The Most Common FDA Quality-System Citations — and How a Modern eQMS Prevents Them
Read enough FDA warning letters and Form 483s and a pattern jumps out: the same handful of quality-system failures show up again and again. They rarely happen because a company doesn't know the rules — they happen because the system holding everything together can't keep up as product volume grows. Almost all of them are preventable with the right electronic quality management system (eQMS).
Here are the five most common quality-system citations under 21 CFR 820 (now the QMSR), what they look like in real life, and how a modern eQMS stops them before an inspector ever sees them.
1. Complaint handling breaks down (ISO 13485 §8.2.2 — 21 CFR Part 820, QMSR)
What it looks like: Complaints get miscategorized as "inquiries" and quietly closed. Reports that clearly allege a performance, durability, or safety problem get cancelled as "user error." When a complaint hints at a possible serious injury, no one asks the follow-up questions needed to decide whether it's MDR-reportable — and reportable events get missed. Backlogs pile up because a small team is drowning in volume.
How an eQMS prevents it: Every complaint enters one controlled intake with a consistent triage step, so nothing gets silently cancelled. A built-in reportability decision forces the MDR question — and flags anything mentioning serious injury for human review — so a potential 30-day or 5-day report can't slip through. Open complaints and their aging are visible on a dashboard, so backlogs surface early instead of in an FDA 483.
2. CAPA gaps and missing links (ISO 13485 §8.5.2/§8.5.3 — 21 CFR Part 820, QMSR)
What it looks like: A CAPA's containment covers one site but misses the other warehouses that shipped the same product. A field action happens but never gets linked to the CAPA that should govern it. Related records live in separate spreadsheets, so no one can see the full chain.
How an eQMS prevents it: CAPAs are linked records, not free-text references — a complaint, nonconformance, or audit finding creates and connects a CAPA in one click, traceable in both directions. Effectiveness checks are required before a CAPA can close. The chain is visible, so containment and field actions can't fall through the cracks.
3. Weak trending and data analysis (ISO 13485 §8.5.2 — 21 CFR Part 820, QMSR)
What it looks like: Quality data is "trended," but only at a high level — so the top issue for the whole product line hides the fact that one specific model is failing for a different reason. Recurring problems go undetected, and no CAPA is opened until they've become a pattern.
How an eQMS prevents it: Metrics are captured continuously and can be sliced by product, model, failure mode, and root cause — with trends over time for management review. Recurring problems become visible early, which is exactly what the regulation asks you to detect.
4. Risk and design records fall out of date (ISO 13485 §7.3.7 — 21 CFR Part 820, QMSR)
What it looks like: A product changes — new features, new compatible devices, refactored software — but the risk management file still reflects a version from years ago. The Design History File is incomplete. Post-production changes were never reassessed for risk.
How an eQMS prevents it: Risk assessments live under version control with an audit trail, tied to the documents and changes they relate to. When a change is made, the system makes the link explicit — so the risk file and design records stay current instead of drifting.
5. Training done, but effectiveness never verified (ISO 13485 §6.2 — 21 CFR Part 820, QMSR)
What it looks like: People complete training on the complaint or MDR procedure, but there's no check that they actually understood it — so the same procedure keeps getting applied incorrectly.
How an eQMS prevents it: Training is assigned against the current effective version of a procedure, each person acknowledges it, and effectiveness is verified — with records that show who was trained on what, and when. When a document is revised, affected people are automatically reassigned.
The bar just went up: QMSR
As of February 2, 2026, 21 CFR 820 became the QMSR, aligning FDA requirements with ISO 13485:2016. The disciplines above didn't get easier — they got framed in ISO terms and, if anything, put more weight on risk-based thinking and record integrity. For a growing company, doing this manually is only getting harder.
The common thread
Every one of these citations is really the same problem: a quality system that can't keep pace with the company. Spreadsheets and shared drives work until product volume and complexity outgrow them — and that's exactly when the gaps an inspector finds start to appear.
Indelio is an AI-native, 21 CFR Part 11 / GAMP 5–compliant eQMS built for small device and biotech companies: complaints with a built-in reportability decision, linked CAPAs, continuous trending, version-controlled risk and documents, and verified training — all on an immutable, hash-chained audit trail with two-component electronic signatures. It ships with a pre-drafted validation package, and we're taking on three founding partners — the platform free for 60 days, onboarding passed through at cost, and the founding rate locked permanently on conversion.
If your quality system is starting to strain, a 20-minute look will tell you whether it fits.
This article is general information, not regulatory or legal advice. Always refer to the current regulations and consult a qualified quality/regulatory professional for your specific situation.