Requirements traceability in FDA QMSR
The FDA Quality Management System Regulation incorporates ISO 13485 by reference in section 820.10, so the ISO 13485 design and development clauses apply to US devices through it, with section 820.35 adding the record controls, among them an audit trail for electronic records.
- standard
- FDA QMSR: the US Quality Management System Regulation, which incorporates ISO 13485 by reference and adds FDA-specific provisions
- edition held
- 21 CFR Part 820 (QMSR), as the export names it
- clauses cited here
- 2 of the 13 held; shown when you tick FDA QMSR
- every clause we hold
- FDA QMSR, clause by clause
The QMSR incorporates ISO 13485:2016 by reference and adds FDA-specific provisions of its own (820.35 among them). Tick it for US devices beside ISO 13485: its lines are shown when you tick it, and the ISO 13485 clauses carry the design and development detail.
Where each finding cites it
- 1Requirement with no parent: 820.10
- 2No verification method or no linked verification: 820.10
- 3Verification failed, blocked or not run: 820.10
- 4Changed after its last passing verification: 820.10 and 820.35
- 7Parent outside this export, or an ID used twice: 820.10
- 9Design validation not recorded: 820.10
The columns that show it
Parent, Level, Derived, Verification Method, Verified By, Justification, the results: Result and Date, Last Changed, the result dates, Revision and the results: Requirement Revision, ID and Validation. The requirements traceability matrix template carries every one.
What it asks, clause by clause
2 clausesSection 820.10 establishes the substantive QMS requirements by incorporating ISO 13485:2016 SECTIONS 4 THROUGH 8 in full. Manufacturers must implement: ISO 13485:2016 SECTION 4 General QMS requirements + documentation (Quality Manual + Medical Device File + control of documents + records); SECTION 5 Management responsibility + customer focus + quality policy + planning + responsibility / authority / communication + management review; SECTION 6 Resource management (provision of resources + human resources + infrastructure + work environment + contamination control); SECTION 7 Product realization (planning + customer-related + design and development - the medical-device 'design controls' parallel + purchasing + production and service provision + control of monitoring + measuring equipment); SECTION 8 Measurement + analysis + improvement (monitoring + measurement + control of nonconforming product + analysis of data + improvement - including CAPA Sections 8.5.2 + 8.5.3). NB: ยง820.10 also clarifies that ISO 13485:2016 internal-audit + management-review requirements (Sections 8.2.4 + 5.6) apply to the QMSR.
Held text: 21 CFR Part 820 (QMSR), our statement of the clause, not the instrument verbatim.
what an assessor asks to see ISO 13485 Section 4-8 compliance file; Internal audit programme + records; Management review records + frequency; Cross-reference matrix between QMSR + ISO 13485 + EU MDR/IVDR + FDA Part 11
where it usually breaks ISO 13485 implemented in parts without full Section 4-8 coverage; Internal audit infrequent or scope-limited; Management review absent + meeting minutes incomplete
Section 820.35 establishes FDA-specific record-control requirements that supplement ISO 13485:2016 Section 4.2.5. SPECIFIC REQUIREMENTS: (a) RECORD RETENTION - records must be retained for a period of time equivalent to the design + expected life of the device + IN ANY CASE NOT LESS THAN 2 YEARS FROM THE DATE OF RELEASE FOR COMMERCIAL DISTRIBUTION BY THE MANUFACTURER. (b) AUDIT TRAIL - records must include audit trail meeting the criteria of FDA 21 CFR Part 11 (Electronic Records + Electronic Signatures) where electronic records are maintained - the audit trail must be: secure + computer-generated + time-stamped + tamper-evident + record who-what-when-where-why for every CRUD operation on regulated records. (c) UNIQUE DEVICE IDENTIFICATION (UDI) - records must include UDI per FDA Unique Device Identification Rule (21 CFR Part 830) where applicable - UDI on labelling + linked to records. (d) MEDICAL DEVICE REPORTING (MDR) - records of MDR submissions under 21 CFR Part 803 (Medical Device Reporting) must be maintained as part of QMSR records. (e) CORRECTIONS AND REMOVALS - records of corrections + removals under 21 CFR Part 806 must be maintained. (f) ACCESSIBILITY - records must be ACCESSIBLE TO + READILY AVAILABLE FOR REVIEW BY FDA inspectors during inspections; manufacturers must provide records in human-readable + electronic form within reasonable time upon FDA request.
Held text: 21 CFR Part 820 (QMSR), our statement of the clause, not the instrument verbatim.
what an assessor asks to see Record-retention policy specifying device-life-or-2-year-minimum + FDA inspection-readiness; Audit trail Part 11 conformance test + design specification; UDI traceability per Part 830; MDR + Part 806 records retention
where it usually breaks Records retention shorter than 2 years from commercial distribution release; Audit trail not Part 11 compliant; UDI traceability gap; MDR + Part 806 records not retained or not inspection-ready