FDA 483 Citations for Management Review and Management Responsibility Under 21 CFR 820.20

"Procedures for management review have not been [adequately] established." FDA investigators cited 21 CFR 820.20(c) with that wording 49 times on system-generated Form FDA 483s in fiscal year 2025. Related management responsibility observations added more than 50 others:

• "Management with executive responsibility has not reviewed the suitability and effectiveness of the quality system [at defined intervals] [with sufficient frequency]," 820.20(c), 18 times

• "Quality system procedures and instructions have not been established," 820.20(e), 14 times

• "The organizational structure has not been [adequately] established and maintained to ensure that devices are [designed] [produced] in accordance with 21 CFR 820," 820.20(b), 11 times

• "No management representative had been appointed to ensure that quality system requirements are met, and to report to management on the performance of the quality system," 820.20(b)(3), 10 times

These citations go to the top of the company. FDA holds executive management responsible for the quality system, and a missing or token management review tells the investigator that leaders are not watching it.

What the citations mean

Examples written after "Specifically" usually describe:

• No management review procedure, or no review held in more than a year

• Reviews that are attendance lists without data, decisions or actions

• Required inputs missing, such as complaints, CAPA status, audit results or supplier performance

• Action items from the last review never closed

• No defined management representative, or one with no authority

• No organization chart or defined responsibilities for quality functions

• A quality manual or procedure set that does not cover the regulation

What 21 CFR 820.20 required

Under the Quality System Regulation, management with executive responsibility had to establish a quality policy and objectives (820.20(a)), an adequate organizational structure with defined responsibility, authority and resources, and a management representative (820.20(b)). Section 820.20(c) required management with executive responsibility to review the suitability and effectiveness of the quality system at defined intervals and with sufficient frequency, according to established procedures, and to document the dates and results of reviews. Manufacturers also needed a quality plan (820.20(d)) and quality system procedures and instructions, with an outline of the documentation structure where appropriate (820.20(e)).

Under the old regulation, section 820.180(c) said FDA would not request to inspect management review results, although executives had to certify in writing that reviews were performed when asked.

What changed under QMSR

Under QMSR, in effect since February 2, 2026, management responsibility comes from ISO 13485:2016 clause 5: management commitment (5.1), customer focus (5.2), quality policy (5.3), planning and quality objectives (5.4), responsibility, authority and communication including the management representative (5.5), and management review (5.6).

Two changes matter most for 483 responses:

• FDA can now read your management review records. QMSR removed the old exception that kept management review, internal audit and supplier audit reports out of routine inspection. Expect investigators to read the minutes and compare them to your complaint, CAPA and audit data.

• Clause 5.6 lists required inputs and outputs. Inputs include feedback, complaint handling, reporting to regulatory authorities, audits, monitoring and measurement of processes and product, corrective action, preventive action, follow-up from previous reviews, changes that could affect the quality system, recommendations for improvement, and new or revised regulatory requirements. Outputs must record decisions and actions on improvements needed to maintain the suitability, adequacy and effectiveness of the quality system and its processes, improvement of product related to customer requirements, changes needed to respond to new or revised regulatory requirements, and resource needs.

How to respond to the 483

FDA generally considers responses received within 15 business days of the close of the inspection before deciding on further action.

Hold a real management review now

If reviews were missing, hold one before you respond, using current data for every clause 5.6 input. Attach the agenda and the action list, or describe them. Executive attendance matters: the review must be performed by top management, not delegated entirely to quality.

Fix the structure

Appoint or confirm the management representative in writing, with authority to report on the quality system. Update the organization chart and define responsibilities for each quality function.

Fix the procedure

• Define frequency, attendees, required inputs and outputs, records and follow-up

• Use a standard agenda that maps to each clause 5.6 input

• Track action items to closure with owners and due dates

• Present trend data, not raw lists

Show the system works over time

Commit to a schedule, such as quarterly reviews for the first year, and offer to send FDA the next review's summary.

What a compliant management review procedure contains

• Responsibilities of top management and the management representative

• Review frequency and triggers for extra reviews

• Every input required by ISO 13485 clause 5.6.2

• Outputs and decisions required by clause 5.6.3

• Action tracking and follow-up at the next review

• Records and retention

• Links to quality objectives, CAPA, internal audit and complaint trending

Common mistakes in management review responses

• Holding one review for the inspection and then stopping

• Listing data without decisions or actions

• Leaving executives out of the meeting

• Reviewing complaint counts but not complaint trends or MDRs

• Treating the management representative as a title with no authority

Example: how one response section might read

This illustrates structure only; your response must describe your own facts.

Observation 7: Management with executive responsibility has not reviewed the suitability and effectiveness of the quality system at defined intervals. Specifically, no management review was documented in the last 22 months.

Response:

• Correction: A management review was held on a stated date with the CEO, COO and quality director. All ISO 13485 clause 5.6.2 inputs were reviewed. Eleven actions were assigned with owners and dates.

• Root cause: The procedure did not set a frequency, and the review was cancelled repeatedly during a product launch.

• Corrective action: The procedure now requires quarterly reviews, a standard agenda and an action log reviewed at each meeting. Reviews are on the executive calendar through next year.

• Verification: Internal audit will verify that the next two reviews took place and that actions closed on time.

Frequently asked questions

Can FDA ask for management review minutes now?

Yes. QMSR removed the old exception, so management review records are open to inspection like other quality records.

How often should management review happen?

ISO 13485 requires planned intervals but does not set one. Most device manufacturers review at least annually, and many review quarterly or semiannually. The interval must be often enough to act on problems.

Who must attend?

Top management, meaning the people who direct and control the organization at the highest level. Quality can prepare and run the review, but executives must take part in it.

How A.P. Lyon documents help

A.P. Lyon's Management Review Procedure for ISO 13485 and FDA QMSR defines inputs, outputs, frequency and action tracking. The Organization, Responsibilities, and Authority Procedure covers the management representative and quality structure, and the ISO 13485 Quality Management System Manual sets the policy and documentation structure.

Documents are editable Word and Excel files and must be adapted to your organization. Top management must still hold and act on the reviews.

Next steps

• Hold a full management review with executives and current data

• Confirm the management representative and organization structure

• Revise the procedure, schedule future reviews and track actions

• Respond within 15 business days with dates for each action

Related guides: Quality Audit Citations and CAPA Procedure Citations.

To build a complete set of procedures at a volume discount, use Build Your QMS. For help with a 483 response, see A.P. Lyon consulting services.

Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.