MDSAP: Production and Service Controls: Part 3

Slide 1

I am CAPT Kimberly Lewandowski-Walker, Senior Regulatory Officer at the Center for Devices and 

Radiological Health at the U.S. Food and Drug Administration. I will be your presenter for this module.

In this training module, we will be reviewing the third of three trainings for the Medical Device Single 

Audit Program (or MDSAP): Production and Service Controls and how to audit this process.

Slide 2

The prerequisites for understanding this Production and Service Controls training module are the 

MDSAP training modules: “Introduction to the MDSAP Program”, “Overview of the MDSAP Audit 

Process”, “Management Process”, “Measurement, Analysis and Improvement Process”, “Design and 

Development Process”, and Production and Service Controls Process: Parts 1 and 2 are prerequisites to 

this course.

Slide 3

In this training module, we will review the purpose of auditing the Production and Service Controls 

process and continue with explaining the audit tasks for Production and Service Controls process: Part 3 

in terms of description and related Clauses and Regulations; country-specific requirements and 

assessment of conformity; and links to other MDSAP processes.

Slide 4

We will begin again with reviewing the purpose of auditing the Production and Service Controls process.

Slide 5

The purpose of auditing the production and service controls process (including testing, infrastructure, 

facilities, equipment, and servicing) is to verify that the manufacturer’s processes are capable of 

ensuring that products will meet specifications.

Accomplishment of the outcomes for the Production and Service Controls process is accomplished 

through the completion of the audit tasks. We will now continue our discussion of the audit tasks and 

links to the interrelated MDSAP processes. 

Slide 6

We will now continue our discussion of the audit of the Production and Service Controls process by 

explaining the remaining audit tasks for the Production and Service Controls process, Part 3 in terms of 

the description and related Clauses and Regulations; the country-specific requirements and assessment 

of conformity; and links to other MDSAP processes.

Slide 7

Audit tasks 1-10 were discussed in MDSAP training module Production and Service Controls, Part 1.

Audit tasks 11-20 were discussed in MDSAP training module Production and Service Controls, Part 2.

Part 3 will commence with audit Task 21.

Slide 8

Task 21: Verify that acceptance activities assure conformity with specifications and are documented. 

Confirm the extent of acceptance activities are commensurate with the risk posed by the device. 
The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 9

There are additional country-specific requirements for Brazil and the United States. Assessing 

conformity includes confirming that the medical device organization has defined processes for receiving, 

in-process, and final acceptance activities, reviewing a sample of batch records and confirm that 

acceptance activities have been documents and show specified requirements have been met, and 

confirming that the organization has taken the appropriate action to determine suitability of the 

acceptance activities.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, under Task 21.

Slide 10

The audit team may choose to review the purchasing controls and requirements for suppliers of higher 

risk products. The audit team should also consider reviewing the purchasing controls and requirements 

for suppliers of products that undergo minimal acceptance activities at the device manufacturer, 

particularly if the supplied product is manufactured using a process that requires validation.

During the review of acceptance activities, if the audit team encounters situations where records of 

acceptance activities for supplied product reveal products that do not meet specified requirements, 

consider selecting those suppliers for review during the audit of the organization’s Purchasing process.

The establishment of the necessary purchasing controls and required acceptance activities is a design 

output. 

The degree of the purchasing controls necessary and extent of acceptance activities should be based on 

the risk posed by the product not meeting its specified requirements and essential function. 

Slide 11

Task 22: Verify that the identification, control, and disposition of nonconforming products is adequate, 

based on the risk the nonconformity poses to the device meeting its specified requirements.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 12

There are no additional country-specific requirements for this task. Assessing conformity includes 

confirming that the medical device organization has defined and implemented procedures for 

identification, control, segregation, evaluation, and disposition of nonconforming product and ensuring 

that the medical device organization has established an interface/interaction between processes for 

identification of nonconforming product and corrective action. 

Detailed information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 6: Production and Service Controls, under Task 22.

Slide 13
The audit team should be mindful of any instances where the acceptance of nonconforming product has 

led to finished devices not meeting specified requirements. This information can often be found in 

records of acceptance activities and complaint records.

During the review of the organization’s corrective and preventive actions, the auditors may have noted 

instances where nonconforming products were found to be the underlying cause of quality problems 

and complaints. 

The audit team should consider reviewing the organization’s handling and evaluation of nonconforming 

products that were determined to be the underlying cause of quality problems.

Slide 14

Ensure the analysis of data regarding nonconforming product is considered as an input to the 

organization’s Measurement, Analysis and Improvement process and that corrective or preventive 

actions have been implemented when necessary.

Slide 15

Task 23: If a product needs to be reworked, confirm the manufacturer has made a determination of any 

adverse effect of the rework upon the product. Verify the rework process has been performed 

according to an approved procedure, that the results of the rework have been documented, and that 

the reworked product has been re-verified to demonstrate conformity to requirements.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 16

There are no additional country-specific requirements for this task. Assessing conformity includes being 

mindful of instances where the underlying cause of quality problems such as complaints that finished 

devices do not meet specified requirements, are traced to devices that have been reworked and 

considering reviewing process validation to confirm that the medical device organization has data to 

show the process is effective, reproducible, and stable, and that the medical device organization is 

operating the process within the validated parameters.

Detailed information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 6: Production and Service Controls, under Task 23.

There are no links to other MDSAP processes for Task 23.

Slide 17

Task 24: Verify that procedures are established and maintained for preserving the conformity of product 

and constituent parts of a product during internal processing, storage, and transport to the intended 

destination. This preservation encompasses identification, handling, packaging, storage, and protection, 

including those products with limited shelf-life or requiring special storage conditions. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 18
There are no additional country-specific requirements for this task. Assessing conformity includes 

confirming that the needed control measures are implemented to ensure the conformity of product to 

its specified requirements.

Detailed information on how to assess conformity for this audit task can be found in the MDSAP Audit

Approach, Chapter 6: Production and Service Controls, under Task 24.

There are no links to other MDSAP processes for Task 24.

Slide 19

Task 25: Confirm that the medical device organization performs a review of customer requirements, 

including the purchase order requirements, prior to the organization's commitment to supply a product 

to a customer. Verify that the medical device organization maintains documentation required by 

regulatory authorities regarding maintenance of distribution records.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 20

There are additional country-specific requirements for Brazil, Canada, and United States for this task.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, under Task 25.

There are no links to other MDSAP processes for Task 25.

Slide 21

Task 26: If installation activities are required, confirm records of installation and verification activities 

are maintained.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 22

There are no additional country-specific requirements for this task.

Assessing conformity includes limiting the review of the installation procedures to confirming the 

necessary procedures are in place.

Detailed information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 6: Production and Service Controls, under Task 26.

There are no links to other MDSAP processes to Task 26.

Slide 23

Task 27: Determine if servicing activities are conducted and documented in accordance with defined 

and implemented instructions and procedures. Confirm service records are used as a source of quality 

data in the Measurement, Analysis and Improvement process.
The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 24

There are additional country-specific requirements for Brazil and United States for this task. Assessing 

conformity includes observing instances of where nonconformities occurred and/or complaints were 

received after the servicing of the device, and confirming, when necessary, that data regarding service 

reports is analyzed for possible corrective action or preventive action.

Detailed information on additional country-specific requirements and how to assess conformity for this 

audit task can be found in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, 

under Task 27.

Slide 25

This task has a link to Measurement, Analysis and Improvement process. During the audit of the 

organization’s Measurement, Analysis and Improvement process, the audit team may have already 

confirmed that quality data from the analysis of servicing activities is analyzed for possible corrective or 

preventive action. 

When reviewing the organization’s service reports, the audit team should be mindful of service reports 

that appear to be product complaints. Ensure that service reports that appear to be complaints have 

been appropriately addressed. In some instances, a similar quality problem for a particular device may 

be found in the service reports and the complaint records. In these instances, confirm the organization is 

taking appropriate corrections and/or corrective actions considering a similar quality problem is 

observed in multiple data sources.

Slide 26

Task 28: When appropriate, verify that risk control and mitigation measures are applied to transport, 

installation and servicing, in accordance with the organization’s risk management practices.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 27

There are no additional country-specific requirements for this task. Assessing conformity includes 

confirming that the necessary processes have been implemented to ensure the risk control measures 

are in place if risk control measures were identified involving the delivery, installation, and servicing for 

a particular device.

Detailed information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 6: Production and Service Controls, under Task 28.

There are no links to other MDSAP processes for Task 28.

Slide 28

Task 29: Determine, based on the assessment of the production and service process overall, whether 

management provides the necessary commitment to the production and service process to ensure 

devices meet specified requirements and quality objectives.
The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 29

There are no additional country-specific requirements for this task. Detailed information on how to 

assess conformity for this audit task can be found in the MDSAP Audit Approach, Chapter 6: Production 

and Service Controls, under Task 29.

Slide 30

In summary, accomplishment of the expected outcomes of auditing the Production and Service Controls 

process is accomplished through the completion of all 29 audit tasks. 

Slide 31

This concludes the training for MDSAP process: Production and Service Controls: Part 3 and is the final 

training module for the Production and Service Control process.