Your internal audits are now evidence for FDA

Under the QMSR, effective February 2, 2026, “The exceptions that existed in the QS regulation at § 820.180(c) are not maintained,” and FDA can inspect “management review, quality audits, and supplier audit reports” (FDA QMSR FAQ). For baseline and pre-approval inspections, “these records will be specifically requested” (FDA Law Blog).

That changes what a good internal audit looks like. ProPharma warns that “Many organizations perform annual internal audits using historical Part 820 checklists” (ProPharma). FDA’s town hall guidance is to ensure “the internal audit program is evaluating how risk management is integrated throughout product development” (FDA Law Blog).

For certification audits, MDSAP and a clause-by-clause gap analysis, see ISO 13485 Audit and Gap Analysis: Certification Audits, MDSAP and a Clause-by-Clause Checklist.

Three 2026 changes for auditors

  • ISO 19011:2026 replaces the 2018 edition. Published May 26, 2026, the new edition of the auditing guideline withdrew ISO 19011:2018 (ISO). CQI | IRCA describes it as “a technical revision, updating and clarifying existing guidance,” with more on remote auditing, digital tools and auditor competence (CQI | IRCA).
  • FDA inspects by six QMS areas. CP 7382.850 organizes inspections into change control; design and development; management oversight; measurement, analysis and improvement (which includes internal audits); outsourcing and purchasing; and production and service provision (FDA). Structuring your audit program the same way makes FDA’s view your view.
  • MDSAP continues, separately. FDA “may continue to accept MDSAP audit reports as a substitute for routine Agency inspections” (FDA), but “FDA inspections under the QMSR will not follow the MDSAP audit plan or procedures” (FDA QMSR FAQ).

ISO 13485 internal audit checklist (QMSR-ready)

Organized by FDA’s six QMS areas. For each item, record the evidence sampled, not just a yes/no.

Management oversight

  • Quality policy and objectives current and measured
  • Management review covers QMS effectiveness, audit results, CAPA trends, supplier performance, complaints and resource needs
  • Medical device file complete for sampled devices
  • Planning of product realization includes risk management

Design and development

  • Design plans, inputs, outputs, reviews, verification, validation and transfer documented for sampled projects
  • Traceability from user needs to verification and validation, including risk controls
  • Design and development file complete

Change control

  • Product, process and QMS changes evaluated for risk and impact before implementation
  • Regulatory impact (510(k), MDR significant change) assessed and documented

Outsourcing and purchasing

  • Suppliers classified by risk; controls proportionate
  • Quality agreements cover nonconformance and change notification
  • Supplier audits completed and reports inspection-ready

Production and service provision

  • Process validation current for sampled processes
  • Labeling and packaging controls meet § 820.45, including UDI checks
  • Servicing records meet § 820.35

Measurement, analysis and improvement

  • Complaints recorded per § 820.35 with MDR decisions documented
  • Complaints and nonconformances feed the risk file
  • CAPAs have verified root causes and effectiveness checks
  • Data analysis covers all quality data sources
  • Internal audit program itself is risk-based and covers all areas

Other FDA requirements

  • MDR (Part 803), corrections and removals (Part 806), tracking (Part 821) and UDI (Part 830) procedures in place and followed

Audit practice (ISO 19011:2026)

  • Auditors independent of the area audited and competent for the topic
  • Findings evidence-based, with objective evidence recorded
  • Remote or hybrid audits planned and controlled where used
  • Audit reports written knowing FDA may read them: factual, specific, with follow-up tracked

Prepare evidence before the audit

The most useful internal audit finds what the investigator would find. AI document assessment can pre-screen SOPs and records against ISO 13485, QMSR and this checklist, flag likely gaps and cite the passage behind every finding, so auditors spend their time sampling and interviewing.

Run a sample regulatory document assessment on one QMS area before your next internal audit. AskDona shows the evidence; your auditors decide.

FAQ

Can FDA review internal audit reports under QMSR? Yes. The § 820.180(c) exception is gone, and FDA can inspect quality audit reports (FDA QMSR FAQ).

Which QMS area covers internal audits in FDA inspections? Measurement, analysis and improvement, alongside complaints, feedback, data analysis and CAPA (FDA CP 7382.850).

Which version of ISO 19011 applies? ISO 19011:2026, published May 2026, which replaced the 2018 edition (ISO).

Does an MDSAP audit replace FDA inspections? FDA may accept MDSAP reports instead of routine surveillance inspections, but not for every inspection type, and QMSR inspections do not follow the MDSAP approach (FDA).

References

All pages opened and checked by October 9, 2026.

SourceTypeDateUsed for
FDA: QMSR FAQRegulatorOct 2, 2026Audit records, MDSAP
FDA Law Blog: Another QMSR Town HallLaw firm blogApr 14, 2026Records requested, risk integration
FDA: CP 7382.850RegulatorFeb 2, 2026Six QMS areas
FDA: MDSAPRegulatorDec 19, 2025MDSAP reports
ISO: ISO 19011:2026Standards bodyMay 26, 2026New edition
CQI | IRCA: ISO 19011:2026 revisionProfessional body2026Key changes
ProPharma: QMSR readiness gapsConsultancyAug 5, 2026Historical Part 820 checklists