The first impression is not about what you say. It's about what the system shows.

FDA investigators arrive with a practiced eye. Within the first few hours of an inspection, they are reading the quality system the way a radiologist reads an X-ray — looking for patterns that reveal what is actually happening beneath the surface. They are not looking for perfection. They are looking for coherence.

I have spent a lot of my career on the host side of an FDA inspection. Front room, back room, both.

What I learned early is that the opening presentation matters far less than most sites believe. By the time you finish your slides, the investigator has already requested a deviation log, a CAPA list, and a change control report. Those three documents will tell them more about your organization in twenty minutes than your presentation will in an hour.

They are not hunting for perfection. Nobody who inspects manufacturing sites for a living expects a clean file. What they are testing is whether the story holds together.

This part is not my opinion. It is the program.

FDA inspects drug manufacturers under Compliance Program 7356.002, which breaks a site into six systems: Quality, Facilities and Equipment, Materials, Production, Packaging and Labeling, and Laboratory Control.

Two things about that program deserve more attention than they usually get.

First, the Quality System is never skipped. Inspections run as Full or Abbreviated, and under the abbreviated option the investigator covers fewer systems. The Quality System has to be one of them. There is no version of this inspection where your quality system goes unexamined.

Second, and this is the part I wish more executive teams knew: the compliance program's objectives include gaining insight into practices that promote a quality culture allowing a site to exceed the CGMP standard, not just meet it.

Culture is in the inspection program. In FDA's words, not a consultant's.

That matters because culture is not measured by asking about it. It is inferred from artifacts, and your quality system produces artifacts continuously whether anyone is watching or not.

FDA has also been steadily pulling ICH into these programs. Recent revisions to related compliance programs incorporate ICH Q9(R1) on risk management, Q10 on the pharmaceutical quality system, and Q12 on lifecycle management. The lens is risk and lifecycle. It has not been a checklist for a long time.

**Everything below this line is my read, built from years of hosting these visits and doing this work. It is not an FDA list and FDA has not published it as one.**

Deviations tell you the most, because they are the hardest to stage

Here is what I look for, and what I watched investigators look for.

Scope. Pull twenty investigations and count how many concluded the event was limited to one batch, one lot, one operator, or one shift. Then count how many document why the boundary was drawn there. If those two numbers are far apart, the site narrows scope by habit, not by evidence. That gap is visible in an afternoon.

Root cause language. When human error dominates the root cause field, the investigations stopped at the first answer that fit. I understand why it happens. Human error closes fast, it satisfies the reviewer, and it does not require anyone to look upstream at a procedure, a training program, or a supervisor's workload. It is also almost never the actual root cause. The real question is why the system let the error happen and then failed to catch it, and that question makes people uncomfortable, which is precisely why it gets skipped.

How the record was built. Investigations written to reach a conclusion read differently from investigations written to find one. The sequence gives it away. Did the record gather evidence and then land somewhere, or did it state a conclusion and then assemble support?

Repetition. Same equipment. Same process step. Same failure mode. Each one closed as isolated. Read one at a time, they are unremarkable. Read in sequence, they are a trend the site failed to see, and an investigator reads them in sequence.

Your CAPA metric is hiding your CAPA problem

Most sites report on-time closure as a single percentage. I have presented that number in management review myself. It is close to useless on its own.

Chart the closure dates against the due dates instead. If your closures pile up in the final few days before the deadline and almost nothing closes early, your CAPA system is being managed to the calendar. Everyone in the room already knows that. The chart just makes it undeniable.

Extensions are worth a hard look too, and not in the direction people expect. A very low extension rate paired with high on-time closure sounds like a strength. In my experience it usually means scope was set to fit the timeline rather than the problem.

Then there are effectiveness checks, which are where I would start if I only had an hour. Two questions:

Do your checks verify the action was completed, or that the failure can no longer occur? Those are completely different exercises and only the second one is an effectiveness check.

And how many have failed in the last two years? If the answer is zero, that is not a healthy system. A quality system that never catches its own inadequate CAPA is not detecting anything.

The last one is the hardest to look at. Find a CAPA that closed, then find the same event recurring six months later opened as a new and unrelated deviation. Every organization has one. It is the cleanest proof available that the original root cause was never found.

Change control backlog is a state-of-control problem, not a paperwork problem

This is the signal sites most consistently underestimate. The backlog gets treated as an administrative queue that quality will get to eventually.

It is not administrative. An aging open change means your facility is running in a configuration that has been approved in concept but not fully implemented, verified, or documented. The gap between your validated state and your actual state widens every week that record stays open.

Three versions of this show up over and over:

The change happened on the floor months ago and the record is open pending documentation. You are operating in a state your own quality system has not confirmed.

The change was approved and never implemented. That one raises a different question, which is how it got approved without being resourced.

The change closed administratively with effectiveness verification deferred indefinitely. At that point change control has quietly become a notification system.

There is also a resourcing story buried in that queue. A large aging backlog is quantitative evidence that the quality unit does not have the capacity the quality system assumes it has. That is a leadership question, and it does not get solved by telling the quality team to work faster.

All-green metrics

A management review package where every indicator is favorable, every trend improves, and nothing has ever tripped an action is not a healthy quality system. It is a measurement system that cannot detect problems.

Manufacturing produces variation. Always. If your metrics never show an adverse trend, you are either measuring the wrong things, setting thresholds nobody can breach, or filtering the signal somewhere between the floor and the slide deck.

Watch for the related pattern too: a metric that improves right after a target gets attached to it, with no corresponding change in the process. That is not improvement. That is a measurement artifact, and it is obvious to anyone who compares the metric against the underlying data.

What holding together actually looks like

Coherence is not a clean file. I want to be clear about that, because sites hear this and start trying to reduce their deviation count, which is the wrong move and occasionally a dangerous one.

Coherence means what you say, what your records show, and what your data supports all point the same direction.

A coherent system has investigations with honest scope and root causes that name system failures. CAPA closures spread across the interval instead of stacked at the deadline. Effectiveness checks that sometimes fail. A change control backlog that is small, visibly aged, and openly discussed at management review. Documents that come out of the controlled system fast. Adverse trends that reach management review with a decision attached.

I have seen sites with real, serious problems come through an inspection better than sites with fewer problems and a system that did not hold together. The first site demonstrated a quality system that found its own issues. The second one left the investigator wondering what else the system was missing. That second question is the expensive one.

Read your own system first

None of this requires an outside party. Run these:

1. Pull the last fifty closed deviations. What percentage list human error as root cause, and what percentage document why scope was bounded where it was?
2. Chart CAPA closure dates against due dates. What is the shape?
3. How many effectiveness checks failed in the last two years and triggered rework?
4. What is the age of your oldest open change control, and can anyone explain it in one sentence?
5. How many changes are live on the floor but still open in the system?
6. Pick a batch record from eighteen months ago and time the retrieval.
7. Open your last four management review packages. Which metric ever triggered an action, and what happened?
8. Which deviations from the last two years describe the same failure mode, and were any of them linked?

Where the answer is uncomfortable, you have found something. Finding it yourself is the whole advantage.

Where Bayou Vantage fits

Investigators start reading your quality system before the opening meeting is over. Most organizations have never read their own system that way.

Bayou Vantage assesses documentation patterns, investigation quality, CAPA durability, and change control health the way an experienced investigator would, then translates what we find into decisions your leadership can act on.

[Start a conversation](/contact)

Regulatory context:

FDA, Compliance Program 7356.002, Drug Manufacturing Inspections, CDER, Chapter 56 Drug Quality Assurance. Establishes the six-system inspection model and the Full and Abbreviated inspection options.

FDA, Guidance for Industry: Quality Systems Approach to Pharmaceutical CGMP Regulations.

ICH Q9(R1) Quality Risk Management; ICH Q10 Pharmaceutical Quality System; ICH Q12 Technical and Regulatory Considerations for Pharmaceutical Product Lifecycle Management, each adopted as FDA guidance and referenced in current CDER compliance programs.

Statements attributed to FDA above come from the compliance program and associated guidance. The signals, the coherence framework, and the self-diagnostic questions are my own analysis and are not FDA requirements. Compliance programs are revised periodically; verify current versions on FDA's website.