CFR 21 Part 820 (QMSR) Internal Auditing Services
Our 21 CFR Part 820 QMSR Internal Audit services help medical device manufacturers evaluate the effectiveness and compliance of their Quality Management System against current FDA requirements. Patient Guard provides independent, expert internal audits aligned with the FDA Quality Management System Regulation (QMSR) and ISO 13485:2016, helping you identify compliance gaps, strengthen your QMS, reduce regulatory risk and prepare with confidence for FDA inspection.
CFR 21 Part 820 (QMSR) Internal Auditing Services
Medical device manufacturers subject to 21 CFR Part 820 must maintain a Quality Management System that complies with the FDA’s Quality Management System Regulation (QMSR).
Effective from 2 February 2026, the QMSR incorporates ISO 13485:2016 by reference while retaining additional FDA-specific regulatory requirements applicable to medical device manufacturers operating in the United States.
Internal audits are an essential part of evaluating whether your Quality Management System is effectively implemented, maintained and compliant with applicable requirements.
Patient Guard provides independent 21 CFR Part 820 QMSR internal audit services, assessing your Quality Management System against applicable QMSR, ISO 13485:2016 and FDA-specific requirements.
Our auditors help identify compliance gaps, weaknesses and opportunities for improvement before they become significant regulatory issues, providing clear findings and practical recommendations to support corrective action.
Whether you are preparing for an FDA inspection, assessing your transition to the QMSR, or maintaining ongoing compliance, Patient Guard provides an objective assessment of your QMS to help strengthen your quality processes and maintain FDA inspection readiness.
Why Choose Patient Guard for QMSR Internal Auditing?
Independent QMS Assessment
We provide an objective assessment of your Quality Management System against 21 CFR Part 820 QMSR, ISO 13485:2016 and applicable FDA-specific requirements.
Experienced Medical Device Auditors
Our auditors understand medical device quality systems and FDA regulatory expectations, providing a focused assessment of the areas that matter to your organisation.
Risk-Based Audit Approach
We focus audit activities on regulatory compliance, process effectiveness and higher-risk areas to identify weaknesses that could affect product quality or inspection readiness.
Clear & Actionable Findings
Audit findings are clearly documented and supported by practical observations, helping your team understand identified gaps and prioritise appropriate corrective actions.
FDA Inspection Readiness
Our audits help evaluate whether your QMS is effectively implemented and provide valuable insight into potential compliance issues before an FDA inspection takes place.
Ongoing Compliance Support
Following the audit, Patient Guard can support remediation, corrective actions, QMS improvements and future internal audits to help maintain continued compliance.
What Our CFR 21 Part 820 Internal Auditing Service Includes
QMS Governance & Management
Assessing management responsibilities, quality objectives, organisational roles, management review and oversight of the Quality Management System.
Document & Record Controls
Reviewing the control, approval, maintenance and retention of QMS documentation and quality records to assess effective implementation and compliance.
Design & Development
Auditing applicable design and development processes including planning, inputs, outputs, reviews, verification, validation, transfer and design changes.
Supplier & Production Controls
Assessing supplier management, purchasing activities, production controls, process validation, identification, traceability and other applicable operational processes.
CAPA & Complaint Handling
Reviewing nonconformities, corrective action, complaint handling, post-market information and applicable FDA reporting processes for effectiveness and compliance.
Audit Findings & Reporting
Providing a structured audit report detailing identified nonconformities, observations and opportunities for improvement to support corrective action and inspection readiness.
Who Requires CFR 21 Part 820 Internal Auditing?
- Medical device manufacturers selling in the United States
- Organisations preparing for FDA inspections
- Companies maintaining FDA QMSR compliance
- Start-ups entering the US medical device market
FDA QMSR (21 CFR Part 820) Requirements
Under the U.S. FDA regulatory framework, medical device manufacturers subject to 21 CFR Part 820 must maintain an effective Quality Management System that complies with the FDA Quality Management System Regulation (QMSR).
The QMSR incorporates ISO 13485:2016 by reference alongside applicable FDA-specific requirements. Manufacturers must not only establish appropriate quality processes but also ensure they are effectively implemented, maintained and supported by objective evidence.
A comprehensive 21 CFR Part 820 QMSR internal audit typically assesses the following areas:
| No | Audit Area | What We Assess |
|---|---|---|
| 1. | QMS Governance & Management | Management responsibilities, quality objectives, organisational roles, management review and evidence that the QMS is effectively implemented and maintained. |
| 2. | Document & Record Controls | Approval, control, availability, retention and integrity of QMS documentation and quality records, including evidence that documented processes are followed in practice. |
| 3. | Design & Development | Design planning, inputs, outputs, reviews, verification, validation, transfer and change controls, including supporting records and objective evidence where applicable. |
| 4. | Supplier & Production Controls | Supplier qualification and monitoring, purchasing controls, production activities, process validation, identification, traceability and control of outsourced processes. |
| 5. | Nonconformity & Corrective Action | Identification and control of nonconforming outputs, investigation of quality issues, corrective action, effectiveness checks and use of quality data to identify systemic issues. |
| 6. | Complaints & FDA Requirements | Complaint handling and applicable FDA-specific requirements, including Medical Device Reporting, corrections and removals, and associated records and escalation processes. |
| 7. | QMS Effectiveness & Inspection Readiness | Overall QMS effectiveness, implementation evidence, recurring compliance risks and areas that may require attention before an FDA inspection. |
Our Process
Audit planning
We define scope, schedule, and audit objectives.
Audit execution
We conduct the audit, including interviews, document review, and process assessment.
Reporting
We provide findings, identify non-conformities, and support corrective actions.
Areas we assess
We assess all key areas of your QMS, including:
- Design controls
- Corrective and Preventive Actions (CAPA)
- Document and record control
- Production and process controls
- Supplier management
- Complaint handling and vigilance
- Training and personnel competence
Cost of Service
CFR 21 Part 820 QMSR Internal Auditing
From
Ensure ongoing compliance and Inspection readiness with expert CFR21 Part 820 quality Internal audits.
Audit Costs
- Small Size Organisation (<10 employees) 2 day audit £2,000
- Medium Size Organisation (10-50 employees) 3 day audit £3,000
- Large Size Organisation (>50 employees) 4 day audit £4,000
Time Lines
Planning
1-2 weeks
Audit
2-4 days depending on organisation size
Reporting
2-4 days depending on organisation size
Frequently Asked Questions (FAQs)
What is a CFR 21 Part 820 internal audit?
A CFR 21 Part 820 internal audit is a systematic review of a manufacturer’s Quality Management System to ensure compliance with FDA Quality System Regulation requirements.
Are internal audits required under FDA QSR?
While not explicitly labelled the same as ISO standards, internal audits are expected as part of maintaining an effective quality system and ensuring ongoing compliance.
Can internal audits be outsourced?
Yes, outsourcing internal audits ensures independence, objectivity, and access to experienced FDA regulatory experts.
How often should QSR audits be conducted?
Audits should be conducted at planned intervals, typically annually or more frequently depending on risk and organisational complexity.
How long does a QSR internal audit take?
The duration depends on the size and complexity of your QMS but typically ranges from 2–5 days.
Related Services
Click on the links below to discover more:
Recent Blog Posts
How to Become NHS Procurement Ready: From DTAC to NHS Market Access
Preparing to sell digital health technology to the NHS requires more than completing DTAC. This guide explains how manufacturers can build a procurement-ready position by aligning regulatory compliance, clinical safety, data protection, cybersecurity, interoperability, accessibility and commercial evidence for NHS market access.
DCB0129 and Clinical Safety: What Digital Health Manufacturers Need for NHS DTAC
For digital health manufacturers preparing to enter the NHS, clinical safety can be one of the most important—and sometimes misunderstood—parts of DTAC.
It is not enough to demonstrate that your software works.
Manufacturers need to consider what could happen if the technology fails, produces incorrect information, presents information incorrectly, contributes to a workflow error or is used in circumstances that could expose patients to harm.
This is where clinical risk management and DCB0129 become particularly important.
NHS England identifies DCB0129 as the clinical risk management standard for manufacturers of health IT systems. Its counterpart, DCB0160, applies to health organisations deploying and using health IT systems. NHS England states that compliance with these standards is required under the Health and Social Care Act 2012.
For manufacturers working towards NHS DTAC readiness, understanding the distinction—and having the right clinical safety evidence—is essential.
DTAC Requirements Explained: The 5 Areas Digital Health Manufacturers Need to Get Right
If your digital health technology is heading towards the NHS, understanding the Digital Technology Assessment Criteria (DTAC) should be part of your market-access planning.
But one of the biggest mistakes manufacturers can make is treating DTAC as simply another questionnaire to complete.
The questions are only part of the process.
Behind your answers needs to be evidence showing that your technology and organisation have appropriate arrangements for clinical safety, data protection, technical security, interoperability, and usability and accessibility.
These five areas form the core of NHS DTAC. NHS England describes DTAC as national baseline criteria for digital health technologies entering NHS and social care.
For digital health manufacturers, the practical question is therefore not simply:
“Can we complete the DTAC assessment?”
It is:
“Can we demonstrate that our product meets the requirements?”
This guide looks at each of the five DTAC areas, the types of evidence manufacturers should consider and some of the common gaps that can delay NHS readiness.
The Complete Guide to NHS DTAC Compliance for Digital Health Manufacturers
A complete guide to NHS DTAC compliance for digital health manufacturers, covering the five DTAC assessment areas, required evidence, clinical safety, data protection, technical security, interoperability and usability, and how to prepare your digital health technology for NHS procurement.
Cosmetic Product Safety Report (CPSR): A Complete Guide to UK Cosmetic Compliance
Before a cosmetic product can legally be placed on the UK market, manufacturers and Responsible Persons must demonstrate that it is safe for human use under normal or reasonably foreseeable conditions. The Cosmetic Product Safety Report (CPSR) is one of the most important regulatory documents required under the UK Cosmetics Regulation. This guide explains what a CPSR is, who can prepare one, what information it must contain, how it relates to the Product Information File (PIF) and how it supports legal cosmetic compliance.
IVDR PMPF Explained: A Complete Guide to Post-Market Performance Follow-up
Post-Market Performance Follow-up (PMPF) is a fundamental requirement under the EU In Vitro Diagnostic Regulation (IVDR), ensuring that manufacturers continually monitor the scientific validity, analytical performance and clinical performance of their in vitro diagnostic medical devices after CE marking. This guide explains IVDR PMPF requirements, PMPF Plans, PMPF Reports, Annex XIII expectations and how ongoing performance monitoring supports continued regulatory compliance throughout the device lifecycle.
