Why Risk Management Is the Top Finding in FDA’s First QMSR Warning Letters

In the first two months of inspections under FDA’s new Quality Management System Regulation (QMSR), risk management drew more Form 483 observations than any other area.

FDA officials shared this data at the MedCon conference in April, noting that they expect the trend to continue into next year.

“I’ll be shocked if that is not at the top of the list on the 483,” said Jeffrey Wooley, a compliance officer at FDA’s Center for Devices and Radiological Health (CDRH).

The four QMSR warning letters FDA has posted since the new regulation took effect in February bear that out. All four cite ISO 13485:2016 Clause 7.1, risk management in product realization. Equally important is that, while the four manufacturers make very different devices, their risk files broke down in similar ways.

Below, we look at what FDA cited, why the company responses fell short, and how to test your own risk file before an investigator does.

Key takeaways

• All four QMSR warning letters FDA has posted since the regulation took effect in February cite ISO 13485 Clause 7.1, risk management in product realization.
• The common failure: complaint, return, recall, and corrective action data never reached the risk file.
• FDA pushed back on 483 responses that offered plans without dates, revised documents, or evidence the fixes worked.
• You can test your own process by tracing one device’s recent complaints and open CAPAs back to its risk file.

Learn what an effective 483 response looks like in our free white paper, How to Respond to an FDA Warning Letter or 483 Observation.

What Is FDA Citing Companies for Under QMSR?

Under QMSR, FDA is citing device manufacturers most often for risk management, specifically for failing to document and maintain risk management processes under ISO 13485 Clause 7.1. Every QMSR warning letter posted so far includes a Clause 7.1 citation. The same letters also cite design changes, corrective action, complaint handling, and supplier controls.

QMSR Warning Letters Citing ISO 13485 Clause 7.1

Why Does FDA Keep Citing Risk Management Under QMSR?

FDA keeps citing risk management because QMSR expanded the requirement from risk analysis during design validation to a documented risk management process across all of product realization, and many companies haven’t made that shift yet. The gaps are also easy to prove.

Under the old Quality System Regulation (QSR), FDA typically cited risk analysis under design validation, as Wooley noted at MedCon. Under QMSR, risk management becomes a process that runs through design, production, purchasing, and post-market activities.

Note that risk analysis is just one step in a comprehensive risk management process, which also includes controlling hazards, verifying those controls, and updating the analysis as production and post-market information comes in. Each of the four letters describes a risk process that stopped short of that full loop.

How Does FDA Spot Risk Management Gaps Under QMSR?

Risk management gaps are easy to prove because an investigator only has to compare what your procedure says with what your files contain. Keisha Thomas, associate director for compliance and quality at CDRH, told the RAPS Quality Conference in June that investigators are finding firms whose risk files exist but aren’t applied systematically across the quality system.

In three of the four letters, the company’s own procedure set the bar it missed:

• Missing process FMEA: The foot pedal maker’s risk procedure required process FMEAs, but the inspected product didn’t have one.
• Missing FMEAs across a product line: The wound therapy manufacturer’s procedure required user, design, and process FMEAs for every product. One product line had none.
• Stale risk analyses: The dialysis solutions maker’s design control procedure required risk updates when new hazards emerged, yet its product risk analyses hadn’t changed since they were first written.

For smaller companies, the gap might look like a procedure template that promises FMEAs that don’t exist. At larger companies, the problem is more often consistency across departments and sites. FDA officials at MedCon flagged in particular risk scales that vary from one department to another.

They also said procedures that just restate the regulation or standard don’t show how the work actually gets done. One official starts with the company’s procedure, then has the team walk her through one risk in the risk analysis, column by column. Running that same walkthrough internally is one of the quickest ways to see whether your procedure matches your practice.

What Pattern Do the First QMSR Warning Letters Share?

The common pattern across FDA’s first four QMSR warning letters is post-market and quality data that never makes it back into the risk analysis.

No defined path for post-market data

FDA’s warning letter to the foot pedal controls maker found that its risk procedure didn’t say how complaints, adverse events, and recalls feed into risk management.

A recall that didn’t change the risk analysis

The dialysis solutions maker started a Class I recall in April 2025, but according to FDA’s warning letter, the product’s risk analysis, last revised in November 2020, still rated every risk negligible or acceptable.

Failures that never became complaints

At the Doppler company, the FDA investigator reviewed numerous returned-goods forms reporting device failures, but none were handled as complaints.

A corrective action the risk file never saw

FDA’s warning letter to the wound therapy manufacturer notes a documented corrective action that was never incorporated into its risk analysis.

FDA cited the last two findings under complaint handling (21 CFR 820.35(a)) and corrective action (Clause 8.5.2), not Clause 7.1. Each still describes a signal the risk file needed and never received.

Why Did FDA Find the Companies’ 483 Responses Inadequate?

In the first QMSR warning letters, FDA judged most of the four companies’ Form 483 responses inadequate or couldn’t evaluate them at all. Each company had responded to a Form 483 before its warning letter arrived, and FDA pushed back on responses that included:

1. A description of planned fixes without a timeline or revised documents
2. Training records that don’t show employees understood the updated procedures
3. Passing retests of retained samples offered as justification for skipping a field action for out-of-specification lots
4. Memos marking CAPAs as ineffective without correcting the underlying problem
5. New CAPAs managed under the same CAPA procedure FDA had cited as deficient

For device companies answering a 483, these letters point to five action items:

1. Put a date on every commitment: Give a completion date for each corrective action, and send the revised procedure rather than a description of it.
2. Look backward as well as forward: Assess products already shipped and records already created under the old process. FDA asked one firm how it would evaluate past test results from an uncalibrated instrument.
3. Show effectiveness, not activity: Training records, closed CAPAs, and new quality plans count only when you can show they worked.
4. Fix the procedure before relying on it: New CAPAs opened under a deficient CAPA procedure inherit its gaps, which FDA pointed out in one letter.
5. Cover the gap in between: FDA faulted a firm for describing no interim risk controls while its FMEAs were being rebuilt.

How Can You Test Your Risk Management Process Before a QMSR Inspection?

You can check for the most common QMSR finding by picking one device and tracing its newest signals back to its risk file:

1. Pull recent signals: Gather the device’s last five complaints and its open CAPAs.
2. Find the risk review: For each item, find the record showing someone assessed it against the risk file, and the date the file changed (or the documented reason it didn’t).
3. Check your triggers: Confirm your risk procedure names what triggers a review, such as complaint trends, recalls, CAPAs, new intended uses, and supplier changes. It should also name who owns and approves each review. FDA doesn’t set a schedule for updating risk analyses, but investigators expect a defined method.
4. Make risk controls specific: Vague or missing risk control descriptions are a common problem. Each control should say what it is, where it’s implemented, and how it was verified.
5. Audit your own promises: Confirm that every FMEA your procedures require exists and that no risk control has gone unverified for months.

The hardest part of this exercise is getting the data into one place. When it’s scattered across documents and spreadsheets, teams can’t see the trends that should drive a risk review.

A connected QMS closes much of that gap. When complaint, CAPA, and risk management records live in one system, a complaint investigation or CAPA workflow can be configured to include a risk review.

The system keeps a dated record of that decision, which is the evidence these letters describe as missing. Siemens Healthineers’ North American organization, for instance, standardized risk management, CAPA, and change management on AssurX and has achieved zero QMS findings on its FDA and ISO audits.

Risk Management Is the QMSR Finding You Can Prevent

Under QMSR, a risk file is supposed to change as a product’s history grows. In the first four warning letters, risk files were static or incomplete while complaints, returns, recalls, and corrective actions accumulated.

A risk file that hasn’t changed since launch is now one of the easiest QMSR findings for FDA to write. For small and mid-size device makers, closing that loop is often the fastest way to reduce regulatory exposure. For larger organizations, the work is making the loop consistent across every site and department.

About the Author

Stephanie Ojeda is Vice President of Product Management for the Life Sciences industry at AssurX. Stephanie brings more than 18 years of experience leading quality assurance functions in a variety of industries, including pharmaceutical, biotech, medical device, food & beverage, and manufacturing.