Executive Accountability: Why the FDA Now Names the CEO

The Shift

What Does Executive Accountability Mean After the FDA's Shift?

Named. Notified. Now.

Executive accountability is the principle that responsibility for a management system can be delegated but ownership of its effectiveness cannot, and it has quietly become the most consequential idea in regulated manufacturing. A medical products manufacturer recently received a communication from the U.S. Food and Drug Administration instructing executive management to “immediately and comprehensively assess your company's global manufacturing operations” to confirm that systems, processes and products conform to FDA requirements. The sentence is short. The shift inside it is not.

For most of the last three decades, findings of this severity were addressed to the organization and phrased around the quality unit. The quality unit failed to investigate. The quality unit failed to exercise its authority. Chief executives read that phrasing, drew the obvious conclusion, and acted on it. Across 28 years of building management systems, the single most common executive response MSI has observed to a serious regulatory finding is some version of the same instruction: replace the head of Quality.

That reflex is the subject of this article, because it is a diagnosis error with a name in every ISO standard on the shelf. It is a correction being mistaken for a corrective action. And the regulator has now closed the door on it by naming the office that has to act.

What follows is the management-system reading of that shift — what executive accountability actually requires, where it is documented, which numbers a chief executive should be reading personally, and why the same logic now applies to quality, environmental, health-and-safety and healthcare systems alike. This is the analysis MSI brings to its ISO consulting engagements, drawn from 200+ audits attended rather than from theory.

The Reflex

Why Does “Fire the Head of Quality” Fail the Executive Accountability Test?

Correct. Cause. Confirm.

Every experienced quality professional knows the response that fails: “the operator was retrained.” It fails because retraining addresses the person who was standing there, not the condition that made the error possible. A verification step performed by a second person, a fixture that makes the wrong orientation physically impossible, a revised acceptance criterion — those change the system. Retraining changes the day.

Terminating the head of Quality is structurally identical, and executive accountability is exactly the lens that exposes it. The distinction between correction and corrective action is fundamental across every standard MSI implements, and it is worked through in detail in MSI's guide to how CAPA works under ISO 13485 and in the companion guide to writing a corrective action procedure that holds up in practice. The test is always the same question: if this person had never worked here, would the failure still have been possible? When the honest answer is yes, the personnel change is a correction.

The Second-Order Damage

There is a cost beyond the failed logic, and executive accountability has to account for it. The head of Quality is usually the single richest repository of undocumented knowledge about why controls exist — which supplier was troublesome in 2019, which process had a validation caveat, which complaint pattern nearly became something worse. MSI has written about what this loss does to a regulated organization in its analysis of why experts quit and what leaves with them. Removing that person in the middle of a remediation removes the map.

The signal sent to everyone else is more expensive still. Regulatory systems run on information travelling upward — deviations reported, complaints escalated, out-of-specification results investigated rather than invalidated. A visible termination following bad news teaches an entire organization that bad news is career-limiting. MSI client experience suggests that the reporting rate falls first and the underlying problem rate does not, which produces a set of metrics that look like improvement and are in fact the opposite. Executive accountability is impossible in an organization where information stops moving upward.

Firing a person is a correction. Changing the authority structure that made the failure possible is the corrective action. Executive accountability is the difference between the two.

The Record

Is the FDA's Executive Accountability Language Actually New?

Older. Harder. Codified.

Not as language — and the distinction matters, because the real change is more serious than a change of tone. Instructions to assess global operations comprehensively have appeared in FDA correspondence for well over a decade, notably in a 2009 letter to a generic manufacturer directing a company-wide assessment of every site supplying the U.S. market. The modern construction, pairing repeated failures across multiple sites with a finding that management oversight is inadequate, recurs through a series of letters issued between 2017 and 2019 to manufacturers in India, Japan and China.

The pattern in those letters is worth reading closely, because it tells you what triggers escalation. In each case the agency had already cited comparable findings at sister sites. One company was cited for invalidating out-of-specification results without thorough investigation at one plant in 2015, at a second plant in 2016, and then across the network in the letters that followed. Repetition across locations is what converts a site problem into an executive accountability problem. A single site failure is a process finding. The same failure at three sites is a governance finding, and no amount of site-level remediation answers it.

The Regulation

How Did Executive Accountability Become Regulation in 2026?

Incorporated. Inspectable. Enforceable.

The FDA issued the final rule on January 31, 2024, amending the device current good manufacturing practice requirements and giving manufacturers a two-year transition. The Quality Management System Regulation became effective on February 2, 2026. From that date, Part 820 largely is ISO 13485:2016, with FDA-specific supplemental provisions layered on top. The agency also retired the Quality System Inspection Technique on the same date and moved to the inspection process described in Compliance Program 7382.850, as set out in the FDA's own QMSR frequently asked questions.

Read that alongside the executive accountability language in the warning letters and the picture resolves. ISO 13485 Clause 5 is titled Management responsibility. Clause 5.1 requires top management to provide evidence of its commitment to the development and implementation of the quality management system and to maintaining its effectiveness. Clause 5.5 requires responsibilities and authorities to be defined, documented and communicated. Clause 5.6 requires management review at planned intervals with named inputs and named outputs. None of that is new to anyone who has held an ISO 13485 certificate. What is new is that those clauses are now part of the regulation an FDA investigator is inspecting against. MSI's breakdown of why the FDA now inspects ISO 13485 risk management covers the same convergence from the risk side.

The quality side of the house has been converging on executive accountability from a second direction as well. The FDA's Center for Drug Evaluation and Research has built its Quality Management Maturity program around goals that begin with fostering a strong quality culture mindset — an explicitly leadership-level measure that sits deliberately above baseline current good manufacturing practice compliance. On the device side, the FDA's Voluntary Improvement Program appraises maturity against a framework whose first domain is leadership and governance. Two centers, two programs, one thesis: the maturity of the system is a property of its leadership.

The Liability Point Executives Are Rarely Told

There is a legal dimension to executive accountability that seldom reaches the boardroom in plain terms. Under the responsible corporate officer doctrine, established in United States v. Dotterweich in 1943 and refined in United States v. Park in 1975, a corporate officer who stands in a position of authority and responsibility to prevent or correct a violation may be held personally liable without proof that the officer knew of it. The Park decision turned on exactly the question this article is about: whether the chief executive had a duty to implement measures that would ensure violations did not occur.

The implication is blunt. Removing the head of Quality does not transfer exposure downward, and it never did. It removes the early-warning function while leaving the exposure precisely where the doctrine places it. Nothing here is legal advice — MSI builds management systems rather than practices law — but executive accountability is not merely a standards concept, and executives who understand that tend to run very different management reviews.

The Structure

Why Can't the Quality Unit Carry Executive Accountability Alone?

Responsibility. Authority. Resource.

ISO 9001 removed the management representative role in its 2015 revision and replaced it with Clause 5.3, distributing responsibilities and authorities across top management rather than concentrating them in one title. The intent was to stop executives treating the management system as one unlucky person's problem. MSI has written about the consequence in its guide to defining roles and authorities from startup to growth: removing the road sign did not remove the road, and a great many organizations have been under-defining authority ever since.

Here is the shape the defect usually takes. Quality reports to the same operating executive as production. That executive carries an output or margin objective. Quality carries a conformity objective. When the two collide near a shipping date, the arbitration happens inside a single set of incentives, and the outcome is structurally predictable regardless of the individuals involved. No amount of personal integrity in the quality role resolves a reporting line that places the release decision inside the schedule owner's span of control. Executive accountability means the chief executive owns that design choice.

The three questions that test it are short. Who can stop a shipment without asking permission? Who approves the quality function's headcount and capital? Who does the head of Quality speak to when the answer from operations is no? If the answers all land inside operations, the system has a documented quality function and an undocumented conflict, and MSI's article on organizational context and structure works through how auditors and investigators find that gap quickly.

The Assessment

What Does “Comprehensively Assess” Require Under Executive Accountability?

Every. Site. Systemically.

The instruction is technical, not rhetorical, and executive accountability turns on reading it that way. The regulator's expectation when a serious finding lands is that the organization examines every site for the same or closely related weaknesses and then remediates everywhere the weakness exists — not only where it was observed. Site-by-site remediation is precisely the behaviour that produced the second warning letter in several of the cases on record.

A comprehensive assessment that satisfies executive accountability has five characteristics, and MSI runs this as a structured planning session rather than a document review:

• Failure-mode led, not clause led. The question is not “does every site have a procedure for X.” It is “could the specific failure we were cited for happen here, and what would stop it?”
• Cross-site and cross-product. Including contract manufacturers, sterilizers, testing laboratories and packagers. Regulators treat contracted operations as extensions of the manufacturer; an agreement does not transfer accountability.
• Retrospective as well as forward-looking. If a control was absent, the product made without it needs a documented disposition rationale.
• Independently reviewed. The function that owns the process cannot be the sole assessor of whether the process works.
• Governed at executive level with dates and owners. A remediation plan without named owners and committed dates is a list of intentions.

Point five is where executive accountability either becomes real or stays decorative, and it has a home in every ISO standard: the management review.

The Evidence

Where Does Executive Accountability Actually Get Documented?

Inputs. Decisions. Proof.

Management review is a requirement across ISO 9001, ISO 13485, ISO 14001, ISO 45001 and ISO 7101 — it is not an ISO 9001 peculiarity, and MSI's management review procedure guide maps the differences clause by clause. ISO 9001 places it at 9.3 with named inputs including audit results, customer satisfaction and feedback from relevant interested parties, nonconformity and corrective action status, monitoring and measurement results, the performance of external providers, the adequacy of resources, and the effectiveness of actions taken to address risks and opportunities. ISO 13485 places it at 5.6 and is unusually prescriptive, naming twelve required inputs — including reporting to regulatory authorities and new or revised regulatory requirements, which is where a QMSR-era system proves it noticed the regulation changed.

Outputs matter more than inputs for executive accountability, because outputs are where a decision either exists or does not. ISO 9001 Clause 9.3.3 requires decisions and actions on improvement opportunities, any need for changes to the system, and resource needs. ISO 13485 Clause 5.6.3 requires decisions and actions on improvement to maintain suitability, adequacy and effectiveness; improvement of product related to customer requirements; changes needed to respond to new or revised regulatory requirements; and resource needs. Resource needs appear in both. That single line is the mechanism by which executive accountability becomes budgetary rather than verbal.

The Failure Mode MSI Sees Most

Most management review agendas are built from the last review rather than from the standard. Ask which clause a given section satisfies and there is often no answer, because the agenda inherited its shape from habit. The requirements an organization has never performed are precisely the ones a habit-built agenda cannot surface — the performance of external providers as a named input in its own right, the effectiveness of actions taken to address risks and opportunities, feedback from interested parties named alongside customer satisfaction rather than instead of it.

The second failure mode is subtler and more damaging to executive accountability: the meeting happens, the discussion is substantive, everyone leaves informed, and the minutes record none of it as a decision. A record that says “CAPA backlog discussed” evidences a conversation. A record that says “CAPA backlog: two additional investigators approved, effective Q1, owner named, reviewed next cycle” evidences accountability. The first is what most organizations have. MSI's ISO 13485 management review playbook and its step-by-step procedure guide both turn on converting the second into the first.

The Dashboard

Which Nine Numbers Should Executive Accountability Put on the CEO's Desk?

Few. Leading. Unfiltered.

These are deliberately leading rather than lagging. Certification status and inspection outcomes are lagging indicators: by the time they move, the condition has existed for a year. The nine below move first.

1. Repeat findings across sites. The strongest single predictor of escalation in the public record. One site with an issue is a process problem; three sites with the same issue is an executive accountability problem.
2. Overdue corrective actions and average age. Ageing is a resource signal before it is a discipline signal. A rising average usually means the people doing investigations are also doing something else.
3. Share of actions closed with retraining as the only action. The most diagnostic number on this list. A high share means root cause analysis is stopping at the person.
4. Complaint-to-investigation conversion. A falling rate with flat complaint volume means the intake filter has tightened, not that the product improved.
5. Deviation extension requests. Extensions are where schedule pressure becomes visible in the quality record.
6. Data integrity and audit trail review findings. Several of the warning letters that triggered executive-level instructions began here — deletable records, shared logins, absent audit trails.
7. Supplier escalations and unapproved supplier usage. Contracted operations are extensions of the manufacturer. MSI's article on AI as an externally provided process works through why control of external processes never transfers accountability outward.
8. Time from detection to executive escalation. Measure it. If nobody knows the number, the escalation path is informal, and informal paths fail under pressure.
9. Voluntary turnover in the quality function. A leading indicator of both knowledge loss and a culture where raising problems has become uncomfortable.

Nine numbers, reviewed at every management review, with a trend line rather than a snapshot. That is a realistic reading load for a chief executive and it is a defensible expression of executive accountability. Organizations typically report that the act of publishing these nine changes behaviour faster than any policy statement, because measurement is itself a form of attention.

The Culture

How Does Quality Culture Make Executive Accountability Work or Fail?

Speak. Escalate. Survive.

Every measure above depends on one condition: that a person who finds something wrong can say so without it costing them. That condition is not a soft concept in 2026 — it is an explicit requirement. ISO 9001 was revised and published on September 16, 2026, and its Clause 5.1 now requires top management to promote a quality culture and to demonstrate ethical behaviour, with guidance on how those are evidenced through shared values, attitudes and observed behaviours. Clause 7.3 extends awareness of that culture to all personnel rather than to the quality team alone. MSI's analysis of what ISO 9001:2026 means for boardrooms covers the governance consequences in depth.

The word that carries the weight in every one of these standards is “ensure.” ISO 14001:2026 states the principle directly in its terminology guidance: where a requirement says the organization shall ensure something, the responsibility may be delegated but the accountability may not. That single sentence is the clearest definition of executive accountability written into any standard, and it applies identically to quality, environmental and occupational health and safety systems.

A practical test of culture, drawn from 200+ audits attended: ask three people at different levels what happens when someone stops a line or halts a shipment. In organizations where executive accountability is real, the answers are consistent and unremarkable. Where it is not, the answers diverge sharply by level, and the divergence itself is the finding. MSI's seven steps to a quality improvement culture that sticks sets out the sequence that closes that gap, and the five stages of team development explain why the authority question surfaces when it does.

The Range

Does Executive Accountability Apply Outside Medical Devices?

Same. Clause. Everywhere.

On the environmental side, ISO 14001 was published in its 2026 edition on April 15, 2026, with a transition deadline of April 30, 2029, and its Clause 5.1 strengthens leadership accountability across the board. Clause 5.2 assigns the environmental policy to top management specifically. MSI's guide to the 2026 environmental policy rewrite covers what changed and what an EHS leader has to produce.

On the occupational health and safety side, ISO 45001 adds a requirement no other standard carries: worker participation and consultation, including in the investigation of causes. That is executive accountability with a second constituency attached. In healthcare, ISO 7101 places the culture obligation directly on top management at Clause 5.1 — the conditions under which people report concerns, escalate risk and speak up about harm.

The accreditation landscape has moved too. Global ACI assumed the roles previously held by IAF and ILAC on January 1, 2026, and ISO 19011 was republished on May 27, 2026, withdrawing the 2018 edition without a transition period. Management systems that treat executive accountability as a documentation exercise have several moving targets to track at once; the ones that treat it as a governance function absorb the changes through the same review cycle they already run.

The First 90 Days

What Does Executive Accountability Look Like in the First 90 Days?

Assess. Assign. Advance.

Ninety days will not remediate a complex multi-site finding. It will produce something more useful: a documented, dated record that executive accountability was exercised — an assessment commissioned, structural conflicts resolved, resources approved, and a review cycle that generates decisions. That record is what an organization has instead of an explanation. MSI runs this sequence as a focused planning session, and it works the same way whether the trigger was a regulatory finding, a recurring internal pattern, or a chief executive who simply decided not to be surprised. The related discipline for preventing recurrence at product level is covered in MSI's article on why trusted brands fail twice.

Questions

Executive Accountability: Frequently Asked Questions

Ask. Answer. Act.

Does ISO require the CEO personally to attend management review?

Is it ever right to replace a quality leader after a serious finding?

Does hiring a third-party consultant transfer executive accountability?

What changed for U.S. device manufacturers on February 2, 2026?

How often should executive accountability be exercised in review?

We are not FDA-regulated. Does any of this apply to us?

The Bottom Line

Executive Accountability Was Never Delegable

Own. Resource. Review.

The regulator did not change its view of who is accountable. It changed its assumption about whether executives already knew. For years the phrasing allowed a chief executive to read a finding as a departmental failure and respond departmentally. Naming executive management in the instruction removes that reading. ISO removed it a decade earlier by deleting the management representative and writing accountability into Clause 5.1, and the incorporation of ISO 13485 into Part 820 has now given that clause regulatory force.

The organizations that handle this well are not the ones with the thickest manuals. They are the ones where the release authority is unambiguous, the nine indicators are visible, the management review produces decisions with resources attached, and a person who finds a problem expects to be thanked. That is a system that works in practice rather than one that exists on paper — and it is what executive accountability produces when it is exercised rather than declared.

MSI has spent 28 years building these systems, with 80+ certifications supported, 200+ audits attended and 600+ professionals trained across manufacturing, technology, medical device, government, healthcare and other regulated industries. The pattern holds across all of them. Executive accountability is the one requirement no template can satisfy on a leader's behalf — but the right procedures make exercising it a matter of routine rather than heroics. Own. Resource. Review.