FDA 21 CFR Part 820 Quality System

Part 820 sets out the quality-system requirements a US device manufacturer must meet: management responsibility, design controls, document and purchasing controls, identification and traceability, production and process controls, acceptance activities, non-conforming product handling, CAPA, labelling, records, and servicing. For years this ran in parallel to ISO 13485 — similar in spirit, different in detail — forcing companies to satisfy both. The FDA’s move to the Quality Management System Regulation changes that, incorporating ISO 13485 by reference and harmonising the US requirements with the international standard.

For a manufacturer, the practical upshot is that a well-built ISO 13485 system now gets you most of the way to US compliance, with the remaining work being the US-specific overlays and, crucially, readiness for the FDA’s way of inspecting. We plan implementation around that convergence, so you build one system tuned for both rather than duplicating effort across two frameworks that are now, deliberately, close cousins.

• Part 820 covers design, production, records, CAPA and complaints.
• QMSR harmonises the US requirements with ISO 13485.
• A strong ISO 13485 system now carries much of the US burden.

Design controls are where FDA inspections most often bite, just as they are under ISO 13485 — but the FDA has decades of enforcement history here and a very particular sense of what good looks like. Investigators trace design inputs to outputs, check that verification and validation genuinely close the loop, look hard at design reviews, and expect a Design History File that tells the complete, contemporaneous story of how the device was developed. A design history assembled after the fact is one of the classic ways a company earns a 483.

We build design controls as a living, traceable process rather than a retrospective paperwork exercise, with the Design History File growing naturally as development proceeds. Done properly it satisfies both the FDA and ISO 13485 at once, and it has the side benefit of making your engineering more disciplined and your next device easier to develop.

The US has its own record vocabulary, and two terms dominate. The Device Master Record is the recipe — the complete set of specifications and procedures that define how the device is made. The Device History Record is the evidence that a particular batch was actually made to that recipe. Together they let an investigator confirm that what you shipped matches what you designed, and gaps or inconsistencies between the two are prime inspection findings.

We structure the DMR and DHR so they are complete, consistent and easy to follow, and so they map cleanly onto your ISO 13485 documentation rather than duplicating it. When an investigator pulls a batch record and traces it back to the master record, the story should hold together without a scramble — and that only happens if the records were designed to hold together in the first place.

If design controls are the first place an FDA investigator looks, CAPA is the second. The FDA cares intensely about whether you detect problems, investigate them properly, fix root causes rather than symptoms, and verify the fix worked — and whether your complaint handling feeds that system honestly. A CAPA system that opens issues but never closes them, or closes them without real root-cause analysis, is a red flag investigators are trained to find.

We build CAPA and complaint handling to withstand exactly that scrutiny: clear triggers, disciplined investigations, root-cause rigour, effectiveness checks, and a clean link from complaints and non-conformances into the CAPA system. The goal is not a system that survives an inspection by luck, but one that genuinely improves the product — which is, not coincidentally, what the FDA is trying to enforce.

Because Part 820 compliance is proven by inspection, readiness is the whole game. An FDA investigator may arrive with little notice and will test your system by doing, not reading — pulling records, tracing processes, interviewing staff, following a complaint to its resolution. The companies that come through cleanly are the ones who have rehearsed this, not the ones with the thickest binders.

We run mock FDA inspections that mimic the investigator’s technique: record traces, targeted questions, and pressure on the areas the FDA favours. A mock inspection surfaces the weaknesses while you still control the outcome, and it trains your team to handle a real visit calmly. It is the single most valuable preparation for the US market, because the QSR is not judged on a submission — it is judged on a Tuesday morning when the FDA is standing in your lobby.

• FDA inspections test the system by doing, not by reviewing a file.
• A mock inspection finds the 483s before the FDA does.
• Trained, calm staff are as important as clean records.

The great advantage of the QSR-to-QMSR convergence is that you no longer have to run separate quality systems for the FDA and the rest of the world. A single ISO 13485-based system, extended with the US-specific overlays and tuned for FDA inspection, can satisfy the United States, the EU, India and other markets at once. Maintaining one honest system is not only cheaper than maintaining several — it is also more robust, because effort is concentrated rather than spread thin.

We build with that unification as the goal, so the work you do for the FDA reinforces your ISO 13485 certification, your CE marking and your CDSCO obligations rather than sitting apart from them. One quality system, several regulators, far less duplication — that is what the harmonisation finally makes possible, and what we build towards.