Preparing for your first FDA inspection after clearance or approval

An FDA inspection of a medical device manufacturer is an on-site examination of your quality management system, conducted under section 704 of the Federal Food, Drug, and Cosmetic Act, to determine whether your company meets the requirements of the Quality Management System Regulation (QMSR) at 21 CFR Part 820 and the other FDA regulations that attach to a marketed device. An investigator arrives, works through a defined set of quality system areas, and leaves with either nothing, a list of observations, or the basis for a regulatory action.

If you have a device on the market and haven't been inspected yet, the process that will be applied to you changed on Feb. 2, 2026. FDA retired the Quality System Inspection Technique, known as QSIT, on the day the QMSR took effect, and replaced it with Compliance Program 7382.850, Inspection of Medical Device Manufacturers. The same document also absorbed the old premarket approval inspection program, 7383.001, so a single compliance program now governs surveillance, for-cause, and PMA inspections alike.

Most of the published advice on FDA inspection prep still describes QSIT's four subsystems and the sampling tables that went with them, but that advice is out of date. What follows is the current process as FDA documents it, in the order it happens, with the named forms and records at each stage.

BONUS RESOURCE: Click here to download your free QMSR inspection readiness checklist!

What is FDA inspecting you against?

The answer is Compliance Program 7382.850, a document that FDA uses as internal instructions for its own field and center staff, which is different from an industry guidance document. Karen Masley-Joseph, Senior Advisor in the Office of Medical Device and Radiological Health Inspectorate, drew that line explicitly at FDA's April 1, 2026 town hall on the program: compliance programs reflect FDA's internal procedures. They aren't guidance, and FDA posts them for transparency. The program itself says it creates no rights and binds neither FDA nor the public.

However, for a quality team, the compliance program is still the most detailed public description of exactly what an investigator has been told to do inside your building. FDA also confirmed at the town hall that nothing further is coming. Asked whether a replacement for QSIT would be published to supplement 7382.850, Keisha Thomas of CDRH's Office of Product Evaluation and Quality said no additional document would be issued in place of, in lieu of, or in addition to the compliance program for QMSR inspections. The program is the whole picture. Eric Henry of Rook Quality Systems walked through the practitioner side of it in our webinar on inspections under the QMSR.

The compliance program contains two major themes. The first is total product life cycle, meaning FDA assesses the device from design and development through postmarket surveillance, rather than treating those as separate exercises. The second is benefit-risk, meaning compliance and enforcement decisions account for the device's benefits and risks to patients, including patient perspectives where reliable information exists. We’ll explore the implications of those two themes later in this guide.

When can you expect your first inspection?

Part II of the compliance program lists the priorities FDA's Office of Inspections and Investigations uses when scheduling. In order: PMA preapproval inspections under the Medical Device User Fee Amendments, compliance follow-up and for-cause inspections, manufacturers of Class III devices that have never been inspected, manufacturers of high-risk devices, and PMA postmarket inspections.

For the fourth category, FDA identifies high-risk manufacturers by product codes for implantable, life-sustaining, or life-supporting devices, by devices with a higher frequency of recalls and medical device reports, and by newly marketed devices such as recent 510(k) clearances or De Novo classifications. A recent clearance is a documented scheduling input, not an incidental detail. The clearance letter that put your device on the market also raised your profile in the system that decides who gets inspected.

Two other factors shape the timing of inspections. Class I manufacturers receive the lowest inspectional priority and shouldn’t be routinely scheduled unless a for-cause assignment or an apparent health hazard applies. And surveillance inspections aren't conducted at manufacturer sites actively enrolled in the Medical Device Single Audit Program (MDSAP), because FDA uses MDSAP audit reports as a substitute for its own surveillance inspections. Enrollment doesn't buy immunity, though. All manufacturers remain subject to non-surveillance inspections, and MDSAP participants can still be inspected under a compliance follow-up, for-cause, or specific product risk assignment.

The seven inspection types and the two models

The compliance program names seven inspection types and assigns each one of two inspection models. The type tells you why FDA is there. The model tells you how much of your quality system will be examined before the investigator can close the inspection.

The seven types of inspection are:

1. Non-baseline surveillance

2. Baseline surveillance

3. Compliance follow-up

4. For-cause

5. Specific product risk assignment

6. PMA preapproval

7. PMA postmarket

Inspection Model 1

Model 1 is the broad-coverage approach. The investigator identifies the product risks that could adversely affect patients or users, then selects at least one element from each of the six QMS areas and evaluates the related requirements, plus the applicable other FDA requirements and a set of general items.

The effect is a real departure from QSIT. Under the old technique, an abbreviated inspection could touch a subset of subsystems. Under Model 1, every main part of your quality system gets evaluated to some extent on every inspection. Masley-Joseph called that out directly at the town hall as one of the differences between the new process and QSIT, and tied it to ISO 13485's process approach to quality management.

Model 1 applies to non-baseline surveillance, compliance follow-up, for-cause, specific product risk assignment, and PMA postmarket inspections.

Inspection Model 2

Model 2 goes deeper. Rather than one element per area, it names the specific minimum elements an investigator must evaluate. Design and development alone expands into seven:

• Inputs

• Outputs

• Review

• Verification

• Validation

• Software validation

• Transfer

Measurement, analysis, and improvement expands into another seven:

• Analysis of data

• Control of nonconforming product

• Complaint handling

• Feedback

• Internal audits

• Corrective action

• Preventive action

Management oversight adds management review, the medical device file, and planning of product realization. Change control requires product and process changes. Production and service provision requires validation of processes, control of production and service provision, identification and traceability, and, for sterile products, the sterilization and sterile barrier element. Outsourcing and purchasing requires the outsourcing element.

Model 2 applies to baseline surveillance inspections and PMA preapproval inspections, the two situations where FDA has either no inspection history to rely on or a pending application to decide.

Which model will you get?

A baseline surveillance inspection is defined as one conducted at a manufacturer with no history of an FDA device inspection or MDSAP audit, or where risk factors indicate a need for baseline evaluation. If you've never been inspected and you're not enrolled in MDSAP, that's your category, and it uses the deeper of the two models.

Plan accordingly. A first inspection after your device in on the market is, by default, the most comprehensive type of surveillance inspection FDA conducts. Anyone budgeting prep time against the assumption that a first visit will be a light touch has the logic backwards.

Remember that both models describe minimums rather than ceilings. In the same town hall we referenced earlier, CAPT Kimberly Lewandowski-Walker, Regulatory Officer on the FDA Inspections and Regulatory Audits Team in CDRH's Office of Regulatory Programs, stressed the words minimum and flexible when asked when an inspection expands past the required elements. Investigators routinely examine additional elements, and FDA doesn't consider that an expansion of scope. It's how the approach is designed to work.

What an FDA investigator will look at

Diagram 1 of the compliance program organizes the QMSR's requirements into six quality management system areas and one hexagon holding four other applicable FDA requirements, with patients and users at the center and a ring of risk management around them. Each area breaks into elements, and each element ties to one or more specific requirements, mostly ISO 13485:2016 clauses with the QMSR's supplemental provisions layered in. Attachment A of the program maps every one of those relationships in tables, and it's the single most useful part of the document for a team trying to anticipate what gets examined.

Source: CP 7382.850 Inspection of Medical Device Manufacturers Part III, Diagram 1

The six quality management system areas

1. Change control covers changes to the quality management system itself and changes to software, products, processes, and purchasing.

2. Design and development runs from design inputs and outputs through review, verification, validation, software validation, and transfer.

3. Management oversight includes the quality management system, management review, the medical device file, planning of product realization, and the risk-based approach required by Clause 4.1.2(b).

4. Measurement, analysis, and improvement holds complaint handling, feedback, internal audits, analysis of data, control of nonconforming product, and both corrective and preventive action.

5. Outsourcing and purchasing covers outsourced processes and the purchasing process.

6. Production and service provision includes process validation, control of production and service provision, identification and traceability, and the sterilization and sterile barrier element for sterile products.

The four other applicable FDA requirements

FDA calls these OAFRs, and they're evaluated on every risk-based inspection unless they don't apply, with PMA preapproval inspections for devices not yet on the market being the exception. They are:

1. medical device reporting under 21 CFR Part 803

2. Reports of corrections and removals under Part 806

3. Medical device tracking requirements under Part 821

4. Unique device identification under Part 830

Section 820.10(b) of the QMSR is what ties each of these back to a specific ISO 13485 clause, which is why they sit alongside the quality system areas rather than inside them.

The OAFR review has specifics that can catch newly commercialized companies. For medical device reporting, the investigator reviews your reports in the MAUDE database before arriving, then verifies that your procedures actually identify reportable deaths, serious injuries, and malfunctions, and that submitted reports carry the unique device identifier. For corrections and removals, the investigator determines whether you've initiated any since the last inspection, verifies you've documented a record for non-reportable ones, and confirms that your justification for not reporting was appropriate. For UDI, the investigator confirms the label carries both plain text and automatic identification and data capture formats, and checks that the data elements you submitted to the Global Unique Device Identification Database match what's actually on the label.

The general items checked on most inspections

Four items get reviewed on most inspections regardless of model: registration and listing, marketing authorizations, observations from previous Form FDA 483s or open compliance issues, and anything specified in the inspection assignment. For a first inspection, the third is blank and the other three are live.

What happens in an FDA inspection under QMSR, start to finish

The compliance program directs investigators to review multiple data sources before setting foot in your facility. Those sources include your medical device reports, your reports of corrections and removals, your device identifier records in the Global Unique Device Identification Database, consumer complaints and allegations of regulatory misconduct, your Total Product Life Cycle report, and the Compliance Management System for open compliance actions, entry refusals, reconditioning activities, and import sample results.

Everything in that list is either public or already in FDA's hands. The investigator forms a view of your product risk profile from it before the first conversation happens. A company whose MAUDE record and GUDID entries disagree with its own labeling has given the investigator a starting point before arrival.

The pre-announcement call

FDA's guidance on device establishment inspection processes and standards, issued June 29, 2020 under the FDA Reauthorization Act of 2017, sets what happens next. An investigator telephones the owner, operator, or agent in charge before the facility undergoes inspection. For domestic inspections, that pre-announcement should be no less than five calendar days in advance. For foreign inspections it's generally longer, because of country clearance requirements.

The notification call should tell you the type and nature of the inspection, including whether it's scheduled as surveillance or pre-approval. The investigator should discuss the planned timeframe and duration, including the working hours during which the inspection is likely to happen. And FDA should, to the extent possible, give advance notice of some of the records that may be requested, such as certain procedures and their associated records.

FDA's standard for a reasonable estimated inspection timeframe generally runs three to six continuous business days, based on the type of surveillance inspection and the extent of coverage needed. The estimated duration is supposed to be shared with you during the pre-announcement. Duration gets extended for reasons including the complexity of your operations, the availability of knowledgeable staff, the nature of observed deficiencies, and FDA follow-up on recalls, medical device reports, and complaints the agency has received.

However, FDA retains authority to conduct unannounced for-cause inspections, and the uniform processes don't apply to them. And for a PMA preapproval inspection, the investigator is directed to ask during pre-announcement whether the process validations tied to the application are complete. If you say no, the inspection will be delayed until they are.

Day one and the FDA 482

A domestic inspection opens with the investigator presenting an FDA 482, the Notice of Inspection. From there the shape of the day is familiar to anyone who has been through a QSIT inspection: a facility tour, questions about how products and processes work, discussion of what the site does and who is responsible for what, review of quality data and documents, interviews with staff, and observation of processes in action.

Masley-Joseph described those as the same activities investigators have always conducted, now performed in a way that assesses QMSR requirements using the process in the compliance program. The arrival ritual hasn't changed. What the investigator does with the next several days has.

One early item is your company’s role. The investigator needs to understand whether you're a specification developer, a finished device manufacturer, or something else, because that determines which requirements apply to you at all. A company that outsources design or manufacturing should expect the outsourcing and purchasing area to carry more weight, and should have its supplier agreements and its design and development file accessible even when the work happened somewhere else.

How the investigator decides where to look

No real equivalent to this stage existed under QSIT, but it determines where the rest of the inspection goes.

The investigator identifies the product risks that could adversely affect patients or users, then reviews your risk management documentation throughout the inspection to understand those risks and how they're controlled. Based on that review, the investigator will select an element inside a quality system area or OAFR and evaluate the related requirements. The areas don't have to be examined in any particular order.

During the compliance program town hall, Tonya Wilbon, Assistant Director for Postmarket Industry Education and Consumer Education in CDRH, described what gets pulled: risk management files and reports for the selected products, risk analyses identifying hazards and harms, documentation showing how risk controls were implemented, evidence that those controls are effective, and records demonstrating risk management across the product lifecycle.

Your risk management file is now the index to your entire inspection. If it's thin, generic, or disconnected from your design outputs and your complaint data, the investigator has no map, and the usual response to a missing map is to look at more things rather than fewer. The QMSR requires you to document one or more processes for risk management in product realization under Clause 7.1, which most manufacturers build on ISO 14971:2019, and separately to apply a risk-based approach to controlling quality system processes under Clause 4.1.2(b).

Record review, element by element

Asked whether investigators would still apply a statistical sampling plan, Wilbon said no, and pointed to Part III.1.B.(3) of the compliance program. Investigators conduct records review, not sampling of records. Records are selected based on the identified product risks and the investigator's experience and professional knowledge, and in most cases multiple records are reviewed for a given requirement to give the investigator assurance that risks are adequately controlled.

For teams that prepared for QSIT by building sampling tables and pulling a defensible number of records per subsystem, that preparation no longer maps to how the review is run. Depth now follows risk.

For instance, under Model 1, the investigator may ask to review your complaint databases and other quality data sources early in the inspection. Later, if the investigator chooses to evaluate the complaint handling element inside measurement, analysis, and improvement, they may request interviews with personnel, record review, or observation of the process. And because complaints are a form of feedback under Clause 8.2.1, the investigator may separately evaluate how complaints feed into risk management as an input.

That last move, following a complaint into the risk management process, is where disconnected systems become visible.

Daily discussion of observations

FDA's updated processes call for regular verbal communication during the inspection about its status. Where time and circumstances permit, investigators should make every reasonable effort to discuss all observations with the owner, operator, or agent in charge as they're observed, or on a daily basis, to reduce errors and misunderstandings. Those discussions can include observations that won't end up on a Form FDA 483 but need clarification. Either party may record these communications, provided there's advance notice and mutual consent.

The closeout meeting and the FDA 483

If the investigator finds significant problems, you receive a Form FDA 483 listing the inspectional observations. You can annotate the form at the time or respond in writing afterward, and both remain available under the new program.

One limit is specific to design and development. Observations relating to design and development placed on a 483 are limited to the adequacy of, and adherence to, the procedures and controls you established. Investigators are not supposed to place observations on the 483 concerning the adequacy, safety, or efficacy of a particular design. Design concerns of that kind get discussed verbally, documented, and sent to the review office instead.

A similar limit applies to premarket authorization. Observations about a lack of premarket authorization go on the 483 only when the investigator has obtained concurrence from CDRH.

The 15 business days after the 483

FDA has stated that if the agency receives a response to 483 observations within 15 business days of issuance, it plans to conduct a detailed review of that response before determining whether to issue a warning letter, and a warning letter issued afterward will acknowledge the response and address the apparent adequacy of the corrective actions. If the response arrives later than 15 business days, FDA doesn't plan to routinely address the adequacy of your corrections in the warning letter and won't ordinarily delay issuing one in order to read what you sent.

For complex observations you can't close inside that window, the expectation is a response that still arrives on time and sets out a corrective action plan with a realistic timetable, rather than a complete response that arrives late.

Classification and the establishment inspection report

Part V of the compliance program covers what happens after the investigator leaves. Every inspection receives one of three classifications.

1. No Action Indicated means no objectionable conditions or practices were observed.

2. Voluntary Action Indicated means objectionable conditions were documented but don't meet the threshold for regulatory action.

3. Official Action Indicated means objectionable conditions were observed and regulatory action is recommended.

The program guides that decision with two situations.

• Situation 1 gives examples pointing toward an initial OAI classification where evidence supports a significant deficiency or a pattern of deficiencies across one or more areas. Two of those examples were presented at the town hall, and both are risk failures: failure to establish, implement, or maintain one or more processes for risk management in product realization under Clause 7.1, and information gathered through feedback or postmarket surveillance that isn't used as an input into risk management under Clause 8.2.1. Seven more examples appear in Part V.

• Situation 2 gives examples for an initial VAI classification, where findings reveal less significant deviations indicating a low probability that nonconforming or defective product will reach patients.

Lewandowski-Walker confirmed that the threshold for taking compliance action hasn't moved with the QMSR. The framework for evaluating compliance was updated, the examples were rewritten to reflect the new requirements, and the regulatory requirements that determine when action is warranted stayed the same.

When action is warranted, the program sets out a ladder running from advisory measures such as untitled letters, warning letters, and regulatory meetings, through administrative actions including civil money penalties, administrative detention, citations, and recall authority under section 518 of the FD&C Act, to judicial actions such as seizure, injunction, and prosecution.

Separately from classification, you can obtain the narrative establishment inspection report for your own inspection. FDA's Office of Medical Device and Radiological Health Inspectorate maintains the criteria and instructions, under Field Management Directive 145, for releasing one copy of the report to the firm's top management official or designee.

Management review, internal audit, and supplier audit records

Under the old Quality System Regulation, 820.180(c) exempted management review records, internal audit reports, and supplier audit reports from FDA review. That exemption is gone.

For baseline surveillance and PMA preapproval inspections, these processes are expected to be reviewed. For other inspection types, the records may be reviewed depending on the inspection's focus and which elements the investigator selects.

Read that against the model assignments and the implication for a first inspection is direct. Baseline surveillance is Model 2, Model 2 names internal audits and management review as minimum elements, and FDA expects to review them. If you've been writing management review minutes on the assumption that FDA would never read them, that assumption expired on Feb. 2, 2026. The same goes for an internal audit program that was built to satisfy a notified body, which is worth rechecking against an internal audit checklist scoped to QMSR requirements rather than to ISO 13485 alone.

A related point can trip up companies with a CE mark. A notified body audit focused on ISO 13485 conformity assessment can't replace an internal audit of QMSR requirements, because the QMSR includes all the requirements of 21 CFR Part 820 along with its supplemental provisions. Notified body findings can inform and strengthen your internal audit program, help you identify areas for deeper internal review, and shape your audit planning. They don't satisfy the internal audit requirement under Clause 8.2.4, and they don't follow your own documented internal audit procedure, which is what that clause obligates you to run.

Do old records have to be rewritten?

Nothing in the QMSR requires you to go back and rewrite history. Manufacturers don't need to revise or recreate records created before the effective date, don't need to add ISO 13485 references or language to older documents, and don't need to remove QSR-era terms such as design history file or device master record from historical records.

The obligation runs forward instead. FDA expects you to identify where your processes need to change to meet the QMSR and to develop a plan for those changes. If a gap analysis of pre-QMSR records reveals a real deficiency, the example FDA used being feedback that was never fed into the risk management process, you're expected to develop and implement a plan to close it. And older records remain fair game for review if the inspection leads there.

Your website and your marketing claims

The general items include marketing authorizations, and the specifics are broader than most quality teams expect. During an inspection, the investigator verifies that you've implemented controls ensuring products receive FDA marketing authorization before release for distribution, and that changes to the device are evaluated for their impact on that authorization. The investigator also reviews product labels, labeling, marketing materials, company websites, and social media to evaluate whether your marketing and promotion stays inside the cleared indications for use.

For a company in its first year on the market, that can be an issue. Commercial teams write claims and websites are often updated faster than labeling. Device manufacturers are required to submit a premarket notification for any device in commercial distribution that's about to be significantly changed or modified where the change could significantly affect safety or effectiveness, or where there's a major change in intended use, under 21 CFR 807.81(a)(3). An investigator who finds a website claim outside the cleared indications has found evidence relevant to both your 510(k) status and your change control process.

Registration and listing

Registration and listing is reviewed as part of the pre-inspection work and again during the inspection, where the investigator reviews a sample of your device listings to determine whether they're accurate. Failures to register, to register accurately, or to list all your devices will be discussed with management and documented in the establishment inspection report. These are among the easiest findings to prevent and among the most common to inherit from a busy launch year.

How to prepare for your first FDA inspection: tracing a risk

FDA’s own advice on preparing for a risk-based inspection starts with the unglamorous version: meet the QMSR requirements that apply to your product, and be ready to discuss and produce the records that demonstrate it.

The more specific exercise is an internal audit that evaluates how risk management is actually integrated through product realization, and whether a risk-based approach controls your quality system processes. In practice that means starting with an identified patient risk, following its risk controls through every process they touch, and being ready to show that the risk-based decisions along the way were justified, documented, and acted on.

Run that trace once, end to end, before the pre-announcement call comes. Start at a hazard in your risk analysis, then follow the control into your design inputs and outputs, through design verification and validation, into the process validation and production controls that hold it in place, out into complaint handling and postmarket feedback, and back into risk management where field data updates the estimate. A team that can walk an investigator along that path demonstrates the connected, risk-driven system 7382.850 was built to evaluate. If the path breaks in three places, you’ve found your own 483 before FDA did.

What to have ready

Work from the Model 2 element list rather than from a generic audit checklist, since Model 2 is what a first inspection most often follows. The records most likely to be requested are:

• Risk management file and risk management reports for the selected products

• Design and development file: inputs, outputs, review records, verification, validation, software validation, and transfer

• Medical device file and your planning of product realization

• Management review records and the procedure behind them

• Internal audit records, schedule, and procedure

• Supplier and outsourcing records, including supplier audits and quality agreements

• Complaint files, feedback records, and your analysis of data

• Nonconforming product records and corrective and preventive action records

• Process validation records, including sterilization and sterile barrier validation for sterile products

• Medical device reporting procedures and the reports you submitted

• Corrections and removals records, reportable and non-reportable alike

• UDI records and your GUDID entries

• Establishment registration and device listings

• Training and competence records

On training management, the effectiveness standard is proportional. Under Clause 6.2, personnel must be competent on the basis of education, training, skills, and experience, and you must evaluate the effectiveness of actions taken to achieve or maintain that competence, and the method should match the risk of the work. Higher-risk processes may call for supervisor evaluations, skill assessments, hands-on demonstrations, or ongoing performance monitoring. Lower-risk work can be verified more simply. Completion records alone don't demonstrate effectiveness at any risk level. For the underlying program design, including competence matrices and retraining triggers, see the full guide to training management.

A note on administrative processes, because this question comes up constantly. The risk-based approach under Clause 4.1.2(b) applies to all quality system processes, including document control and training, but it isn't the same thing as the formal risk management documentation required under Clause 7 for product realization. You don't need to create separate risk assessments for administrative processes. Instead, decisions about those processes should reference the existing risk management documentation for the related product or process, and the decision should be documented. For example: deciding how often to retrain staff on a manufacturing procedure shouldn't produce a standalone training risk assessment, it should reference the documented risk of the procedure being trained on.

Do you have to document a culture of quality?

The QMSR preamble frames top management's responsibility in cultural terms, and the compliance program quotes it: a culture of quality meets regulatory requirements through a set of behaviors, attitudes, activities, and processes.

However, manufacturers don't need to take special steps to document a culture of quality for an inspection. FDA examines the decisions you made and the actions you took across the quality system, and using risk information to make appropriate risk-based decisions is itself the evidence. Your quality culture is read from the operating record, not from a slide.

How a connected quality system changes an inspection

Nothing in 7382.850 requires you to use a software tool for your QMS. A compliant quality management system can run on documents and spreadsheets, and some do. What the program does require is that risk management be traceable through design, production, purchasing, and postmarket feedback, and that you be able to produce the evidence on request, in an order an investigator chooses rather than one you prepared.

That's where disconnected systems cost the most. When the risk file lives in one spreadsheet, the design outputs in a second, the complaint log in a third, and the supplier records in a shared drive, the trace exercise we described earlier becomes a manual reconciliation performed under time pressure in front of an investigator.

Greenlight Guru is the eQMS purpose-built for medical device manufacturers, with design controls, risk management, CAPA, supplier management, document control, training, and postmarket data connected in one validated system aligned to ISO 13485 and the QMSR. Risk controls stay linked to the requirements and tests that implement them, and complaint and feedback data stays linked back into the risk file, which is the connection Situation 1 of the compliance program singles out when it goes looking for an OAI.

See how your quality system reads to an investigator

Quality systems that keep risk management connected to design, production, and postmarket feedback come through inspection in good shape. The ones that keep risk management in a separate file are where the new program finds its observations.

Greenlight Guru is the QMS purpose-built for medical device manufacturers, with design controls, risk management, CAPA, supplier management, and postmarket data connected in one validated system aligned to ISO 13485 and the QMSR.

If your team is preparing for its first inspection under the new program, get your free demo of Greenlight Guru to see how you can keep risk management connected throughout your QMS.

BONUS RESOURCE: Click here to download your free QMSR inspection readiness checklist!