10/13/2026
“Clean up all code.”
That was the entire description on a software change order at a wound-therapy device company that the FDA inspected this spring.
When the investigator asked what had actually changed, neither the CEO nor the President could say.
There was no verification record. Another ten more software changes had been closed without records showing they were implemented correctly. Several CAPA forms were incomplete.
That’s from one of the first warning letters issued under the FDA’s new QMSR, which took effect in February.
I’ve read through the early ones, and a pattern jumps out.
At one company, a contract manufacturer added a new intended use to a device, and the company had no record of the change. At another, the risk procedure never said who was responsible. At a third, the risk analysis hadn’t been updated since 2020, even after a Class I recall.
None of these is a paperwork problem. In each case, nobody with the right expertise owned the system.
QMSR puts risk management front and center. Since it took effect, risk management has become the FDA’s most-cited 483 observation, accounting for more than 20% of all 483 citations. And you can’t have accountable risk management without accountable people. Outsourcing the work doesn’t outsource the responsibility.
The companies that do well in these inspections aren’t the ones with the thickest binders. They’re the ones with someone in the room who can answer the question.
So, for the hiring managers here:
If FDA walked in tomorrow and asked what changed, who on your team could answer?