Warning letters. 483 observations. Consent decrees. Most FDA enforcement actions have one thing in common: inadequate documentation. Here's what the agency actually looks for.
Review the 483 observation letters published by the FDA over any recent two-year period for medical device manufacturers, and a pattern emerges. The same documentation-related observations appear repeatedly, across different facilities, different product categories, and different company sizes.
This is not because manufacturers are not trying. It is because Part 820's documentation requirements are genuinely complex, and because the agency's expectations about what "adequate" documentation means have become more demanding as enforcement has intensified. The 2024 revision to 21 CFR Part 820, which aligned U.S. device quality system requirements more closely with ISO 13485:2016, added nuance to documentation requirements that many organizations are still catching up to.
Understanding what the FDA actually expects — not just what the regulation literally says — is the starting point for building a compliant system.
Part 820 establishes documentation requirements across multiple sections. These generate the most citations.
"Each manufacturer shall establish and maintain procedures to control all documents that are required by this part."
The regulation requires procedures for document approval, distribution, and changes. Documents must be reviewed and approved by designated individuals before use. Changes must be reviewed and approved by the same or equivalent designation, with access to relevant background information.
The most common 820.40 citation: "Documents were not reviewed and approved prior to use." This appears when a work instruction is found in use without evidence of formal approval, or when operators are working from superseded revisions that were never formally withdrawn.
All records required by Part 820 must be maintained at the manufacturing establishment or other location reasonably accessible to responsible officials and FDA employees. Records must be legible, stored to prevent deterioration or loss, and accessible for the required retention period.
For electronic records, 21 CFR Part 11 adds requirements for audit trails, electronic signatures, and system validation.
The most common 820.180 citation: retention periods not defined or not consistently applied across record types.
These three record systems establish the most fundamental documentation requirements for medical device manufacturing. Understanding the distinction between them is essential — and confusing them is a finding.
The Device History File (DHF) documents the design and development history, demonstrating that the design was developed in accordance with the design plan and meets specified design requirements. The DHF is created during design and development. It includes design reviews, verification and validation records, and design transfer records.
The Device Master Record (DMR) is the complete set of information describing how the device is to be made. Specifications, production processes, quality assurance procedures, packaging requirements, and labeling are all part of the DMR. The DMR answers: "Here is what the device is supposed to be and how it is supposed to be manufactured."
The Device History Record (DHR) is the production record for each lot, batch, or unit. It documents what was actually manufactured — quantities, dates, acceptance activities, the identity of operators and equipment, and the manufacturing procedures and specifications used. The DHR answers: "Here is evidence that this specific device was manufactured in accordance with the DMR."
These three records create a traceable chain from design intent to production execution to specific product history. A complete chain is the foundation of a compliant device quality system. Gaps in any one are significant findings.
Based on published FDA inspection databases and enforcement letters, these findings appear most frequently in device manufacturing inspections.
Failure to establish and maintain adequate procedures. The most cited finding in device manufacturing. A procedure exists but is incomplete, unclear, or does not reflect how the process is actually performed. The gap between the documented procedure and actual practice is what generates the citation.
DHR does not contain required elements. Specifically: records of acceptance activities and results, the date of manufacture, the quantity manufactured and the quantity released for distribution, and the signatures or initials of the individual authorizing distribution. Missing any of these from the DHR is a citable deficiency.
Change control failures. Changes to device specifications, manufacturing procedures, or quality system procedures were not reviewed and approved in accordance with 820.40. This includes informal changes — verbal updates to operators, annotations on printed procedures, email instructions — that were never formally processed through document control.
Complaint files not maintained. Section 820.198 requires complaint files that document customer complaints and the investigation thereof. Finding complaints that were not formally recorded, or that were recorded but not investigated, is among the most common citations.
CAPA documentation inadequate. Section 820.100 requires documented corrective and preventive actions with evidence of investigation, action taken, verification of effectiveness, and escalation when systemic problems are identified. Closing CAPAs without documented effectiveness verification is one of the most reliably cited findings.
Records not legible or retrievable. Electronic records requiring obsolete software, handwritten records that cannot be read under reasonable conditions, or records stored in a format that makes retrieval impractical all meet the criteria for this citation.
Beyond the formal citation categories, device manufacturers make several recurring errors in how they design their documentation.
Procedures written at the wrong level of detail. A procedure that says "follow GMP practices" for a manufacturing step with critical parameters is not adequate. Equally, a quality system procedure that specifies individual software keystrokes will break with every system update. The level of detail should match the criticality and variability of the process.
Training records not linked to specific revisions. Evidence that an employee was trained on "Procedure XYZ" is insufficient if you cannot demonstrate which revision they were trained on and whether that remains the current revision. Training records must be revision-specific.
Design transfers that create DMR gaps. When a device moves from R&D to manufacturing, the DMR must be complete before production begins. Partial DMRs — where manufacturing specifications are "to be determined" — are both a compliance failure and a quality risk. The design transfer process must include a DMR completeness review.
CAPA effectiveness not verified before closure. Opening and closing corrective actions without documented evidence that the action actually corrected the problem is one of the most reliably cited findings across all inspection types. Effectiveness verification requires specific evidence, not just confirmation that the action was completed.
A QMS document structure that meets Part 820 requirements needs to address documentation at four levels.
Quality System level: Quality manual, quality policy, quality objectives, and QMS structure. These documents define the system and are reviewed infrequently but must be current and accessible.
Process level: SOPs for each major QMS process — document control, change control, CAPA, complaint handling, internal audit, and management review. These must be living documents with a defined review cycle that ensures they reflect current practice.
Product level: The DMR for each device family, maintained at current revision, covering all elements required under 820.181. This includes not just specifications but the procedures and acceptance criteria required to manufacture and accept the product.
Production level: Work instructions for each manufacturing step that has process parameters or acceptance criteria. These must be at the workstation, at current revision, in a format operators can use during actual production.
Record level: DHR requirements for every lot or unit, with retention period defined and consistently applied.
The FDA inspection process looks for evidence at each level and specifically looks for consistency between levels. A well-documented quality policy supported by work instructions that do not reflect current practice generates citations at the process and product level regardless of how thorough the quality policy is.
Coplain converts existing manufacturing procedures into clear, controlled, audit-ready work instructions designed for FDA-regulated environments. Free trial at coplain.com.
Coplain turns any work instruction into a print-ready, audit-proof job aid in minutes.
Try Coplain free →