Management Review Under QMSR: Why “Top Management” Now Means the CEO

Management review has existed as a quality system requirement for decades, but it’s often functioned as a compliance formality — a scheduled meeting, a slide deck of metrics, a documented sign-off. QMSR, through its incorporation of ISO 13485, raises the bar on who’s actually expected to be engaged in that process and what genuine engagement looks like. For manufacturers where “leadership” has meant a quality director briefing executives after the fact, this is a meaningful and underappreciated shift.

What “Top Management” Now Implies

QMSR’s incorporation of ISO 13485’s management responsibility clauses — particularly Clause 5.1 (management commitment) and Clause 5.5 (responsibility, authority, and communication) — means the role of “top management” now implies genuine CEO or board-level endorsement of the quality system, not delegated authority handed down to a quality function and rubber-stamped above. Firms are expected to ensure executives are demonstrably engaged in QMS reviews and resource allocation decisions — engagement that needs to be visible and documented, not simply assumed to be happening because a quality department exists and reports upward periodically.

This matters because FDA’s expanded inspection authority under QMSR — which now extends to management review records previously treated with more limited scrutiny — means the gap between nominal executive oversight and actual executive engagement is no longer invisible to inspectors. A management review record showing passive acknowledgment of quality metrics, without evidence of genuine executive decision-making in response, is a different inspection finding than one showing documented resource allocation changes driven by review outputs.

What Belongs in a Substantive Management Review

Under ISO 13485’s Clause 5.6 framework, incorporated through QMSR, management review is meant to be a genuine analytical exercise, not a status update. Meaningful inputs include:

Complaint patterns and trends. Not just complaint counts, but pattern analysis — are complaints clustering around a specific product line, failure mode, or time period in a way that signals a systemic rather than isolated issue.

CAPA recurrence data. Given QMSR’s mandatory separation of corrective and preventive action workflows, management review should specifically examine whether corrective actions are actually preventing recurrence, or whether the same underlying issues keep generating new CAPAs — a pattern that indicates root cause analysis isn’t reaching deep enough.

Supplier performance trends. Connecting to QMSR’s expanded supplier and outsourcing control expectations, management review should incorporate supplier risk and performance data, with documented actions taken when trends warrant intervention — not simply noting that supplier audits occurred.

Training effectiveness data. Not training completion rates alone, but evidence that training is actually producing the intended competency — a distinction QMSR’s broader risk-based thinking expectations make more consequential than it was under the prior framework.

Audit findings, both internal and external. Internal audit results, along with any FDA inspection or third-party audit findings, should feed directly into management review with documented follow-up actions — creating the traceability between audit findings and executive-level response that FDA inspectors are increasingly testing for.

From Metrics to Decisions: The Real Distinction

The practical difference between a compliance-formality management review and a substantive one isn’t the list of inputs reviewed — most quality systems already track complaint data, CAPA metrics, and supplier performance in some form. The difference is what happens after the data is presented.

A management review that concludes with metrics reported and no documented resource allocation, process change, or strategic decision in response is functioning as a reporting exercise, not a governance mechanism. QMSR’s expectations point toward the latter: trend data becomes valuable specifically when it drives management decisions and documented action — a resourcing decision to add quality headcount, a strategic decision to consolidate suppliers in a high-risk category, a decision to accelerate a corrective action given recurrence trends.

FDA inspectors reviewing management review records under QMSR's expanded access are, in effect, looking for evidence of this causal chain: data was presented, it was substantively analyzed, and it changed something. Records that show data presentation without a visible decision-making thread are a distinguishable — and increasingly scrutinized — pattern.

Building a Management Review Process That Holds Up

Document decisions, not just discussion. Meeting minutes should capture specific decisions made in response to review inputs — resource allocations, process changes, escalations — not just a summary of what was presented.

Establish a cadence that matches risk, not just a calendar default. While periodic management review is a baseline expectation, higher-risk trend signals — a spike in complaints, a cluster of related CAPAs — should trigger review outside the standard cadence rather than waiting for the next scheduled meeting.

Make executive attendance and participation genuinely verifiable. Sign-in records, documented questions or direction given by executives during review, and follow-up actions attributable to specific leadership decisions all help demonstrate the kind of engagement QMSR's “top management” language expects — rather than leaving engagement as an assumption inspectors have to take on faith.

Connect management review explicitly to quality objectives and resource planning. ISO 13485's framework ties management review to broader quality policy and objectives; review records that reference how findings inform quality objectives and resourcing for the coming period demonstrate the kind of forward-looking governance QMSR is designed to surface.

The shift QMSR introduces here isn't really about adding new documentation burden — most manufacturers already track the relevant metrics. It's about closing the gap between data being reviewed and data driving decisions, and about making executive engagement in that process demonstrable rather than assumed. Manufacturers that treat management review as genuine governance, rather than a compliance checkpoint, are the ones best positioned when FDA inspectors start asking not just “was this reviewed” but “what changed because it was.”

This article reflects FDA's QMSR, effective February 2, 2026, and its incorporation of ISO 13485:2016 management responsibility clauses. It is intended for general regulatory and educational purposes and does not constitute regulatory or legal advice for a specific quality system.