When you take a pill, inject a vaccine, or use a medical device, you assume it’s safe. But behind that trust is a complex system of inspections, records, and regulations - mostly hidden from public view. The FDA inspection records are not public documents you can download. Yet, they shape the safety of everything made in U.S. factories. Understanding what the FDA can see - and what stays private - is critical for manufacturers, regulators, and anyone who cares about quality.
What the FDA Can and Can’t See
The FDA doesn’t get full access to every document inside a drug or device factory. Under Compliance Policy Guide (CPG) Sec. 130.300, internal quality assurance audits are protected. These are the reports companies write for themselves - honest reviews of where things went wrong, what they learned, and how they fixed it. The FDA intentionally doesn’t review these to encourage companies to be truthful without fear of punishment. But here’s the catch: if something goes wrong with a product - a batch fails, a patient reports a reaction, or a test comes back abnormal - the investigation into that issue is not protected. Those records, called quality control investigations, are fully open to FDA inspectors. This distinction matters. One is about learning. The other is about accountability. For example, if a lab technician notices a machine is drifting out of calibration, and the company runs a root cause analysis to fix it before any product is affected, that report stays internal. But if that same machine produced 500 vials of insulin with inconsistent potency, and the company investigates why, that investigation file is fair game for the FDA.What Records Must Be Kept - And For How Long
Manufacturers aren’t just guessing what to save. The law spells it out. For drug makers, 21 CFR 211.180 requires retention of all current Good Manufacturing Practice (CGMP) records for at least one year after the product’s expiration date. For medical devices, 21 CFR 820.180 says records must be kept for the life of the device plus two years. That means a pacemaker’s manufacturing logs could be stored for 15+ years. These records include:- Batch production and control records
- Validation protocols for equipment and processes
- Deviation reports - when something didn’t go as planned
- Corrective and Preventive Action (CAPA) logs
- Supplier qualification files
- Training records for staff handling critical steps
Inspection Types: Routine vs. For-Cause
Not all FDA inspections are the same. In 2024, 75% of pharmaceutical inspections were routine surveillance visits. These are scheduled, planned, and follow a standard checklist. During these, FDA inspectors typically avoid digging into internal audit reports, sticking to production logs, equipment logs, and CAPA files. But when an inspection is labeled “for-cause” - triggered by a complaint, a recall, or a pattern of failures - everything changes. In these cases, the FDA can demand access to internal audit reports, emails between quality teams, and even draft versions of investigations. In 2024, 18% of inspections fell into this category. These are the ones that lead to warning letters, consent decrees, or even shutdowns. There’s also a third type: Remote Regulatory Assessments (RRAs). Introduced in July 2025, RRAs let the FDA review documents digitally - think secure portals, read-only access to databases, or live video walkthroughs. RRAs don’t generate Form 483s, but they’re becoming more common. By Q1 2025, 73% of Fortune 500 pharma companies had built RRA-ready systems. Why? Because they cut inspection-related downtime by 65%.
The Form 483: What Happens After the Inspector Leaves
If the FDA finds problems during an inspection, they issue Form FDA 483 - a list of observations. This isn’t a fine. It’s not a citation. It’s a heads-up: “We saw this. You need to fix it.” Companies have exactly 15 business days to respond. No more. No less. And the response matters. The FDA’s 2024 Compliance Metrics Report shows that companies using a full root cause analysis - digging into why the problem happened, not just how to patch it - closed 89% of their Form 483 issues within six months. Companies that just wrote “we’ll train staff” had only a 62% success rate. A good response includes:- A clear description of the issue
- Root cause analysis with data
- Corrective actions already taken
- Preventive steps to stop it from happening again
- Timeline for full implementation
Foreign vs. Domestic: A Growing Divide
The rules are the same, but the enforcement isn’t. In 2023, only 12% of inspections at foreign facilities were unannounced. By the end of 2025, that number will jump to 35%. The FDA is cracking down on overseas factories because over half of all prescription drugs sold in the U.S. are made abroad. Domestic facilities still get scheduled inspections 92% of the time. Foreign ones? They’re getting surprise visits. Why? The 2024 GAO Report flagged inconsistent compliance at overseas sites. The FDA’s response: more unpredictability. This shift is forcing global manufacturers to treat every facility like it’s under constant scrutiny. Companies now train teams in India, China, and Ireland the same way they train teams in New Jersey - because the FDA might show up tomorrow.
How Companies Prepare - And What It Costs
Preparing for an FDA inspection isn’t a one-time project. It’s a full-time job. According to a 2025 benchmarking study of 120 facilities, the average company spends $385,000 per year on inspection readiness. That includes:- Dedicated staff (78% of companies have a full inspection team)
- Document control systems
- Training programs
- Mock inspections and audits
- Software for tracking deviations and CAPAs
The Bigger Picture: Why Transparency Matters
There’s a tension in the system. On one side, the FDA wants companies to be open, honest, and proactive. On the other, it can’t trust everything it’s told. That’s why the protected audit space exists - to encourage real change, not just cover-ups. But critics argue it creates blind spots. Professor Daniel Troy, former FDA Chief Counsel, says the policy lets systemic problems hide. And Congress is listening. The 2024 Pharmaceutical Supply Chain Transparency Act (S. 2884) proposed making certain inspection findings public - a move the pharmaceutical industry opposes, saying it would kill the safe space for internal audits. The truth? Transparency isn’t about publishing every document. It’s about making sure the right records are available when they matter most. When a child gets a contaminated vaccine, or an elderly patient gets a faulty pacemaker, the public doesn’t care if the company had a protected audit. They care that the FDA had access to the investigation that should have caught it.What You Need to Do Now
If you’re in manufacturing:- Know the difference between QA audits (protected) and QC investigations (not protected)
- Train your team on what records to keep, and for how long
- Build a response plan for Form 483 - don’t wait until the inspector leaves
- Prepare for unannounced inspections, even if you’re based in the U.S.
- Invest in digital systems that support Remote Regulatory Assessments
Can the public access FDA inspection records?
No, the public cannot access raw FDA inspection records. While some Form 483 observations and Warning Letters are posted on the FDA website, the underlying production logs, CAPA files, and internal audit reports remain confidential. Only the FDA and the inspected company have full access to these documents.
What’s the difference between a Form 483 and a Warning Letter?
A Form 483 is a list of observations made during an inspection - it’s an informal notice of potential issues. A Warning Letter is a formal, legally enforceable action issued when the FDA believes the issues are serious or unresolved. Warning Letters are public and can lead to fines, import bans, or facility shutdowns.
Do FDA inspectors check internal quality audit reports?
Generally, no - during routine inspections, FDA follows CPG Sec. 130.300 and avoids reviewing internal quality assurance audit reports. But during for-cause inspections, triggered by complaints or recalls, the agency can demand access to those reports if they’re relevant to the issue under investigation.
How long do manufacturers have to respond to a Form 483?
Manufacturers have exactly 15 business days to respond to a Form 483. The response must include a detailed plan to correct each observation, with root cause analysis and timelines. Missing this deadline can lead to a Warning Letter or further enforcement.
Are foreign manufacturing facilities inspected more often than U.S. ones?
Foreign facilities are inspected less frequently in total, but they’re far more likely to face unannounced inspections. In 2023, only 12% of foreign inspections were unannounced. By the end of 2025, that will rise to 35%. Domestic facilities still mostly receive scheduled inspections (92% of the time). The FDA is increasing surprise visits abroad to address compliance concerns.
What is a Remote Regulatory Assessment (RRA)?
An RRA is a virtual evaluation where the FDA reviews records, databases, or conducts live video walkthroughs without physically entering the facility. RRAs don’t result in Form 483s but can replace physical inspections in certain cases. By Q1 2025, 73% of Fortune 500 pharmaceutical companies had implemented RRA-ready systems to reduce downtime and improve compliance.