ISO 13485:2016 clause 5: Management responsibility

• Quality manual or QMS overview document -- verify it names specific top management roles and their QMS accountabilities, not just generic org chart references
• Board or executive meeting minutes from the last 12 months -- look for quality/compliance as a standing agenda item, not a one-off mention
• Management commitment statement or signed quality policy -- confirm the signatory is current top management, not a predecessor who left 2 years ago
• Resource allocation records -- check that management approved budget line items specifically for QMS activities (audits, training, CAPA, equipment qualification)
• Organizational chart showing reporting lines -- verify the quality function has a direct line to top management, not buried 3 levels below operations
• Evidence of management participation in quality events -- look for attendance at CAPA reviews, design reviews, or supplier audits beyond just management review meetings

• Top management cannot articulate the quality policy or name the current quality objectives when interviewed -- indicates the QMS operates as a quality department exercise rather than a leadership-driven system (Major NC)
• Quality function reports to operations or manufacturing VP with no independent access to top management -- creates inherent conflict of interest when quality decisions impact production schedules (Major NC)
• Management commitment is limited to signing the quality policy annually with no other documented involvement in QMS activities throughout the year (Minor NC)
• No evidence that top management reviews or approves resource requests for QMS improvements -- quality budget decisions are made at middle management level only (Minor NC)

Interview at least 2 members of top management and 3 shop-floor personnel. Compare their descriptions of management's involvement in quality to identify perception gaps.

• When was the last time you personally intervened in a production decision because of a quality concern?
• How do you ensure quality considerations are factored into strategic business decisions such as new product launches or facility changes?
• Can you give me an example of a resource request from the quality team that you approved in the last 12 months?

• Management review meeting minutes -- verify top management attendance (not just their delegate), look for specific decisions with assigned owners and deadlines, not just 'noted' or 'acknowledged'
• Budget approval records for quality initiatives -- cross-check that approved amounts were actually disbursed, not just approved on paper
• Executive communications referencing quality and compliance -- verify these go beyond boilerplate; look for specific references to company performance data, incidents, or improvement initiatives
• Strategic planning documents -- confirm quality objectives are integrated into the business strategy, not appended as an afterthought
• Training records showing management participated in quality/regulatory training -- check if management completed GMP awareness, MDR transition, or similar regulatory training
• Capital expenditure approvals for quality-related equipment or infrastructure -- verify management signed off on IQ/OQ/PQ-related investments

• Management review records show the quality manager presented all data and top management only signed the minutes without documented discussion, questions, or decisions -- this is passive attendance, not commitment (Minor NC)
• Top management approved a quality policy years ago but has no record of reviewing, questioning, or updating it since, despite significant changes in product portfolio and regulatory landscape (Minor NC)
• Quality objectives exist only at the quality department level with no cascade to operations, R&D, or supply chain -- management has not ensured objectives are established at relevant functions and levels (Major NC)
• Management allocated zero dedicated budget for CAPA implementation or corrective action verification activities -- corrective actions are expected to be absorbed within existing operational budgets (Minor NC)
• No evidence that management conducts or participates in management reviews -- reviews are conducted entirely by quality manager and results are emailed to management for 'review and approval' (Major NC)

Review management review records from the last 2 cycles. For each, verify top management attendance, specific decisions made, and follow-up completion rates.

• Describe a situation in the last year where you personally had to make a difficult decision between production schedule and quality requirements.
• How do you stay informed about changes in medical device regulations that affect this organization?
• What quality metrics do you monitor personally, and how often?

• Regulatory requirements matrix or register -- verify it covers all markets where devices are sold (FDA, EU MDR, MDSAP countries), check the last update date, and confirm it includes recent regulatory changes like EUDAMED milestones or FDA QMSR transition
• Customer requirement capture process -- look for a systematic method (VOC program, contract review, design input process) rather than ad-hoc collection of customer emails
• Customer satisfaction measurement results with trend analysis -- check for meaningful metrics (complaint rates per unit shipped, NPS scores, on-time delivery) rather than generic satisfaction surveys with 95%+ satisfaction claims
• Post-market surveillance data analysis -- verify feedback from the field is systematically collected, analyzed for trends, and fed back into design and manufacturing
• Management review inputs showing customer and regulatory data -- confirm management actually reviews this data and makes decisions based on it
• Contract review records for recent orders -- check that customer-specific requirements (labeling, packaging, testing, documentation) are identified before acceptance

• Organization sells devices in 5 EU member states but the regulatory matrix only references the Medical Devices Directive 93/42/EEC with no evidence of EU MDR 2017/745 transition planning or gap analysis (Major NC)
• Customer satisfaction is measured only by absence of complaints -- no proactive satisfaction measurement exists, and management interprets 'no news is good news' as meeting customer requirements (Minor NC)
• Post-market surveillance data is collected but not analyzed for trends or fed back to design or manufacturing -- the data sits in a database with no periodic review or action trigger thresholds (Minor NC)
• Contract review process exists but does not include verification of customer-specific regulatory requirements for different jurisdictions -- same labeling is shipped to all markets regardless of local requirements (Major NC)
• Management review does not include any customer feedback data or regulatory compliance status -- Section 5.6.2 inputs (a) through (c) are missing entirely (Major NC)

Select 2 products sold in different regulatory jurisdictions. Trace the regulatory requirement identification through to objective evidence of compliance for each.

• How quickly after a new FDA guidance document is published does your organization assess its applicability and impact?
• Show me how a customer complaint from the last 6 months was traced back to a requirement gap and resulted in a process change.
• Who is responsible for monitoring regulatory changes in each jurisdiction where you sell devices?

• All-hands or town hall meeting presentations from the last 12 months -- look for specific references to regulatory requirements, customer feedback, or compliance incidents, not just generic 'quality is important' slides
• CEO/President written communications (emails, newsletters, intranet posts) -- verify they reference specific regulatory obligations (e.g., MDR transition, FDA 510(k) conditions, UDI compliance) rather than abstract quality platitudes
• Training records showing management-led quality awareness sessions -- distinguish between management presenting versus management merely attending quality department presentations
• Documented evidence of management communicating consequences of non-compliance -- look for references to specific incidents, warning letters, recalls, or regulatory actions in the industry that management used as teaching moments
• Onboarding materials for new employees showing quality/regulatory orientation content approved by management -- verify the content is current and references actual products and regulations applicable to the organization
• Interview records or awareness assessment results -- sample 5-8 employees across departments and levels to gauge understanding of why compliance matters to their specific role

• Management communication consists solely of distributing the quality policy during annual training -- no other evidence of communicating the importance of compliance throughout the year (Minor NC)
• Production operators interviewed cannot name a single regulatory requirement applicable to the product they manufacture daily, despite working in the role for an extended period -- indicates communication has not been effective (Major NC).
• All quality communications are issued by the quality department with no visible involvement or endorsement from top management -- employees perceive quality as a departmental function, not a management priority (Minor NC)
• Management communicates about customer requirements (delivery, cost) but never mentions regulatory requirements -- the 'applicable regulatory requirements' half of this clause is not addressed (Minor NC)
• Communication is exclusively top-down with no mechanism for employees to raise quality or compliance concerns to management (Observation)

Review communications from the last 12 months. Interview 3 employees from different departments (production, warehouse, design) and compare their understanding of regulatory requirements to what management claims to have communicated.

• How does management communicate the impact of regulatory changes that affect day-to-day operations on the production floor?
• Can you show me an example where management communicated lessons learned from a quality event or near-miss to the broader organization?
• What feedback mechanism exists for employees to report quality concerns directly to management?

• Quality policy document with current top management signature and date -- verify the signatory is still in their role and the date is within a reasonable review cycle (typically annual)
• Meeting minutes or records showing management's involvement in policy development or revision -- look for evidence of discussion, debate, or input from management, not just a signature approval
• Policy revision history -- check whether revisions coincide with management changes, strategic shifts, or regulatory updates, indicating active management engagement
• Evidence linking the policy to business strategy -- verify the policy reflects the organization's actual products, markets, and regulatory obligations rather than being a generic template
• Management interview notes -- ask the CEO/GM to explain the policy in their own words and describe why specific commitments were included

• Quality policy was written by a consultant during initial ISO 13485 certification and has never been revised despite changes in top management -- current leadership cannot explain why specific commitments are in the policy (Major NC).
• Policy is signed by 'VP Quality' rather than top management -- the person who established the policy does not have ultimate organizational authority (Minor NC)
• Meeting minutes show the quality manager presented a draft policy and management approved it in the same meeting with no recorded discussion or modifications -- management did not 'establish' the policy, they rubber-stamped it (Minor NC)
• The quality policy is identical to a template from an ISO 13485 implementation guide, with only the company name changed -- it does not reflect the organization's specific purpose or products (Minor NC)

Review the current policy, its revision history, and interview the policy signatory about their personal involvement in its content.

• If you were to rewrite the quality policy today, what would you change and why?
• How does the quality policy influence your strategic business decisions?
• When was the last time you considered whether the quality policy still reflects the direction of this organization?

• Quality objectives register or matrix showing objectives at corporate, departmental, and functional levels -- verify each objective has a measurable target, an owner, a deadline, and a defined measurement method
• Management approval records for objectives -- look for evidence that management reviewed, challenged, and approved the objectives rather than just signing off
• Progress tracking dashboards or reports reviewed by management -- verify management sees objective status at least quarterly and takes action when objectives are off-track
• Cascading structure showing how top-level objectives flow down to department-level targets -- check that production, design, supply chain, and regulatory all have quality objectives, not just the quality department
• Management review records addressing objective achievement -- cross-reference with 5.6 to verify objectives are a standing input to management review
• Evidence of management intervention when objectives are not met -- look for escalation records, resource reallocation, or corrective actions triggered by missed objectives

• Quality objectives exist only at the quality department level (e.g., 'reduce audit findings by 10%') with no objectives established for production, design, purchasing, or other functions that affect product quality (Major NC)
• Objectives are stated as aspirations ('improve customer satisfaction') without measurable targets, measurement methods, or deadlines -- they cannot be objectively evaluated (Major NC)
• Management approved objectives at the start of the year and has no record of reviewing progress until the next annual management review -- an entire year without monitoring (Minor NC).
• Same objectives have been carried forward unchanged for multiple consecutive years regardless of whether they were achieved -- no evidence of management engagement in objective-setting (Minor NC).

Review the full objectives register. Select 2 objectives from different functions, trace them from establishment through progress monitoring to management review discussion.

• Which quality objective did the organization fail to meet last year, and what was management's response?
• How do department managers know what their quality objectives are, and how do they report progress?
• Show me an example where a missed quality objective led to a management decision to allocate additional resources.

• Management review meeting minutes with attendance records -- verify top management (CEO, President, or equivalent) was present and actively participated, not just listed as an attendee
• Agenda and pre-read materials -- confirm the review covered all mandatory inputs per 5.6.2 and was structured to support decision-making, not just data presentation
• Decision log from reviews -- look for specific, actionable decisions with assigned owners, deadlines, and allocated resources, not vague statements like 'continue to monitor'
• Action item tracker showing completion status of previous review actions -- verify closure rates and whether overdue items are escalated
• Evidence of management conducting the review -- look for management asking questions, challenging data, and directing actions, not just signing minutes prepared by the quality department
• Calendar entries or scheduling records showing reviews are planned at defined intervals -- check whether planned intervals are maintained or frequently rescheduled

• Management review was conducted by the quality manager who then circulated minutes for top management signature -- top management did not 'conduct' the review as required (Major NC)
• Review minutes consist of a 2-page summary with the notation 'reviewed and approved' -- no evidence of discussion, questions, challenges, or decisions (Minor NC)
• Planned review interval is defined but the last review was conducted well beyond the required interval with no documented justification for the delay (Minor NC).
• Action items from the previous management review show a low completion rate, yet the current review does not address the overdue items or escalate them (Minor NC).
• Top management delegate attended 'on behalf of' the CEO for multiple consecutive management reviews -- the CEO has not personally conducted a review within the required interval (Major NC).

Review the last 2 complete management review cycles. For each, verify attendance, completeness of inputs, specificity of decisions, and completion rate of resulting action items.

• How long does a typical management review meeting last, and is it a standalone meeting or combined with other business reviews?
• Show me an action from a previous management review that resulted in a significant change to the QMS.
• What happens when a management review action item is overdue -- what is the escalation process?

• Annual quality budget with management approval -- verify it includes line items for internal audits, training, equipment calibration, CAPA implementation, supplier audits, and regulatory submissions
• Staffing plan for quality-affecting roles -- check vacancy rates, time-to-fill for critical positions, and whether temporary resource gaps are managed with contingency plans
• Capital expenditure approvals for quality-related equipment -- verify management approved IQ/OQ/PQ budgets, not just the equipment purchase price
• Training budget and utilization records -- compare approved budget against actual spend and check whether training was deferred or cancelled due to budget constraints
• Management review outputs specifically addressing resource needs (5.6.3(d)) -- verify management committed specific resources in response to identified needs
• Evidence of resource adequacy assessment -- look for workload analyses, capacity studies, or competency gap analyses that management uses to proactively determine resource needs

• Quality department has had open positions unfilled for an extended period, resulting in overdue internal audits and delayed CAPA closures -- management has not ensured resource availability (Major NC).
• Training budget was significantly cut mid-year to meet financial targets, resulting in cancelled GMP training for new production staff -- resources were not maintained (Minor NC).
• No dedicated budget exists for quality system activities -- quality costs are embedded in departmental budgets with no visibility to management on total QMS investment (Minor NC)
• Management review output states 'resources are adequate' without any supporting analysis or assessment -- this is a conclusion without evidence (Observation)
• Calibration program is significantly behind schedule because the calibration technician position was eliminated in a restructuring -- management did not ensure resource availability before making the change (Major NC).

Review the quality budget, staffing plan, and 3 specific resource requests from the last 12 months. Cross-reference with CAPA closure rates, audit schedule compliance, and training completion rates as indicators of resource adequacy.

• What is your current vacancy rate in quality-affecting positions, and what is the average time-to-fill?
• Has any quality activity been delayed or deferred in the last 12 months due to insufficient resources?
• How does management determine whether the current resource level is adequate for the QMS?

• Current quality policy document signed by top management -- verify the signatory is still in their role, the date is within the review cycle, and the document is controlled per 4.2.3
• Policy content analysis against all five sub-clauses -- systematically verify (a) appropriate to purpose, (b) commitment to compliance and effectiveness, (c) framework for objectives, (d) communicated and understood, (e) reviewed for suitability
• Communication records showing how the policy was deployed -- look for multiple channels (training, posting, onboarding, digital display) and evidence of ongoing reinforcement, not just initial distribution
• Employee awareness assessment or quiz results -- verify a representative sample of employees can explain the policy's relevance to their role, not just recite it from memory
• Management review records showing policy suitability was assessed -- confirm the review evaluated whether the policy still fits the organization's current products, markets, and regulatory obligations
• Revision history showing changes aligned with business evolution -- a policy unchanged for 5+ years despite business changes is a red flag

• Quality policy is missing one or more of the five mandatory elements -- most commonly missing: framework for objectives (c) or commitment to maintain QMS effectiveness (b) (Major NC)
• Policy was last reviewed well beyond the organization's review cycle despite the organization expanding into new regulated markets, adding new product families, and changing leadership -- the policy no longer reflects the organization's current purpose (Minor NC).
• Employees can recite the quality policy word-for-word from the wall poster but cannot explain what it means for their daily work -- communication occurred but understanding was not achieved (Minor NC)
• Policy uses conditional language ('we strive to comply') rather than unconditional commitment ('we are committed to comply') -- weakens the mandatory commitment statement in (b) (Minor NC)
• Policy is displayed in English only at a facility where a significant portion of production staff are non-English speakers -- communication has not been effective for the full workforce (Minor NC).

Read the full policy text. Interview 3 employees from different departments and levels. Review the last 2 management review records for evidence of policy suitability assessment.

• If I removed your company name from this policy, could I tell it belongs to a medical device organization? What makes it specific to you?
• How would a new employee learn about this policy during their first week?
• When was the last time the policy was actually changed, and what triggered the change?

• Quality policy text -- check for explicit references to medical devices, patient safety, healthcare, or the organization's specific device types (Class II cardiovascular, Class III implantables, IVDs, etc.)
• Organization's stated mission/vision -- compare to the policy for alignment; if the mission says 'innovative surgical robotics' but the policy says 'quality products,' there is a disconnect
• Product portfolio documentation -- verify the policy reflects the actual scope of products (e.g., sterile single-use devices, reusable surgical instruments, active implantables)
• Regulatory registration documents -- confirm the policy acknowledges the regulatory jurisdictions where the organization operates (FDA, EU MDR, MDSAP, etc.)
• Business strategy documents -- check whether the policy aligns with the organization's strategic direction or contradicts it

• Quality policy states 'we are committed to providing high-quality products that meet customer expectations' -- this could apply to a furniture manufacturer; there is no reference to medical devices, patient safety, or regulatory compliance (Major NC)
• Organization manufactures Class III active implantable devices but the policy makes no reference to patient safety, biocompatibility, or the heightened regulatory requirements for high-risk devices (Minor NC)
• Organization serves both EU and US markets but the policy only references FDA compliance with no mention of EU MDR obligations (Minor NC)
• Policy references 'manufacturing excellence' but the organization is a contract design house that does no manufacturing -- the policy does not reflect the organization's actual role (Minor NC)

Compare the policy text against the organization's product catalog, regulatory registrations, and business strategy to verify alignment.

• Your policy does not mention patient safety -- is that intentional, and if so, why?
• You recently expanded into the EU market -- how was the quality policy updated to reflect this change?
• Your organization's role is contract sterilization -- how does the policy reflect that specific scope?

• Quality policy text -- identify the specific sentences that address (1) commitment to comply with requirements and (2) commitment to maintain QMS effectiveness; both must be present and unambiguous
• Language analysis -- check for conditional qualifiers ('strive,' 'aim,' 'endeavor,' 'where practicable') that weaken the commitment; the standard requires commitment, not aspiration
• Scope of 'requirements' -- verify the commitment covers all applicable requirements including ISO 13485, regulatory requirements (FDA, MDR), customer requirements, and internal requirements, not just one category
• Distinction between compliance and effectiveness -- confirm the policy addresses both; 'comply with requirements' and 'maintain effectiveness' are two separate obligations

• Policy states 'we strive to comply with applicable regulations' -- the word 'strive' introduces conditionality; the standard requires an unconditional commitment (Minor NC)
• Policy includes a commitment to 'continual improvement' but not to 'maintaining effectiveness' -- improvement and maintenance are different concepts; the standard specifically requires effectiveness maintenance (Minor NC)
• Policy commits to 'meeting customer requirements' but does not mention regulatory requirements -- only half of the compliance commitment is present (Minor NC)
• Policy uses a single statement 'we are committed to quality' without specifying what that means in terms of compliance or effectiveness -- too vague to satisfy the requirement (Major NC)

Perform a close reading of the policy text. Highlight the specific sentences addressing each of the two commitments and evaluate them for completeness and unconditional language.

• Your policy says 'strive to comply' -- can you explain the difference between striving and committing?
• Your policy mentions improvement but not effectiveness maintenance -- how do you ensure you maintain what is already working?
• Does your compliance commitment extend to all regulatory jurisdictions where you market devices?

• Quality policy text -- identify strategic themes, priorities, or focus areas that provide direction for objective-setting (e.g., 'commitment to patient safety' should lead to objectives measuring adverse event rates)
• Quality objectives register -- verify each objective traces back to a specific policy statement or theme; orphan objectives that do not connect to the policy indicate a framework gap
• Traceability matrix linking policy statements to objectives -- some organizations formalize this linkage, which is good practice but not required
• Management review records -- verify that objective review considers alignment with policy direction
• Evidence that the policy guides objective updates -- when policy priorities change, objectives should follow

• Quality policy is so vague ('committed to quality excellence') that it provides no meaningful direction for objective-setting -- any objective could be claimed as aligned, which means none are specifically derived from the policy (Minor NC)
• Objectives focus entirely on internal metrics (audit findings, CAPA closure) with no connection to policy statements about customer satisfaction or regulatory compliance -- the framework is not functioning (Minor NC)
• Policy was revised to include new strategic priorities but objectives were not updated to reflect the new direction -- the framework linkage is broken (Minor NC)
• No documented evidence that anyone considers the policy when establishing or revising quality objectives -- objectives are set based on historical targets, not policy direction (Minor NC)

Select 3 quality objectives and trace each back to a specific policy statement. If the linkage cannot be demonstrated, the framework requirement is not met.

• Which quality objective is most directly linked to your policy commitment on regulatory compliance? Show me the connection.
• When you establish new quality objectives each year, how do you ensure they align with the policy?
• Has the policy ever been revised because the objectives showed a gap in policy coverage?

• Training records showing policy communication during onboarding and refresher training -- verify all personnel who affect product quality received the training, including temps and contractors
• Policy displays in work areas -- physically verify during the facility tour that policies are posted in relevant languages, current revision, and visible (not behind equipment or in a locked office)
• Digital communication records -- intranet posts, email distributions, digital signage content showing the policy is communicated through electronic channels
• Understanding verification records -- look for quizzes, assessments, or documented interviews that test comprehension, not just attendance signatures
• Multi-language versions if applicable -- verify translations are available for all languages spoken by the workforce and that translations are verified for accuracy
• Communication to contractors and temporary workers -- verify the policy is communicated to all personnel whose work affects quality, not just permanent employees

• Policy is posted on a notice board in the quality department hallway but not in production areas, warehouses, or design offices where quality-affecting work actually occurs (Minor NC).
• Policy was communicated during initial deployment with no evidence of reinforcement, refresher communication, or verification of continued understanding since (Minor NC).
• Production workforce includes a significant proportion of non-English speakers but the policy is only available in English -- communication has not been effective for a significant portion of the workforce (Minor NC).
• Employees interviewed can recite the policy from the wall poster but cannot explain how it relates to their specific role -- communication occurred but understanding was not achieved (Minor NC)
• Temporary and contract personnel who work in cleanroom assembly areas have no evidence of policy awareness training -- they affect product quality but were excluded from communication (Minor NC)

Interview 4 employees from different functions and levels. Ask each to explain the policy in their own words and how it applies to their role. Grade understanding as strong, adequate, or insufficient.

• How do you verify that employees actually understand the policy rather than just memorizing it?
• When the policy was last revised, how was the change communicated and how did you verify the new content was understood?
• How are temporary workers and contractors made aware of the quality policy?

• Management review records specifically addressing policy suitability -- verify the review goes beyond 'policy reviewed, no changes' and actually evaluates the policy against current business context
• Review criteria or checklist used -- look for consideration of regulatory changes, product portfolio changes, market expansion, organizational restructuring, and strategic direction shifts
• Policy revision history showing changes correlated with business changes -- if the organization added 3 product lines and entered 2 new markets but the policy is unchanged, the review may not be effective
• Documented justification for retaining the policy unchanged -- if the review conclusion is 'no changes needed,' there should be documented reasoning explaining why the policy remains suitable
• Input data for the review -- external factors (new regulations, industry trends, customer feedback) and internal factors (audit results, quality performance, organizational changes) that were considered

• No record of any policy suitability review within the organization's defined review cycle -- the policy may be suitable, but there is no evidence it was reviewed (Minor NC).
• Management review minutes state 'quality policy reviewed -- no changes' with no documented assessment of suitability factors or justification for no changes (Minor NC)
• Organization transitioned from MDD to EU MDR and expanded into MDSAP markets since the last policy revision, but the policy review did not consider these changes (Minor NC)
• Policy review is conducted by the quality manager alone without top management involvement -- top management is required to ensure the review occurs and consider the results (Minor NC)
• Policy has not been revised for an extended period during which leadership changed, the product portfolio expanded significantly, and new regulatory markets were entered -- yet the review consistently concludes 'suitable, no changes needed' (Major NC).

Review the last 2 policy suitability assessments. Evaluate whether they considered relevant internal and external changes and whether the conclusions are justified.

• What would need to change in the business for you to decide the quality policy needs revision?
• How do you evaluate whether the policy is still appropriate after a significant regulatory change like the QMSR final rule?
• Has the policy ever been revised as a result of a suitability review? If so, what triggered the revision?

• Quality objectives register or matrix -- verify each objective has a SMART structure: Specific target, Measurable metric, Assigned owner, Realistic timeline, and Time-bound deadline
• Objectives at multiple organizational levels -- confirm objectives exist at corporate, departmental, and functional levels; check production, design, regulatory, purchasing, and service all have quality objectives
• Traceability to quality policy -- select 3 objectives and verify each traces to a specific policy commitment; orphan objectives that cannot be linked to the policy indicate a planning gap
• Regulatory compliance objectives -- verify at least one objective addresses regulatory requirement compliance (e.g., zero FDA 483 observations, on-time MDR periodic safety update reports)
• Product quality objectives -- verify objectives address product performance (e.g., field failure rate below 0.1%, first-pass yield above 98%, complaint rate per 1000 units shipped)
• Progress tracking evidence -- review dashboards, scorecards, or reports showing objective performance against targets at least quarterly

• Quality objectives are stated as aspirations without measurable targets, measurement methods, or deadlines -- they cannot be objectively evaluated for achievement (Major NC)
• Objectives exist only at the corporate level with no cascaded targets at departmental or functional levels -- production, design, and purchasing have no quality objectives (Major NC)
• All 5 quality objectives are internal QMS metrics (audit findings, CAPA closure time, training completion) with no objectives addressing regulatory compliance or product quality as mandated by the clause (Minor NC)
• Quality objectives have been the same for multiple consecutive years with targets consistently exceeded -- objectives are not revised to drive improvement and may no longer be relevant (Minor NC).
• Objectives lack assigned owners -- when asked who is responsible for achieving each objective, the quality manager says 'everyone' which effectively means no one (Minor NC)

Review the complete objectives register. Select 3 objectives from different functions, verify SMART criteria, trace to policy, and check progress data. Interview 2 department managers about their quality objectives.

• Which quality objective is the organization currently furthest from achieving, and what corrective actions are in place?
• Show me how department-level objectives roll up to support corporate quality objectives.
• How do you determine whether an objective target is appropriately challenging versus easily achievable?

• QMS implementation or operational plan -- verify it addresses how each Section 4.1 requirement is met with assigned responsibilities and timelines
• Objective achievement action plans -- for each quality objective, verify specific actions, milestones, responsible persons, and resource needs are documented
• Annual quality plan or quality calendar -- look for a structured approach to planned activities (internal audits, management reviews, supplier audits, training, calibration) with resource allocation
• Risk-based planning evidence -- verify the organization considers risks when prioritizing planning activities and resource allocation
• Resource planning documents -- confirm plans include human resource needs, infrastructure, equipment, and budget requirements

• No documented quality plan exists -- QMS activities are managed ad-hoc by the quality manager personal knowledge rather than a systematic plan (Minor NC)
• Quality objectives have no associated action plans -- targets exist but there is no documented plan for how to achieve them (Minor NC)
• Plans exist on paper but resource allocation was never confirmed -- action items require engineering time that was never budgeted (Minor NC)
• No evidence of risk-based prioritization in planning -- all activities are treated equally regardless of their impact on product quality or regulatory compliance (Observation)

Review the annual quality plan or equivalent. Select 2 quality objectives and verify action plans with milestones, owners, and resource allocations exist for each.

• When a new regulatory requirement is identified, how is it incorporated into the QMS plan?
• How do you handle competing resource demands between production deadlines and planned QMS activities?
• Show me the plan for achieving the quality objective you are currently furthest behind on.

• Process map or turtle diagrams for key QMS processes -- verify these address 4.1 requirements including inputs, outputs, resources, methods, criteria, and monitoring
• QMS process interaction matrix -- confirm the sequence and interaction of processes is planned and documented, not just organically evolved
• Quality objective action plans with milestones -- verify plans include specific actions, responsible persons, resources, timelines, and success criteria
• Resource allocation tied to plans -- confirm planned activities have budgeted resources (personnel time, equipment, budget)
• Training plans supporting QMS requirements -- verify personnel development is planned to support both 4.1 process needs and objective achievement
• Timeline showing planned vs. actual completion -- check plans have realistic timelines and track actual progress

• QMS processes evolved over time without formal planning -- no evidence that process determination, sequence, criteria, and monitoring were systematically planned as required by 4.1 (Minor NC)
• Quality objectives exist without action plans -- targets were set but no one documented what specific actions would be taken to achieve them (Minor NC)
• Plans exist on paper but resource allocation was never confirmed -- action items require engineering time that was never budgeted, making the plan aspirational (Minor NC)
• No planning evidence for how 4.1 outsourced process controls were determined -- outsourced processes lack planning documentation (Minor NC)

Select 2 QMS processes and verify planning documentation (turtle diagrams, process maps). Select 2 quality objectives and verify action plans with resource commitments.

• How was the sequence and interaction of your QMS processes determined -- was it planned or did it evolve?
• Show me the action plan for the quality objective with the tightest deadline.
• How do you ensure resource plans are realistic and not just wish lists?

• Change control records for QMS changes -- verify formal impact assessments were performed before implementing changes to QMS processes, procedures, or systems
• Risk assessments for organizational changes -- look for documented evaluation of how restructuring, personnel changes, or system migrations could affect QMS process integrity
• Transition plans for major changes -- verify plans include parallel running periods, rollback procedures, training requirements, and validation activities
• Post-change validation records -- confirm that after changes were implemented, affected processes were verified to still meet requirements
• Training records for changed processes -- verify personnel were trained on new procedures before the changes took effect
• Gap analysis records -- look for documented assessments identifying and closing any compliance gaps created by changes

• Organization migrated from paper-based document control to an electronic QMS with no formal transition plan, resulting in 3 months where document approval workflows were not controlled (Major NC)
• Major organizational restructuring eliminated a quality role and redistributed responsibilities with no impact assessment -- several CAPA investigations stalled for an extended period (Major NC).
• New ERP system changed the nonconforming material process but the corresponding QMS procedure was not updated for an extended period -- operators followed the old procedure while the system enforced the new one (Minor NC).
• Production was moved to a new facility with no documented requalification of environmental controls, process validations, or equipment (Major NC)
• A new product line was added to the QMS scope but process validations, supplier qualifications, and operator training were not completed before production started (Major NC)

Identify 2 significant QMS changes from the last 18 months. For each, review the impact assessment, transition plan, post-change validation, and check for any compliance gaps during the transition period.

• What was the most significant change to the QMS in the last year, and how did you ensure no compliance gaps were created?
• Have you ever had to roll back a QMS change because it caused unintended consequences?
• How do you identify which QMS processes are affected when a change is proposed?

• Organizational chart with reporting lines -- verify the quality function reports independently to top management, not through operations or manufacturing management
• Responsibility and authority matrix (RACI) for key QMS processes -- verify it defines who is Responsible, Accountable, Consulted, and Informed for quality-critical activities including product release, nonconformance disposition, and CAPA approval
• Job descriptions for quality-affecting roles -- verify each description defines specific responsibilities, authorities, and required competencies; check that authority levels are explicit (e.g., 'authority to stop production,' 'authority to reject product')
• Documented interrelation of personnel -- verify the standard's specific requirement that interrelations are documented, showing how personnel who manage, perform, and verify quality work relate to each other
• Independence documentation for quality functions -- look for explicit statements that QA/QC personnel have authority to halt production, reject product, or escalate to top management without permission from production management
• Delegation of authority records -- verify that when authority is delegated, it is documented with scope limitations and the delegate has been assessed as competent

• Quality inspector reports to the production supervisor who is also responsible for meeting production targets -- there is no documented independence for quality verification activities, creating an inherent conflict of interest (Major NC)
• Job descriptions exist but do not define specific authorities -- an operator's description says 'responsible for quality' but does not specify what authority they have to stop production, segregate nonconforming product, or escalate issues (Minor NC)
• Organizational chart shows reporting lines but there is no documented interrelation between personnel who manage, perform, and verify work affecting quality -- the standard specifically requires this documentation (Minor NC)
• Authority to release product is not clearly defined -- when asked who can authorize product release, three different people claim they have the authority but none can point to a documented authorization (Major NC)
• Recent organizational restructuring combined quality and operations under a single VP but no assessment was performed on how this affects the independence of quality verification functions (Major NC)

Review the org chart, 3 job descriptions for quality-affecting roles, and the RACI matrix. Interview 1 quality inspector and 1 production supervisor about authority and independence. Review 2 recent product release records to verify authorization.

• Has a quality person ever stopped a shipment or production run over the objection of operations management? Show me the record.
• How are conflicts between quality decisions and production schedules resolved, and who has final authority?
• When was the last time a delegation of authority was reviewed to ensure the delegate is still competent and the scope is still appropriate?

• Formal appointment letter or record -- verify it is signed by top management, names a specific individual, defines the scope of responsibility and authority, and is current (not an appointment from a previous management regime)
• Evidence the appointee is a member of management -- verify through org chart, title, and decision-making authority that this person is part of the management team, not a technical individual contributor given the MR title
• Authority documentation -- verify the MR has documented authority to access top management directly, allocate QMS resources, and make decisions affecting the QMS without requiring approval from another manager
• Backup or succession plan -- verify arrangements exist for when the MR is unavailable (vacation, illness, departure) so that the three sub-requirements continue to be fulfilled
• Performance evaluation of the MR in this role -- verify the MR is evaluated on QMS responsibilities, not just their other management duties

• The management representative is the quality manager who reports to the operations director -- they are not a member of management with independent authority; their QMS decisions can be overridden by their direct manager who has competing production priorities (Major NC)
• No formal appointment record exists -- the quality manager assumed the role by convention but there is no documented appointment by top management (Minor NC)
• The appointed management representative left the organization and no replacement has been formally appointed -- the quality manager is performing the role informally but without documented authority (Major NC).
• An external consultant is designated as the management representative -- this person has no management authority within the organization and visits only quarterly (Major NC)
• The MR has no backup -- when the MR is unavailable for an extended period, no one has documented authority to fulfill the three sub-requirements (Minor NC).

Review the appointment record, verify management-level position through org chart and authority documentation, and interview the MR about their actual authority and access to top management.

• What is the most significant QMS decision you have made in the last 6 months without needing approval from anyone else?
• When you identify a need for QMS improvement, what authority do you have to implement the change?
• How is continuity of the MR role maintained during absences?

• QMS process documentation inventory or master list -- verify it covers all required processes (document control, record control, internal audit, CAPA, nonconforming product, management review, design control, purchasing, production, etc.)
• Process documentation review schedule and records -- verify the MR ensures periodic review of process documentation for currency and accuracy
• Gap analysis of documented versus actual processes -- look for evidence that the MR has assessed whether any QMS processes are being performed without documentation
• Documentation change request tracking -- verify the MR oversees the documentation system to ensure new or changed processes are captured
• Audit findings related to documentation -- check whether internal audits identify undocumented processes and how the MR responds

• Three QMS processes identified during the audit (supplier qualification, software validation, and customer feedback analysis) have no documented procedures -- the MR was unaware of the gaps (Major NC)
• Process documentation exists but has not been reviewed within the required cycle -- several procedures reference obsolete equipment, former employees, and superseded regulatory requirements (Minor NC).
• The MR relies entirely on internal audits to identify documentation gaps but the internal audit schedule does not cover all QMS processes -- some processes have never been audited for documentation completeness (Minor NC)
• New processes were implemented for a recently added product line but the corresponding procedures have not been written -- the MR was not involved in the product launch planning (Minor NC).

Review the process documentation inventory. Select 3 processes and verify documented procedures exist, are current, and match actual practice observed during the audit.

• How do you know if a new process has been established somewhere in the organization that needs documentation?
• When was the last time you discovered a QMS process being performed without documentation, and what did you do?
• How do you verify that documented procedures match actual practice?

• QMS effectiveness reports to top management -- verify reports include performance metrics (objective achievement, process capability, complaint trends) not just activity metrics (audits completed, training hours)
• Management review presentations by the MR -- verify the MR presents data with analysis, conclusions, and recommendations, not just raw data tables
• Improvement recommendations documented by the MR -- look for specific, actionable recommendations with business justification, not vague suggestions
• Top management responses to MR reports -- verify management acknowledges reports and takes action on recommendations, not just files them
• KPI dashboards maintained by the MR -- verify metrics measure effectiveness (are we achieving our goals?) not just compliance (are we doing the activities?)
• Trend analysis in reports -- verify the MR identifies trends over time and projects future performance, not just reports current status

• MR reports to top management consist solely of activity metrics (audits completed, CAPAs closed, training records) with no analysis of whether the QMS is effectively achieving its objectives (Minor NC).
• No evidence of reporting outside of the annual management review -- the MR has no regular cadence of reporting to top management on QMS effectiveness throughout the year (Minor NC)
• Reports include data but no recommendations for improvement -- the MR presents metrics without drawing conclusions or proposing actions, leaving top management without clear direction (Minor NC)
• Top management receives MR reports via email but there is no evidence of review, discussion, or action -- reports are filed without acknowledgment (Minor NC)
• The MR reports only problems and nonconformities -- there is no reporting on what is working well or where the QMS is most effective, giving management a skewed view of system performance (Observation)

Review the last 3 MR reports to top management. Evaluate whether they report on effectiveness (outcomes) versus activity (tasks completed). Check for specific recommendations and evidence of management response.

• What is your assessment of overall QMS effectiveness right now, and what evidence supports that assessment?
• What is the most significant improvement need you have identified in the last 6 months, and how did top management respond?
• How do you distinguish between QMS effectiveness and QMS compliance in your reporting?

• Regulatory awareness training program records -- verify the MR has established and maintains a program to keep all personnel informed of applicable regulations, not just quality department staff
• Regulatory change communication records -- look for evidence that when regulations change (new FDA guidance, MDR updates, MDSAP audit model changes), the MR communicates the impact to affected personnel
• QMS requirement awareness materials -- verify training content, bulletins, or communications that explain QMS requirements in language relevant to each audience (production, design, purchasing)
• Awareness assessment results -- look for evidence that the MR evaluates whether awareness is achieved, not just whether communications were sent
• New employee orientation content on regulatory/QMS requirements -- verify the MR ensures onboarding includes awareness training appropriate to the role

• Regulatory awareness is limited to the quality and regulatory departments -- production, design, and purchasing personnel cannot identify the key regulatory requirements applicable to their work (Major NC)
• The MR has not communicated the impact of a significant regulatory change (e.g., FDA QMSR final rule) to the organization despite it being published and having significant implications for QMS documentation requirements (Minor NC).
• Awareness training is a one-time event during onboarding with no refresher or update mechanism -- employees hired years ago have not received any regulatory awareness updates since their first week (Minor NC).
• No assessment of awareness effectiveness -- the MR sends quarterly emails about regulatory topics but has no evidence that anyone reads them or understands the implications (Minor NC)

Review awareness training records and regulatory communications from the last 12 months. Interview 3 non-quality employees about their understanding of applicable regulatory requirements.

• What was the last regulatory change you communicated to the organization, and how did you verify the message was received and understood?
• How do you keep yourself current on regulatory changes so you can promote awareness to others?
• What specific awareness activities have you conducted in the last 6 months beyond routine training?

• Communication procedure or framework -- verify it defines channels, frequency, and content for quality-related communications at all levels
• Meeting structure documentation -- look for a tiered meeting cadence (daily huddles, weekly department reviews, monthly quality reviews, quarterly management reviews) where QMS effectiveness is discussed at each level
• Quality performance dashboards visible to employees -- verify shop-floor personnel can see quality metrics relevant to their area (reject rates, audit findings, customer complaints)
• Bottom-up feedback mechanisms -- verify employees have channels to raise quality concerns, suggest improvements, or report problems (suggestion boxes, quality circles, escalation hotlines)
• Communication records showing QMS effectiveness information -- verify examples of both good news (objectives met, successful audits) and bad news (trends worsening, CAPAs needed) being communicated
• Cross-functional communication records -- verify quality information flows between departments (design, production, supply chain, service) not just within the quality department

• Communication is exclusively top-down -- management sends quality bulletins but there is no mechanism for employees to provide feedback, raise concerns, or suggest improvements (Minor NC)
• No formal communication process exists -- quality information is shared informally through hallway conversations and ad-hoc emails with no structured cadence or defined audience (Minor NC)
• Quality performance data is available only within the quality department -- production, design, and purchasing personnel have no visibility into complaint trends, audit findings, or CAPA status that affects their work (Minor NC)
• Cross-functional communication about quality is limited to escalation of crises -- there is no routine sharing of quality performance data between departments for continuous improvement (Observation)
• Employee quality concern reporting mechanism exists but employees interviewed say they do not trust it because concerns were previously ignored or reporters were identified and criticized (Major NC)

Review the communication framework, attend or review minutes from one tier of the meeting structure, and interview 2 employees about their awareness of QMS performance and their ability to raise quality concerns.

• If an operator discovers a potential quality issue during second shift, what is the documented process for communicating it?
• How does the design team learn about field complaints that may indicate design-related issues?
• Show me an example where bottom-up communication from the shop floor led to a quality improvement.

• Management review SOP or procedure -- verify it defines review frequency, required attendees, mandatory inputs (all 12 per 5.6.2), required outputs (all 4 per 5.6.3), record retention requirements, and action tracking process
• Review schedule showing planned intervals -- verify intervals are documented (at least annual, many organizations do semi-annual or quarterly) and that actual review dates align with planned intervals
• Attendance records from last 2 reviews -- verify top management (CEO, President, GM) personally attended, not just delegates; compare attendee list against the org chart to confirm management-level participation
• Complete meeting minutes or review records -- verify they cover all 12 inputs, include discussion notes (not just data presentations), document specific decisions, and assign actions with owners and deadlines
• Action item register with completion tracking -- verify actions from previous reviews are tracked to closure with effectiveness verification, and overdue items are escalated
• Pre-read or input package distributed before the meeting -- verify data was prepared and distributed in advance so the review could focus on analysis and decisions rather than data presentation

• No documented procedure for management review exists -- reviews are conducted based on the quality manager's personal knowledge of what should be covered, leading to inconsistent coverage of mandatory inputs across review cycles (Major NC)
• Planned review interval is defined but the last review was conducted well beyond the planned interval with no documented justification for the delay -- the 'documented planned intervals' requirement is not met (Minor NC).
• Management review records consist of a pre-formatted template with check boxes for each input topic but no documented discussion, analysis, or decisions -- the review is a data-reading exercise, not a decision-making session (Minor NC)
• Top management did not attend the last 2 management reviews -- the quality director conducted them alone and sent minutes to the CEO for signature (Major NC)
• Records from management reviews are not maintained per 4.2.5 -- minutes from older reviews have been discarded despite the record retention schedule requiring longer retention (Minor NC).

Review the procedure, verify the last 2 management review cycles end-to-end (scheduling through action closure), and confirm top management attendance at each.

• How long does a typical management review meeting last, and how is the time allocated across the 12 input topics?
• What happens when the CEO is unable to attend the scheduled management review -- is it postponed or conducted without them?
• Show me how action items from management reviews are tracked differently from general CAPA actions.

• Complete management review input package -- verify all 12 mandatory inputs (a-l) are addressed with data, analysis, and trend information for each
• Trend analysis for each input -- verify data is presented with historical comparisons (quarter-over-quarter, year-over-year) to show whether performance is improving, declining, or stable
• Consolidated dashboard or scorecard -- look for a summary view that helps management quickly identify areas requiring attention versus areas performing well
• Pre-read materials distributed before the meeting -- verify the input package was available to attendees in advance so they could prepare questions and focus on decision-making during the review
• Data quality indicators -- verify data sources, sample sizes, and time periods are documented so management can assess the reliability of the information presented

• The management review input package does not cover all mandatory inputs -- commonly missing inputs include preventive action (h), follow-up from previous reviews (i), new regulatory requirements (l), and recommendations for improvement (k) (Major NC).
• Input data is presented as raw numbers without trend analysis -- management sees '47 complaints received' but not whether that is an increase or decrease, or how it compares to the complaint rate per unit shipped (Minor NC)
• Several inputs are marked 'no data available' without explanation or action plan to obtain the data for the next review (Minor NC)
• Input data covers different time periods for different topics -- complaints are reported for an extended period, audits for several months, and CAPA for several months, making cross-topic analysis impossible (Minor NC)

Systematically verify all 12 mandatory inputs against the most recent management review package. For each, assess data completeness, trend analysis, and analytical depth.

• Which of the 12 mandatory inputs was most difficult to compile, and why?
• How do you ensure that the data presented is accurate and covers the complete review period?
• What additional inputs beyond the mandatory 12 does your organization include in management review?

• Customer satisfaction survey results with response rates and trend data -- verify surveys cover representative customer segments and response rates are statistically meaningful (above 20%)
• Field service and technical support feedback summaries -- look for categorized themes, not just individual case notes; verify trends are analyzed across reporting periods
• Distributor and channel partner feedback -- check whether distribution chain feedback is systematically collected or only captured when distributors escalate problems
• Healthcare provider and end-user feedback -- verify the organization captures clinician usability feedback and patient outcome data where applicable
• Feedback analysis with identified themes and improvement opportunities -- look for Pareto analysis or categorization that enables management to prioritize response actions
• Benchmarking data -- verify feedback results are compared to targets, industry benchmarks, or competitor performance where available

• Customer feedback is limited to a single annual satisfaction survey with a low response rate and no follow-up on non-respondents -- the data is not representative and may be biased toward satisfied customers (Minor NC).
• Only distributor feedback is collected -- end-user (clinician and patient) feedback is not systematically captured despite the organization manufacturing Class II devices used in direct patient care (Minor NC)
• Feedback data is presented as aggregate satisfaction scores (4.2/5.0) without drill-down into specific themes, product lines, or customer segments that would enable targeted improvement (Minor NC)
• No trending of feedback across multiple periods -- management sees current-period data but cannot determine whether satisfaction is improving or declining (Minor NC)

Review the feedback data package from the last management review. Verify multiple feedback sources, trend analysis, and evidence that feedback was actionable.

• How do you collect feedback from the actual users of your devices, not just the purchasing organizations?
• What is your customer satisfaction target, and how was it determined?
• Show me an example where customer feedback led directly to a product or process improvement.

• Complaint volume trends by product/device family -- verify data shows complaint counts AND rates (per units shipped or units in the field) to normalize for volume changes
• Complaint category Pareto analysis -- look for classification by failure mode, component, process, or root cause category to identify systemic issues
• Response time and closure time metrics versus targets -- verify the organization tracks how quickly complaints are acknowledged, investigated, and closed against defined service-level targets
• Complaint-to-CAPA conversion analysis -- verify the rate at which complaints trigger formal corrective actions and whether the conversion criteria are appropriate
• Regulatory-reportable complaint summary -- verify all reportable events were identified, reported within required timelines (30-day MDR, 10-day vigilance), and tracked to resolution
• Repeat complaint analysis -- verify whether the same complaint types recur despite previous corrective actions, indicating ineffective CAPAs

• Complaint data is presented as total count without normalization per units shipped -- an increase in complaints may simply reflect sales growth; conversely, a flat count may mask a rising rate if sales declined (Minor NC).
• No Pareto analysis of complaint categories -- management cannot identify which complaint types represent the greatest risk or frequency because data is presented as an undifferentiated total (Minor NC)
• Regulatory reportable event section states 'no reportable events' but the complaint log shows complaints involving patient injury that were not assessed for reportability -- the reporting process may have gaps (Major NC).
• Repeat complaint analysis shows the same complaint type recurring across multiple review periods despite a CAPA -- the corrective action was ineffective but this was not flagged to management (Minor NC).
• Complaint handling KPIs show average closure time significantly exceeds the target, but no corrective action has been taken to improve the process -- management has accepted substandard performance (Minor NC).

Review complaint data from the last 2 management review packages. Verify trending, categorization, reportability assessment, and CAPA conversion analysis. Cross-check 3 specific reportable events for timeline compliance.

• What is your complaint rate per 1000 units shipped, and how does it compare to industry benchmarks?
• Show me the criteria used to determine when a complaint triggers a CAPA versus being closed with only correction.
• How many of the complaints received in the review period resulted in regulatory reports, and were all submitted within required timeframes?

• Regulatory reporting log -- verify it tracks all submissions (MDR/MedWatch, EU vigilance, Health Canada mandatory problem reports) with dates, types, and timeliness against regulatory deadlines
• Field safety corrective action (FSCA) and recall summary -- verify status of any open recalls or field corrections including scope, progress, and health authority communications
• Regulatory inspection summary -- verify outcomes of any FDA inspections (483 observations, warning letters), notified body audits, or competent authority inspections with corrective action status
• Reporting timeliness metrics -- verify all reports were submitted within required timeframes (FDA 30-day MDR, 5-day reports, EU 15/60/90-day vigilance timelines)
• Trend analysis of reportable events -- verify the organization tracks whether reportable events are increasing, decreasing, or revealing patterns that warrant additional investigation

• Regulatory reports were submitted past the applicable deadline -- late regulatory reporting indicates a process failure in complaint assessment for reportability (Major NC).
• Management review records show 'no regulatory reports submitted' but the complaint log contains events involving serious injury -- either events were properly assessed and determined non-reportable (show me the assessment records) or reportability assessment has gaps (Major NC if assessments are missing).
• Organization received regulatory inspection observations but the management review input does not address inspection findings or corrective actions -- a mandatory input topic was missed (Minor NC).
• An open field safety corrective action has been in progress for an extended period with a low proportion of affected units accounted for -- management has not escalated the slow progress despite patient safety implications (Major NC).

Review the regulatory reporting log for the review period. Cross-reference 3 complaints involving serious injury against the reportability assessment records and reporting log. Verify all submissions met timeline requirements.

• Walk me through the process for determining whether a complaint is regulatory-reportable. Who makes the decision and within what timeframe?
• How many regulatory inspections has the organization had in the last 2 years, and what were the outcomes?
• Are there any open regulatory commitments (warning letter responses, consent decree terms) that are being tracked?

• Internal audit schedule completion rate -- verify whether all planned audits were completed on time; delays or cancellations should have documented justification
• Audit finding summary by severity and by clause/process -- verify findings are categorized and analyzed for patterns, not just listed as individual events
• Finding theme analysis -- look for cross-audit analysis identifying systemic issues (e.g., document control findings across multiple departments indicate a system-wide problem)
• CAPA closure rate and timeliness for audit-generated CAPAs -- verify corrective actions from audit findings are tracked separately and closed within defined timelines
• Repeat finding analysis -- verify whether findings from previous audits recur, indicating ineffective corrective actions
• Supplier audit summary -- verify supplier audit results are consolidated showing supplier quality performance trends

• Internal audit schedule shows a significant number of planned audits were not completed by the review date with no documented justification -- the audit program is not being executed as planned (Minor NC).
• Audit findings are presented as a simple count without severity classification, process categorization, or theme analysis -- management cannot identify which areas need the most attention (Minor NC).
• Same finding on training records has been identified in multiple consecutive internal audits of the same department -- the corrective action taken after the first finding was ineffective and this was not escalated (Minor NC).
• Supplier audit results show critical suppliers received major nonconformities but no follow-up actions or corrective action verification is documented in the management review output (Minor NC).
• No external audit or inspection results are included despite the organization undergoing a notified body audit during the review period (Minor NC)

Review audit data from the last 2 management review packages. Check schedule completion, finding severity trends, repeat findings, and CAPA closure rates for audit-generated actions.

• What are the top 3 audit finding themes from this review period, and what systemic actions are planned?
• How does the internal audit schedule account for risk -- are high-risk processes audited more frequently?
• Show me the corrective action verification for the most significant audit finding from the previous review period.

• Process KPI dashboard or scorecard -- verify key QMS processes have defined metrics with targets and current performance data
• Process capability data (Cpk/Ppk) for critical manufacturing processes -- verify capability is monitored and trended for processes with measurable quality characteristics
• Trend analysis showing process performance over multiple review periods -- look for improving, stable, or declining trends with management response to adverse trends
• Out-of-specification or out-of-control event summaries -- verify process excursions are tracked, investigated, and corrected
• Process improvement initiative status -- verify planned improvements are tracked and their effectiveness is measured

• Only manufacturing processes have KPIs -- QMS support processes (document control, CAPA, training, purchasing) have no defined metrics or performance targets (Minor NC)
• Process monitoring data is presented but no targets are defined -- management cannot determine whether process performance is acceptable because no acceptance criteria exist (Minor NC)
• Cpk data for a critical process shows a declining trend over multiple review periods but no investigation or corrective action has been initiated -- the process is approaching the minimum acceptable capability level (Minor NC).
• Process data is presented as period averages that mask significant variation -- a process with an average a different yield rate but individual batch yields ranging from 85% to 100% may not be stable (Observation)

Review process monitoring data for 3 processes (at least 1 manufacturing and 1 QMS process). Verify metrics, targets, trends, and management response to adverse trends.

• Which process is currently performing furthest below its target, and what is being done about it?
• How do you determine which processes require formal capability studies versus simpler monitoring?
• Show me an example where process monitoring data led to a preventive action before a quality event occurred.

• Product quality metrics by product family or device type -- verify data is segmented to allow management to identify which products are performing well and which need attention
• Yield, scrap, and rework trend data -- verify rates are trended over time and compared to targets; look for root cause analysis when rates exceed targets
• First-pass acceptance rates at key inspection points -- verify rates are tracked and trended for incoming, in-process, and final inspection
• Field failure rate data -- verify the organization tracks failures per units in the field, not just warranty claims, to understand actual product reliability
• Critical quality attribute (CQA) performance data -- verify product-specific quality characteristics are monitored against specifications with statistical summaries

• Product quality data is aggregated across all product lines -- management sees an aggregated yield figure but cannot identify that one product line has a significantly different yield while one product line has a significantly different yield because data is not segmented (Minor NC)
• Scrap and rework rates are trending upward for 3 consecutive periods but no root cause investigation or corrective action has been initiated (Minor NC)
• Field failure data is limited to warranty claims processed -- the organization does not track field failures reported through channels other than warranty (service calls, customer complaints, distributor reports) (Minor NC)
• No product quality data is available for products manufactured by contract manufacturers -- the organization does not receive or review product quality metrics from its CMOs (Minor NC)

Review product quality data for the 2 highest-volume product families. Verify data completeness from incoming through field performance, trend analysis, and management response to adverse trends.

• Which product family has the highest quality cost (scrap, rework, complaints combined), and what is the improvement plan?
• How do field failure rates compare to the assumptions in your risk analysis files?
• Show me the trend for your highest-volume product's first-pass acceptance rate over the last 4 quarters.

• CAPA metrics dashboard -- verify data includes open/closed counts, aging distribution, on-time closure rates, and source analysis (audit, complaint, nonconformance, process monitoring)
• CAPA aging report -- verify management can see how long CAPAs have been open and whether aging CAPAs are escalated
• Root cause category analysis -- look for Pareto analysis of root cause categories to identify systemic drivers (training gaps, procedure gaps, design issues, supplier issues)
• Effectiveness verification summary -- verify the percentage of closed CAPAs that have undergone effectiveness verification and the pass/fail rate
• Repeat issue tracking -- verify whether the same root causes or problem types recur despite previous CAPAs, indicating ineffective corrections

• CAPA data shows a significant number of open CAPAs with several overdue, but management review output contains no escalation actions or additional resource allocation to address the backlog (Minor NC).
• CAPA effectiveness verification has been performed on only a minority of closed CAPAs -- most were closed without confirming the corrective action actually prevented recurrence (Minor NC).
• Root cause analysis consistently identifies 'human error' as the primary cause without further investigation into why the error occurred -- systemic causes (inadequate procedures, training gaps, poor design) are masked (Minor NC)
• The same root cause category (e.g., supplier material nonconformance) appears as the top CAPA driver for multiple consecutive review periods with no systemic action taken beyond individual CAPA resolutions (Minor NC).
• CAPA closure rate is reported as 95% but the metric includes CAPAs closed by reclassification to 'observation' or 'no further action needed' -- actual problem resolution rate is significantly lower (Observation)

Review CAPA data from the last 2 management reviews. Select 3 closed CAPAs and verify effectiveness verification was performed. Check for repeat issues across review periods.

• What is your CAPA effectiveness verification failure rate, and what happens when a CAPA is found to be ineffective?
• Show me the CAPA that has been open the longest. Why is it still open, and what is the escalation path?
• How do you distinguish between corrections (fix the immediate problem) and corrective actions (prevent recurrence)?

• Preventive action log or register -- verify the organization maintains a distinct record of proactive actions separate from corrective actions; look for actions driven by risk assessment, trend analysis, near-miss events, or industry intelligence
• Risk register updates -- verify risk assessments have been reviewed and updated based on new information, and that new risk mitigations were implemented as preventive actions
• Near-miss and potential problem analysis -- look for evidence the organization investigates near-misses and potential issues with the same rigor as actual nonconformances
• Industry intelligence and lessons-learned actions -- verify the organization monitors industry recalls, FDA warning letters to competitors, and regulatory guidance to identify preventive actions for their own products
• Continuous improvement project portfolio -- verify proactive improvement initiatives are tracked and their expected benefits are measured

• No preventive actions have been initiated in the review period -- all actions are reactive (corrective) in response to problems that already occurred (Minor NC)
• The organization cannot distinguish between corrective and preventive actions -- all quality actions are logged as CAPAs regardless of whether they address an existing or potential problem (Minor NC)
• Risk register has not been updated for an extended period despite changes in product design, manufacturing processes, and regulatory requirements -- risk-based preventive action is not occurring (Minor NC).
• No evidence of monitoring industry events (competitor recalls, FDA warning letters, safety alerts) for lessons learned applicable to the organization's own products (Observation)
• Preventive action section of management review states 'ongoing monitoring continues' with no specific actions, results, or metrics -- this is a placeholder, not meaningful input (Minor NC)

Review the preventive action input from the last 2 management reviews. Verify at least 2 genuinely preventive (not corrective) actions were identified, implemented, and measured for effectiveness.

• How do you proactively identify potential problems before they become actual nonconformances?
• Show me an example where monitoring a competitor's recall or warning letter led to a preventive action in your organization.
• How does the risk management process feed into preventive action -- when was the risk register last updated?

• Action item tracker from previous management review -- verify each action has an owner, deadline, status, and completion evidence
• On-time completion rate -- calculate the percentage of actions closed by their original deadline; below 80% indicates a systemic execution problem
• Effectiveness verification for completed actions -- verify closed actions achieved their intended outcome, not just that the task was performed
• Escalation records for overdue items -- verify overdue actions were escalated to appropriate management levels with documented reasons for delay and revised timelines
• Carried-forward item justification -- for actions not yet complete, verify documented justification and revised completion dates

• A majority of action items from the previous management review are still open well past their due dates with no documented escalation or revised timelines -- the management review action system is ineffective (Minor NC).
• Actions are recorded as 'complete' based on the owner's self-assessment with no independent verification that the action achieved its intended purpose (Minor NC)
• The same actions have been carried forward through multiple consecutive management reviews without completion -- management has not escalated or resourced these persistent open items (Minor NC).
• No follow-up on previous management review actions is presented at the current review -- input (i) was omitted entirely (Major NC)

Review the complete action item list from the previous management review. Calculate the on-time completion rate. Select 3 completed actions and verify effectiveness. Select 2 overdue actions and verify escalation.

• Which action from the previous management review had the most significant positive impact, and how do you know?
• What is your escalation process when a management review action is overdue by more than 30 days?
• Show me an action that was carried forward from a previous review -- why was it not completed on time?

• Change impact summary -- verify organizational changes (restructuring, key personnel changes, facility moves), regulatory changes, technology implementations, and market changes were identified and assessed
• Risk assessments for significant changes -- verify changes were evaluated for their potential impact on QMS processes, product quality, and regulatory compliance
• Change implementation status -- verify planned changes have implementation timelines and responsible owners
• Horizon scanning results -- verify the organization proactively monitors external changes (regulatory, market, technology) that could affect the QMS

• The organization restructured its quality department, moved to a new facility, and implemented a new ERP system during the review period, but none of these changes were discussed as management review input -- mandatory input (j) was effectively omitted (Major NC)
• Regulatory changes are listed (EU MDR transition, FDA QMSR final rule) but no impact assessment or implementation plan is documented -- management was informed but took no action (Minor NC)
• Only internal changes are discussed -- external changes (new competitor products, market consolidation, supply chain disruptions) that could affect quality requirements are not considered (Observation)
• Key personnel departure (QA manager resigned) is noted but the impact on QMS processes that the individual managed is not assessed (Minor NC)

Review the change summary from the last management review. Cross-reference against known changes (regulatory updates, organizational announcements) to verify completeness. Verify impact assessments for 2 significant changes.

• What is the most significant change to the organization since the last management review, and how was its impact on the QMS assessed?
• How do you monitor external changes (regulatory, market, technology) that could affect the QMS?
• Were any changes discussed at management review that required modification to QMS processes or documentation?

• Improvement recommendation register -- verify recommendations from multiple sources are collected, evaluated, and tracked
• Source analysis of recommendations -- verify input comes from auditors, employees, customers, process owners, and management, not just one source
• Evaluation and prioritization records -- verify each recommendation was assessed for feasibility, impact, and alignment with quality objectives
• Management response documentation -- verify management made decisions on each recommendation (approve, defer, decline) with documented rationale
• Implementation tracking for approved recommendations -- verify approved improvements have action plans, owners, and timelines

• No improvement recommendations were presented at the last management review -- the input section was either omitted or stated 'none received' without any employee suggestion or process improvement mechanism in place (Minor NC)
• Recommendations come exclusively from internal audit findings -- there is no mechanism for employees, customers, or process owners to submit improvement ideas (Minor NC)
• Multiple improvement recommendations were presented but management response was 'to be evaluated' for all of them -- no actual decisions were made (Minor NC).
• Improvement recommendations focus exclusively on cost reduction -- no recommendations address product quality, customer satisfaction, or regulatory compliance improvements (Observation)

Review improvement recommendations from the last 2 management reviews. Verify sources are diverse, management responded to each, and at least 2 approved recommendations were implemented.

• How do employees at the shop-floor level submit improvement recommendations?
• Show me the improvement recommendation that had the highest impact when implemented.
• How do you prioritize competing improvement recommendations when resources are limited?

• Regulatory intelligence process -- verify a systematic method exists for monitoring new regulations, standards, and guidance documents across all applicable jurisdictions
• New/revised requirement register -- verify a log of identified changes with applicability assessment, impact analysis, and implementation status
• Impact assessments for significant regulatory changes -- verify the organization evaluates what must change in their QMS, products, or processes to comply
• Implementation plans with timelines -- verify plans exist for transitioning to new requirements, including resource allocation, training needs, and documentation updates
• Gap analyses for major regulatory transitions -- verify structured gap assessments (e.g., MDD to MDR, 21 CFR 820 to QMSR) with closure plans

• No systematic regulatory monitoring process exists -- the organization relies on its notified body or registrar to inform them of regulatory changes, which may not cover all jurisdictions or provide timely notice (Minor NC)
• A significant regulatory change (e.g., FDA QMSR final rule) has been published but the organization has not performed an impact assessment or developed a transition plan despite marketing devices in the affected market (Major NC).
• Regulatory requirement monitoring covers only the primary market (US FDA) but the organization also sells in the EU, Canada, and Japan -- regulatory changes in these markets are not monitored (Minor NC)
• New regulatory requirements are identified but no implementation timelines or resource plans are developed -- the organization is aware of changes but has no plan to comply before deadlines (Minor NC)
• Regulatory intelligence is performed by a single individual with no backup -- when this person was unavailable for an extended period, no monitoring occurred (Minor NC).

Review the regulatory requirement monitoring process and the list of changes identified in the review period. Verify impact assessments for the 2 most significant regulatory changes. Check that all applicable jurisdictions are covered.

• What regulatory change has the most significant impact on your organization, and what is your compliance timeline?
• How quickly after a new FDA guidance document is published do you assess its applicability?
• Who is responsible for regulatory intelligence, and what sources do they monitor?

• Management review output minutes or decision record -- verify all 4 mandatory output areas (a-d) are addressed with specific decisions, not generic statements
• Action items with owners and deadlines -- verify each decision results in assignable actions with named individuals, specific deadlines, and resource commitments
• Record retention and control -- verify management review records are controlled per 4.2.5 with appropriate retention periods, access controls, and protection from loss
• Communication plan for decisions -- verify decisions from management review are communicated to affected personnel, not kept within the management team
• Action tracking mechanism -- verify outputs are tracked in a system that enables follow-up at the next management review per 5.6.2(i)

• Management review output does not address all required categories -- commonly missing: resource needs (d) and regulatory change responses (c), despite being discussed during the review (Minor NC).
• Outputs are documented as vague statements ('continue monitoring quality performance') rather than specific, actionable decisions with assigned owners and deadlines (Minor NC)
• Management review records are stored on the quality manager's personal computer with no backup, version control, or access management -- records are not maintained per 4.2.5 (Minor NC)
• Decisions from management review were not communicated beyond the attendees -- department managers not in attendance are unaware of decisions that affect their areas (Minor NC)
• Output includes action items but only a minority have assigned owners and deadlines -- the remainder are unassigned and therefore unlikely to be completed (Minor NC).

Review outputs from the last 2 management reviews. Verify all 4 categories are addressed with specific actions. Select 3 output actions and track them to completion or current status.

• Which management review output decision had the most significant impact on the organization?
• How do you ensure management review decisions are communicated to all affected personnel?
• Show me how you track management review action items between review cycles.

• QMS improvement decisions documented in management review output -- verify specific improvements are identified (not generic 'continue improving')
• Improvement project scopes and objectives -- verify each approved improvement has a defined scope, expected outcome, and success criteria
• Resource commitments for improvements -- verify management allocated budget, personnel time, or other resources for each approved improvement
• Implementation status tracking -- verify approved improvements are in progress with milestone tracking
• Effectiveness measurement plans -- verify how the organization will determine whether implemented improvements achieved their intended benefit

• Management review output states 'QMS is suitable and effective -- no improvements needed' despite input data showing declining CAPA closure rates, repeat audit findings, and increasing complaint trends -- the conclusion contradicts the evidence (Major NC)
• Improvements are identified but no resources are allocated -- 'implement electronic CAPA tracking system' is listed as an output but no budget, timeline, or owner is assigned (Minor NC)
• Same improvement has appeared as a management review output for multiple consecutive reviews without implementation -- management repeatedly identifies the need but does not execute (Minor NC).
• Improvements focus exclusively on documentation updates -- no improvements address process effectiveness, product quality, or system capability (Observation)

Review improvement outputs from the last 2 management reviews. Verify at least 2 improvements were implemented and their effectiveness was measured. Cross-reference outputs against input data to verify improvements address identified problems.

• What was the most significant QMS improvement implemented since the last management review, and what was the measurable impact?
• How do you assess whether the QMS is 'suitable' versus just 'effective'?
• Show me an improvement that was approved at a previous review and is now complete -- what benefit did it deliver?

• Product improvement decisions linked to customer feedback -- verify management review outputs include specific product improvements driven by customer complaint data, satisfaction feedback, or requirement changes
• Design change proposals approved at management review -- verify product changes address customer-identified issues, not just internal quality metrics
• Improvement actions with customer impact analysis -- verify the expected benefit to customers is documented for each product improvement decision
• Implementation plans for product improvements -- verify approved improvements have design control plans, validation requirements, and timelines
• Customer communication plans -- verify customers will be informed of improvements that address their reported issues

• No product improvement actions related to customer requirements were documented in the management review output despite input data showing recurring complaint types affecting user satisfaction (Minor NC).
• Product improvements focus only on manufacturing cost reduction -- no improvements address customer-reported usability issues, performance concerns, or feature requests (Minor NC)
• Management review approved a product improvement but without routing it through the design control process -- the improvement bypasses risk analysis and design validation requirements (Major NC)
• Customer feedback data shows a clear need for labeling improvements but the output only addresses manufacturing process changes -- the customer requirement input did not translate into a customer-facing improvement (Minor NC)

Review product improvement outputs from the last 2 management reviews. Trace at least 1 improvement from customer feedback through management review decision to design control implementation.

• Which customer complaint or feedback theme from the review period led directly to a product improvement decision?
• How are product improvements approved at management review tracked through the design control process?
• Show me a product improvement that was driven by customer requirements and is now implemented.

• Regulatory response actions documented in management review output -- verify each new or revised requirement from input (l) has a corresponding action decision in the output
• Implementation plans with regulatory deadlines -- verify plans align with compliance deadlines and include milestones, responsible persons, and resource commitments
• Gap analysis results driving actions -- verify management decisions are based on gap analysis data showing specific areas requiring change
• Training plans for regulatory changes -- verify personnel affected by regulatory changes will receive training on new requirements
• Validation plans for regulatory-driven changes -- verify process or product changes required by new regulations include appropriate validation activities

• Management review input identified the FDA QMSR final rule as a significant regulatory change but the output contains no response actions, timeline, or resource allocation -- management acknowledged the change but did not act (Minor NC)
• Response plan for a major regulatory transition was approved but implementation is significantly behind schedule with the compliance deadline approaching -- management underestimated the effort and did not escalate when the plan fell behind (Major NC).
• Regulatory response actions are assigned to a single regulatory affairs specialist with no additional resources despite the scope requiring cross-functional effort -- resources are inadequate for the task (Minor NC)
• No gap analysis was performed before the response plan was created -- actions were based on assumptions about what needs to change rather than a systematic assessment of current state versus requirements (Minor NC)

Match regulatory changes from input (l) to response actions in the output. Select the most significant regulatory change and review the implementation plan, timeline adherence, and resource allocation.

• What is your organization's timeline for QMSR transition, and is the plan on track?
• How do you determine whether a new regulatory requirement requires a QMS change versus just a documentation update?
• Show me a regulatory change that required significant QMS modifications -- how did management allocate resources?

• Resource allocation decisions documented in management review output -- verify specific commitments including headcount approvals, budget allocations, equipment purchases, and training investments
• Budget approvals with amounts and timelines -- verify resource commitments are quantified (not just 'provide adequate resources') with approval signatures and disbursement dates
• Hiring plans approved -- verify headcount decisions include positions, qualifications, start dates, and recruitment timelines
• Capital expenditure approvals -- verify equipment or technology investments include procurement timelines and validation requirements
• Resource decisions mapped to identified needs -- verify each resource need identified in the input data has a corresponding decision in the output (approved, deferred with justification, or denied with rationale)

• Management review output states 'adequate resources will be provided' without specifying what resources, how much, or when -- the commitment is meaningless without specifics (Minor NC)
• Input data identified a need for additional quality resources to address CAPA backlog, but the output contains no headcount decision or alternative plan to address the backlog (Minor NC).
• Capital expenditure request for calibration equipment was deferred for multiple consecutive management reviews with no documented rationale or alternative plan -- aging calibration equipment is causing measurement uncertainty issues (Minor NC).
• Training budget was approved in the management review output but was significantly reduced shortly after without management review approval -- the resource commitment was undermined outside the review process (Minor NC).
• All resource requests were approved but none include timelines -- resources are committed in principle but there is no accountability for when they will be delivered (Minor NC)

Review resource decisions from the last 2 management reviews. For each, verify specificity (amounts, timelines), and cross-check 2 commitments against actual delivery (were approved resources actually provided?).

• What resource request from the quality function was most recently denied, and what was the documented rationale?
• How do you verify that resource commitments made at management review are actually delivered?
• Show me a resource decision that directly improved QMS effectiveness -- what was the measurable impact?