FDA 483 Citation 21 CFR 820.22: Quality Audit Procedures

23 hours ago

5 min read

"Procedures for quality audits have not been [adequately] established." FDA investigators cited 21 CFR 820.22 with that wording 57 times on system-generated Form FDA 483s in fiscal year 2025, and a second version, "Quality [audits] [reaudits] have not been performed," added another 25.

Internal audits are how a manufacturer finds its own problems before FDA does. When the audit program is missing or weak, FDA concludes that management has no reliable view of whether the quality system works. Since February 2, 2026, there is a second reason to take audits seriously: the Quality Management System Regulation lets FDA investigators review internal audit reports, which they generally did not do before.

What the citations mean

Typical examples written after "Specifically" include:

No internal audit procedure, or one that does not define frequency, scope or auditor independence
No audits performed during the past year, or only part of the quality system audited
Auditors auditing their own work
Audit findings with no corrective action or no follow-up audit
Audit reports not reviewed by management with responsibility for the area
Audit dates and results not documented

What 21 CFR 820.22 required

Under the Quality System Regulation, each manufacturer had to establish procedures for quality audits and conduct them to assure that the quality system complies with the established requirements and to determine its effectiveness. Audits had to be conducted by individuals who do not have direct responsibility for the matters being audited. Corrective action, including a reaudit of deficient matters, had to be taken when necessary. A report of the results of each audit and any reaudit had to be made, and the report had to be reviewed by management having responsibility for the matters audited. The dates and results of audits and reaudits had to be documented.

Under the old regulation, section 820.180(c) said FDA would not request to inspect the results of quality audits, although manufacturers had to certify in writing that audits were performed when asked.

What changed under QMSR

With QMSR in effect since February 2, 2026, internal audit requirements come from ISO 13485:2016 clause 8.2.4, Internal audit. The organization must conduct internal audits at planned intervals to determine whether the quality management system conforms to planned arrangements, the requirements of ISO 13485, the organization's own requirements and applicable regulatory requirements, and whether it is effectively implemented and maintained. The documented procedure must describe responsibilities and requirements for planning and conducting audits, and for recording and reporting results.

ISO 13485 adds several specifics:

An audit program must be planned, taking into consideration the status and importance of the processes and areas to be audited and the results of previous audits
Audit criteria, scope, interval and methods must be defined and recorded
Auditors must be selected to ensure objectivity and impartiality, and must not audit their own work
Management responsible for the area audited must ensure that necessary corrections and corrective actions are taken without undue delay
Follow-up activities must include verification of the actions taken and reporting of the verification results

The bigger change is access. FDA's final rule removed the old exception in 820.180(c), so internal audit reports, supplier audit reports and management review records are now available to investigators. An audit program that exists only on paper, or audit reports that list serious findings with no follow-up, can now become evidence in the inspection itself.

How to respond to the 483

FDA generally considers responses received within 15 business days of the close of the inspection before deciding on further action.

Plan and start audits immediately

If audits were not performed, schedule a full audit of the quality system and start it before you respond if possible. Use auditors who are independent of the areas audited. If you lack independent internal staff, a qualified outside auditor is a common solution.

Fix the audit program

A revised procedure covering the audit program, auditor qualification and independence, planning, conduct, reporting, management review of results and follow-up
An annual audit schedule covering every quality system process and regulatory requirement, with frequency based on risk and past results
Auditor training and qualification records
A requirement that findings enter the CAPA system when appropriate, with verification of effectiveness
Management review of audit results as a standing input

Close the loop on past findings

Review previous audit reports. Confirm each finding has an action, an owner and verification. Reopen any that were closed without evidence.

Prepare for audit reports to be read

Because investigators can now see audit reports, write findings clearly, link them to actions and keep the follow-up records with the report.

What a compliant internal audit procedure must contain

Scope covering the full quality management system and applicable regulations
The audit program and how frequency is set
Auditor qualification, independence and objectivity
Audit planning: criteria, scope and methods
Conduct of the audit and evidence collection
Reporting, including review by responsible management
Corrections, corrective actions and follow-up verification
Links to CAPA and management review
Records

Common mistakes in audit responses

Scheduling audits for the response but never resourcing them
Using a single checklist that ignores the firm's own risks and past findings
Letting the quality manager audit the quality system processes they own
Writing vague findings that cannot be verified as closed
Forgetting that audit reports are now visible to FDA

Example: how one response section might read

This illustrates structure only; your response must describe your own facts.

Observation 7: Quality audits have not been performed. Specifically, no internal audits were conducted in 2025.

Response:

Correction: An external qualified auditor began a full quality system audit on a stated date, covering all processes over four weeks. The audit plan is attached.
Root cause: The internal audit procedure set no frequency, and the only trained auditor left the company in 2024.
Corrective action: The procedure was revised to require an annual program covering every process, with frequency increased for high-risk processes and those with prior findings. Two employees from different departments completed auditor training, so no one audits their own area.
Follow-up: Findings will enter the CAPA system, and each will be verified before closure.
Management review: Audit results are now a required input to each management review meeting.
Verification: The 2026 audit program and its completion status will be included in FDA updates.

Frequently asked questions

Can FDA now read our internal audit reports?

Yes. Under QMSR, FDA removed the exception in the old 21 CFR 820.180(c), so internal audit reports, supplier audit reports and management review records are available to investigators.

Can a small company audit itself?

Yes, if auditors do not audit their own work. Small firms often cross-train staff from different areas or use an outside auditor for the processes the quality manager owns.

How often must we audit?

ISO 13485 requires audits at planned intervals. Most firms audit every process at least annually and more often for high-risk processes or those with recent problems.

How A.P. Lyon documents help

A.P. Lyon's Internal Audit Procedure for ISO 13485 and FDA QMSR covers the audit program, auditor independence, planning, reporting and follow-up, with audit schedule, checklist and report forms. Findings feed the Corrective and Preventive Action Procedure. A dual-standard Internal Audit Procedure covers ISO 9001 and ISO 13485 together.

Documents are editable Word and Excel files and must be adapted to your organization. Audits must still be performed by qualified, independent auditors.

Next steps

Schedule and begin independent audits of the full quality system
Revise the audit procedure and annual program
Close out past findings with evidence
Respond within 15 business days with the audit schedule and dates

To build a complete set of procedures at a volume discount, use Build Your QMS. For help with a 483 response or an independent audit, see A.P. Lyon consulting services.

Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.