Production and Service Controls Process: 

Part 3 

CAPT Kimberly Lewandowski - Walker 

Senior Regulatory Officer 

Center for Devices and Radiological Health 

U.S. Food and Drug Administration
Course Prerequisites

• Successful completion of the following MDSAP training

module is a prerequisite to this course:

– Introduction to the MDSAP Program

– Overview of the MDSAP Audit Process

– MDSAP: Management Process

– MDSAP: Measurement, Analysis and Improvement Process

– MDSAP: Design and Development Process

– MDSAP: Production and Service Controls Process: Parts 1 and 2
Learning Objectives

• Review the purpose of auditing the Production and

Service Controls process

• Explain the audit tasks for Production and Service

Controls process, Part 3 to include:

– Description and related Clauses and Regulations

– Country - specific requirements and assessment of conformity

– Links to other MDSAP processes
Learning Objectives

• Review the purpose of auditing the Production and 

Service Controls process 

• Explain the audit tasks for Production and Service 

Controls process, Part 3 to include: 

– Description and related Clauses and Regulations

– Country - specific requirements and assessment of conformity 

– Links to other MDSAP processes 
Purpose of Auditing

• The Production and Service Controls process is audited

to:

– Verify that the manufacturer’s processes are capable of

ensuring that products will meet specifications

ØIncludes testing, infrastructure, facilities, equipment, and 

servicing

5
Learning Objectives

• Review the purpose of auditing the Production and 

Service Controls process 

• Explain the audit tasks for Production and Service 

Controls process, Part 3 to include: 

– Description and related Clauses and Regulations

– Country - specific requirements and assessment of 

conformity 

– Links to other MDSAP processes 
Task 1-20

• Audit tasks 1 - 10 were discussed in MDSAP training 

module Production and Service Controls, Part 1 

• Audit tasks 11 - 20 were discussed in MDSAP training 

module Production and Service Controls: Part 2 

• Part 3 will commence with audit Task 21 
Task 21

21. Verify that acceptance activities assure conformity with

specifications and are documented. Confirm the extent of

acceptance activities are commensurate with the risk posed

by the device.

Clause and Regulation: [ISO 13485:2016: 4.2.1, 7.4.3, 7.5.8, 

8.2.6; TG(MD)R Sch1 P1 2, Sch3 P1 Cl1.4(5)(d); RDC ANVISA 

16/2013: 5.3.1, 5.3.2, 5.3.3, 5.3.4, 9.2; MHLW MO169: 6, 39, 

47,58, 59; 21 CFR 820.80, 820.250(b)]

MDSAP Audit Approach
Task 21

• Additional country - specific requirements: Brazil (ANVISA), 

United States (FDA)

• Assessing conformity: 

Ø Confirm that the organization has defined processes for receiving, inprocess, and final acceptance activities 

Ø Review a sample of batch records and confirm that acceptance activities 

o have been documented 

o Show specified requirements have been met 

Ø Confirm that the organization has taken the appropriate action to 

determine suitability of the acceptance activities 

Detailed information on how to assess conformity for this audit task can 

be found in the MDSAP Audit Approach, Chapter 6: Production and 

Service Controls, under Task 21. 
Task 21

• Links: 

– Purchasing 

ØConsider reviewing the purchasing controls and 

requirements for suppliers of products that 

undergo minimal acceptance activities at the 

device manufacturer 

ØConsider selecting suppliers that supplied 

product that did not meet specified 

requirements

– Design and Development 
Task 22

22. Verify that the identification, control, and disposition of 

nonconforming products is adequate, based on the risk the 

nonconformity poses to the device meeting its specified 

requirements.

Clause and Regulation: [ISO 13485:2016: 7.5.8, 8.3; TG(MD)R 

Sch1 P1 2, Sch3 P1 Cl1.4(5)(b); RDC ANVISA 16/2013: 6.5.1, 

6.5.2; MHLW MO169: 47 (Old: 47, 50, 60); 21 CFR 820.60, 

820.90(a), 820.86, 820.100(a)] 

MDSAP Audit Approach
Task 22

• Additional country - specific requirements: None

• Assessing conformity:

– Confirm that the organization has defined and implemented procedures

for identification, control, segregation, evaluation, and disposition of

nonconforming product

– Ensure that the organization has established an interface/interaction

between processes for identification of nonconforming product and

corrective action

Detailed information on how to assess conformity for this audit task can 

be found in the MDSAP Audit Approach, Chapter 6: Production and 

Service Controls, under Task 22 
Task 22

• Links:

– Measurement, Analysis and Improvement

ØBe mindful of where the acceptance of 

nonconforming product has led to finished 

devices not meeting specified requirements 

ØConsider reviewing the handling and evaluation 

of nonconforming products that were 

determined to be the underlying cause of quality 

problems
Task 22

• Links:

– Measurement, Analysis and Improvement

ØEnsure the analysis of data regarding 

nonconforming product is considered as an 

input to the Measurement, Analysis and 

Improvement process 

ØEnsure that corrective or preventive actions 

have been implemented when necessary
Task 23

23. If a product needs to be reworked, confirm the manufacturer

has made a determination of any adverse effect of the rework

upon the product. Verify the rework process has been

performed according to an approved procedure, that the

results of the rework have been documented, and that the

reworked product has been re - verified to demonstrate

conformity to requirements.

Clause and Regulation: [ISO 13485:2016: 8.3.4; RDC ANVISA

16/2013: 6.5.3; MHLW MO169: 60 - 4 (Old: 60); 21 CFR

820.90(b)]

MDSAP Audit Approach
Task 23

• Additional country - specific requirements: None

• Assessing conformity:

– Be mindful of where the underlying cause of quality

problems are traced to devices that have been reworked

– Consider reviewing process validation

Detailed information on how to assess conformity for this 

audit task can be found in the MDSAP Audit Approach, 

Chapter 6: Production and Service Controls, under Task 23 
Task 24

24. Verify that procedures are established and maintained for

preserving the conformity of product and constituent parts of

a product during internal processing, storage, and transport to

the intended destination. This preservation encompasses

identification, handling, packaging, storage, and protection,

including those products with limited shelf - life or requiring

special storage conditions.

Clause and Regulation: [ISO 13485:2016: 7.5.8, 7.5.11;

TG(MD)R Sch1 P1 5; RDC ANVISA 16/2013: 5.2.1, 6.1.1, 6.2.1;

CMDR 14; MHLW MO169: 47, 52; 21 CFR 820.130, 820.140,

820.150, 820.160(a)]

MDSAP Audit Approach
Task 24

• Additional country - specific requirements: None

• Assessing conformity:

– Confirm that the needed control measures are

implemented

Detailed information on how to assess conformity for this 

audit task can be found in the MDSAP Audit Approach, 

Chapter 6: Production and Service Controls, under Task 24
Task 25

25. Confirm that the medical device organization performs a 

review of customer requirements, including the purchase 

order requirements, prior to the organization’s commitment 

to supply a product to a customer. Verify that the medical 

device organization maintains documentation required by 

regulatory authorities regarding maintenance of distribution 

records. 

Clause and Regulation: [ISO 13485:2016: 4.2.1, 5.2, 7.2.2, 7.5.9; 

RDC ANVISA 16/2013: 6.3; MHLW MO169: 6, 11, 28, 48, 49; 21 

CFR 820.160(a)]

MDSAP Audit Approach
Task 25

• Additional country - specific requirements: Brazil

(ANVISA), Canada (HC), United States (FDA)

• Assessing conformity:

Detailed information on how to assess conformity for this

audit task can be found in the MDSAP Audit Approach, 

Chapter 6: Production and Service Controls, under Task 25 
Task 26

26.If installation activities are required, confirm records of 

installation and verification activities are maintained.

Clause and Regulation: [ISO 13485:2016: 7.5.3; RDC 

ANVISA 16/2013: 8.1; MHLW MO169: 42; 21 CFR 820.170]

MDSAP Audit Approach
Task 26

• Additional country - specific requirements: None

• Assessing conformity:

– Confirm necessary installation procedures are in place

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 6: 

Production and Service Controls, under Task 26 
Task 27

27. Determine if servicing activities are conducted and

documented in accordance with defined and implemented

instructions and procedures. Confirm service records are

used as a source of quality data in the Measurement, Analysis

and Improvement process.

Clause and Regulation: [ISO 13485:2016: 4.2.1, 7.5.4, 8.4; RDC 

ANVISA 16/2013: 8.2; MHLW MO169: 6, 43, 61; 21 CFR 

820.200]

MDSAP Audit Approach
Task 27

• Additional country - specific requirements: Brazil (ANVISA), 

United States (FDA) 

• Assessing conformity: 

– Observe instances of where nonconformities occurred and/or 

complaints were received after the servicing 

– Confirm data regarding service reports is analyzed for possible 

corrective or preventive action 

Detailed information on how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 6: Production 

and Service Controls, under task 27 
Task 27

• Links:

– Measurement, Analysis and Improvement

ØWhen reviewing the organization’s service reports, 

the audit team should be mindful of service reports 

that appear to be product complaints 

ØEnsure that service reports that appear to be 

complaints have been appropriately addressed 

ØConfirm the organization is taking appropriate 

corrections and/or corrective actions
Task 28

28. When appropriate, verify that risk control and mitigation 

measures are applied to transport, installation and servicing, 

in accordance with the organization’s risk management 

practices.

Clause and Regulation: [ISO 13485:2016: 7.1, 7.5.1, 7.5.3, 7.5.4, 

7.5.11; TG(MD)R Sch1 P1 2; RDC ANVISA 16/2013: 2.4; MHLW 

MO169: 26, 40, 42, 43, 52; 21 CFR 820.160(a), 820.170(a), 

820.200(a)] 

MDSAP Audit Approach
Task 28

• Additional country - specific requirements: None

• Assessing conformity:

– Confirm that the necessary processes have been

implemented to ensure the risk control measures are in

place

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 6: 

Production and Service Controls, under Task 28 
Task 29

29. Determine, based on the assessment of the production and 

service process overall, whether management provides the 

necessary commitment to the production and service process 

to ensure devices meet specified requirements and quality 

objectives.

Clause and Regulation: [ISO 13485:2016: 5.1, 5.2; RDC ANVISA 

16/2013: 2.2.1; MHLW MO169: 10, 11]

MDSAP Audit Approach
•

Task 29 

Additional country - specific requirements: None 

• Assessing conformity:

Detailed information on how to assess conformity for this audit

task can be found in the MDSAP Audit Approach, Chapter 6: 

Production and Service Controls, under Task 29. 
Summary

• Accomplishment of the outcomes for auditing the 

Production and Service Controls process is 

accomplished through the completion of all 29 audit 

tasks. 
Conclusion

• This concludes the training for MDSAP process: Production and Service 

Controls