PMS Inspection Preparation & Gap Analysis — RA/QA Checklist Guide (2026)

PMS Inspection Preparation: What Regulators Actually Look For

Whether it is an FDA QSIT inspection, EU Notified Body audit, MDSAP audit, or Health Canada inspection, the questions regulators ask about your post-market surveillance system follow predictable patterns. RA and QA professionals who understand these patterns can prepare systematically — and identify gaps before inspectors do.

This guide provides the complete inspection preparation checklist, the gap analysis methodology, and the most common findings so you can assess your own readiness today.

What Inspectors Look For: The Universal PMS Questions

Regardless of jurisdiction, PMS inspections follow a consistent logic. Inspectors want evidence that you:

Collect — Have systematic processes to gather PMS data from all required sources (internal and external)
Analyze — Evaluate data using defined methods, including trend analysis and statistical methods
Act — Take appropriate actions based on analysis (report, investigate, correct, prevent)
Document — Record everything — especially your rationale when you decided NOT to act
Close the loop — Feed PMS findings back into risk management, clinical evaluation, and design

Jurisdiction-Specific Focus Areas

Inspection Type	Primary PMS Focus	Key Documents Requested
FDA QSIT	CAPA subsystem → complaint handling → MDR decision-making → trending	Complaint files, MDR decision logs, CAPA records, trend reports, management review minutes
EU NB Audit (MDR)	PMS Plan → PSUR → PMCF → vigilance → CER linkage	PMS plan, PSUR/PMS report, PMCF plan/report, CER, risk management file, vigilance records
MDSAP (Ch. 5)	Complaint handling → adverse event reporting → CAPA → PMS data analysis	Complaint register, reporting logs, CAPA records, trend analysis, management review
Health Canada	Mandatory problem reporting → complaint investigation → recall readiness	Complaint files, HC Form 4005 logs, distribution records, recall procedures

The Complete PMS Inspection Preparation Checklist

Use this checklist to prepare for any PMS-related regulatory inspection or audit:

A. Procedures and Plans

☐ PMS Plan (device-specific, per EU MDR Article 84) or equivalent PMS procedure
☐ Complaint handling procedure with MDR/reportability decision tree
☐ Adverse event reporting procedure — timelines per each jurisdiction
☐ CAPA procedure with clear triggers, investigation methodology, effectiveness verification
☐ Recall/field safety corrective action procedure
☐ Trend analysis procedure with statistical methods defined
☐ External PMS monitoring procedure — databases, literature, frequency
☐ PMCF plan (EU MDR) with defined clinical questions and methods
☐ Risk management procedure (ISO 14971) with PMS input defined
☐ Management review procedure including PMS data as required input

B. Records and Evidence

☐ Complaint register — complete, current, searchable
☐ Complaint investigation files — with documented root cause and rationale
☐ MDR/adverse event decision logs — showing evaluation of EVERY complaint for reportability
☐ Filed adverse event reports — copies of all submitted reports with acknowledgments
☐ Trend analysis reports — monthly or quarterly with identified trends and actions
☐ CAPA records — open and closed, with effectiveness verification evidence
☐ External PMS monitoring records — database search logs, literature review results
☐ PSUR or PMS Report — current and meeting submission schedule
☐ PMCF report — current with data analysis and conclusions
☐ Management review minutes — showing PMS data presentation and decisions
☐ Risk management file — with post-market risk data integrated
☐ Clinical evaluation report — updated with PMS and PMCF findings
☐ Training records — for all PMS-related personnel

C. System Capability

☐ Can retrieve all complaints for a specific device model within minutes
☐ Can demonstrate complaint trending by code, severity, and time period
☐ Can show the decision trail from complaint → reportability assessment → report (or documented non-report)
☐ Can show CAPA linkage from PMS finding → investigation → corrective action → effectiveness
☐ Can show PMS data flowing into risk management file updates
☐ Can show external monitoring results and evaluation of similar-device events
☐ Can produce distribution records for recall execution

PMS Gap Analysis Methodology

A systematic gap analysis evaluates your PMS system against regulatory requirements in every jurisdiction where you market your device. Here is the methodology:

Step 1: Map Your Jurisdictions

List every country/region where your device is marketed and the applicable PMS regulations for each.

Step 2: Create a Requirements Matrix

Build a matrix with regulatory requirements on one axis and your current system capabilities on the other:

PMS Element	FDA	EU MDR	HC	Japan	Your System	Gap?
Complaint handling	21 CFR 820.198	Art. 84	CMDR	GVP	SOP-QA-012	Review
Adverse event reporting	21 CFR 803	Art. 87	S.59-62	PMD Act	SOP-RA-005	—
Trend analysis	QMSR	Art. 88	CMDR	GVP	No SOP	GAP
PSUR	N/A	Art. 86	N/A	N/A	No process	GAP
PMCF	Section 522	Annex XIV B	N/A	Re-exam	Plan only	GAP
External monitoring	Expected	Art. 84	Expected	GVP	Manual quarterly	Review
Risk mgmt integration	QMSR	Art. 83	MDSAP	GVP	Annual update	Review

Step 3: Classify Gaps

Critical Gap: No process exists where regulation requires one (e.g., no adverse event reporting procedure for a market where you sell devices). These need immediate remediation.
Major Gap: Process exists but does not meet specific regulatory requirements (e.g., complaint handling procedure does not include EU MDR 2-day reporting timeline). These need remediation within 90 days.
Minor Gap: Process meets requirements but lacks documentation or evidence (e.g., trending is done but not documented per procedure). These need remediation within 180 days.
Observation: Process is adequate but could be improved for efficiency or robustness.

Step 4: Prioritize by Risk

Prioritize gap remediation based on: (1) patient safety impact, (2) regulatory risk (upcoming inspections, history of findings), (3) effort to remediate, (4) number of jurisdictions affected.

Step 5: Build a Remediation Plan

For each gap, define: specific action, responsible person, target date, verification method.

PMS Maturity Model: Where Is Your Organization?

Level	Name	Characteristics	Typical Outcome
1	Reactive	PMS = complaint handling only. No external monitoring. No trending. No PMCF. Respond to events after they happen.	Frequent 483s, NB findings. Risk of recall without early warning.
2	Compliant	Procedures exist for all required PMS elements. Adverse events reported. Basic trending. External monitoring is periodic and manual.	Passes audits but findings on effectiveness evidence. Limited proactive detection.
3	Proactive	Systematic external monitoring using automated tools. Statistical trending. PMS data feeds into risk management and CER. PMCF active.	Clean audits. Early detection of potential issues. Efficient regulatory operations.
4	Predictive	Real-time monitoring. Advanced analytics on PMS data. Predictive models for device failure. Integrated across all jurisdictions. PMS drives product improvement.	Industry-leading safety profile. Competitive advantage through regulatory excellence.

Most companies are at Level 1-2. Regulatory expectations (especially EU MDR) demand at least Level 3. Organizations using regulatory intelligence platforms like TrueMedDevice for automated external monitoring are at Level 3 and building toward Level 4.

Top 10 PMS-Related Audit Findings Globally

Inadequate complaint investigation — complaints closed without root cause analysis or with superficial investigation
Missing reportability determination — complaint evaluated but no documented decision on whether event is reportable
No trend analysis methodology — trend "analysis" consists of counting complaints without statistical methods or thresholds
PMS not connected to risk management — PMS data collected but not used to update ISO 14971 risk files
Inadequate CAPA effectiveness verification — CAPA closed without evidence that the corrective action actually prevented recurrence
No external PMS monitoring — relying only on internal complaints without monitoring regulatory databases or literature
PSUR/PMS report not current — overdue or containing outdated data
PMCF plan inadequate — generic plan without device-specific clinical questions or defined endpoints
Management review lacks PMS input — management review minutes do not show PMS data presentation or resulting decisions
Training gaps — PMS personnel lack documented training on reporting timelines, decision criteria, or procedure changes

Conducting a Pre-Inspection Mock Audit

Before any scheduled audit or inspection, conduct an internal mock audit focused on PMS:

Pull 10-15 random complaint files — verify investigation completeness, reportability determination, and timeline compliance
Review all filed adverse event reports — verify they match complaint records and were filed within required timelines
Request the current PSUR/PMS report — is it up-to-date? Does it reflect actual PMS data?
Ask for trend analysis output — can the team produce trending data on demand?
Trace one CAPA from origin to effectiveness verification — follow the complete thread
Ask for evidence of external PMS monitoring — show the search logs, evaluation records
Check management review minutes — find where PMS data was discussed and what decisions resulted
Verify risk management file dates — has it been updated with PMS data in the last year?

Frequently Asked Questions

What is the most common FDA 483 observation related to post-market surveillance?

The most common PMS-related FDA 483 observation involves failure to adequately investigate complaints and determine reportability. Specifically, 21 CFR 803 requires manufacturers to evaluate every complaint for MDR reportability and document their determination. Inspectors frequently find complaints that were closed without any documented evaluation of whether the event was reportable. The second most common finding involves inadequate CAPA procedures — specifically, failure to verify that corrective actions were effective in preventing recurrence.

How do I perform a PMS gap analysis for my medical device company?

A PMS gap analysis follows five steps: (1) Map all jurisdictions where your devices are marketed, (2) Create a requirements matrix listing PMS obligations for each jurisdiction against your current capabilities, (3) Classify gaps as critical, major, or minor based on regulatory risk and patient safety impact, (4) Prioritize remediation based on upcoming inspections, number of affected jurisdictions, and effort required, (5) Build a remediation plan with specific actions, owners, and target dates. Use the PMS maturity model (reactive → compliant → proactive → predictive) to set organizational targets.

What documents should I have ready for a PMS-focused regulatory inspection?

Essential documents include: complaint register and investigation files, adverse event reporting logs with copies of submitted reports, MDR/reportability decision tree and decision logs, CAPA records with effectiveness verification evidence, trend analysis reports, PMS plan (EU MDR), PSUR or PMS report (EU MDR), PMCF plan and report (EU MDR), external monitoring records (database search logs, literature review results), management review minutes showing PMS input, risk management file with post-market data integrated, clinical evaluation report updated with PMS findings, and training records for PMS personnel.

How often should I update my risk management file with PMS data?

At minimum, the risk management file should be updated annually with PMS data as part of the production and post-production review (ISO 14971:2019 Section 10). However, significant PMS findings — such as a new failure mode identified through complaint trending, a new hazard identified through literature review, or a change in risk probability based on field data — should trigger an immediate risk management file update. EU MDR explicitly requires that PMS data feed into risk management (Article 83(3)(b)), and NB auditors check the currency of risk files as part of PMS assessment.

What is a PMS maturity model and where should my company be?

A PMS maturity model describes four levels of PMS system sophistication: Level 1 (Reactive) relies only on complaint handling with no proactive monitoring; Level 2 (Compliant) has all required procedures but operates them as checkbox exercises; Level 3 (Proactive) uses automated monitoring tools, statistical trending, and systematic feedback into risk management and clinical evaluation; Level 4 (Predictive) uses advanced analytics and real-time monitoring to detect and prevent safety issues before they become incidents. EU MDR expectations require at least Level 3. Most companies should target Level 3 using regulatory intelligence platforms for automated external monitoring.

PMS Inspection Preparation and Gap Analysis: What Regulators Actually Look For (2026)