Complaint Handling Compliance

Complaint handling compliance refers to the structured obligations organizations must meet when receiving, documenting, investigating, and resolving product or service complaints — particularly those subject to federal regulation. This page covers the regulatory frameworks that govern complaint management, the procedural steps required to maintain compliance, and the classification distinctions that determine how complaints must be treated. Failure to maintain adequate complaint records is among the most frequently cited deficiencies in FDA inspections, making this a high-stakes area within any quality management system compliance program.

Definition and scope

A complaint, in the regulatory sense, is any written, electronic, or oral communication that alleges a deficiency in the identity, quality, durability, reliability, safety, effectiveness, or performance of a product after it has been released for distribution. This definition is drawn from 21 CFR Part 820.198 (FDA Quality System Regulation for medical devices) and is mirrored structurally in 21 CFR Part 211.198 (Current Good Manufacturing Practice for finished pharmaceuticals).

The scope of complaint handling compliance extends across industries regulated by the U.S. Food and Drug Administration, the Consumer Product Safety Commission (CPSC), the Environmental Protection Agency (EPA) for regulated chemical products, and — in financial services contexts — the Consumer Financial Protection Bureau (CFPB). Each agency has distinct procedural thresholds, but all share a common structural requirement: complaints must be formally captured, evaluated, and retained in accessible records.

Under ISO 13485:2016, Section 8.2.2, manufacturers of medical devices are required to maintain a documented procedure for complaint handling that distinguishes between complaints requiring investigation and those that do not — and explains the rationale for any complaint excluded from investigation. The ISO 9001:2015 standard (Section 10.2) similarly requires documented nonconformity and corrective action processes that encompass complaint inputs. These standards intersect directly with corrective and preventive action compliance obligations.

How it works

Complaint handling operates as a defined, multi-phase process. The following breakdown reflects the structure required under 21 CFR Part 820.198 and broadly applicable across ISO-governed systems:

1. Receipt and intake — All complaints are captured through a designated intake channel. Oral complaints must be reduced to writing. The intake record must include the date received, the complainant's identity (where available), the product identifier, and the nature of the allegation.
2. Completeness review — The intake record is reviewed to determine whether enough information exists to proceed. If critical information is missing, the organization must document attempts to obtain it.
3. Complaint classification — Each complaint is assessed to determine whether it (a) represents a potential MDR (Medical Device Report) or adverse event requiring external reporting, (b) constitutes a potential serious injury or death, or (c) involves a product still in distribution. This classification step determines regulatory escalation obligations.
4. Investigation — Complaints meeting investigation criteria must be investigated by a designated unit that is independent of the complaint's origin. The investigation must evaluate whether the complaint is related to product nonconformance and must document the findings.
5. Corrective action determination — Where the investigation confirms a deficiency, the findings feed into the corrective and preventive action compliance system.
6. Record retention — Complaint files must be retained for a period of at least 2 years from the date of device release (21 CFR 820.198(e)) or the useful life of the device, whichever is longer. Pharmaceutical complaint records under 21 CFR 211.198 must be retained for at least 1 year past the product's expiration date.

Common scenarios

Medical device manufacturers encounter complaint handling compliance most directly during FDA inspections. Investigators examine whether a formal complaint unit exists, whether intake procedures are documented, and whether MDR obligations under 21 CFR Part 803 were triggered and met. Missing MDR evaluations in complaint files are a recurring Form 483 observation.

Pharmaceutical manufacturers under CGMP must document both complaint investigations and their conclusions. A complaint alleging contamination or out-of-specification results triggers batch record review obligations and may initiate a recall assessment under product recall and withdrawal compliance procedures.

Consumer goods companies subject to CPSC jurisdiction must evaluate whether a complaint pattern implicates a reportable substantial product hazard under Section 15(b) of the Consumer Product Safety Act (CPSC, 16 CFR Part 1115). 5 or more incidents in a product category can trigger CPSC's pattern-of-defect analysis threshold.

ISO-certified organizations outside FDA scope must nonetheless maintain complaint records per ISO 9001:2015 Section 10.2 to satisfy third-party audit requirements, even absent a federal mandate.

Decision boundaries

The most operationally significant classification boundary in complaint handling is the distinction between a complaint and a service request or general inquiry. A service request reflects normal product use and user preference; a complaint alleges a product deficiency. Misclassifying complaints as service requests is a documented pathway to regulatory citation.

The second major boundary is between complaints that require investigation and those that do not. Under 21 CFR 820.198(b), investigation can be waived only if the complaint is not related to the identity, quality, durability, reliability, safety, or effectiveness of the device — and the decision not to investigate must itself be documented with justification.

A third boundary distinguishes MDR-reportable events from non-reportable complaints. Under 21 CFR Part 803, a complaint involving a death, serious injury, or device malfunction that could cause either must be reported to FDA within 30 days (or 5 days for certain urgent reports). This threshold is not discretionary. The nonconformance reporting requirements framework provides additional classification guidance for events that fall below MDR thresholds but still require internal escalation.

References

• FDA 21 CFR Part 820.198 — Complaint Files (Quality System Regulation)
• FDA 21 CFR Part 211.198 — Complaint Files (CGMP for Finished Pharmaceuticals)
• FDA 21 CFR Part 803 — Medical Device Reporting
• ISO 13485:2016 — Medical Devices Quality Management Systems (ISO)
• ISO 9001:2015 — Quality Management Systems Requirements (ISO)
• CPSC 16 CFR Part 1115 — Substantial Product Hazard Reporting
• FDA Guidance on MDR Reporting Requirements