The quality systems manager’s part of QMSR
The quality manager owns the outcome; the quality systems manager owns the documents that prove it. Since February 2, 2026, those documents are tested against FDA’s Quality Management System Regulation, which incorporates ISO 13485:2016 by reference, and against a new inspection program, CP 7382.850, that replaced QSIT (King & Spalding).
That means three documentation jobs: update the structure, update the language, and make sure the records stand up to an investigator who can now read material that used to stay internal.
Job 1: Restructure around how FDA inspects
CP 7382.850 organizes inspections into six QMS Areas (Management Oversight; Design and Development; Change Control; Outsourcing and Purchasing; Production and Service Provision; Measurement, Analysis and Improvement) plus four Other Applicable FDA Requirements: Medical Device Reporting, Corrections and Removals, Tracking, and UDI (Ropes & Gray).
You do not have to renumber your procedures to match, but you do need a crosswalk: a single table showing, for each QMS Area and OAFR, which procedures apply and where the records live. King & Spalding recommend reviewing how the QMS Areas map to ISO 13485 clauses as a first step.
| QMS Area | Typical ISO 13485-based procedures to map |
|---|---|
| Management Oversight | Quality manual, quality policy and objectives, management review, responsibility and authority |
| Design and Development | Design and development planning, inputs, outputs, review, verification, validation, transfer, design changes, risk management |
| Change Control | Document control, engineering change, design change |
| Outsourcing and Purchasing | Supplier evaluation and selection, purchasing information, verification of purchased product, quality agreements |
| Production and Service Provision | Production control, process validation, identification and traceability, servicing, preservation |
| Measurement, Analysis and Improvement | Feedback and complaints, internal audit, monitoring and measurement, nonconforming product, data analysis, CAPA |
Job 2: Update the language
King & Spalding point out that Design History Files, Device Master Records and Device History Records are no longer terms used in FDA regulations. The quality systems manager has three options for each legacy term:
- Replace it with the ISO 13485 term where one exists.
- Keep it as an internal name, with a definition that maps it to the ISO 13485 record.
- Retire documents that only existed to satisfy the old wording.
Whichever you choose, be consistent: an investigator who finds three names for the same record will ask which one is controlled. Search controlled documents, forms and training material for old Part 820 section numbers as well.
Job 3: Make records inspection-ready
Under the old QSR, FDA did not request management review, internal audit or supplier audit reports. That policy is gone: CP 7382.850 lists management reviews and internal quality audits as inspection elements, and FDA’s QMSR FAQ says supplier audit reports are reviewable too (Ropes & Gray). Ropes & Gray note that CPG 130.300, which limits review of audit reports, has not been formally revised, but advise firms to expect the requests anyway.
Practical changes for templates:
- Management review: add fields for decisions, owners and due dates, not just data inputs.
- Internal audit: require evidence references for every finding and a closure record.
- Supplier audit: use a controlled template, factual language and a clear link to the supplier’s status in your approved supplier list.
Job 4: Make risk management visible in the documents
Risk management is a stated inspection goal under the new program. Ropes & Gray list failures to establish risk management processes, to use current risk information and to evaluate changes for risk as findings that can lead to Official Action Indicated classification. In documentation terms, that means:
- Change control forms with a mandatory risk evaluation field completed before implementation.
- Complaint and CAPA procedures that require checking and updating the risk file.
- A risk management procedure that names the post-market inputs it uses.
Who you work with
- Quality manager: priorities and sign-off.
- Regulatory affairs: FDA-specific requirements (MDR, corrections and removals, UDI, tracking).
- Process owners: rewriting procedures they actually follow.
- IT / eQMS administrators: templates, workflows, retrieval.
- Training: retraining staff on new terms and on what investigators can now request.
Common weaknesses
- Crosswalk built once and never maintained.
- Legacy terms removed from procedures but left in forms and training slides.
- New template fields added but old records left inconsistent.
- Risk evaluation fields that can be completed after a change is implemented.
- No retrieval drill: records exist but cannot be found quickly.
Checklist
- Crosswalk from QMS Areas and OAFRs to procedures and record locations
- Legacy Part 820 section numbers and DHF/DMR/DHR terms resolved
- Management review, internal audit and supplier audit templates updated
- Change control enforces risk evaluation before implementation
- Staff retrained on new terms and inspectable records
- Retrieval drill completed for each QMS Area
How AskDona helps
Building a crosswalk means reading every procedure against the requirement set. AskDona reads your controlled documents against QMSR and the ISO 13485 structure you define, flags legacy terminology and missing requirements, and cites the exact page for each finding. Run a sample procedure-to-QMSR mapping on one QMS Area. AskDona shows the evidence; your quality systems team decides.
Editor’s note: Based on law-firm analyses published in February 2026; not legal advice. ISO 13485 text is copyrighted and not reproduced; the procedure mapping table reflects common QMS structures, not an official FDA crosswalk. The LinkedIn count was supplied by the client.
FAQ
Do I have to renumber procedures to match QMSR? No. A clear crosswalk to the QMS Areas and ISO 13485 is usually enough.
Are DHF, DMR and DHR still required? The terms are no longer used in FDA regulations; equivalent records under ISO 13485 are still needed.
Which records are newly inspectable? Management review, internal audit and supplier audit reports.
What should change control documents show now? A risk evaluation completed before the change is implemented.
References
All pages opened and checked by October 23, 2026.
| Source | Type | Used for |
|---|---|---|
| King & Spalding: The QMSR goes live (Feb 3, 2026) | Law firm analysis | Effective date, legacy terms, recommendations |
| Ropes & Gray: A QMSR state of mind (Feb 17, 2026) | Law firm analysis | QMS Areas, OAFRs, inspectable records, CPG 130.300, risk findings |