medical device complaint handling

Complaints handling mistakes – Why?

Complaints handling mistakes, medical device reporting, and CAPA are the most common reasons for FDA 483 inspection observations, but why?complaints Complaints handling mistakes   Why?

Reasons for FDA 483s related to the CAPA process

You should already be well aware that deficiencies in the CAPA process, complaints handling, and medical device reporting are the three most common reasons why the FDA issues 483 inspection observations and Warning Letters in 2023. The most common reason for an FDA 483 inspection observation is related to the CAPA process (i.e., 336 observations citing 21 CFR 820.100). For the CAPA process, all 336 observations cited problems with inadequate procedures or inadequate records.

Reasons for complaints handling mistakes

The complaints handling process is the second most common reason for FDA 483 inspection observations (i.e., 276 observations citing 21 CFR 820.198). The complaints handling process has nine different reasons for 483 inspection observations (listed from most common to least common):

  1. Procedures for receiving, reviewing, and evaluating complaints by a formally designated unit have not been [adequately] established.  Specifically,*** 
  2. Complaints involving the possible failure of [a device] [labeling] [packaging] to meet any of its specifications were not [reviewed] [evaluated] [investigated] where necessary. Specifically, *** 
  3. Records of complaint investigations do not include required information.  Specifically, *** 
  4. Complaint files are not [adequately] maintained.  Specifically, *** 
  5. Not all complaints have been [adequately] reviewed and evaluated to determine whether an investigation is necessary. Specifically, ***
  6. Records for complaints where no investigation was made do not include required information.  Specifically, *** 
  7. Complaints representing events that are MDR reportable were not [promptly reviewed, evaluated, and investigated by a designated individual] [maintained in a separate portion of the complaint files] [clearly identified]. Specifically, ***
  8. Investigation records of MDR reportable complaints do not include required information.  Specifically, *** 
  9. Records of complaint investigations do not include required information, including any unique device identifier (UDI) or universal product code (UPC).  Specifically, ***

Reasons for FDA 483s related to Medical Device Reporting

There were 106 observations related to medical device reporting (i.e., 21 CFR 803) in 2023 thus far. There are 25 different reasons identified by the FDA for 483 inspection observations related to the Medical Device Reporting regulation. The majority o of the inspection observations were related to an inadequate or missing MDR procedure. However, there were also a number of inspection observations that were related to missing information in the MDR records. Therefore, we updated our Medical Device Reporting Procedure to include all of the required elements of the FDA’s MedWatch Form. We posted a blog about “Where to Focus your Medical Device Complaint Handling Training.” In that blog we answered questions from device manufacturers and consultants regarding the process of complaints handling investigation. The following section is a summary of my responses to those questions.

Complaints handling investigations

What criteria do you think should be used to determine whether a complaint should be investigated or not?

There is only one acceptable rationale for not investigating a complaint. If you don’t investigate complaints when required, then you might receive an FDA Form 483 observation worded like this…

21 CFR 820.198(c) – Complaints involving the possible failure of labeling to meet any of its specifications were not investigated where necessary. Specifically, a missing IFU was reported in customer complaints, but no investigation was conducted. The rationale documented in the complaint record was “the missing IFU presented no patient risk.”

A missing IFU is a “failure of labeling to meet any of its specifications.” Therefore, 21 CFR 820.198(c) requires you to conduct an investigation “unless such investigation has already been performed for a similar complaint, and another investigation is not necessary.” This is the only rationale that is acceptable for skipping your investigation. To ensure that no one forgets to investigate a complaint, make sure you include a space in your complaint handling form that is specifically labeled as “Summary of Complaint Investigation.” This space should also include an option to cross-reference to a previous complaint record where a similar investigation is already documented.

A missing IFU is also considered a misbranded product that requires correction (e.g., sending the customer a replacement IFU) or removal (i.e., recall). The FDA expects a Health and Hazard Evaluation (HHE) form to be included in your recall records, and the HHE should indicate the potential risk of a “delay in treatment.” This is the FDA’s conclusion in their evaluation of risk, and therefore your HHE must identify a delay in treatment as a patient risk too. The FDA also expects a CAPA to be initiated to prevent the recurrence of this type of labeling error. You can make a “risk-based” determination that reporting a specific recall to the FDA is not required as per 21 CFR 806.20. However, you need to maintain records of your determination not to report a recall. If you already received a Warning Letter, you should err on the side of reporting anyway.

Note: References to “recall” in the above paragraph are meant to include field corrections.

Intended Use

If a complaint consists of a medical device being used for something other than its intended use, is an MDR required for this user error?

The answer is yes. If you don’t report adverse events involving “user error,” then you might receive an FDA Form 483 observation worded like this…

21 CFR 803.17(a)(1) – The written MDR procedure does not include an internal system which provides for the timely and effective evaluation of events that may be subject to medical device reporting requirements.  Specifically, several incidents where a death or serious injury occurred were “caused by a user error,” and the procedure did not identify this as an event requiring Medical Device Reporting.

In 21 CFR 803.3, the FDA defines “caused or contributed” to include events occurring as a result of:

  1. Failure
  2. Malfunction
  3. Improper or inadequate design
  4. Manufacture
  5. Labeling, or
  6. User error

It is important to understand that the definition of complaints and the requirement to report adverse events should not be “risk-based.” The need for remediation and the need to report corrections and removals can be “risk-based,” but whether something is a complaint, and whether it is reportable should be “black-and-white.” For example, “Did the death or serious injury occur due to auser error’-including use other than the intended use?” If the answer is yes, then it is a complaint and reportable.

Incidents and Adverse Event Reporting

Do incidents that occurred outside the United States need to be reported to FDA?

The answer is yes. If you don’t report adverse events that occur outside the United States, then you might receive an FDA Form 483 observation worded like this…

21 CFR 820.50(a)(1) – An MDR report was not submitted within 30 days of receiving or otherwise becoming aware of information that reasonably suggests that a marketed device may have caused, or contributed to, a death or severe injury. Specifically, several instances were identified where the device caused or contributed to a death or serious injury, and the event was not reported to the Agency. The rationale documented in the complaint record was that the “event occurred outside the United States.”

This type of mistake is most likely due to a lack of training on 21 CFR 803–Medical Device Reporting. Some manufacturers that distribute products internationally are more familiar with the European Vigilance requirements as defined in Articles 87-89 of Regulation (EU) 2017/745. You can find additional guidance on vigilance reporting in our Vigilance Procedure or the applicable MDCG guidance. The European Medical Device Directive (i.e., MDD) only required vigilance reporting of incidents that occurred outside the Member States of the European Economic Area (EEA), Switzerland, and Turkey if the incident required implementation of field safety corrective actions. The EU MDR now requires reporting of incidents that occur outside of the EU if the device is also made available in the EU.

The FDA Part 803 requirements are worded differently. Part 803 does not indicate that the event had to occur in the United States. The MedWatch form (i.e., FDA Form 3500A) must be filed for events that occur in the United States and events occurring outside the USA if the devices are “similar” to devices marketed in the USA. Unfortunately, most device manufacturers are not aware of this requirement. Therefore, the FDA released a final guidance on Medical Device Reporting requirements on November 8, 2016. If you would like to learn more about Medical Device Reporting requirements, you can purchase our MDR procedure and webinar bundle. We will also be expanding our consulting services in January 2024 to include Medical Device Reporting for our clients.

Additional Resources on Complaints Handling

Medical Device Academy sells a complaints handling procedure, and a webinar on complaints handling. We will be updating the procedure during the holidays and hosting a new live complaints handling webinar on January 4, 2024. If you purchase the webinar, or you purchased the webinar in the past, you will receive an invitation to participate in the live webinar in January. If you purchase the complaints handling procedure, or you purchased the procedure in the past, you will receive the updated procedure, updated complaints handling form, and updated complaints log. You will also receive an invitation to the live webinar because we will be bundling the webinar with an updated procedure. We will also provide a discount code during the live webinar for people to upgrade their purchase of the webinar to include the purchase of the procedure. Customers who purchased one of our turnkey quality systems will also receive access to the live webinar.

Complaints handling mistakes – Why? Read More »

FDA Inspections-Complaint Investigation Requirements-Part I

“FDA Inspections-Complaint Investigation Requirements-Part I” is a two-part series that provides an overview of 21 CFR 820.198 requirements. 

complaint part 1 FDA Inspections Complaint Investigation Requirements Part I

Last week, I received a message from someone asking for advice on how to perform a complaint investigation. She has a complaint handling procedure that explains how to determine if complaints are reportable (, and she is the complaint coordinator. Her procedure includes a list of pre-determined cause codes for the most common complaints the company has received in previous years. Her system does not require a complaint investigation if an existing cause code is identified. She would like to know how to perform an investigation if she receives a complaint that does not fit one of the existing cause codes.

Is It a Complaint?

Most discussions about complaint handling begin with the definition of a complaint [i.e., 21 CFR 820.3(b);]. However, if a complaint is received during an investigation of a device rather than the use of the device, the FDA will still consider this as being “after releasing for distribution.” The reason is that release for distribution occurs at final inspection. If the device breaks during installation, the device was still distributed.

One last question. Is it correct to consider a complaint only when the device is live and not during the settings and installation process of the device? (The definition states “after it is released for distribution,” what do they mean by this?).

What is Required?

The FDA QSR section specific to complaint handling is 21 CFR 820.198 ( There are seven subsections (i.e., “A” through “H”) that comprise the regulation.

  1. Manufacturers shall maintain complaint files and establish procedures for complaint handling.
  2. Manufacturers must review and evaluate if an investigation is needed.
  3. Manufacturers must perform an investigation automatically for any complaint involving a device malfunction–unless an investigation has already been performed for a similar complaint.
  4. Separate files shall be maintained for complaints that involve adverse events that are reportable under 21 CFR 803 (
  5. The content of a complaint investigation record is specified in this subsection.
  6. When the complaint handling unit is located at another facility, the records of investigations shall be reasonably accessible to the manufacturing establishment.
  7. When the complaint handling unit is located outside the USA, then the records must be reasonably accessible at a U.S. manufacturer or the location of an initial distributor.

What Does the FDA Expect to See?

FDA inspectors are guaranteed to sample complaint records and CAPA records during every routine inspection. The complaint records sampled will typically be limited to a specific product family that has been selected as the focus of the investigation. Most companies have an electronic log of the complaints, and the investigator may request a sorted list that only includes complaints specific to that one product family. The investigator will already be aware of all of your reported adverse events associated with the product family, and there may be one or two records they specifically want to investigate. The investigator will also review the complaint log to see if there are any complaints with a description that sounds like it might be reportable–even though the complaint was not reported.

The investigator will verify that each complaint record includes the content specified in subsection “E”:

  1. name of the device;
  2. the date the complaint was received;
  3. any device identification(s) and control number(s) used;
  4. the name, address and phone number of the complainant;
  5. the nature and details of the complaint;
  6. the dates and results of the investigation;
  7. any corrective action is taken; and
  8. any reply to the complainant.

In my response to the question that I received, I also included advice on how to conduct an investigation. In general, the investigation is no different than an investigation for any CAPA. The first step is to perform a root cause analysis. The second part of this article will explain the investigation process in more detail.

Register to receive email notification of new blog postings (, so you can read the second part of this article next week. If you are interested in learning more about complaint handling, you might be interested in downloading the webinar that Medical Device Academy recorded last year for complaint handling and vigilance reporting ( We can also help you one-on-one with a current complaint investigation you are conducting. Please don’t hesitate to contact me and ask for help: Mobile: 802.281.4381 or

FDA Inspections-Complaint Investigation Requirements-Part I Read More »

Complaint Management Auditing

This article explains how to use the process approach to auditing to ensure more effective complaint management auditing.

inbound link building Complaint Management Auditing

Auditors typically focus on the requirements of how to handle complaints, but what do you do with complaints after the investigation? If the only reason why you “handle” complaints is that it is a requirement, you are extremely unlikely to gain product benefits from reviewing complaints. When you conduct complaint management auditing, you need to focus on linkages to other processes.

Disadvantages of checklists for complaint management auditing

Are you using an audit checklist when you conduct complaint management auditing? This will verify that your complaint handling process includes all eight requirements of 21 CFR 820.198(e), but it will tell you nothing about whether the process is effective.

Audit checklists encourage auditors to ask close-ended (i.e., yes/no) questions. For example:

  1. Did you document your investigation?
  2. Did you document corrective actions taken?

What is the Process Approach to Auditing?

The process approach to auditing is a seven-step process where the auditor interviews the process owner and individuals performing the process being audited:

  1. What is the process?
  2. What are the inputs to the process?
  3. What are the outputs of the process?
  4. With what resources is the process performed?
  5. With whom is a process performed?
  6. How is the process done?
  7. Which process metrics are important?

Each step of the process systematically gathers information about the process. More importantly, however, the process approach identifies how the process being audited interacts with other processes. Evaluating the effectiveness of linkages is one of the primary benefits of the process approach. For example:

  1. Which records are used as inputs to the complaint handling process?
  2. How many corrective actions were initiated in response to complaints?

Sometimes, an auditor using the process approach will find a “broken link.” If there is no connection between the servicing of devices and the complaint handling process, this is a link that needs to be “repaired.”

The Most Valuable Step in the Process Approach to Auditing

Of the seven steps to the process approach, the last step frequently provides the most proactive suggestions for process improvements. The final step is when the auditor asks the process owner, “Which metrics do you gather for this process?” Often, this question is met with a blank stare. If the process is not being measured, then the process owner cannot proactively make adjustments before mistakes are made. Instead, the process becomes reactionary.

A reactionary process for post-market surveillance and monitoring of complaints allows the number of complaints to increase and cause additional problems. Therefore, each complaint should be categorized, and data analysis should be performed. Ideally, each complaint category should have a maximum threshold established for the frequency of complaints and the severity of complaints. The frequency and severity would be documented in your risk management file. You may even establish quality objectives for the length of time it takes to process complaints and the number of actual complaints.

Adjacent Link Auditing for Complaint Management Auditing

Adjacent Link Auditing is an extension of the process approach to auditing. The principle behind Adjacent Link Auditing is that each process has adjacent processes in the process workflow. The process owners managing the previous process step (i.e., “upstream”) are internal suppliers because they provide the records and physical product that is used in the process being audited. Process owners managing the subsequent process step (i.e., “downstream”) are internal customers because they receive records and physical product from the process being audited. Internal “Suppliers” and “Customers” have a stronger connection to the process than other departments, because they are directly connected to the process. Adjacent processes are intimately involved in creating process inputs or using the process outputs for the next adjacent step in the process. If you are interested in learning more about Adjacent Link Auditing Theory, please click here to read an article in OrthoWorld’s BoneZone magazine.

If you are interested in downloading an example of a complaint handling procedure, please visit our webpage for SOP-018. For learning more about the process approach to auditing, please visit our YouTube channel.

Complaint Management Auditing Read More »

Where to Focus Your Medical Device Complaint Handling Training

%name Where to Focus Your Medical Device Complaint Handling Training

Medical Device Academy performed data analysis of FDA 483s for 2013 and identified four areas of focus for your medical device complaint handling training. 

One of the challenges of creating a strong training curriculum is the need for practical examples. This is why there are lots of stories about real-life companies and products in every Medical Device Academy training event. We learn more from our painful mistakes than we do from our success stories. When you recall a product, report deaths involving a product your company made, or if you receive a Warning Letter—these are events that we will never forget.

Medical Device Academy recently posted a blog ( about complaint handling, because this is one of the most common areas identified in FDA Form 483s and Warning Letters. Therefore, if you are trying to develop training on the topic of complaint handling (i.e., 21 CFR 820.198), then you should look for examples from your competitor’s mistakes. The following is a list of places you should look:

  1. Past inspection reports issued to your company by the FDA
  2. Any inspection reports or Warning Letters about your competitors that become public
  3. Other Warning Letters that mention complaint handling as an issue

Here’s an example of the type of 483 observation you might find: “Failure to adequately establish and maintain procedures for receiving, reviewing, and evaluating complaints by a formally designated unit, as required by 21 CFR 820.198(a).”

The example above identifies five different problems with a complaint process:

  1. You need a procedure 
  2. You need to designate a complaint handling unit
  3. You need to define the process for receiving complaints
  4. You need to define the process for reviewing complaints
  5. You need to define the process for evaluating complaints

21 CFR 820.198 is a prescriptive requirement in the regulations. Therefore, you not only need to create a procedure specifically for complaint handling, but you also need to ensure each element of the requirement is satisfied. This is important because FDA inspectors will verify that your procedure includes each element.

Medical Device Academy performed data analysis of FDA inspection reports for FY2013 ( to identify other common mistakes related to complaint handling. The data analysis of FDA inspection reports for FY2013 identified that there are 15 individual citations related to complaint handling that the FDA identified using the TURBO EIR System ( The table below summarizes the frequencies of these 15 sub-sections that were referenced in citations during FY2013 under the complaint handling category: 

483 Where to Focus Your Medical Device Complaint Handling Training

Medical Device Complaint Handling Training: 4 Critical Areas of Focus

The above table identifies several other sub-sections that present problems for companies. Based on the data analysis, your company should also be training your complaint handling unit in the following four critical areas:

  1. Maintaining complaint files
  2. Reviewing and evaluating complaints for the need to perform an investigation
  3. Documenting complaint investigations in your complaint files
  4. Determining whether a complaint is reportable under 21 CFR 803

The fourth area is one of the most important because these complaints involve injury, death, and product malfunction. Therefore, you might consider reviewing the TPLC database ( for MDRs. The best data to review is data for the same product codes that your company distributes, but reviewing any MDRs can teach your employees which types of incidents need to be reported. This area will also receive increased scrutiny with the recent changes to 21 CFR Part 803 (

Where to Focus Your Medical Device Complaint Handling Training Read More »

7 Considerations for Outsourcing Medical Device Complaints


complaint handling 7 Considerations for Outsourcing Medical Device Complaints

Investigating medical device complaints can be a time-consuming task. This blog reviews seven considerations for outsourcing medical device complaints.

Two different clients of mine recently mentioned that they are overwhelmed by the amount of time required to investigate complaints and to file MDRs with the FDA. I suggested outsourcing the complaint handling to a third-party service provider, but they were unaware of any suppliers with that capability.

I was already familiar with several suppliers offering these services, but I wanted to know if companies were looking for these services. Therefore, I decided to post a discussion on one of the LinkedIn groups I manage: In just two days, there were 21 different comments. Most of these were from consultants offering their services, but their comments were helpful. For example:

  1. “The majority of complaint handling work typically involves a high volume of less critical tasks. Routine things like ensuring all potential complaints are entered into your system, requesting additional information when its needed, documenting updates when they are received, or drafting complaint/reportability decisions based on company policy are all tasks that can easily be performed by a well-qualified service provider for significantly less than if they were done domestically.”  – Matts Bell
  2. “Direct input into ESG is much better and easier than an additional third party software package, as ESG does change often, and the software companies are not keeping up. Keep in mind that each change digs deeper into the quality system and information. What is acceptable today may not be acceptable tomorrow as the validation keys within ESG tighten.” – Courtland Imel
  3. “I too, have provided outsourced complaint, NCMR and CAPA investigations, customer contacts, and root cause analysis to final disposition, sometimes in an FDA remediation project. But it requires active involvement on the part of the client company, with periodic meetings to discuss each case/its resolution, as well as identified trends/their resolution.” – John E. Lincoln
  4. “In the case of adverse events identified through the litigation process, the company cannot contact the complainant directly because the case is in litigation…Utilizing an appropriate third-party service provider to work with you on this process can make this type of adverse event reporting fast, efficient, and cost-effective.” – Melissa Becker

It is true that parts of complaint investigations must be performed internally—such as failure analysis. You also cannot outsource responsibility for review and approval of complaint records or MDRs. However, suppliers can provide trained personnel that are capable of initiating and completing complaint records, performing follow-up with complainants, and determining if complaints are reportable to the FDA and other countries around the world. One of the suppliers I interviewed can translate adverse event reports for countries that require reporting of adverse events in languages other than English, and they have a professional translator verify accuracy. Some personnel even have a medical background (e.g., nursing).

7 Considerations for Outsourcing Medical Device Complaints 

  1. Find a supplier that has many years of experience helping medical device manufacturers with complaint handling and adverse event reporting (no rookies)
  2. Ask for a demo of the software—web-based software is best (I’ll explain why shortly)
  3. Ask to see their complaint handling procedure and perform a procedure review
  4. Ask how the supplier handles complaint investigations when the product is not returned (
  5. Verify that the rationale for MDR decisions is based upon the FDA requirements in 21 CFR 803 (, and vigilance decisions are based upon MEDDEV 2.12/1 (
  6. Ensure that the software system has a tracking of timelines for complaint handling and reporting already built-in
  7. Ensure the electronic forms are adequately designed for capturing information—not just yes/no checkboxes everywhere

Why is web-based software better than hosted?

The US FDA is moving quickly toward Electronic Submission Gateways (ESGs) as the preferred method of submissions ( Unfortunately, there are frequent changes to ESGs that require software modifications and revalidation ( Therefore, unless you prefer to have a full-time person responsible for revalidation of software, web-based software solutions are typically your best choice for regulatory submission software tools. It’s also convenient to be able to access records and print them out for an FDA inspector from any computer. This eliminates any possibility of a 483 being issued against 21 CFR 820.198(f) (

7 Considerations for Outsourcing Medical Device Complaints Read More »

Scroll to Top