Inspection Readiness: The 90-Day Plan

Why ninety days

A quality director gets the call on a Tuesday. The site is on the list. Nobody knows the date, but the window is real, and the honest internal answer to "are we ready?" is somewhere between "mostly" and "we'd rather not find out." So the team does what most teams do: a frantic sweep of open CAPAs, a scramble to close overdue training, and a lot of printing.

Ninety days later the inspection happens anyway, and the finding is not about any of the things that got swept. It's that an investigator asked for the training record behind one operator's signature on one batch record, and it took forty minutes and three people to produce it. That's the gap this plan is about.

Why ninety days specifically? Not because any regulation says so — no agency prescribes how long you should spend preparing. It is a practical window. A quarter is long enough to find your retrieval problems, fix the ones that matter, and prove the fix held. It is short enough that whoever committed to something in week two still remembers it in week eleven. Compress it much further and you are triaging rather than fixing; stretch it much longer and the early work has decayed by the time anyone actually arrives.

It is also long enough to do the one thing that actually predicts an inspection outcome: rehearse. Not review the SOPs — rehearse the act of being asked for something and producing it while somebody waits.

A note on scope. The plan itself is regulator-agnostic — an MHRA inspector, a notified body auditor and an FDA investigator all ask the same underlying question, which is whether you can produce a complete, current record on request. What differs is the paperwork that follows. This guide uses FDA's post-inspection machinery for its worked examples, because the Form 483 and the NAI/VAI/OAI classifications are publicly documented and specific enough to plan against. If you are preparing for an MHRA inspection, the phases and gates transfer directly; the outcome vocabulary and the response mechanics do not, and you should read those from the relevant MHRA guidance rather than mapping them onto the FDA terms below.

What the outcome actually is

Before planning backwards from an outcome, it helps to be precise about what the outcomes are. FDA assigns every inspected firm a final classification:

Classification	What FDA says it means	Was a 483 usually issued?
NAI No Action Indicated	The facility is in an acceptable state of compliance.	Usually not.
VAI Voluntary Action Indicated	The inspection found objectionable conditions or practices, but the agency has determined the facility can voluntarily correct its deficiencies and will not recommend any action.	Usually yes.
OAI Official Action Indicated	The facility is in an unacceptable state of compliance.	May have been.

That classification does not arrive on the day the inspectors leave. FDA states its final inspection classification is usually sent to the firm within 45 to 90 days from the close of an inspection, depending on inspection type — so the weeks after a visit are their own waiting period, and what you sent in response is still working on your behalf during it.

Two things follow from that table. First, a Form 483 is not the outcome — it is an input to the outcome. FDA is explicit that a 483 does not constitute a final Agency determination of whether any condition violates the law, and that it is considered alongside the Establishment Inspection Report, the evidence collected on site, and your response.

Second, the gap between VAI and OAI is very often about response quality rather than the raw severity of what was observed. That is where a ninety-day plan pays off twice: it reduces what gets observed, and it leaves you with an organised evidence base to respond from when something is.

What a 483 is not

It is not an all-inclusive list of every deviation at your site. FDA instructs investigators to note only what they saw during that inspection — and tells firms they are responsible for addressing the cited conditions and any related non-cited objectionable conditions that might exist. Reading a 483 as the complete list of your problems is a mistake teams make in both directions: relief that it was short, or panic that it was long.

Phase one, days 1–30: inventory the evidence

The first thirty days are not about fixing anything. They are about finding out, honestly, what you can produce and how fast. Teams that skip straight to remediation almost always remediate the wrong things — the visible backlog rather than the retrieval failure.

Work through the record types an investigator actually asks for, and for each one answer three questions: can we produce it, is it current and complete, and how long did that take? The third question is the one that gets skipped, and it is the one that predicts the inspection.

Phase one gate — you pass when

Every record type on the list has a named owner, not a department

You have a measured retrieval time for each — measured, not estimated

Every gap is written down as a gap, with no argument attached about why it is fine

You know which records live outside a controlled system entirely

The output of phase one is a list of gaps, not a list of excuses. If the honest retrieval time for a batch record's associated training evidence is forty minutes, write forty minutes. The plan cannot fix a number you have rounded down.

Our inspection readiness checklist is built for exactly this phase — twenty record types, a Ready / Gap / N-A rating, and a retrieval-time column on each.

Phase two, days 31–60: close gaps and rehearse

Phase two splits into two streams that run at the same time, and the second one is the one teams cut when they get busy. Don't.

Stream A — close the gaps. Take the phase-one list and work it in risk order: records tied to product release and patient safety first, then the quality-system records that show your process is under control, then the rest. Each gap gets an owner and a date, and the date is real.

Stream B — rehearse the ask. Pick records at random. Have someone who is not the record's owner request them the way an investigator would: "show me the current effective SOP for this operation, its revision history, and the training records for everyone who performed it last month." Time it. Do it again next week with different records.

Rehearsal surfaces a category of problem that no checklist finds: the record is retrievable in principle, but only by one person, who is on leave. Or the system produces it in a format nobody can read on a projector. Or it comes back complete but with an unexplained gap in the audit trail that now needs a story.

Phase two gate — you pass when

Every high-risk gap from phase one is closed or has a dated, owned plan with evidence of progress

At least three unannounced retrieval rehearsals have been run, timed, and recorded

Retrieval no longer depends on any single named person

The audit trail for a rehearsed record was reviewed and explains itself without narration

The rehearsal nobody wants to run

Ask for a record whose owner has left the company. That is the one that finds your real dependency — on a person, an inbox, or a local drive — and it is the exact scenario an inspection will eventually create for you. Better to find it in week six.

Phase three, days 61–90: hold steady

The last thirty days are about not undoing the first sixty. The failure mode here is specific and common: the site gets so focused on inspection preparation that normal quality work backs up, and the backlog you cleared in phase two quietly rebuilds behind you.

Freeze what you can, and document what you cannot. Major system changes and process changes in the last month are a risk. Where a change must go ahead, run it through change control properly — a well-documented change is not a finding, but an undocumented one is.
Keep the metrics visible. Overdue CAPAs, overdue training, open deviations past their target date. These are the numbers an investigator can compute from your own system, so you should be computing them first.
Brief the people who will be in the room. Not scripts — scope. Who answers what, who fetches records, who is authorised to commit to a corrective action, and the discipline of answering the question that was asked rather than the one you prepared for.
Re-run the phase-one inventory. Same list, same measurement. If retrieval times have not improved, the plan did not work and you still have thirty days to find out why.

Phase three gate — you are ready when

The phase-one inventory re-run shows measurably faster retrieval, not just fewer open items

Overdue CAPA and overdue training counts are current, known, and explainable

Front-room and back-room roles are assigned and the people know them

Nothing in the last thirty days went in without change control

If the inspection produces a 483

A 483 at close-out is not a verdict, and the ninety days you just spent are what make the response credible. FDA discusses the form with company management at the conclusion of the inspection, reading and discussing each observation so there is a full understanding of what it means — so nothing on the form should be a surprise by the time you are drafting.

On timing, the number that matters is 15 business days, and it is worth knowing exactly what it buys you. Under FDA's Review of Post-Inspection Responses program (74 FR 40211), the agency generally allows firms 15 business days to respond to 483 observations before issuing a Warning Letter. Respond inside that window and FDA plans to conduct a detailed review of your response before deciding whether a Warning Letter is warranted. Respond after it, and the agency will not ordinarily delay issuing the letter in order to read what you sent.

So it is not a statutory deadline, and missing it is not itself a violation — but it is not merely advisory either. It is the window in which your response still influences the decision. FDA's own guidance to inspected firms elsewhere puts it as responding in writing within 15 days of the 483 being issued, with the corrective action plan and supporting documentation; the 15-business-day program is the one that governs the Warning Letter timing.

Two habits separate responses that land from responses that don't. The first is answering the observation that was written, not the one you wish had been written. The second is committing only to dates you will hit — a missed commitment in a response is worse than an honest longer timeline, because it becomes its own finding at the follow-up.

For the mechanics of building the response itself, use the 483 response template, and read FDA Form 483 examples for how observations are actually worded.

What to ask a vendor if a system is in scope

If a computerised system holds the records an investigator will ask for, its behaviour becomes part of your readiness. These are the questions worth asking — of any vendor, including us — and every one of them is answerable by watching the software rather than reading a datasheet.

Show me a record retrieved from a cold start: log in, find it, open it, export it. How long did that take, and how many systems were involved?
Show me the audit trail for that record. Can I read who did what and when without an interpreter?
Change a record, then try to edit or delete its audit-trail entry. What does the system do?
Show me a record and the linked records around it — the deviation, its CAPA, the change that followed, the training that was reassigned. Are they connected, or are they four separate searches?
What validation artefacts ship with the platform, and what is left for us to produce?
When you release a new version, what tells us what changed and what evidence arrives with it?

Complere is built around the connected-records answer to question four: deviations, CAPAs, change control, documents, training, and audits live in one workspace with links between them, each carrying an immutable audit trail — database-enforced, so audit records cannot be modified or deleted. That is the difference between producing a record and reconstructing a story about it.

For a broader vendor evaluation, pair this with how to evaluate an eQMS and the GAMP 5 categories guide.

The plan on one page

Phase	Focus	Typical owner	The gate
Days 1–30	Inventory the evidence. Measure retrieval time honestly. Name an owner per record type.	QA lead, with system owners	Every record type owned, timed, and its gaps written down.
Days 31–60	Close gaps in risk order. Run unannounced retrieval rehearsals in parallel.	Gap owners, QA coordinating	High-risk gaps closed or dated; three rehearsals timed; no single-person dependencies.
Days 61–90	Hold the line. Keep metrics visible. Brief the room. Re-measure.	Site quality leadership	Re-run inventory shows faster retrieval; roles assigned; nothing uncontrolled shipped.

The downloadable 90-day plan carries this as a working sheet — phased tasks, owners, due dates, and a gate check at the end of each phase.