Deep Dive: When the Risk Baseline and the QMS Both Break Down

The baseline is completely broken and the iteration process is blind.

FDA’s August 21, 2026 warning letter to Pensar Medical LLC illustrates a failure that goes well beyond incomplete documentation.

The underlying risk-management foundation was weak. Risk-control verification remained incomplete for critical areas, and FDA reportedly found no design, process, or use-related FMEAs for the WoundPro product line.

At the same time, key QMS processes were also failing.

Key highlights covered in the audio:

* Risk analysis was incomplete or missing. Critical risk controls remained unverified, and some products lacked the basic FMEAs required by the firm’s own procedures.

* Design and software changes were poorly controlled. Multiple changes lacked adequate implementation records, including an engineering change order described simply as “clean up all code,” with no verification record showing what had actually changed.

* Field corrections were not properly managed. Software rework performed in the field was not reported within the required timeframe.

* CAPA was not functioning as a learning system. FDA found CAPA records with missing root-cause analysis, corrective actions, and effectiveness verification. In another case, a corrective action was never incorporated back into the risk analysis.

* Post-market information was not being translated into effective action. A serious injury involving retained foam and surgical intervention was reported late and categorized as a malfunction rather than a serious injury.

The central lesson is straightforward:

A robust QMS needs both a reliable risk baseline and processes that continuously challenge, maintain, and improve that baseline.