FDA inspections don't fail because manufacturers don't know the rules. They fail because the right person didn't check the right thing on the right day. This compliance checklist breaks FDA requirements for pharmaceutical and medical device manufacturing into 5 actionable domains — cGMP facility, QMS, 21 CFR Part 11, validation, and inspection readiness — covering 21 CFR Parts 210/211/820, the new QMSR (2026), and current 483 observation patterns. Request a compliance readiness assessment before your next FDA inspection date is announced.
01
Facility & Infrastructure
21 CFR 211.42 · ISO 14644
18 checks
02
Quality Management System
21 CFR 820 · QMSR · ISO 13485
15 checks
03
cGMP Production Controls
21 CFR 210/211
22 checks
04
21 CFR Part 11 Electronic Records
Subparts A, B, C · ALCOA+
16 checks
05
Validation & Qualification
IQ/OQ/PQ · CSV · GAMP 5
16 checks
$5M+
Avg cost of a consent decree
2026
QMSR replaces QSR (Part 820)
87%
of 483 observations are repeat findings
What Non-Compliance Actually Costs You
FDA enforcement isn't a yes/no switch — it's an escalation ladder. Most facilities encounter every rung at some point. Understanding which rung corresponds to which violation severity helps you triage compliance gaps before they become public regulatory actions that trigger investor questions, customer audits, and SEC disclosures.
Level 1
Form 483 Observation
Inspector documents specific findings during inspection. Requires written response within 15 business days. Most common outcome.
Time + remediation cost
Level 2
Warning Letter
Formal regulatory notice escalated from 483 when response inadequate. Publicly posted on FDA website. Triggers customer audits.
Reputational + customer audit cascade
Level 3
Import Alert / Detention
FDA blocks product shipments at ports of entry. Applies to foreign facilities or facilities under repeated violation. Revenue stops immediately.
Direct revenue interruption
Level 4
Consent Decree
Federal court injunction. Includes FDA-mandated remediation plan, third-party monitoring, civil penalties. Can take 5-10 years to resolve.
$5M+ direct costs · multi-year burden
Level 5
Criminal Prosecution
Reserved for willful violations, fraud, or repeated egregious failures. Individual executives can face criminal charges under the Park Doctrine.
Personal liability · prison terms
Checklist 1 · Facility & Infrastructure
The physical facility is the first thing FDA inspectors examine — and the easiest place to find violations because problems are visible. Cleanrooms, HVAC, water systems, and environmental monitoring failures account for ~30% of 483 observations in pharma facilities. Use this checklist to walk every space before any inspector does.
Cleanroom classification certified (ISO 5/6/7/8) for each roomCritical
Differential pressure monitoring with continuous loggingCritical
HEPA filter integrity tests current (within 12 months)Critical
Smoke studies completed for unidirectional airflow zonesMajor
Environmental monitoring program (viable + non-viable) runningCritical
Gowning qualification procedures + training records currentMajor
Temperature & humidity monitoring with alarmingCritical
Air change rates documented and verified per ISO classMajor
Compressed air, nitrogen, and gases tested for contaminationCritical
Building Management System (BMS) Part 11 compliantMajor
Purified Water (PW) loop validated and continuously monitoredCritical
Water for Injection (WFI) system with conductivity + TOC alarmsCritical
Sanitization schedule documented and verifiedMajor
Microbial & endotoxin trending data reviewed monthlyCritical
Checklist 2 · Quality Management System
The new Quality Management System Regulation (QMSR) takes effect in February 2026, replacing 21 CFR Part 820 by harmonizing with ISO 13485. Pharmaceutical manufacturers continue under cGMP (21 CFR 210/211). Both require the same fundamentals: documented QMS, change control, CAPA, supplier management, and risk-based thinking baked into every process.
Quality Manual approved and version-controlledCritical
Management review minutes with action items closedMajor
QMSR gap analysis completed (medical device only)Critical
Risk management process per ISO 14971 implementedMajor
CAPA process with root cause analysis methodologyCritical
Open CAPAs < 90 days from initiationMajor
Change control with impact assessment documentedCritical
Deviation handling with effectiveness checksMajor
Approved Supplier List (ASL) current with qualification statusCritical
Supplier audits scheduled per risk classificationMajor
Quality agreements signed with all critical suppliersCritical
Incoming material testing & release procedures definedCritical
Get an Independent FDA Readiness Assessment
iFactory's compliance team walks your facility, audits your QMS, reviews your validation packages, and identifies the gaps an FDA inspector will find — before they find them. Built-in remediation plan included.
Checklist 3 · cGMP Production Controls
cGMP production controls are where most repeat 483 observations originate — and where inspectors spend the most time. Batch records, in-process controls, cleaning validation, and stability programs are scrutinized in every inspection. This checklist covers the production-floor fundamentals that drive ~40% of all FDA findings.
Master batch records approved by Quality before useCritical
Executed batch records reviewed within 30 daysCritical
Yield reconciliation with documented investigation triggersMajor
In-process testing performed at defined sampling intervalsCritical
Cleaning validation completed for all shared equipmentCritical
Cleaning agent residue limits established and verifiedCritical
Equipment cleaning logs current and completeMajor
Hold time studies completed (dirty + clean)Major
Stability program covers all marketed products + strengthsCritical
Out-of-Specification (OOS) procedures with timely investigationCritical
Retain samples maintained per regulatory requirementsMajor
Product release procedures with QA dual-sign-offCritical
Need help building an audit-ready batch record system? Schedule a cGMP gap assessment with our pharmaceutical operations team.
Checklist 4 · 21 CFR Part 11 — Electronic Records & Signatures
Part 11 sits on top of every other predicate rule (cGMP, QSR, GLP, GCP) for electronic records. Inadequate audit trails, missing validation of computer systems, and improperly configured electronic signatures are now top-5 FDA inspection findings. Every electronic system touching GxP data must satisfy these controls.
Computer System Validation (CSV) per GAMP 5 completedCritical
System access controls limit functions to authorized usersCritical
Computer-generated time-stamped audit trails activeCritical
Records protected from alteration or deletionCritical
ALCOA+ principles applied (Attributable, Legible, Contemporaneous, Original, Accurate)Critical
Signature includes printed name, date/time, and meaningCritical
Two-component identification (user ID + password minimum)Critical
Signature linked to record — cannot be excised or transferredCritical
Letter of intent filed with FDA (one-time, per organization)Major
Audit trails reviewed routinely (frequency documented)Critical
System clock synchronized to authoritative time sourceMajor
Backup & disaster recovery validated and testedMajor
Records retention meets predicate rule requirementsCritical
Validating new electronic systems for a regulated facility? Connect with our CSV/Part 11 specialists for a tailored validation plan.
Checklist 5 · Validation & Qualification (IQ/OQ/PQ)
Equipment and process validation is the foundation regulators expect under every cGMP and QSR system. IQ verifies correct installation, OQ verifies operation across the intended range, PQ verifies sustained performance in production conditions. Missing or stale validation packages account for ~25% of Form 483 observations.
Validation Master Plan (VMP) approved and currentCritical
IQ executed: installation drawings, utilities, calibrationCritical
OQ executed: functional tests across operating rangeCritical
PQ executed: 3 consecutive successful production runsCritical
Requalification schedule defined and currentMajor
Stage 1: Process Design documented (development data)Major
Stage 2: Process Qualification (PQ) complete with 3 batchesCritical
Stage 3: Continued Process Verification (CPV) program activeCritical
Worst-case scenarios documented in cleaning validationMajor
Method validated for specificity, accuracy, precision, linearityCritical
System suitability criteria defined and met per runCritical
Reference standards traceable to USP/Ph.EurMajor
Building a validation package for a new production line? Book a validation strategy session to scope IQ/OQ/PQ for your specific equipment.
Top 5 FDA Form 483 Observations to Avoid
The same handful of findings appear on the majority of pharmaceutical and medical device 483 forms year after year. Knowing the most common citations lets you self-inspect against them before FDA arrives — and prevents your facility from becoming the 88th company cited for the same recurring failure.
#1
Inadequate investigations. OOS results, deviations, and complaints not investigated to root cause or closed without effectiveness verification.
21 CFR 211.192
#2
Data integrity failures. Audit trails disabled, original data overwritten, electronic signatures shared, or paper records backdated.
21 CFR 211.68 · Part 11
#3
Inadequate cleaning validation. Cleaning procedures not validated for worst-case product, residue limits not justified, or hold times unstudied.
21 CFR 211.67
#4
Equipment not qualified. IQ/OQ/PQ incomplete, missing for production equipment, or stale (no requalification after changes).
21 CFR 211.63 · 211.68
#5
CAPA system failures. Open CAPAs aging, no effectiveness checks, or systemic issues not identified through trend analysis.
21 CFR 211.192 · 820.100
60-Day Inspection Readiness Timeline
FDA inspections rarely happen with no notice — you almost always have 5-30 days to prepare for routine surveillance inspections (for-cause inspections may come unannounced). Using that window correctly means walking into the inspection with documentation organized, teams briefed, and known weak spots already addressed. Here's the canonical readiness timeline.
T-60d
Quarterly Self-Inspection
Internal audit against this checklist · CAPA aging review · open observation status
T-30d
Mock FDA Inspection
External consultant runs simulated inspection · weak spots prioritized for remediation
T-14d
Documentation Sweep
Batch records current · validation packages organized · CAPAs current · training records verified
T-7d
Team Briefing & Logistics
Inspection front office setup · designated SMEs briefed · communication protocols defined
Day 0
Inspection Begins
Opening meeting · facility tour · documentation review · daily debriefs · response tracking
Expert Perspective
The pattern we see in every 483 we review is the same: facilities know what their compliance gaps are months before FDA arrives. They just don't close them. The mock inspection identified the issue. The internal audit flagged it. Three CAPAs touched it. But the resourcing wasn't there, or the priority slipped, or someone said "we'll get to it before next inspection." Then the inspection happens, and the same finding from the internal audit shows up on the 483. Compliance isn't about knowing the rules. It's about institutional follow-through on what you already know is broken.
— FDA Compliance Best Practice
87%
of 483 findings are repeat observations
15 days
Response deadline for Form 483
Feb 2026
QMSR replaces 21 CFR 820
~5-10 yr
Typical consent decree resolution
Bottom Line · Close the Gaps Before FDA Finds Them
FDA compliance is institutional discipline, not regulatory expertise. The facilities that pass inspections cleanly aren't the ones with the smartest quality teams — they're the ones with the most consistent follow-through on what they already know is broken. Use this checklist quarterly. Run mock inspections annually. Track CAPA aging weekly. Treat every 483 finding from a peer facility as a free dress rehearsal. Get this right and inspections become routine. Get it wrong and your next FDA visit becomes the start of a multi-year regulatory burden.
Walk Into Your Next FDA Inspection Ready
iFactory's compliance practice combines former FDA investigators with active validation engineers to run readiness assessments, mock inspections, and remediation plans for pharmaceutical and medical device facilities. Built to find what FDA will find — before they do.
Frequently Asked Questions
What is the FDA compliance checklist for pharmaceutical and medical device manufacturing?
An FDA compliance checklist for pharmaceutical and medical device manufacturing covers five interconnected domains: facility & infrastructure (cleanrooms, HVAC, water systems per 21 CFR 211.42 and ISO 14644), quality management system (QMS per 21 CFR 820 transitioning to QMSR in February 2026, plus ISO 13485 alignment), cGMP production controls (batch records, in-process controls, cleaning validation, stability per 21 CFR 210/211), 21 CFR Part 11 electronic records and signatures (audit trails, ALCOA+ data integrity, CSV per GAMP 5), and validation and qualification (IQ/OQ/PQ for equipment, process validation per FDA 2011 guidance, analytical method validation per ICH Q2(R2)). A complete checklist contains approximately 80-90 specific control points across these domains, prioritized by risk level (Critical vs Major) so quality teams can focus remediation effort where 483 observations actually originate.
What is 21 CFR Part 11 and which systems does it apply to?
21 CFR Part 11 is the FDA regulation establishing criteria under which electronic records and electronic signatures are considered trustworthy, reliable, and legally equivalent to paper records and handwritten signatures. It applies to any electronic system that creates, modifies, maintains, archives, retrieves, or transmits records required by FDA predicate rules — meaning cGMP (21 CFR 210/211 for drugs), QSR/QMSR (21 CFR 820 for medical devices), GLP, and GCP. Common Part 11-regulated systems include Manufacturing Execution Systems (MES), Laboratory Information Management Systems (LIMS), Electronic Document Management Systems (EDMS), eQMS platforms, electronic batch record systems, and automated inspection technologies. The regulation has three subparts: General Provisions (Subpart A), Electronic Records (Subpart B covering audit trails, system validation, access controls), and Electronic Signatures (Subpart C covering signature components and linking).
What is the difference between cGMP and QMSR?
cGMP (Current Good Manufacturing Practices) is the broader regulatory framework for pharmaceutical manufacturing under 21 CFR Parts 210 and 211, covering facility design, equipment, personnel, production, quality control, and records. cGMP applies to drugs, biologics, and APIs. QMSR (Quality Management System Regulation) is the new FDA medical device regulation taking effect February 2026, replacing the previous Quality System Regulation (QSR) at 21 CFR Part 820. QMSR harmonizes US medical device requirements with ISO 13485:2016 by incorporating most of ISO 13485 by reference. Pharmaceutical manufacturers continue operating under cGMP. Medical device manufacturers must now comply with QMSR. Companies making both drugs and devices (combination products) need both. The fundamental concepts overlap heavily — documented QMS, change control, CAPA, supplier management, risk-based thinking — but specific clauses, terminology, and reporting requirements differ between the two frameworks.
What are IQ, OQ, and PQ in pharmaceutical validation?
IQ, OQ, and PQ are the three sequential phases of equipment qualification that prove a piece of manufacturing equipment is installed correctly, operates within its intended range, and performs consistently in production. IQ (Installation Qualification) verifies that the equipment is installed according to specifications — correct utilities, calibrations, drawings, and documentation. OQ (Operational Qualification) verifies that the equipment operates as intended across its full operating range — testing speed, temperature, pressure, alarms, interlocks. PQ (Performance Qualification) verifies that the equipment performs reliably under actual production conditions — typically requiring three consecutive successful production runs at the intended operating conditions. FDA expects all three completed before an equipment item is used for commercial production, with documented requalification triggered by changes, repairs, or extended downtime. Inadequate or stale IQ/OQ/PQ packages account for approximately 25% of all Form 483 observations.
How do you prepare for an FDA inspection?
FDA inspection preparation follows a structured 60-day readiness timeline. At T-60 days, conduct a comprehensive internal audit against current 21 CFR Parts 210/211/820/Part 11 requirements, review CAPA aging, and verify open observation status. At T-30 days, engage an external consultant for a mock FDA inspection that identifies weak spots before the real inspection — this typically uncovers 5-15 findings that get prioritized for immediate remediation. At T-14 days, perform a documentation sweep ensuring batch records are current, validation packages are organized and accessible, CAPAs are appropriately closed, and training records are verified. At T-7 days, set up the inspection front office, brief designated subject matter experts, and establish communication protocols. Day 0: opening meeting, facility tour, documentation review, daily debriefs, response tracking. Plan for 5-15 days of on-site inspection for routine surveillance, longer for for-cause.
Book a 30-day readiness review with our compliance team for a structured pre-inspection plan.
