The FDA removed the shield from your internal audits — and from your supplier's

For decades the internal audit report was the one place a company could write plainly about what was not working. The investigator did not ask for it, and that exemption was what made the quality system useful for improving rather than for self-protection.

That ended on 2 February 2026. Under the QMSR, internal audit reports and management review minutes are no longer outside what an FDA investigator can request. They are now a map an investigator can follow to a 483.

Why this is not only a US story

If your devices are made in Mexico — and a great many are — this change lands on a supplier whose quality system you do not run.

Industry trackers put Mexico's 2025 medical device exports at roughly US$22 billion, with over 80% of it going to the United States, which makes Mexico the largest device supplier to the US market. The QMSR does not care where the plant sits. It reaches the manufacturer, and through the manufacturer it reaches whoever depends on that plant's records.

So there are two questions rather than one. The first is whether your findings close properly. The second is whether you could answer that question about your contract manufacturer in Ciudad Juárez, Tijuana or Guadalajara — today, without scheduling an audit.

What changes in practice

From protected space to evidence. What your team wrote in order to improve can now be read as documented acknowledgement of a problem. The candour that made internal audit useful is the same candour that makes it a map.

From the minute to the thread. A management review that mentions a problem opens the question of what happened next. If the answer is not recorded, the question stays open — and an open question in a quality system has a name.

From the finding to demonstrable closure. Detecting is no longer enough, and neither is acting. You have to be able to show the whole chain: detection, root cause, action, verification and effectiveness, each link with a date and an owner.

The wrong reaction

The immediate temptation is to write less. Soften the findings, thin out the minutes, move the uncomfortable conversations out of the record.

It is the worst available response, for two reasons.

A quality system that does not record problems does not solve them. Internal audit exists to find what the operation cannot see. If it stops finding things, the problem is still there and now nobody is looking at it.

Absence is also read. A system with zero findings across two years does not communicate excellence. It communicates that internal audit is not working — and in front of an investigator that is a finding in itself.

The right response is the opposite: keep writing plainly, and make sure each thing written has its closure documented beside it.

What "closed" means now

A closed finding has four elements, and in many systems only two of them exist.

Root cause, not apparent cause — with the analysis that supports it, not only the conclusion.

Action, with an owner and a committed date.

Verification that the action was implemented. This is not the same as the action itself.

Effectiveness: evidence that the problem did not recur after the action, measured over a reasonable period.

The fourth is the one almost always missing. A finding with an implemented action and no effectiveness verification is, technically, open — even if the system shows it green.

The questions that reveal whether you are exposed

1. Of your internal audit findings from the last two years, how many are closed with evidence of effectiveness rather than just a recorded action?
2. Do your management review minutes mention problems whose follow-up lives outside the quality system?
3. For any given finding, can you show the full chain without reconstructing it?
4. How long does assembling that chain take?
5. Who decides a finding is closed, and against what written criterion?
6. How many findings closed later than their committed date, and what was documented about the delay?
7. Did your internal audit find anything in the last cycle? If not, why not?
8. Could you answer all seven about your contract manufacturer, without asking them?

A test you can run this week

Pick a finding from eighteen months ago — neither the most serious nor the most trivial — and ask for its complete closure file.

If effectiveness verification is missing, you have an open finding that your system reports as closed. Repeat with three more. The proportion you find is your real state, and it is the state an investigator will find by walking the same path.

Then run it once more, on a finding from your supplier's system. The gap between how long the two take is the part of your exposure you do not control.

What it looks like solved

The change is not documenting more. It is that the chain gets built while it happens, instead of being assembled when someone asks for it.

A finding that, on being recorded, already requires root cause, owner and date. An action that cannot be marked complete without its verification. A verification that schedules the effectiveness review by itself. When the system enforces it, the file exists because there was no way to move forward without building it.

And when the supplier records into the same system, the second question stops being a question.

It is the same discipline the standard asks of your product — traceability from requirement to evidence — applied to your quality system.

The regulatory basis, with dates

What follows is the exact citation for everything mentioned above. It sits at the end because the argument stands without it, but anyone taking this to a committee needs it.

FDA QMSR · in force 2 February 2026 Quality Management System Regulation. Replaces the Quality System Regulation of 21 CFR 820 and removes the exemption that kept internal audit reports and management review minutes out of an investigator's reach.

21 CFR 820 · superseded by the QMSR The prior Quality System Regulation.

ISO 13485:2016 · current Quality management systems for medical devices. The QMSR aligns with it, which is why a site already certified is closer to compliance than it may assume.

21 CFR Part 11 · 11.10(e) Electronic records and signatures: a secure, computer-generated, time-stamped audit trail; a change must not obscure previously recorded information; the trail is retained as long as the record itself.

Mexico as the largest US device supplier · industry-reported, 2025 Roughly US$22 billion in device exports, over 80% of it to the United States. Figure reported by industry trackers rather than by an official trade statistic — worth citing as such.

---

SPARTANE · This page describes the operational implications of a regulatory change and is not a substitute for regulatory advice on a specific case. The governing text of the QMSR should be consulted at its official source.

What to read next

• The date — the one everything else in this industry lines up behind
• The number — the indicator this sector is charged against
• The processes, step by step — the three flows with their break points and the record that closes them
• This industry’s suite — open to walk in and use, with sample data, before talking to anyone

Where to verify this

This piece describes an operational implication. It is not the text of the obligation and does not replace reading it.

What sets it is QMSR de la FDA, in force since 2 de febrero de 2026. Its primary sources are listed below, one by one [3][4][5][6].

The sector framing —the thesis with its dated signal [1] and the sector anatomy with the chain of actors and the points where the record breaks today [2]— is what supports the reading above.

If you find a misquoted fact, write to sales@spartane.ai: we correct it with the correction in plain sight.