The Management Review Problem Nobody Talks About

Management review has been a regulatory requirement for as long as most of us have been in this industry. ISO 13485 requires it. The old Part 820 required it. Every notified body and registrar checks for it. It's the one meeting quality leaders never skip — and yet, it's the one meeting most companies never get right.

Under QMSR, the stakes just changed. Management review outputs are now FDA-inspectable records. Not just "does the company do management reviews?" but "show me the output. Show me the decisions. Show me what happened after."

Most companies are still producing management reviews that look like 2019. That's not a process gap — it's a compliance exposure.

The Copy-Paste Ceremony

Let's be honest about what management review looks like at most MedTech companies. Someone in quality pulls together a slide deck. They dust off last quarter's version, update a few numbers, and present it to a room of executives who are already thinking about the next meeting on their calendar.

The slides hit the required topics — complaint trends, CAPA status, audit results, supplier performance. But they hit them the way a student hits a checklist on a homework assignment: technically complete, practically meaningless.

Nobody challenges the data. Nobody asks what changed. Nobody makes a resource decision based on what's presented. The meeting ends. Someone writes "management review completed" in the quality calendar. And the slide deck goes back in the drawer until next quarter, when it gets copy-pasted again.

If your management review could be conducted by reading last quarter's minutes and changing the date, it isn't a management review. It's a filing exercise.

I've seen this pattern at companies of every size — from startups clearing their first FDA inspection to established manufacturers with decades of market history. The size of the company changes, but the ceremony doesn't.

What the Regulation Actually Requires

ISO 13485:2016, Section 5.6, is specific. Management review isn't a status update. It requires:

• Review inputs — feedback, complaint handling, process performance, audit results, corrective and preventive actions, changes that could affect the QMS, and recommendations for improvement
• Review outputs — decisions and actions related to improvement of the QMS and its processes, improvement of product, and resource needs
• Evidence of top management engagement — not delegation to the quality team, but actual leadership involvement in evaluating QMS effectiveness

Under QMSR, FDA inspectors now have direct access to ISO 13485 requirements as the harmonized standard. That means they're not just checking that management review happened. They're evaluating whether it produced what the standard requires: documented decisions, resource commitments, and evidence of follow-through.

Why "We Discussed It" Isn't Enough Anymore

Here's the failure mode I see most often: management review minutes that document topics discussed, but not decisions made. The record shows that complaint trends were reviewed. It doesn't show what leadership decided to do about them.

"We discussed it" is not an output. It's a process step. Inspectors want to see the other side: what decision was reached, who owns the action, what resources were allocated, and whether effectiveness was verified at the next review.

This is where the board-defensibility question becomes relevant. If your management review outputs can't withstand an FDA inspector's scrutiny — if they don't show real decisions tied to real data — they probably can't withstand a board's scrutiny either. And in a regulatory environment where quality system maturity directly impacts company valuation, that's a problem that extends well beyond compliance.

Common Failure Modes

After years of auditing quality systems and preparing companies for FDA inspections, the same failure modes surface repeatedly:

• No action items. The review generates observations but no assigned actions with owners and due dates. There's nothing to follow up on because nothing was committed to.
• No trend data. Complaint volumes are presented as snapshots, not trends. CAPA closure rates appear without context. There's no quarter-over-quarter or year-over-year comparison that would reveal whether things are getting better or worse.
• No connection between CAPA data and management decisions. The CAPA section shows open items and closure statistics. The resource section shows headcount and budget. But there's no documented link between the two — no evidence that management evaluated whether the quality team has what it needs to address systemic issues.
• No quality objective evaluation. Companies set quality objectives during planning, then never evaluate them during management review. Objectives like "reduce complaint response time to under 5 days" appear in the quality manual and nowhere else.
• Executive absence. The CEO or COO sends a delegate. Or worse, the "management review" is conducted entirely within the quality department. Top management engagement means exactly that — and the record should reflect it.

What a Strong Management Review Looks Like

A management review that meets both the intent and the letter of ISO 13485 is data-driven, decision-documented, and tied to quality objectives with measurable outcomes.

It starts with data that tells a story — not a data dump. Complaint trends over multiple quarters, mapped to product families. CAPA effectiveness rates, not just closure counts. Supplier performance tied to risk classifications. Audit findings categorized by process area, with repeat finding analysis.

From that data, leadership makes documented decisions: reallocate resources to supplier qualification, invest in design control training, escalate a specific product complaint trend to engineering, set a revised quality objective for CAPA cycle time.

Each decision gets an owner, a timeline, and a verification method. At the next management review, the first order of business is reviewing whether prior actions were completed and whether they were effective.

A strong management review doesn't just prove you held the meeting. It proves the meeting changed something.

How MB&A Approaches Management Review

This is one of the areas where the relationship between Qualera and MB&A becomes most tangible.

Qualera analyzes QMS performance data — complaints, CAPAs, audit findings, supplier metrics, process performance indicators — and identifies trends, gaps, and correlations that manual review would miss or take weeks to compile. The platform processes the full dataset, not a sample.

MB&A takes that analysis and prepares the management review package: the executive summary, the trend analysis, the recommended discussion points, the proposed action items. We structure it for decision-making, not for filing.

Then the client's quality leader presents it and owns it. That's the critical step. The quality leader walks the executive team through the data, facilitates the decisions, and documents the outputs. MB&A prepares the stage; the client's leadership performs.

This approach produces management reviews that are simultaneously more rigorous and less burdensome. The quality team isn't spending three weeks pulling data into spreadsheets. They're spending that time preparing to lead a meaningful discussion with leadership — which is what the role was always supposed to be.

The Real Risk

The companies that will struggle under QMSR aren't the ones with bad quality systems. They're the ones with adequate quality systems and performative management reviews. The ones where the QMS documentation checks every box, but the management review output is a slide deck that could have been generated without anyone in the room.

FDA inspectors under CP 7382.850 are trained to evaluate process effectiveness — not just process existence. A management review process that exists but produces no meaningful output is exactly the kind of finding that leads to an observation. And under QMSR, that observation has teeth.

The fix isn't complicated. It requires better data, clearer structure, and genuine leadership engagement. But it starts with acknowledging the problem — that management review, as practiced at most companies, isn't meeting the standard it claims to follow.