FDA QMSR Document Control: What an Inspection-Ready Record Should Show

An investigator asks which packaging instruction was used for a production lot, who approved that revision, and where the related training evidence is stored. Producing today’s procedure answers only part of the question. The quality record needs to explain the process and decisions that applied when the work occurred.

FDA’s Quality Management System Regulation (QMSR) became effective on February 2, 2026. It incorporates ISO 13485:2016 by reference into 21 CFR Part 820. FDA also replaced QSIT with the inspection process in Compliance Program 7382.850.

This guide focuses on document control within the quality management system of a medical-device manufacturer subject to QMSR. The tables and worked example are practical recommendations for organising and retrieving that evidence.

1. Start with the questions the record must answer

Define an evidence model for each record class, using your approved procedures and applicable requirements. Keep the controlled document connected to the activity it governed.

A document’s approval date and effective date serve different purposes. Likewise, an effective revision does not prove it was actually used for a specific lot. Preserve the operational record that establishes that connection.

2. Control the revision and the release decision

Make draft, under-review, approved, effective, superseded, and retired states unambiguous. Define who may move a document between them and what evidence is needed. File versioning preserves changes; the release process establishes which revision is authorised for use.

Retain comments, requested changes, rejected submissions, final decisions, and change reasons against the revision they concern. Prevent routine users from overwriting approved evidence. Record amendments or replacements with their relationship to the earlier record.

When a revision affects how work is performed, record the change assessment and any resulting training or competence requirements under your approved process. An email-open event or a download log does not establish that the required training was completed.

For the broader release model, see Controlled Revisions vs. File Versioning.

3. Connect supplier, audit, and corrective-action records

A supplier audit should be retrievable with its supplier and site, scope, report, findings, decisions, and follow-up evidence. A complaint investigation may connect to a device, lot, risk assessment, and corrective and preventive action (CAPA). Use stable references across the systems that hold those records.

FDA’s QMSR FAQ confirms that the former exception for management-review, quality-audit, and supplier-audit reports was not retained. Prepare those records for retrieval when relevant to an inspection, along with the decisions and actions they support.

Keep open findings visible with an owner, status, and next action. A retained audit PDF does not establish that its findings were resolved. Where evidence remains in a supplier portal, training system, or another application, test that the referenced version can still be retrieved.

4. Preserve pre-QMSR history and assess process gaps

FDA may review quality-system records created before February 2, 2026. Its April 1, 2026 town-hall clarification also explains that manufacturers do not need to revise or recreate older records solely to conform them to QMSR language. Historical terms such as design history file or device master record do not need to be removed from those records.

Preserve the original and its context. Assess where current processes need to change, document identified gaps, and manage necessary actions through the quality system. If a later explanation is needed, date and attribute it as a later assessment rather than making it appear contemporaneous with the original activity.

5. Demonstrate the configured electronic process

Define the software’s intended use and the controls it performs: revision selection, permissions, approval routing, audit capture, retention, retrieval, and integration. Identify consequential failure scenarios and retain evidence that those controls work in the configured environment.

FDA’s February 2026 computer software assurance guidance describes a risk-based approach to confidence in production and quality-management-system software. Use the intended use and risk to determine assurance activities, and control changes to the configuration and integrations.

Where the process uses electronic records or signatures, assess the applicable scope and controls using FDA’s Part 11 guidance. Preserve the link between the signature or approval evidence, the person, the exact record, and the action’s meaning. A generic “approved” flag is too little context for reviewing that decision.

Apply the retention and access rules appropriate to the record class. Keep superseded revisions and related evidence retrievable for their required period, and test recovery. A backup alone is not a usable inspection history.

Run a production-lot retrieval exercise

Suppose the current packaging instruction is revision 4, released in April. An investigator asks about lot L-204, packaged in March under revision 3. Test whether your team can assemble the relevant history without substituting the current document for the historical one.

1. Start from the lot record

   Find the production record and the instruction identifier and revision it references. Retrieve revision 3 with the applicable product/site scope and effective dates. Do not infer the revision used solely from the date.

2. Follow the release evidence

   Produce revision 3’s review, approval, change rationale, and release decision. Show its relationship to the earlier and later revisions so the reviewer can distinguish historical use from the current release.

3. Retrieve the supporting records

   Find the training or competence evidence relevant to the personnel and process, and any related supplier or corrective-action records. Retain the identifiers needed to follow those links across systems.

4. Review the package and the gaps

   Create an indexed, readable package through the approved inspection-response process. Check access restrictions, record completeness, and retrieval time. Log missing evidence and follow-up actions under the QMS rather than reconstructing history without explanation.

Set internal retrieval targets appropriate to your process and test representative records, including older formats and external references. The target is a way to expose dependencies before an inspection, rather than a new regulatory deadline.

Use the exercise to improve the record system

• Current and historical effective revisions are distinguishable, and operational records identify what was used.
• Approval, change, and relevant training evidence refer to the exact controlled revision.
• Supplier and audit findings remain connected to decisions, follow-up, and open work.
• Pre-QMSR records remain intact, with later assessments clearly identified.
• Authorised staff can retrieve and export the evidence, including after a restore or system change.

Sources reviewed: November 10, 2026. Apply the current requirements and approved procedures relevant to the manufacturer, device, and intended system use.

Make the quality record retrievable and explainable

Connect operational records to the controlled revisions, approvals, training, and follow-up evidence relevant to the work performed. Preserve earlier history and test retrieval through the manufacturer's approved quality process so an inspection response can show both the records and any unresolved gaps.