Complaint Handling, MDR, CAPA, and Risk Management Under QMSR

Postmarket quality work under the Quality Management System Regulation (QMSR) is a connected system, not four separate departments. QMSR—FDA's medical-device quality-system regulation in 21 CFR Part 820, effective February 2, 2026—incorporates ISO 13485:2016 by reference and retains FDA-specific requirements, including complaint-handling provisions in Part 820 and Medical Device Reporting (MDR) obligations under 21 CFR Part 803. Corrective and preventive action (CAPA) follows the incorporated ISO 13485 clauses, and risk management expectations align with ISO 14971. These controls apply across device categories, and investigators read them as one evidence chain.

A defensible system lets an investigator select a single complaint and follow it: intake record, evaluation, MDR decision, investigation, any CAPA opened, the effectiveness check, and the update to the risk file and design inputs. Weakness anywhere in that chain—an undocumented reportability decision, a CAPA closed without an effectiveness check, a risk file untouched by field data—undermines the whole. This guide turns that chain into practical preparation; it is not a promise of any inspection outcome.

Discipline complaint intake and evaluation

Everything downstream depends on intake quality. Complaint records should capture when the complaint was received, the device and lot or version identification, the complainant and event description, and the immediate assessment of what the complaint alleges. Procedures should define what counts as a complaint broadly enough to catch service reports, social-media reports, distributor feedback and technical-support calls—not only formal written complaints.

Evaluation comes next, and it must be documented even when the answer is "no further investigation needed." The record should show who decided, on what basis, and how the decision considered the risk the complaint describes. Investigations that do occur should connect to the evidence that explains the device in question: device history records, supplier lots, labeling versions and distribution scope, as the inspection readiness guide for the six QMS areas describes for complaint and CAPA linkages.

Treat MDR decisions as records, not judgments recalled later

Under 21 CFR Part 803, manufacturers must report to FDA certain device-related deaths, serious injuries and reportable malfunctions within defined timelines. FDA's Medical Device Reporting page summarizes who must report and how. The inspection-sensitive point is not only whether a report was filed but whether the reportability decision was made on time, by a defined process, with the rationale retained.

Build the MDR assessment into complaint evaluation rather than bolting it on afterward. Each complaint evaluation should record the reportability determination—reportable, not reportable, or pending additional information—with the facts relied upon and the date the clock started. Supplemental reports, late-report explanations and trends in malfunction reporting should be retrievable without heroics. An investigator comparing complaint files against submitted MDRs should find no unexplained asymmetry.

Connect complaints to CAPA with risk-based thresholds

Not every complaint warrants a CAPA, and treating every complaint as one buries real signals in noise. The workable model is a documented, risk-based threshold: complaint trends, severity, detectability and recurrence determine when an issue escalates from individual correction to systemic corrective or preventive action. Whatever threshold you set, apply it consistently and record the decision, because an unexplained inconsistency—similar issues handled differently—is a classic observation.

A well-run CAPA record shows root-cause analysis that goes beyond retraining as a default answer, an action plan proportionate to the risk, implementation evidence, and—most often missing—an effectiveness check performed after enough time or data to mean something. CAPA records should link back to the complaints, nonconformities, audit findings or supplier issues that triggered them, and forward to the processes and documents they changed. The Form 483 prevention guide catalogs the recurring evidence gaps FDA cites in this area.

Close the loop into risk management and design

Field data is the real-world test of your risk file. Complaint and MDR trends should feed a defined review that asks whether existing hazard evaluations still hold, whether new hazards emerged, whether risk controls work as intended in practice, and whether residual-risk acceptability conclusions need revision. FDA recognizes ISO 14971 for risk management; confirm current status in the recognized consensus standards database. A risk file that never changes while complaints accumulate is evidence of a broken loop.

The loop ends in design. Significant complaint patterns and CAPA outcomes should be evaluated as inputs to design changes, labeling updates and next-generation requirements, with the design controls guide covering how those changes are then controlled. Management review should see complaint, MDR and CAPA metrics together, not as separate reports, so that resource and escalation decisions rest on the combined signal.

Download the complaint-to-risk linkage register

Download the editable QMSR Complaint, MDR, CAPA and Risk Linkage Register.xlsx. Use it to test each linkage against sample records, assign owners and track gaps to closure. It is a preparation aid, not an FDA form, certification tool or substitute for device-specific regulatory judgment.

• Complaint intake captures all field-signal channels with device and lot identification.
• Every complaint evaluation records the investigation and MDR reportability decisions with rationale.
• CAPA escalation follows documented, risk-based thresholds applied consistently.
• CAPA closures include effectiveness checks based on data.
• Complaint and MDR trends are reviewed against the risk file and evaluated as design inputs.

FDA primary sources

Start with FDA's QMSR overview, QMSR frequently asked questions and the Inspection of Medical Device Manufacturers compliance program. Use current 21 CFR Part 820 for quality-system requirements, 21 CFR Part 803 and FDA's Medical Device Reporting page for reporting obligations, and the recognized consensus standards database for ISO 13485 and ISO 14971 recognition status.

Turn postmarket signals into controlled action

Use MedTech Copilot to organize complaint evaluation, MDR decisions, CAPA effectiveness evidence and risk-file updates around traceable decisions. Qualified human owners remain responsible for reportability, CAPA acceptance and regulatory determinations. The goal is practical, evidence-backed, inspection-ready implementation—not automated assurance of compliance.