The QSR to QMSR Gap Analysis: 12 Procedures You Must Update for ISO 9001 Principles

Before diving into procedures, it helps to be clear about the nature of the change, because misunderstanding it leads to wasted effort. The QMSR did not invent new quality requirements out of nowhere. The core intent of Part 820 remains intact. You still need design controls, production and process controls, CAPA, complaint handling, and robust records. What changed is the framework those requirements live in. The FDA replaced most of the old subpart structure with the clause-based architecture of ISO 13485:2016, then layered specific US requirements back on top where the international standard alone was not enough.

That layering is the key to understanding your workload. The FDA deliberately retained several US-specific obligations that go beyond the ISO baseline, including device labeling, complaint handling tied to medical device reporting, unique device identification, corrections and removals, and certain record keeping and retention expectations. So your updated system has to do two things at once: adopt the ISO structure and language, and preserve the FDA-specific provisions that the regulation keeps. A procedure that satisfies ISO 13485 but ignores the retained FDA requirements will still fail an inspection.

The procedures below are the ones the transition affects most. Work through them in your gap analysis, and treat the higher risk areas, particularly CAPA, complaint handling, and design controls, as priorities, since these are where FDA findings concentrate most heavily.

1. Definitions and Terminology Glossary

Start here, because terminology cascades into everything else. The QMSR adopts ISO 13485 language, and familiar terms have shifted. The device master record, design history file, and device history record no longer appear by those names in the rule, even though the underlying records are still required. At the same time the QMSR keeps certain FDA definitions, such as manufacturer, rework, and safety and performance, that override the ISO equivalents. Update your quality manual and every SOP glossary so terms map cleanly, because a missing term for term mapping can obscure the link between your processes and enduring legal requirements.

2. Document Control

Document control is the most frequently cited area in FDA warning letters, so it deserves early attention. Your procedure needs to reflect the ISO 13485 approach to controlling documents while preserving FDA expectations around approval before use, version control, and distribution records. Make sure obsolete documents are removed from use and that your controlled document list reflects the new terminology and structure.

3. Control of Records

Record control changes in an important way. The legacy records exception that previously shielded certain quality records from routine FDA review has not been carried into the QMSR, which means management review, internal audit, and supplier audit records are now open to inspection. Update your records procedure to reflect ISO 13485 record controls plus FDA specific records such as complaint files, servicing records, and UDI records, along with confidentiality and retention expectations. Being able to prove traceability with complete, retrievable records is now central to passing an inspection.

4. Management Responsibility and Review

The QMSR sharpens expectations around how leadership engages with quality. Investigators now assess management review effectiveness rather than simply confirming that reviews happen, so senior management should use those reviews to set a clear vision, build a shared sense of purpose around quality initiatives, and reinforce a culture of quality through a strong management team. ISO 9001 emphasizes leadership's role in achieving quality goals, and effective leadership can improve employee motivation, productivity, and overall organizational performance. Update your procedure so reviews draw on real performance data, including complaint trends and post-market signals, and produce documented decisions that feed back into the system. Map the explicit cross-references to other FDA requirements, such as medical device reporting and corrections and removals, into your management responsibility process.

5. Risk Management

Risk management moves from implicit to central. The QMSR expects risk-based thinking to run through the entire quality system, supported by quantitative data wherever possible, with ISO 9001 emphasizing identifying risks and opportunities for improvement. Your procedure should establish risk management across the full product lifecycle, not just within design, and show how risk assessments cross-reference your other QMS processes. Under the process approach, those cross-references connect linked processes and interconnected processes through the Plan-Do-Check-Act cycle to support continuous improvement and continual improvement in line with the organization's goals while surfacing improvement opportunities. This is one of the clearest shifts in inspection focus, so the documented link between risk and your day-to-day quality decisions needs to be obvious.

6. Design Controls

Design controls remain a high-priority area and an FDA-specific strength of the regulation. Update your design planning, inputs, outputs, review, verification, validation, transfer, and change records so they reflect the risk-integrated expectations of the QMSR rather than older checklist-style records, using a customer-focused approach with a strong customer focus to meet customer needs and support high-quality products. The expectation is that risk management and design control are genuinely connected, with design decisions traceable to risk analysis and to post-market feedback. Customer feedback and customer satisfaction data should guide design changes, with customer satisfaction tracked as a key performance indicator to improve product quality, maintain customer focus, support improving customer satisfaction, address customer expectations, and exceed customer expectations.

7. CAPA

Corrective and preventive action is where warning letters concentrate most heavily, so this procedure must be solid. The QMSR expects structured root cause analysis and, critically, effectiveness verification gates that confirm an action actually worked and monitor improvement projects for effectiveness before the CAPA is closed. Build effectiveness check timelines and acceptance criteria into the procedure, and make sure your team is trained in proper root cause methods. This kind of continuous improvement supports adaptability and innovation, not just closure of individual CAPAs. Strong handling of corrective actions also strengthens performance improvement and helps quality initiatives drive operational excellence toward operational excellence. A system that helps you address nonconformances and minimize deviations with a documented closed loop is exactly what this demands.

8. Complaint Handling and Customer Focus

Complaint handling is now explicitly tied to post-market surveillance, creating an expectation of closed-loop feedback from the field back into design and risk management. Your procedure needs formal evaluation, investigation, trend analysis, and risk assessment, with clear triggers feeding mandatory medical device reporting. Link complaint codes to design and process risk so that fixes target root causes rather than symptoms, and ensure labelling-related complaints loop through document control.

9. Supplier and External Provider Controls

Supplier controls need to be rebuilt around documented risk classification, with supplier selection and evaluation aligned to understanding the needs of interested parties as required by relationship management iso. Assess each critical supplier against quality history, regulatory status, and the risk their inputs contribute to the finished device. Inspection-ready supplier qualification files are no longer optional, particularly now that supplier audit records fall within FDA inspection scope. Good relationship management with suppliers should build mutual trust and transparency, while encouraging cooperation for shared value creation; this supports corporate goals, strengthens relationships with customers and other interested parties, and helps form mutually beneficial relationships that can create competitive advantage, a competitive edge, and sustainable growth. Update the procedure so supplier selection, evaluation, and monitoring are all risk-based and fully documented.

10. Labeling and Packaging Controls

Labeling and packaging controls are explicitly carried forward as FDA-specific requirements rather than left to ISO text alone. Update procedures so they link the ISO production and labeling controls to FDA compliance, including storage, handling, and unique device identification application and maintenance where it applies. This is one of the areas where the FDA deliberately retained US-specific expectations on top of the harmonized standard.

11. Internal Audit and Evidence-Based Decision Making

Your internal audit procedure has to do more under the QMSR, partly because internal audit records are now inspectable. Update the procedure so audits are planned against the new clause structure, cover the FDA-specific additions, support evidence-based decision making, and use reliable data from audit results to feed findings into CAPA and management review. Audit conclusions should rely on accurate and reliable data and clear communication channels rather than subjective judgment. A strong internal audit programme is your own early warning system, surfacing gaps before an investigator arrives, which makes it one of the most valuable procedures to get right during the transition.

12. Training and Competence

Finally, training and competence underpins everything else, and the transition itself creates a training obligation. Staff need to understand the new terminology, the restructured procedures, and the FDA enforcement approach, because engaged employees and cross-functional teams support quality management system success, strengthen quality culture, and contribute to employee motivation while helping leadership turn quality objectives into better resource allocation and improving quality. Update your training procedure to capture the transition training, define competence requirements against the new structure, assess employee competency levels, and include skill-building, recognition, and records that prove people are trained on the current versions. Investigators will ask frontline staff questions, and informed answers are the strongest evidence that the new system is real rather than paper deep.

A QSR to QMSR gap analysis can feel like a compliance burden, but it is also a chance to build a genuinely stronger quality system on the principles of ISO 9001; ISO 9001:2015 outlines seven quality management principles that are applicable across industries. The twelve procedures above are where the transition bites hardest, and working through them methodically, prioritizing by risk and keeping everything documented and retrievable, is how you turn a regulatory deadline into a more resilient operation. The manufacturers who come through this well will be the ones whose systems were already organized, connected, and inspection-ready. To see how QualityReady supports your transition and keeps you ready for every FDA inspection that follows, request a QualityReady demo or explore the QualityReady platform .