Summary
“I don't think it's as easy to outsource risk as it used to be. Risk is pervasive now.”
In this episode of the Let’s Talk Risk! conversation, host Naveen Agarwal speaks with Allyson Mullen, Director at Hyman, Phelps & McNamara, P.C., about what FDA’s early enforcement activity under the Quality Management System Regulation (QMSR) may tell medical device manufacturers about the agency’s evolving expectations.
Using the first warning letter discussed in the episode as a starting point, Allyson examines how FDA is citing risk management under ISO 13485 Clause 7.1 and, increasingly, looking at the broader requirement to apply risk-based thinking across QMS processes under Clause 4.1.2.
The conversation explores why companies already certified to ISO 13485 should not assume they are fully prepared for an FDA inspection, how FDA inspections may differ from notified-body audits, and why post-market information must feed back into risk management.
Naveen and Allyson also discuss the legal and contractual implications of the transition, particularly the importance of reviewing quality agreements and clearly defining responsibilities when activities are outsourced.
Finally, Allyson offers practical perspective on responding to FDA 483 observations and warning letters during a period when both regulators and industry are adapting to a new inspection framework.
Listen to the full 25-minute podcast or jump to a section of interest listed below.
Chapters
01:17 – Introduction and Allyson Mullen’s Regulatory and Legal Background02:17 – FDA’s First QMSR Warning Letter and Its Risk Management Findings03:46 – How FDA’s Language Around Risk Is Changing Under QMSR05:10 – Risk Beyond Design Control: ISO 13485 Clause 4.1.207:42 – When FDA May Look Beyond Product Realization12:48 – Why ISO 13485 Certification May Not Be Enough14:59 – Legal Risks and the Importance of Updating Quality Agreements17:19 – What to Do When FDA May Have Gotten an Observation Wrong21:21 – Warning Letters and the Challenges of the QMSR Transition23:40 – Allyson’s Journey from Regulatory Affairs to Law26:10 – Key Takeaways: Risk, Outsourcing, and Quality Agreements
If you enjoyed this podcast, consider subscribing to the Let’s Talk Risk! newsletter.
Suggested links:
FDA Law Blog: FDA’s First QMSR Warning Letters.
LTR Deep Dive: First FDA Warning Letter Under QMSR.
LTR: LTR Risk Coach - AI-Powered Decision Support Tool.
Key Takeaways
* Risk is becoming more pervasive under QMSR. FDA now has clearer regulatory pathways for examining risk beyond traditional design-control activities.
* Clause 7.1 may only be the beginning. Product realization provides an obvious entry point, while ISO 13485 Clause 4.1.2 allows FDA to examine whether risk-based thinking is embedded throughout the QMS.
* Post-market feedback must close the loop. Complaints, adverse events, recalls, and other post-market information need a defined pathway back into risk management.
* ISO 13485 certification does not guarantee an easy FDA inspection. FDA may challenge the methods and reasoning behind risk-based decisions more deeply than organizations have experienced in traditional notified-body audits.
* Risk cannot simply be outsourced. Manufacturers remain responsible for understanding and managing risk even when product-realization activities are performed by suppliers or contract manufacturers.
* Review quality agreements now. Older agreements may assign responsibilities using the former QSR structure and may not adequately address obligations under ISO 13485 and QMSR.
* A 483 is not necessarily the final word. Companies should carefully evaluate FDA observations, provide missing context, correct the record where appropriate, and respond with a complete factual narrative.
* The transition creates challenges for both FDA and industry. Early warning letters and inspection observations will be important signals for understanding how FDA applies QMSR in practice.
Keywords
QMSR, FDA, ISO 13485, Risk Management, Quality Systems, FDA Inspections, Warning Letters, Quality Agreements, Post-Market Surveillance, Medical Devices
About Allyson Mullen
Allyson Mullenis a Director at Hyman, Phelps & McNamara, P.C., where her work brings together deep experience in FDA regulatory matters and law.
Before joining the firm, she served as a Corporate Attorney and Principal Regulatory Affairs Specialist at Waters Corporation, a Senior Regulatory Affairs Specialist at Boston Scientific, and a Regulatory Affairs Associate at DePuy Mitek.
She earned her J.D. from New England Law | Boston and began her career in regulatory affairs before transitioning into legal practice—giving her experience on both sides of regulatory and legal decision-making.
Let’s Talk Risk! with Dr. Naveen Agarwal is a bi-weekly live audio event on LinkedIn, where we talk about risk management related topics in a casual, informal way. Join us at 11:00 am EST every other Friday on LinkedIn.
Disclaimer
Information and insights presented in this podcast are for educational purposes only, and not as legal advice. Views expressed by all speakers are their own and do not reflect those of their respective organizations.
Parts of this article were created using AI-generated content, which was subsequently reviewed, edited, and fact-checked by the author to ensure accuracy and alignment with our standards.
This is a public episode. If you'd like to discuss this with other subscribers or get access to bonus episodes, visit naveenagarwalphd.substack.com/subscribe
