11 electronic-records guide helps assess applicable record and signature controls. It does not mean every digital record is automatically subject to Part 11.

Prepare for connected, risk-based review

The program describes inspection models and minimum coverage; these are not a guarantee that review will stop at a minimum sample. Objectionable conditions or inadequately assessed information may prompt additional evaluation. FDA’s focus on patient and user risks means the record trail can move between QMS areas and OAFRs.

Document applicability for tracking and other device-specific obligations. Keep MDR, corrections/removals and UDI decisions accessible through their quality-system interfaces. Do not assume the six-area table removes registration, listing or authorization checks from scope.

Download and rehearse with the evidence index

Download the FDA Inspection Evidence Index.xlsx. Add record identifiers, revisions, owners, linked risks and related records. This is an editable internal preparation aid, not an FDA form or a prediction of inspection results.

• Trace one risk-relevant device or process across more than one QMS area.
• Confirm record retrieval works without the originating author present.
• Reconcile tested, approved and released configurations.
• Document applicable OAFRs and unresolved evidence gaps.

FDA primary sources

Read CP 7382.850, issued February 2, 2026: Part III describes the inspection process, and Attachment A lists areas, elements and requirements. FDA’s CDRH compliance programs page explains that compliance programs instruct investigators and do not themselves bind the public. FDA’s QMSR FAQ confirms the transition away from QSIT. For binding requirements, consult applicable regulations and incorporated standards.

Build inspection-ready evidence with MedTech Copilot

Use MedTech Copilot to organize fragmented quality, development, risk, V&V and regulatory evidence into structured preparation work. Keep document approval, applicability and final decisions with qualified reviewers. Inspection readiness means explainable implementation supported by records—not a generated assertion that your system is compliant.