Mock FDA inspections: four formats for quality teams facing the 2026 QMSR

A mock FDA inspection is a structured simulation that tests your records, procedures, interviews and facility the way an FDA investigator would, without any regulatory authority. It is not an FDA inspection and cannot issue a real Form 483 or make a compliance determination. The point is to surface weak evidence and unprepared staff before a real investigator does.

In short:

• Match the rehearsal to the product stage: GCP or BIMO for trials, GVP for marketed products, GMP or a pre-approval scenario for manufacturing, QMSR for devices.
• Use an independent lead, timed document requests and a tracked evidence room; then assign CAPA owners, deadlines and an effectiveness check.
• Check batch records, audit trails, investigations, change approvals, training files, maintenance logs and labeling; treat gaps clustered around one process or shift as systemic.
• Rehearse a CAPA plan on the 15-business-day timeline a real Form 483 response follows, and verify fixes with evidence rather than closure memos.
• Device mocks must follow the QMSR risk-based inspection model in effect since February 2, 2026; ISO 13485 certification does not exempt a manufacturer from FDA inspection.

What a mock inspection is, and what it cannot do

A well-run mock mirrors a real inspection: document requests, procedure walkthroughs, facility observation where relevant, and interviews with the people who actually run the process. The test is whether your team can produce objective evidence on demand, the same standard an investigator applies.

What a mock cannot do matters just as much. It cannot issue a genuine Form 483 or make an FDA compliance determination, and that should shape how you write up results. A real Form 483 lists inspectional observations and is not the agency's final conclusion. Mock findings should borrow its factual, evidence-linked tone but never be labeled as 483 observations. A mock report calls out a gap in evidence or control; it does not speculate about whether an item "would be a 483." That keeps staff focused on what the records show, not on hypotheticals.

The four formats, and how to pick one

The right format depends on where your product sits in its life cycle and which inspection model an investigator would use. A generic walkthrough when your real exposure is a pre-approval inspection wastes the rehearsal.

Choose scope the way FDA does: by product type, the likely inspection assignment, and the risk factors in your own history. Your facility's past inspections and Form 483s, on its page in the FDA facility lookup, are the most direct guide to where an investigator will start.

A ten-step mock inspection sequence

A mock works best when it is time-boxed and run with the same discipline as the real thing.

1. Define the objective and scope. Name the product, process or system and the risk factors driving the choice.
2. Appoint an independent lead who does not own the process being tested. Assign front-room staff to face the "inspector" and back-room staff to pull documents.
3. Set up a controlled evidence room with a request log, so every document pulled is tracked, timed and traceable to who provided it.
4. Hold an opening meeting that states scope and ground rules the way a real one would.
5. Run timed document requests and interviews under realistic pressure.
6. Observe the facility and process where the scope calls for it, watching for gaps between written procedure and actual practice.
7. Hold a factual closing meeting that summarizes findings without speculation or blame.
8. Issue an internal report separating confirmed gaps from items needing further review.
9. Open CAPA records with named owners and deadlines.
10. Schedule an effectiveness check to confirm the fix held.

Pro tip: run the evidence room exactly as you would in a real inspection, including the request log, so staff build habits instead of answering from memory.

What investigators cite most, and the evidence that triggers it

The same categories recur across real inspections, and most mocks surface the same patterns. Atlas data makes the frequencies concrete. Across 90 human-drug Form 483s issued in late 2025:

The typical 2025 Form 483 carried a median of three observations, and 59% carried three or fewer. A mock that produces a long list of minor findings is less useful than one that finds the two or three gaps an investigator would actually write up.

When several gaps cluster around the same process or shift, treat them as one systemic risk, not separate items. That is how investigators read them, and how the Fresenius warning letters of 2026 were built: the same investigation requirement cited at the same facility across several inspections.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

Turning mock findings into CAPA

Findings matter only if they become fixes that hold up.

1. Prioritize by risk, weighting patient or user impact first, then likelihood of recurrence.
2. Group related findings so one root cause gets one systemic fix rather than several disconnected patches.
3. Build each CAPA record with a documented root cause, corrective steps, named owners, a realistic timeline and a measurable verification metric.
4. Rehearse real response timing. FDA considers a Form 483 response received within 15 business days before deciding whether to escalate, so practice producing a credible plan in that window.
5. Schedule the effectiveness check and keep the verification evidence, not only the closure memo.

Pro tip: write the CAPA the way you would want an investigator to read it later. A vague root cause is itself a common finding. Our guide on how to address and prevent Form 483 observations covers language that holds up.

What changed for device mocks in 2026

Device teams running mocks in 2026 need to account for a real shift in how FDA inspects. Since February 2, 2026, the Quality Management System Regulation has replaced the old Quality System Regulation and incorporated ISO 13485, and inspections follow the risk-based model under Compliance Program 7382.850 rather than QSIT. A mock built on legacy QSIT checklists will miss how investigators now scope and sequence their review.

The change is visible in the record. In a sample of 96 device Form 483s issued between May and July 2026, 91 cited ISO 13485 clauses and only 4 cited old Part 820 sections. The clauses cited most:

A device mock in 2026 should be scoped around those clauses. FDA has also been direct that ISO 13485 certification does not exempt a manufacturer from inspection: a mock should test actual QMSR obligations, not assume a certificate covers them. The Olympus warning letter of October 2026, which followed corrective action citations at six facilities inspected in late 2025, shows what happens when those findings are not resolved.

Scope the mock around the investigator you are likely to get

The most useful mocks are not the broadest ones. They are scoped around what a specific investigator or your own site history suggests will come up. Investigators repeat their focus areas: the profile of anyone who has inspected your facility, in the FDA investigator lookup, shows their inspection history and the sections they cite most. Pairing an independent mock lead with that history produces a sharper exercise than a generic checklist, because the team rehearses the questions most likely to be asked. Our piece on FDA investigators and their inspection history explains how to read a profile.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe