Your Quality Culture? The QMSR Says Plenty—And So Will the FDA

Last week, I shared insights on the FDA's upcoming review of internal audits and management reviews under the new Quality Management System Regulation (QMSR), set to take effect on February 2, 2026. Today, let's connect that to the vital concept of quality culture.

The pharmaceutical industry has long emphasized quality culture, with the Center for Drug Evaluation and Research (CDER) introducing the Quality Management Maturity (QMM) program to systematically evaluate and rate quality management systems—where culture plays a key role. In the medical device sector, the Case for Quality (CfQ) initiative mirrors this, featuring the Voluntary Improvement Program (VIP), which launched as a pilot in 2018 and evolved into the permanent CfQVIP program. CfQVIP leverages the Capability Maturity Model Integration (CMMI) framework to appraise quality systems and business practices, promoting continuous enhancement.

You're right if you think you'll never see an FDA-483 observation or Warning Letter explicitly citing "quality culture." However, it's a mistake to assume your organization's quality culture isn't under scrutiny during inspections—or that it doesn't influence your risk profile, which can affect inspection frequency, even outside of CfQVIP participation.

Don't just take my word for it. The preamble to the QMSR final rule (Federal Register, February 2, 2024) addresses this directly. Recent updates, including technical amendments issued on December 4, 2025, further align regulations with the QMSR and reinforce these expectations.

From Comment 27 (Response to the use of the term “Top Management”)

• "Utilizing the definition in ISO 9000 for the term 'top management' does not change that FDA expects medical device manufacturers, led by individuals with executive responsibilities, to embrace a culture of quality as a key component in ensuring the manufacture of safe and effective medical devices that otherwise comply with the FD&C Act."

• "A culture of quality meets regulatory requirements through a set of behaviors, attitudes, activities, and processes."

• "Top management ensures that applicable regulatory requirements are met through the integration of QMS processes. For example, quality cannot be inspected or tested into products or services. Rather, the quality of a product or service is established during the design of that product or service, and achieved through proper control of the manufacture of that product or the performance of the service."

From Comment 55 (Response Regarding Record-Keeping Exceptions and Access to Records):

• "FDA emphasizes that robust management review, as well as internal and supplier audit programs, are fundamental to the culture of quality discussed previously in this rulemaking and which FDA expects firms to embrace."

Your organization's culture directly affects inspection outcomes and the FDA's willingness to collaborate during challenges. It's evident from these comments that the FDA will evaluate quality culture by scrutinizing top management's actions, management review content, and the robustness of internal and supplier audit programs.

More concretely, here are key indicators of quality culture that investigators may quietly assess during QMSR inspections to verify that quality is "built in" and accountability exists at every level:

Leadership and Management Commitment (ISO 13485 Clause 5)

• Evidence that top management actively promotes quality culture via policies, objectives, and resource allocation.

• Management review records demonstrating regular QMS effectiveness evaluations, incorporating inputs like audit results, complaints, nonconformities, and risk assessments. Investigators will verify if these lead to actionable, preventive improvements.

• Visible leadership support, including clear communication of quality goals, accountability for QMS results, and seamless integration of quality into business strategies. Red flags include departmental silos or purely reactive issue handling.

Resource Management and Employee Engagement (ISO 13485 Clause 6)

• Comprehensive training programs and competency records ensuring employees grasp their roles in quality and risk management, including how their work affects device safety.

• Infrastructure and work environment controls that bolster quality, with proof of employee empowerment to report issues fearlessly (e.g., via open channels).

• Positive indicators like low turnover in quality positions or strong feedback systems; warnings signs include insufficient training linked to recurring errors.

Measurement, Analysis, and Improvement (ISO 13485 Clause 8)

• Efficacy of internal audits, corrective and preventive actions (CAPA), and nonconformity management. Inspectors will examine audit reports for in-depth root cause analyses, timely fixes, and evidence of proactive learning.

• Data integrity and trend analysis from complaints, production metrics, and supplier performance. A mature culture exhibits ongoing improvement loops, not just Band-Aid solutions.

• Supplier audit records assessing risk-based oversight and alignment with your firm's quality standards.

Risk Management Integration (ISO 13485 Clauses 4.1, 7.1, 7.3, etc.; QMSR §820.10(b))

• Documentation of risk-based processes across the product lifecycle, from design and production to supplier selection and post-market surveillance (harmonized with ISO 14971).

• Proactive risk identification, analysis, control, and monitoring, emphasizing patient safety and data-driven choices over mere compliance.

• Embedding risk principles in all aspects of QMS, like supplier controls and process validation. Investigators may consider deviation or recall trends as signals of cultural weakness.

Overall Organizational Behaviors and Outcomes

• Comprehensive evidence of a "culture of quality" through attitudes and activities, such as cross-functional collaboration, ethical decisions, and patient focus. The FDA may conduct staff interviews or observe operations to determine if quality trumps production demands.

• Regulatory history trends, including Form 483 observations, recalls, or complaints, to spot systemic cultural gaps.

• Behaviors during the inspection itself: Transparency, cooperation, timeliness, and employees' ability to articulate processes all reflect a quality culture.

It's not sufficient to have complete paperwork or do the bare minimum. The QMSR requires a quality system that is continually assessed, preventive, and improved, with everyone understanding their responsibilities. A robust quality culture—rooted in leadership commitment, employee involvement, and patient-prioritizing practices—can prevent observations and Warning Letters. While "quality culture" won't appear on an FDA-483, its absence will manifest in compliance issues.

So….how's your culture stacking up?