What medical device quality assurance means
Quality assurance (QA) is the part of a device company that makes sure quality is built into how work is done, not just checked at the end. In practice, QA designs and runs the quality management system, approves the documents and decisions that matter, and gives management an honest picture of compliance and product risk.
The stakes rose in 2026. FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, incorporates ISO 13485:2016 (FDA), and QA’s own records, from management reviews to internal and supplier audit reports, are now open to FDA inspection (FDA QMSR FAQ).
Quality assurance vs quality control
| Quality assurance (QA) | Quality control (QC) | |
|---|---|---|
| Focus | The system and processes | The product |
| Timing | Before and throughout | During and after production |
| Typical activities | Procedures, training, audits, CAPA, change control, supplier quality, management review | Receiving, in-process and final inspection; testing; release |
| Question answered | ”Will our processes reliably produce conforming devices?" | "Does this lot conform?” |
| Key evidence | Validated processes, audit results, CAPA effectiveness | Inspection and test records, device history records |
FDA’s final QMSR rule makes the relationship explicit: “manufacturers should not rely solely on inspection and testing,” because “all processes require some degree of qualification, verification, or validation” (Federal Register). QC alone cannot assure quality; QA makes the process capable.
The core QA processes, mapped to FDA’s inspection areas
FDA’s compliance program CP 7382.850 inspects six QMS areas (FDA). QA owns or oversees processes in every one.
| FDA QMS area | QA-owned or QA-overseen processes |
|---|---|
| Management oversight | Quality policy and objectives, management review, quality manual, document and record control, training |
| Design and development | Design review participation, design transfer, design and development file completeness, risk management oversight |
| Change control | Change evaluation and approval, regulatory and risk impact assessment |
| Outsourcing and purchasing | Supplier qualification, quality agreements, supplier audits and monitoring |
| Production and service provision | Process validation oversight, labeling controls (§820.45), product release, servicing records |
| Measurement, analysis and improvement | Complaint handling, MDR decisions, nonconformance, data analysis, CAPA, internal audit |
Two areas need particular attention in 2026. Early QMSR inspection results show “Risk management is the top observation,” followed by outsourcing, complaint handling, UDI and corrective actions (RAPS). And software that QA uses to run the QMS must itself be validated proportionate to risk, as FDA’s Computer Software Assurance guidance describes (FDA).
QA KPIs that show your system works
ISO 13485 requires analysis of data to demonstrate the suitability and effectiveness of the QMS. These indicators give management a balanced view. Set targets based on your own baseline and risk, not industry folklore.
| KPI | What it tells you | Watch for |
|---|---|---|
| CAPA cycle time (open to effectiveness verified) | Whether problems are actually fixed | Old CAPAs closed in batches before audits |
| CAPA effectiveness rate | Whether fixes work | Recurrence of the same root cause |
| Complaint-to-MDR decision time | Reporting compliance | Decisions approaching 30-day MDR deadlines |
| Repeat audit findings | Whether audit follow-up works | Same finding in consecutive audits |
| Nonconformance rate by process and supplier | Process and supplier capability | Rising trends after changes |
| Right-first-time document approvals | Procedure and record quality | High rework in change control |
| Training completion before task execution | Competence control | People performing tasks before training is recorded |
| Risk file updates from postmarket data | Whether risk management is live | Risk files unchanged despite new complaints |
| Inspection and audit retrieval time | Inspection readiness | Records that take days to find |
How QA teams are organized
More than 80% of US device companies have fewer than 50 employees (AdvaMed), so many QA teams are small. Common structures:
- Start-up (1–3 people): A QA/RA lead covers the QMS, design control oversight, suppliers and submissions support, with consultants for audits and validation.
- Growth stage (4–15 people): Specialists for design quality, supplier quality, complaints and CAPA, and document control; QA and RA often split.
- Multi-site: Corporate QA owns the QMS and audits; site QA owns release, nonconformances and local CAPA; postmarket and supplier quality may be centralized.
At every size, QA must keep its independence: ISO 13485 requires management to assign responsibility and authority, and QA should be able to stop a release or escalate without commercial pressure.
Quality control capacity is another constraint. The Bureau of Labor Statistics reports about 602,000 quality control inspector jobs across US industries, with a median wage of $48,570 and projected growth of 3% (BLS). Slow growth in inspection labor is pushing companies toward validated automated inspection, which shifts work from QC to QA’s validation oversight.
Medical device quality assurance checklist
- QMS documented against ISO 13485:2016 and Part 820, with FDA-specific requirements included
- QA responsibility, authority and independence defined in the quality manual
- QA processes cover all six FDA QMS areas
- Risk management integrated with design, suppliers, production, complaints and CAPA
- QMS software validated with a risk-based CSA approach
- Supplier quality proportionate to risk, with audit reports written for FDA visibility
- Complaint handling includes documented MDR decisions and §820.35 record content
- KPIs defined, trended and reviewed in management review
- Internal audit program risk-based and independent
- Inspection readiness tested with mock inspections
Give QA time back for judgment
QA spends much of its time reading: procedures, change records, validation reports, complaint files. AI document assessment can read those documents against ISO 13485, QMSR and your own procedures, flag gaps and cite the passage behind every finding, so QA professionals spend their time deciding rather than searching.
Run a sample regulatory document assessment on one procedure or record set. AskDona shows the evidence; your QA team decides.
FAQ
What is quality assurance in medical devices? The system of planned activities that ensures devices are designed, produced and monitored to meet requirements, built on ISO 13485 and, in the US, the QMSR.
What is the difference between QA and QC? QA focuses on processes and the system; QC checks the product. FDA expects both, and states manufacturers “should not rely solely on inspection and testing” (Federal Register).
What are the most common QA problems FDA finds? In early QMSR inspections: risk management, outsourcing, complaint handling, UDI and corrective actions (RAPS).
Which KPIs should a medical device QA team track? CAPA cycle time and effectiveness, complaint-to-MDR decision time, repeat audit findings, nonconformance trends and risk file updates are a strong starting set.
References
All pages opened and checked by October 13, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| FDA: QS Regulation / QMSR | Regulator | 2026 | QMSR |
| FDA: QMSR FAQ | Regulator | 2026 | Records open to FDA |
| Federal Register: QMSR final rule | Regulation | Feb 2, 2024 | QA vs QC |
| FDA: CP 7382.850 | Regulator | Feb 2, 2026 | Six QMS areas |
| RAPS: Top QMSR observations | Professional body | May 14, 2026 | Inspection findings |
| FDA: CSA guidance | Regulator guidance | Feb 3, 2026 | QMS software |
| AdvaMed: Job creation | Trade association | 2021 data | Firm size |
| BLS: Quality control inspectors | Government | Current | Jobs, wages, outlook |