Receipt, investigation, MDR reportability evaluation, and complaint records — 820.198 investigative structure preserved in QMSR 820.35.
Complaints must feed CAPA, trending, and risk management; QMSR 820.35 adds explicit content requirements for complaint records.
CAPA-initiation decision gate and complaint-trending records — complaint files are the first document FDA inspectors open.
Maps to
QMSR / ISO 13485: §820.198 Complaint files.
ISO 13485: §8.2.2 Complaint handling
Requirement text
The organization shall establish documented procedures for receiving, reviewing, and evaluating complaints. FDA-Plus: Each complaint must be evaluated to determine whether it constitutes a reportable event under 21 CFR Part 803 (MDR). Complaint investigation must determine if CAPA is needed. Records must be maintained and accessible for FDA inspection.
Why this clause exists
Complaint files are the first document FDA investigators request when they arrive at a medical device manufacturer. The reason is straightforward: complaints are the primary signal that the device is causing or contributing to harm in the field, and the manufacturer's response to that signal — how quickly, how thoroughly, and with what consequence for the broader quality system — tells an investigator nearly everything they need to know about the culture and capability of the QMS. QMSR 820.35, combined with ISO 13485:2016 clause 8.2.2, establishes complaint handling not just as a reactive process but as an active surveillance mechanism: every complaint must be evaluated for MDR reportability, every investigation must explicitly determine whether CAPA is warranted, and complaint data must feed trend analysis that reaches the risk management file and management review. The historical pattern that drove these requirements was systematic under-reporting: manufacturers would handle complaints at the individual-case level — logging the report, sending a replacement, closing the record — without accumulating the data necessary to detect that the same failure mode was recurring at a rate that indicated a systemic problem. Under the QMSR framework, a complaint that is not investigated must have a documented rationale for the decision; if a similar investigation has already been performed, that prior investigation must be referenced. Complaint records must include the UDI or equivalent device identifier, enabling traceability to the production lot that may require field action.
What changed
§820.198 — Part 820 (legacy)
"Each manufacturer shall maintain complaint files. Each manufacturer shall establish and maintain procedures for receiving, reviewing, and evaluating complaints by a formally designated unit. Such procedures shall ensure that: (1) All complaints are processed in a uniform and timely manner; (2) Oral complaints are documented upon receipt; and (3) Complaints are evaluated to determine whether the complaint represents an event which is required to be reported to FDA under part 803 of this chapter, Medical Device Reporting. Each manufacturer shall review and evaluate all complaints to determine whether an investigation is necessary. When no investigation is made, the manufacturer shall maintain a record that includes the reason no investigation was made and the name of the individual responsible for the decision not to investigate. Any complaint involving the possible failure of a device, labeling, or packaging to meet any of its specifications shall be reviewed, evaluated, and investigated, unless such investigation has already been performed for a similar complaint and another investigation is not necessary. Any complaint that represents an event which must be reported to FDA under part 803 of this chapter shall be promptly reviewed, evaluated, and investigated by a designated individual(s) and shall be maintained in a separate portion of the complaint files or otherwise clearly identified. In addition to the information required by § 820.198(e), records of investigation under this paragraph shall include a determination of: (1) Whether the device failed to meet specifications; (2) Whether the device was being used for treatment or diagnosis; and (3) The relationship, if any, of the device to the reported incident or adverse event. When an investigation is made under this section, a record of the investigation shall be maintained by the formally designated unit identified in paragraph (a) of this section. The record of investigation shall include: (1) The name of the device; (2) The date the complaint was received; (3) Any unique device identifier (UDI) or universal product code (UPC), and any other device identification(s) and control number(s) used; (4) The name, address, and phone number of the complainant; (5) The nature and details of the complaint; (6) The dates and results of the investigation; (7) Any corrective action taken; and (8) Any reply to the complainant. When the manufacturer's formally designated complaint unit is located at a site separate from the manufacturing establishment, the investigated complaint(s) and the record(s) of investigation shall be reasonably accessible to the manufacturing establishment. If a manufacturer's formally designated complaint unit is located outside of the United States, records required by this section shall be reasonably accessible in the United States at either: (1) A location in the United States where the manufacturer's records are regularly kept; or (2) The location of the initial distributor."
§8.2.2 — ISO 13485:2016 (current)
"The organization shall document procedures for timely complaint handling in accordance with applicable regulatory requirements. These procedures shall include at a minimum requirements and responsibilities for: a) receiving and recording information; b) evaluating information to determine if the feedback constitutes a complaint; c) investigating complaints; d) determining the need to report the information to the appropriate regulatory authorities; e) handling of complaint-related product; f) determining the need to initiate corrections or corrective actions. If any complaint is not investigated, justification shall be documented. Any correction or corrective action resulting from the complaint handling process shall be documented. If an investigation determines activities outside the organization contributed to the complaint, relevant information shall be exchanged between the organization and the external party involved. Complaint handling records shall be maintained (see 4.2.5)."
Δ ISO 13485 drops the US-specific MDR linkage and geographic record-access rules; adds a requirement to exchange information with external parties when they contributed to the complaint.
Common gaps (what we see in audits)
- Missing Complaint-to-CAPA Linkage Procedure — ISO 13485 requires a documented process for evaluating each complaint to determine whether CAPA is needed. Many Part 820-era complaint procedures handle investigation and MDR evaluation but lack a formal decision gate for CAPA initiation, resulting in complaints being closed without systematic assessment of whether corrective action is warranted.
- Inadequate investigation rationale — Complaints are closed with 'No investigation necessary' but the documented rationale is vague (e.g., 'known issue'). ISO 13485 requires a specific rationale for not investigating.
- No Systematic Complaint Trending — ISO 13485 requires that complaint data be trended to identify systemic issues. Many organizations trend complaints informally or only at management review, without a defined frequency, statistical method, or escalation threshold for when trends trigger CAPA or risk management action.
- Incomplete Complaint Record Content — QMSR section 820.35 defines specific content requirements for complaint records that are more detailed than the legacy QSR. Organizations may lack fields for risk classification, CAPA determination rationale, and linkage to regulatory reporting decisions in their complaint record forms.
- Feedback System Not Integrated with Complaints — ISO 13485 positions complaints within a broader feedback collection system (8.2.1). Many organizations treat complaints and general customer feedback as entirely separate processes, missing the requirement to evaluate all feedback, not just formal complaints, for quality signals.