FDA 483 Citation 21 CFR 820.90: Control of Nonconforming Product

23 hours ago

6 min read

"Procedures have not been [adequately] established to control product that does not conform to specified requirements." In fiscal year 2025 FDA investigators cited 21 CFR 820.90(a) with that wording 95 times on system-generated Form FDA 483s. A second version, "Products that do not conform to specifications are not adequately controlled," added 18 more.

Nonconforming product control is where quality problems become visible on the shop floor. If parts that fail inspection can be used, shipped or reworked without control, FDA has reason to doubt every device that left the building.

What the citation means

Examples investigators commonly list after "Specifically" include:

Rejected material stored next to good material with no identification or segregation
Nonconformance reports opened but never dispositioned
Material used "as is" with no documented justification or approval signature
Rework performed without a procedure, without retesting and without a record in the device history record
No evaluation of whether a nonconformance needs an investigation or a CAPA
Nonconformances found after shipment not linked to complaint handling or field action decisions

What 21 CFR 820.90 required

Under the Quality System Regulation, 820.90(a) required procedures to control product that does not conform to specified requirements. The procedures had to address the identification, documentation, evaluation, segregation and disposition of nonconforming product. The evaluation had to include a determination of the need for an investigation and notification of the persons or organizations responsible for the nonconformance. Evaluation and any investigation had to be documented.

Section 820.90(b) covered nonconformity review and disposition:

Procedures had to define the responsibility for review and the authority for disposition of nonconforming product, and set out the review and disposition process.
Disposition had to be documented, including the justification for use of nonconforming product and the signature of the individual authorizing the use.
Rework and reevaluation activities required procedures, including retesting and reevaluation after rework to ensure the product meets its current approved specifications, with rework and reevaluation documented in the device history record.

What changed under QMSR

Under QMSR, in effect since February 2, 2026, nonconforming product control comes from ISO 13485:2016 clause 8.3:

8.3.1 General: documented procedure defining controls and responsibilities for identifying, documenting, segregating, evaluating and disposing of nonconforming product. The evaluation must include whether an investigation is needed and notification of external parties responsible for the nonconformity.
8.3.2 Actions in response to nonconforming product detected before delivery: product may be accepted by concession only if justification is provided, approval is obtained and regulatory requirements are met, with records of the concession and the identity of the person authorizing it.
8.3.3 Actions in response to nonconforming product detected after delivery: action appropriate to the effects, or potential effects, of the nonconformity, including documented procedures for issuing advisory notices in line with regulatory requirements.
8.3.4 Rework: rework performed according to documented procedures that take into account potential adverse effects, with the same review and approval as the original work instruction, and verification afterward that the product meets acceptance criteria.

The main additions compared with the old regulation are the explicit requirement to handle nonconformities found after delivery, including advisory notices, and the consideration of adverse effects of rework.

How to respond to the 483

FDA generally considers responses received within 15 business days of the close of the inspection before deciding on further action.

Contain and correct

For every lot or nonconformance cited, confirm where the product is now. Quarantine any suspect material, complete the evaluation and disposition, and document justification and approval for any use-as-is decision. If nonconforming product may have shipped, evaluate the need for a field action and say what you decided.

Fix the system

Typical system fixes include:

A revised procedure covering identification, segregation, evaluation, disposition, concession, rework and post-delivery nonconformities
A physically separated and controlled quarantine area, with clear tags or system status
A material review board or named approvers with defined authority
Criteria for when a nonconformance requires investigation or escalation to CAPA
A rework instruction requirement, with retest and recording in the device history record
Trending of nonconformances by part, supplier, process and failure mode

Look back

Review open and recently closed nonconformance reports, often for one to two years, to confirm each has a disposition, justification and approval. Check that use-as-is decisions were justified and that reworked units were retested.

Train and verify

Train production, inspection, warehouse and quality staff. Plan an internal audit of the nonconforming product process once the changes have been in place for a few months.

What a compliant nonconforming product procedure must contain

Identification and status marking of nonconforming product
Segregation and quarantine controls
Documentation of the nonconformance
Evaluation, including investigation need and notification of responsible parties
Disposition options and who has authority for each
Concession (use-as-is) justification and approval
Rework instructions, retest and device history record entries
Handling of nonconformities found after delivery, including advisory notices
Links to CAPA, supplier corrective action and complaint handling
Trending and records

Common mistakes in nonconforming product responses

Moving material into a quarantine area without fixing how it got out in the first place
Allowing use-as-is decisions by one person with no technical justification
Treating rework as routine production with no specific instruction or retest
Failing to link supplier-caused nonconformances to supplier controls
Never escalating repeat nonconformances to CAPA

Example: how one response section might read

This illustrates structure only; your response must describe your own facts.

Observation 4: Procedures have not been adequately established to control nonconforming product. Specifically, lot 2417 of molded housings failed dimensional inspection and was released for use without documented justification or approval.

Response:

Correction: Finished devices built with lot 2417 were identified and placed on hold. An engineering evaluation with test data showed the deviation did not affect fit or function. A concession was documented with justification and approved by quality and engineering on a stated date.
Root cause: The procedure allowed use-as-is decisions by production supervisors and did not require technical justification.
Corrective action: The procedure was revised to require a material review board decision, technical justification and quality approval for every concession.
Retrospective review: All 186 nonconformance reports from the last two years were reviewed; 12 use-as-is decisions lacked justification and were evaluated, with no product impact found.
Training: Production, inspection and quality staff were trained.
Verification: Nonconformance records will be sampled monthly for six months.

Frequently asked questions

What is the difference between a correction and a corrective action?

A correction fixes the nonconforming product, for example by rework or scrap. A corrective action removes the cause so the nonconformity does not happen again. FDA expects both where appropriate.

When should a nonconformance become a CAPA?

Your procedure should set criteria, such as risk to the patient, recurrence, cost or number of units affected. Repeat nonconformances with the same cause are the most common trigger.

Can we ship product that does not meet specification?

Only through a documented concession with justification and approval, and only where regulatory requirements are met. It should be the exception, not a routine way to release product.

How A.P. Lyon documents help

A.P. Lyon's Nonconforming Material Procedure for ISO 13485 and FDA QMSR covers identification, segregation, review, disposition, concessions and rework, with nonconformance report and material review forms. It connects to the Corrective and Preventive Action Procedure for escalation. A dual-standard version is available for firms certified to both ISO 9001 and ISO 13485.

Documents are editable Word and Excel files. They must be adapted to your products, facility and organization, and staff must be trained on them. FDA judges the controls you operate.

Next steps

Locate and contain every product referenced in the observation
Complete dispositions and justifications, and decide on any field action
Revise the procedure, set up quarantine controls and train staff
Respond within 15 business days with dates for each action

To build a complete set of procedures at a volume discount, use Build Your QMS. For help with a 483 response, see A.P. Lyon consulting services.

Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.