Manufacturing Regulatory Inspections: A Compliance Team's Guide
Manufacturing Regulatory Inspections: A Compliance Team’s Guide
A regulator can turn up at a manufacturing plant for four broad reasons: a routine check, a pending product application, a specific concern, or to follow up earlier problems. FDA calls these surveillance, application-based, for-cause and follow-up inspections, and OSHA and EPA run their own versions. Then there are the checks you control yourself: internal QA inspections, supplier audits, and certification audits such as ISO 9001. None of those carry legal penalties. They do produce the records an investigator asks for first, though.
Below: each type, who owns it, what happens on the day, and how to stay ready without a scramble the week before.
Here's the short version. Surveillance visits are risk-based checks on ongoing compliance. An application-based (pre-approval) visit confirms the plant can actually make what a pending application describes. For-cause visits follow complaints, adverse events, injuries or bad data, and follow-ups confirm that earlier violations got fixed.
On your side of the fence sit incoming, in-process and final QA inspections, plus the customer or third-party audits run against standards like ISO 9001 or IATF 16949.
Only government inspections carry enforcement power
Who's at the door decides who leads the response, which evidence you pull first and how fast you have to move.
A regulatory inspector represents an agency that can issue citations, warning letters or penalties, and in serious cases seek a recall or a court order. Your internal QA inspection is your own people checking work against SOPs and specs. A supplier audit sits in between. Your contract probably requires it, but the auditor can't fine you. What they can do is cost you the customer, or the certificate.
Agencies split visits into planned ones, scheduled by risk, and reactive ones triggered by an incident, a complaint or a referral. You can see a planned visit coming. You can't see a reactive one, so readiness has to be how the plant normally runs, not a project you start when the letter arrives.
Ownership usually splits four ways. QA holds incoming, in-process and final inspections, calibration and batch records. EHS covers OSHA and EPA: safety data sheets, environmental monitoring logs. Regulatory affairs is FDA's point of contact and owns application-linked inspections and CAPA documentation, while procurement or supplier quality looks after supplier audits, certificates of analysis and the approved vendor list.
What FDA, OSHA and EPA each inspect
FDA's inspection basics page sets out the four types. Surveillance inspections watch products already on the market and whether the maker follows good manufacturing practice. For-cause inspections happen when FDA has reason to think a facility has quality problems, or needs to chase a complaint. Application-based inspections are part of reviewing a new drug, device or biologic, and FDA says it runs them for about 20% of application reviews. Follow-ups check corrective action after a violative inspection, violative samples or a warning letter.
Any of these can be comprehensive (the whole operation) or directed at one issue, like a recall. Directed visits have a habit of widening once the investigator is on the floor. Treat every for-cause visit as a possible full inspection.
OSHA follows a published priority order: imminent danger first, then severe injuries and illnesses, worker complaints, referrals, targeted inspections of high-hazard industries, and follow-ups. It normally arrives without notice. You can ask the compliance officer to get a warrant. Most employers don't.
EPA inspections follow whichever environmental statute applies: the Clean Air Act, the Clean Water Act, RCRA for hazardous waste, TSCA for chemicals and so on. EPA's ECHO data dictionary lists the inspection and evaluation types it records under each statute, such as full and partial evaluations. Give it to your EHS lead. The statute tells you which permits, logs and manifests the inspector will want.
Your own QA inspections produce the evidence regulators ask for
Internal inspections aren't a separate world from regulatory compliance. They make the records an investigator asks to see first. Incoming material inspection checks raw materials and components against spec before use, and leaves certificates of analysis, supplier qualification records and the approved vendor list. In-process checks leave control charts, deviation logs and operator sign-offs.
- First-article inspection confirms the first unit of a new run meets spec (first-article reports, dimensional data, PPAP files if you're in automotive).
- Final inspection reviews product before release: batch records, certificates of conformance, release signatures.
- Environmental and cleanroom monitoring tracks particles, temperature, humidity and microbes, and leaves monitoring logs, trend reports and out-of-spec investigations.
- Destructive and non-destructive testing checks structural integrity. Expect questions on method validation, calibration of the test kit and technician certifications.
- Supplier audits review a supplier's quality system and leave audit reports, corrective action requests and scorecards. Supplier compliance tracking is its own discipline, but it feeds the same pool of evidence.
Certification audits are a different animal. Accredited certification bodies run ISO 9001, IATF 16949 and SQF audits, not government, and they check conformance to a standard. A regulator may read your certificate as a sign of a working quality system. It isn't bound by it, and a clean ISO audit won't stop an FDA observation.
What happens on inspection day
OSHA normally gives no notice, and a for-cause visit from any agency may not either. If you do get warning, spend it briefing people and checking the evidence pack is current.
The visit opens with a conference. The inspector shows credentials and explains the scope; your inspection lead sits in, takes notes and asks about anything vague. Then comes the records review. Expect requests for batch records, SOPs, CAPA logs, training records, calibration certificates and complaint files, and have a retrieval routine so nobody is rummaging through shared drives while the investigator waits.
- Records review. Expect requests for batch records, SOPs, CAPA logs, training records, calibration certificates and complaint files. Have a retrieval routine so nobody is digging through shared drives.
On the walkthrough, inspectors may take samples, photograph equipment, take readings and watch the line run. They may also talk to operators, QA staff and supervisors one at a time. Brief your people to answer what's asked, honestly, and to send anything outside their knowledge to the lead.
At the closing conference the inspector summarises the findings. At FDA, observations go on Form 483 and are handed to management. Write down everything said. Ask about anything unclear, and don't promise what you can't deliver.
Length depends on scope. A directed OSHA visit about one hazard can be over in a day, while a comprehensive FDA inspection of a complex plant runs for days. A for-cause visit ends when the investigator is satisfied.
After the inspection: what a Form 483 or a citation means for your calendar
Findings run from nothing at all to action that shuts a line. Know the sequence and you can respond in proportion.
At FDA, a Form 483 lists conditions the investigator thinks may be violations. It isn't a final agency decision. FDA later weighs it with the inspection report and your response. The inspection is then classified as no action indicated, voluntary action indicated or official action indicated, and serious unresolved problems can lead to a warning letter.
Timing matters. In a 2009 Federal Register notice, FDA said it will generally allow 15 business days for a response to 483 observations before deciding on a warning letter, and won't usually hold the letter for a late reply. Count those days from the closeout and put them in a calendar the same afternoon.
OSHA works differently. Citations come with proposed penalties and abatement dates, and employers have 15 working days after receiving them to contest in writing. Anything not contested or settled becomes a final order.
A strong 483 response takes each observation in turn: the root cause, the correction, the evidence, and a completion date you can actually hit. "We will review our procedures" invites a warning letter. Specific, dated commitments with documents attached close observations faster.
If a critical finding comes up, contain the affected product first with a quarantine or production hold. Preserve every record linked to the finding, and don't alter, delete or tidy documents once an inspection has started. Tell senior leadership and legal counsel the same day about any citation or serious observation.
Then the slower work. Finish the root cause analysis early, ideally inside the first week, so the response has substance. Build a CAPA with owners, milestones and a verification step for each item, and track every date against what you promised. Missed commitments are the first thing a follow-up inspector checks.
Get your team and evidence ready before anyone calls
- All SOPs current, approved and in one place
- Calibration certificates for critical instruments in date
- Last three CAPA cycles reviewed for open items
- Training records checked for everyone likely to be interviewed
- Environmental monitoring logs complete and trend reports current
- Document retrieval tested with a timed mock request
Who does what on the day:
| Role | What they do |
|---|---|
| Inspection lead (regulatory affairs or QA director) | Greets the inspector, manages scope, attends every meeting |
| Records coordinator (QA manager) | Retrieves documents and logs each request and the time it was answered |
| Subject matter experts (QA, EHS, production) | Walk the inspector through their area and answer technical questions |
| Legal or compliance counsel | On call; reviews written commitments before they go out |
| Executive sponsor | Briefed daily; approves production holds and containment |
Run a mock inspection at least once a year, unannounced to most of the site. Ask for the five documents investigators request most often and time how long each takes to produce. Rotate who plays the inspector; the same person tends to check the same things.
Most inspection findings are missed dates, not missing procedures
The gaps that turn up in inspections usually aren't missing SOPs. They're a calibration that lapsed between reviews, retraining that slipped in a busy quarter, a CAPA closed on paper and never verified. Those are missed dates. Dates are easy to automate.
The ones worth putting on reminders with a named owner: calibration certificates that expire between scheduled reviews, training and certifications that lapse before the next audit, supplier qualifications that get forgotten when a buyer changes roles, CAPA verification deadlines and your own internal audit calendar.
For calibration, a setup that works: the equipment owner gets reminders 90, 30 and 7 days before each certificate expires. When the lab issues the new one, it's uploaded against that instrument with a date stamp. Nothing by day 7? The QA director gets an escalation. The same pattern fits operator certifications, environmental monitoring schedules and CAPA milestones.
ExpiryEdge is built for that pattern. It tracks each certificate and deadline, reminds the owner by email, SMS, WhatsApp, Slack or Teams, escalates overdue items to a manager, collects the renewed document, and keeps an exportable audit trail you can show an investigator. That trail helps with a 483 response too, when you need to show exactly when something was fixed.
Stop the line when a critical finding comes up
Plants that handle inspections well treat readiness as ordinary operations. The ones that struggle spend the week before an announced visit pulling records together for the first time.
The hardest call on the day is production. If an inspector spots a possible critical defect mid-run, the instinct is to keep going while you investigate. Stop, contain and document instead. Lost output can be made up. A warning letter citing continued production after a known defect can't be taken back.
Be calm and factual with inspectors. They have a job, a checklist and legal authority, and they're not out to catch you. Answer directly, produce records fast, and admit a gap when there's a credible fix to go with it. That lands far better than defensiveness or a long story.
A good next step: list every calibration, certification and CAPA date due in the next 90 days, put a named owner against each, and set the first reminder at least 30 days out. If you'd like to run that in ExpiryEdge, the 14-day trial needs no credit card.
Sources
- Types of FDA Inspections | FDA
- FDA: Form 483 frequently asked questions
- Federal Register, 11 August 2009: FDA review of post-inspection responses
- OSHA fact sheet: OSHA inspections
- ICIS FE&C inspection types data dictionary | EPA / ECHO
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
What are the four types of FDA inspections?
FDA lists surveillance inspections (routine checks on products already on the market), for-cause inspections (when it has reason to suspect quality problems), application-based inspections (part of reviewing a new drug, device or biologic) and follow-up inspections (checking corrections after a violative inspection or warning letter). Any of them can cover the whole facility or focus on one issue.
What are the main types of inspections in manufacturing?
There are two families. Government inspections come from agencies such as FDA, OSHA and EPA and can lead to citations, warning letters or penalties. Then there are the checks you run or commission yourself: incoming, in-process and final QA inspections, supplier audits, and certification audits against standards like ISO 9001 or IATF 16949.
What are the three main types of inspections?
Planned, reactive and follow-up. Planned visits are scheduled by risk, so a high-hazard plant sees them more often. A reactive visit follows something specific, like a worker complaint, an injury or a bad sample result. Follow-ups come back to check that last time's problems were fixed. OSHA publishes its priority order, and you'll find all three on it.
What are the seven types of inspection in quality control?
A common list is incoming material, first-article, in-process, final, environmental or cleanroom monitoring, destructive testing and non-destructive testing. The exact names vary between companies. What matters for a regulatory visit is that each one leaves a dated, signed record, because those records are what an investigator asks to see first.
Recommended
Frequently asked questions
There are two families. Government inspections come from agencies such as FDA, OSHA and EPA and can lead to citations, warning letters or penalties. Then there are the checks you run or commission yourself: incoming, in-process and final QA inspections, supplier audits, and certification audits against standards like ISO 9001 or IATF 16949.
Planned, reactive and follow-up. Planned visits are scheduled by risk, so a high-hazard plant sees them more often. A reactive visit follows something specific, like a worker complaint, an injury or a bad sample result. Follow-ups come back to check that last time's problems were fixed. OSHA publishes its priority order, and you'll find all three on it.
A common list is incoming material, first-article, in-process, final, environmental or cleanroom monitoring, destructive testing and non-destructive testing. The exact names vary between companies. What matters for a regulatory visit is that each one leaves a dated, signed record, because those records are what an investigator asks to see first.
Not safety or OSHA compliance advice
This article is for general informational purposes and does not constitute formal OSHA or workplace-safety compliance advice. Safety regulations and standards (OSHA, state plans, EU OSHA, AS/NZS, etc.) vary by jurisdiction and change. Consult a qualified safety professional or your regulator for the specifics of your operation.
