Design Control Audits and Design Documentation Review

Three ways design controls get audited

Design controls are examined by three kinds of auditors, and each samples differently.

Auditor	How design is examined	2026 change
FDA investigator	Compliance program 7382.850 evaluates design inputs, outputs, review, verification, validation, software validation and transfer in baseline and PMA preapproval inspections, starting from risk management (FDA)	QSIT retired with the QMSR on February 2, 2026 (AABB)
MDSAP or notified body auditor	Selects a completed design project and audits it task by task, from planning to transfer and top management commitment (MDSAP Audit Approach, 2020 revision)	Audit Approach updated with a version date of February 2, 2026 (SGS)
Internal auditor	Audits the design process and sampled projects against procedures and ISO 13485 clause 7.3	Internal audit reports are now open to FDA

The last change matters most for internal teams. FDA’s QMSR FAQ states: “The QMSR gives the FDA the authority to inspect management review, quality audits, and supplier audit reports,” and the former 820.180(c) exceptions “are not maintained” (FDA, QMSR FAQ). Write design control audit reports expecting an investigator to read them.

How MDSAP structures a design audit

The MDSAP Audit Approach is a useful model for any design audit. Its design and development chapter (2020 revision) runs through tasks including “SELECTION OF A COMPLETED DESIGN AND DEVELOPMENT PROJECT,” “COMPLETENESS, COHERENCE, AND UNAMBIGUITY OF DESIGN AND DEVELOPMENT INPUT,” “RISK MANAGEMENT ACTIVITIES APPLIED THROUGHOUT THE DESIGN AND DEVELOPMENT PROJECT,” “DESIGN VERIFICATION OR DESIGN VALIDATION TO CONFIRM EFFECTIVENESS OF RISK CONTROL MEASURES,” “SOFTWARE DESIGN AND DEVELOPMENT,” “IMPACT REVIEW OF DESIGN AND DEVELOPMENT CHANGES ON PREVIOUSLY MADE AND DISTRIBUTED DEVICES” and “DESIGN TRANSFER” (MDSAP).

Its sampling advice transfers well: prefer “Judgement based sampling using audit trails from one task or process to inform the selection of samples,” and prioritize “new or modified designs and new products.”

Design documentation review vs design review

Two activities share similar names:

Design review (ISO 13485 clause 7.3.5) is a formal, planned checkpoint during development. FDA summarizes it as using “an appropriate team to systematically review” the design at suitable stages, evaluating whether results meet requirements, proposing actions and recording results (FDA, QMSR Design and Development).
Design documentation review is a check of the documents themselves: completeness, consistency, approval and traceability. It happens before design reviews, before submissions and during audits.

Both fail the same way: documents are reviewed one at a time, so contradictions between them survive.

Running an internal design control audit

Pick the sample by risk: recent launches, higher-risk devices, projects with post-market signals or many changes.
Trace forward and backward through a few requirements and hazards, from user need to transfer.
Check inputs for completeness, conflicts and verifiability.
Read verification and validation for acceptance criteria set in advance, representative units and sample size rationale.
Test the risk link: every risk control implemented, verified and reflected in labeling where needed.
Follow changes after launch, including impact on distributed devices.
Check transfer to internal and external manufacturing sites.
Review design review records for independence, attendance and closed actions.
Write findings with requirement, evidence and gap, and route them to CAPA.

Findings that recur in 2026

Finding	Example
Transfer does not carry specifications to external sites	FDA found a “design transfer process did not ensure that performance specifications” were met (FDA, Abbott Diabetes Care, Jan 2026)
Verification coverage claimed without rationale	Testing “only performed on a single female luer connector” (FDA, Medline Industries, Mar 2026)
Acceptance criteria missing before testing	”Test plans do not include established acceptance criteria prior to testing” (FDA, Contec Medical Systems, Oct 2025)
Risk file out of step with design	”Risk management is the top observation” in early QMSR inspections (RAPS)

Design control audit checklist

Review design documents as a set

A design audit means reading hundreds of documents and checking them against each other. AskDona does the first pass: it reviews design records against ISO 13485 clause 7.3, the QMSR, MDSAP tasks or your own procedure, flags gaps, contradictions and unsupported conclusions, and cites the passage behind every finding, so auditors spend their time on sampling and interviews.

Run a sample design control audit on one completed design project. AskDona shows the evidence; your auditors decide.

FAQ

What is a design control audit? An examination of whether design and development followed procedures and ISO 13485 clause 7.3, usually by tracing a sampled design project end to end.

Can FDA read our internal audit reports? Yes. Under the QMSR, FDA can inspect quality audit reports; the old 820.180(c) exception no longer applies (FDA).

What is the difference between design review and design documentation review? Design review is a formal development checkpoint under clause 7.3.5; documentation review checks the documents for completeness and consistency.

How do MDSAP auditors sample design projects? They select a completed design project and prefer judgment-based sampling that follows audit trails (MDSAP).

What design findings are most common? Weak risk links, missing acceptance criteria, unjustified family coverage and incomplete design transfer.

References

All pages opened and checked by October 14, 2026.

Source	Type	Date	Used for
FDA: QMSR risk-based inspections (slides)	Regulator	Apr 1, 2026	CP 7382.850 design elements
AABB: FDA implements QMSR	Professional body	Feb 4, 2026	QSIT retired
MDSAP Audit Approach (AU P0002.005)	Regulators’ program	Sep 1, 2020	Design audit tasks, sampling
SGS: What’s changed	Auditing organization	2026	MDSAP update date
FDA: QMSR FAQ	Regulator	Oct 2, 2026	Audit report access
FDA: QMSR Design and Development (slides)	Regulator training	2026	Clause 7.3.5 design review
FDA warning letter: Abbott Diabetes Care	Regulator	Jan 23, 2026	Transfer
FDA warning letter: Medline Industries	Regulator	Mar 25, 2026	Verification coverage
FDA warning letter: Contec Medical Systems	Regulator	Oct 2, 2025	Acceptance criteria
RAPS: Top QMSR observations	Professional body	May 14, 2026	Risk management