When you take a pill or use a medical device, you assume it’s safe. But how do you know the factory that made it followed the rules? The answer lies in FDA inspection records - the behind-the-scenes documents that show whether a manufacturer actually meets quality standards. Access to these records isn’t open to the public, but understanding what the FDA can see - and what it can’t - helps manufacturers stay compliant and consumers trust the system.
What the FDA Can Inspect - And What It Can’t
The FDA doesn’t just show up and ask for everything. Under Section 704(a)(1) of the Federal Food, Drug, and Cosmetic Act, the agency has the legal right to inspect any facility making drugs or medical devices for human use. But there’s a key boundary: internal quality audits. If a company runs its own confidential audits to find problems before the FDA arrives, those reports are generally off-limits. This policy, outlined in Compliance Policy Guide Sec. 130.300, was created to encourage honest self-evaluation. Companies can admit mistakes internally without fearing those notes will be used against them in court.But here’s the catch: if something goes wrong - a batch fails, a customer complains, a product is recalled - then the investigation records become fair game. The FDA can demand every email, lab report, deviation log, and CAPA (Corrective and Preventive Action) file tied to that failure. There’s no hiding behind an “internal audit” label if the issue directly affects product quality.
For example, if a pharmaceutical plant discovers a machine is consistently under-dosing tablets during a routine internal audit, they can fix it quietly. But if that same under-dosing leads to a patient receiving the wrong dose, the FDA will demand every record related to that incident - including the audit that spotted it. The distinction isn’t about secrecy; it’s about intent. Protected audits aim to prevent problems. Required records prove how you handled them.
Record Retention Rules You Can’t Ignore
It’s not enough to have good records - you have to keep them long enough. The FDA requires pharmaceutical manufacturers to hold onto CGMP (Current Good Manufacturing Practice) records for at least one year after the product’s expiration date. For medical devices, the rule is even stricter: you must keep quality system records for the entire lifespan of the device, plus two more years. That means if you make a pacemaker that lasts 15 years, you’re legally responsible for those records for 17 years.These aren’t suggestions. The FDA’s 2024 Warning Letter Analytics Dashboard showed that 22% of warning letters issued last year cited “non-contemporaneous recordkeeping.” That means someone wrote down what happened after the fact - maybe even days later - instead of logging it in real time. The FDA considers this a serious violation because it suggests records were altered or fabricated to look compliant.
Every batch record, calibration log, cleaning procedure, and environmental monitoring result must be signed, dated, and timestamped as it happens. Electronic systems must have audit trails that can’t be deleted. Paper records must be stored securely and legibly. If you can’t prove you did something when you say you did it, the FDA will assume you didn’t do it at all.
The Inspection Process: From Notice to Form 483
When an FDA inspector walks into your facility, they’ll hand you Form FDA 482 - the official Notice of Inspection. This isn’t a request. It’s a legal demand. You can’t refuse. If you do, you’re violating Section 301(f) of the FD&C Act, and the FDA can shut you down.During the inspection, the investigator will ask for:
- Batch production and control records
- Validation protocols for equipment and processes
- Deviation reports and investigations
- CAPA documentation
- Supplier qualification files
- Training records for staff handling critical operations
They won’t ask for your internal audit reports - unless it’s a “for-cause” inspection. Routine inspections (about 75% of all inspections in 2024) follow the CPG Sec. 130.300 policy. But if the FDA gets a tip about contamination, a whistleblower complaint, or a history of repeated violations, they can launch a “for-cause” inspection. In those cases, they get full access - including internal audit logs.
At the end of the inspection, if they find problems, they issue Form FDA 483 - the Notice of Inspectional Observations. This isn’t a fine. It’s a list of concerns. You have exactly 15 business days to respond. That’s not a suggestion. It’s a requirement.
How Companies Respond - And Why Most Fail
A Form 483 isn’t the end of the world. But how you respond determines whether you get another inspection in six months - or a warning letter that makes investors run for the exits.Most companies panic. They send back a generic letter saying, “We’re sorry, we’ll fix it.” That’s not enough. The FDA wants root cause analysis. They want evidence you fixed the system, not just the symptom.
For example, if an inspector finds that a machine wasn’t calibrated on time, a weak response says: “We calibrated it now.” A strong response says: “We identified that the calibration schedule wasn’t integrated into our work order system. We’ve updated the software to auto-flag overdue calibrations, trained all operators on the new process, and added monthly audits to ensure compliance. Attached are the updated SOP, training logs, and audit results from the first two months.”
According to the FDA’s 2024 Compliance Metrics Report, companies using proper root cause analysis close 89% of Form 483 issues within six months. Those using quick fixes? Only 62%.
And here’s the real kicker: if you don’t respond in 15 days, the FDA assumes you’re ignoring the problem. That’s when they escalate - to a warning letter, a consent decree, or even an import alert that blocks your products from entering the U.S.
Remote Inspections Are Changing the Game
In July 2025, the FDA finalized new rules for Remote Regulatory Assessments (RRAs). These aren’t inspections. They’re virtual reviews. The FDA can ask you to share digital records, grant read-only access to your quality system database, or even join a live video walkthrough of your production line.RRAs don’t result in Form 483s. But they’re becoming a regular part of the process. By Q1 2025, 73% of Fortune 500 pharmaceutical companies had already built RRA-ready systems. Why? Because companies using RRAs cut inspection-related downtime by 65%. No more shutting down production for a week while the FDA tours the floor. You can submit records digitally, answer questions remotely, and keep making medicine.
But RRAs aren’t a loophole. They’re a tool. If the FDA sees red flags during an RRA - inconsistent data, missing logs, unexplained gaps - they’ll schedule a physical inspection. And when that happens, they’ll come in with a list of exact issues they already spotted.
Foreign Facilities Are Under More Scrutiny Than Ever
More than half of the drugs sold in the U.S. are made overseas. That’s why the FDA has been pushing harder to inspect foreign facilities - and doing it without warning.In 2023, only 12% of foreign inspections were unannounced. By the end of 2025, that number will jump to 35%. That’s a massive shift. It means manufacturers in India, China, or Germany can no longer assume they’ll get a heads-up. The FDA can show up at 8 a.m. on a Tuesday with no notice - and you have to be ready.
Domestic facilities still get scheduled inspections 92% of the time. But foreign sites? They’re being treated like high-risk operations. And it’s working. Facilities that passed their first unannounced inspection saw a 40% drop in repeat violations over the next year.
What This Means for Manufacturers
If you’re running a facility that makes drugs or medical devices, transparency isn’t optional. It’s the cost of doing business in the U.S. market. The FDA isn’t trying to catch you. They’re trying to make sure you don’t need to be caught.Here’s what you need to do:
- Separate your internal audit reports from your quality control investigation files. Keep them in different systems with clear labels.
- Train every new employee on what records are required and what’s protected. A 2025 survey found 63% of quality teams over-disclose because they don’t understand the rules.
- Build a real-time documentation culture. No backdating. No handwritten notes on sticky pads.
- Prepare for unannounced inspections. Have your records digital, organized, and accessible 24/7.
- Invest in RRA readiness. It’s not a luxury anymore - it’s a competitive advantage.
The global market for pharmaceutical compliance tools is growing at 8.3% per year. Companies spend an average of $385,000 annually just on inspection readiness. That’s not waste. That’s insurance. One failed inspection can cost millions in lost sales, recalls, or lawsuits.
What’s Coming Next
The FDA’s 2025-2027 Strategic Plan aims to cut inspection cycle times by 25% using digital records and AI-assisted review. That means more automated checks, fewer human visits - but also less room for error. If your records aren’t clean, the system will flag you faster.Congress is also pushing for more transparency. The 2024 Pharmaceutical Supply Chain Transparency Act proposed making certain inspection findings public. The pharmaceutical industry is fighting it, arguing it would kill honest internal audits. But if it passes, manufacturers may soon have to post their inspection results online - not just for regulators, but for patients and investors too.
Manufacturing transparency isn’t about being perfect. It’s about being honest, organized, and ready. The FDA doesn’t want to shut you down. They want you to make safe products - and prove it every day.
Can the public access FDA inspection records?
No, the public cannot directly access FDA inspection records. While some summaries of inspection results are published on the FDA website, detailed records - including Form 483s, deviation reports, and CAPA files - are confidential and only available to the facility being inspected and the FDA. However, under the Freedom of Information Act (FOIA), certain redacted inspection reports may be released upon request, though sensitive business information and internal audit documents are typically withheld.
What’s the difference between a routine and a for-cause FDA inspection?
A routine inspection is scheduled and part of the FDA’s regular surveillance program. These account for about 75% of inspections and follow the CPG Sec. 130.300 policy, meaning internal quality audit reports are generally not reviewed. A for-cause inspection is triggered by specific concerns - like a product recall, whistleblower report, or history of violations. In for-cause inspections, the FDA can request any record, including internal audits, because the agency suspects systemic issues.
What happens if I don’t respond to a Form FDA 483?
If you don’t respond to a Form 483 within 15 business days, the FDA considers it a failure to address serious compliance issues. This often leads to a Warning Letter, which is publicly posted on the FDA’s website. Repeated failures can result in import alerts, consent decrees, or even criminal charges. The FDA treats silence as non-cooperation - and responds accordingly.
Are internal quality audit reports ever visible to the FDA?
Generally, no - unless it’s a for-cause inspection. Under Compliance Policy Guide Sec. 130.300, the FDA does not review internal quality audit reports during routine inspections to encourage candid self-assessment. However, if the FDA has reason to believe a facility is hiding systemic quality problems, they can demand those reports during a for-cause inspection. The policy is designed to protect honest internal reviews, not to shield negligence.
How can a company prepare for an unannounced FDA inspection?
The best preparation is constant readiness. Maintain accurate, real-time digital records. Train staff on what documents to provide and who to notify immediately. Conduct mock inspections quarterly. Ensure your quality system is integrated with your production systems so records are automatically generated and timestamped. Keep a 24/7 accessible folder with all required CGMP documents - batch records, validation reports, deviation logs, and CAPA files - ready to share at a moment’s notice. Unannounced inspections are not surprises; they’re tests of your daily discipline.
What’s a Remote Regulatory Assessment (RRA), and how is it different from a physical inspection?
A Remote Regulatory Assessment (RRA) is a virtual review authorized by FDA guidance finalized in July 2025. It allows the agency to request digital records, access secure databases, or conduct live video walkthroughs without sending inspectors on-site. RRAs don’t generate Form 483s and aren’t formal inspections. They’re used to screen facilities, reduce travel costs, and minimize production disruption. But if red flags appear during an RRA, the FDA will follow up with a physical inspection - and they’ll already know what to look for.