1 

Module 6: MDSAP Design and Development Process

Slide 1

I am CAPT Kimberly Lewandowski-Walker, Senior Regulatory Officer at the Center for Devices and 

Radiological Health at the U.S. Food and Drug Administration. In this training module, we will be 

reviewing the Design and Development process for the Medical Device Single Audit Program.

Slide 2 

The prerequisites for understanding this Design and Development Process training module are the 

MDSAP training modules: “Introduction to the MDSAP Program”, “Overview of the MDSAP Audit 

Process”, “MDSAP: Management Process” and “MDSAP: Measurement, Analysis and Improvement” 

modules.

Slide 3 

In this Design and Development process training module, we will explain the Design and Development 

process, describe the purpose of auditing the Design and Development process, discuss the expected 

outcomes from the audit of the Design and Development process, and explain the audit tasks in terms of 

description and Clauses and Regulations, list country-specific requirements and assessment of 

conformity for each audit task, and indicate the links to other MDSAP processes.

Slide 4 

We will first begin with explaining the Design and Development process.

Slide 5 

The intention of the Design and Development process is to control the design and development 

activities and to assure that devices meet user needs, intended uses, and specified requirements. 

To achieve this, attention to: design and development planning; identifying design inputs; developing 

design outputs; verifying that design outputs meet design inputs; validating the design; controlling 

design changes; reviewing design results; transferring the design to production, and compiling the 

appropriate records will help an organization assure that resulting designs will meet user needs, 

intended uses, and requirements. 

Slide 6 

As you can see from this diagram, audit of the Design and Development process will follow audit of the 

Measurement, Analysis and Improvement process per the MDSAP audit sequence. Information 

regarding product or quality system nonconformities noted during the audit of the Measurement, 

Analysis and Improvement process should be considered when selecting the design and development 

projects to be reviewed during the audit of the Design and Development process. 

Selecting design changes resulting from corrective actions will provide contemporary objective evidence 

and allow the audit team to evaluate the interaction between the Measurement, Analysis and 

Improvement process and the Design and Development process. Review of the Design and Development 

process will also provide an opportunity to evaluate how the organization has utilized risk management 

activities to ensure design inputs are comprehensive and meet user needs, to confirm that risk control 

measures that were planned have been implemented in the design, and to verify that risk control 

measures are effective in controlling or reducing risk. 
 

2 

Additionally, review of design and development activities will assist the audit team during the audit of 

the organization’s Purchasing process because the auditors have an opportunity to select suppliers for 

review whose activities are associated with higher risks to the product or whose activities are critical to 

the essential design outputs. The review of design and development activities also provides information 

to assist the audit team in performing a final evaluation of the Management process at the conclusion of 

the audit.

Slide 7 

We will now move to describe the purpose of auditing the Design and Development process.

Slide 8 

The purpose of auditing the Design and Development process is to verify that the organization 

establishes, documents, implements, and maintains controls to ensure that medical devices meet user 

needs, intended uses and specified requirements.

Slide 9 

We will continue with discussing the expected outcomes from audit of the Design and Development 

process. 

Slide 10 

As a result of the audit of the Design and Development process, objective evidence will show whether 

the organization has: defined, documented and implemented procedures to ensure medical devices are 

designed according to specified requirements; effectively planned the design and development of a 

device; established mechanisms, including systematic review, for addressing incomplete, ambiguous or 

conflicting requirements.

Slide 11 

Determined the requirements for safety, function, and performance for the intended use, including 

regulatory requirements, risk management requirements, and human factors requirements; verified 

that the design outputs satisfy the design input requirements; and identified and mitigated, to the 

extent practical, the risks associated with the device, including the device software.

Slide 12

Ensured that changes to device designs are controlled, that risks associated with design changes are 

identified and mitigated, to the extent practical, and that devices will continue to perform as intended; 

performed design validation to ensure devices conform to user needs and intended use; and confirmed 

that designs are correctly transferred into production through methods and procedures.

Slide 13 

We will explain the audit tasks for the Design and Development process in terms of description and 

related Clauses and Regulations, country-specific requirements and assessment of conformity and links 

to other MDSAP processes.

Slide 14 

Task 1: Verify that those devices that are, by regulation, subject to design and development procedures 

are identified. 
 

3 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 15

There are additional country-specific requirements for Australia; Brazil; Canada; and Japan. 

Assessing conformity includes: verifying that the medical device organization maintains a defined and 

documented design change procedure; verifying that controls and records related to the design transfer 

to production have been determined and verifying that the production line, implemented in the medical 

device organization’s site meets the production requirements established during the design and 

development of the device. 

Detailed information on country-specific requirements and how to assess conformity for this audit task 

are in the MDSAP Audit Approach, Chapter 5: Design and Development, under Task 1. 

Slide 16 

This task has a link to the Purchasing process. If the medical device organization outsources design and 

development activities, or any portion of the design and development, confirm that the organization 

treats the outsourced firm as a supplier, has appropriately qualified and maintains control over the 

supplier, communicates requirements to the supplier, including regulatory requirements, and has 

arrangements to verify that the design and development activities satisfy those requirements.

Slide 17 

Task 2: Select a completed design and development project for review. The audit team should use the 

following priorities when making the selection: complaints or known problems with a particular device; 

product risk – higher risk devices should be selected over lower risk devices; recent design changes, 

particularly design changes made to correct quality problems associated with the device design; 

combination products when the combination product is marketed to Australia; age of design, preferably 

the most recent design; and designs that have not been recently audited. 

There are no related Clauses or Regulations.

Slide 18 

There are no additional country-specific requirements for Task 2. Detailed information on how to assess 

conformity for this audit task are in the MDSAP Audit Approach, Chapter 5: Design and Development, 

under Task 2.

Slide 19 

This task has a link to Measurement, Analysis and Improvement processes. The audit team should be 

particularly mindful of how the identified quality problems from the Measurement, Analysis and 

Improvement process are related to specific aspects of the design and development of the device. For 

example, if the auditors review complaints related to a safety feature of the device that is not 

performing as intended, the audit team should consider selecting for review the design verification of 

that safety feature and determine whether appropriate risk control methods were confirmed to be 

effective.

Slide 20 

Task 3: Verify that the design and development process is planned and controlled. Review the design 

plan for the selected design and development project to understand the design and development 
 

4 

activities; including the design and development stages, the review, verification, validation, and design 

transfer activities that are appropriate at each stage; and the assignment of responsibilities, authorities, 

and interfaces between different groups involved in design and development. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 21 

There are additional country specific requirements for Australia and Canada. Assessing conformity 

includes reviewing design plans such as flowcharts, Gantt charts, Program Evaluation Review Technique

(PERT) charts, and expect to see interfacing between research and development, marketing, regulatory, 

manufacturing, and quality departments. 

Detailed information on country-specific requirements and how to assess conformity for this audit task 

are in the MDSAP Audit Approach, Chapter 5: Design and Development, under Task 3. 

There are no links to other MDSAP processes for Task 3. 

Slide 22

Task 4: For the device design and development records selected, verify that design and development 

procedures have been established and applied. Confirm the design and development procedures 

address the design and development stages, review, verification, validation, design transfer, and design 

changes. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 23 

There are additional country specific requirements for the United States. Assessing conformity includes 

verifying that Design and Development procedures address the regulatory requirements and ensuring 

that the medical device organization maintains defined and documented design change procedures.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

are in the MDSAP Audit Approach, Chapter 5: Design and Development, under Task 4. 

There are no links to other MDSAP processes for Task 4.

Slide 24 

Task 5: Verify that design and development inputs were established, reviewed and approved; and that 

they address customer, functional, performance and safety requirements, intended use, applicable 

regulatory requirements, and other requirements including those arising from human factors issues, 

essential for design and development. Verify that any risks and risk mitigation measures identified 

during the risk management process are used as an input in the design and development process.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 25 
 

5 

There are additional country-specific requirements for Australia and the United States.

Assessing conformity includes reviewing the sources used to develop the inputs that include the 

relevant regulations where safety and performance criteria have been defined and it includes 

determining that relevant aspects of the requirements for the device such as intended use, performance 

characteristics, intended user, and risk mitigation were covered. Detailed information on countryspecific requirements and how to assess conformity for this audit task are in the MDSAP Audit 

Approach, Chapter 5: Design and Development, under Task 5.

Slide 26 

This task has a link to Device Marketing Authorization and Facility Registration process. Confirm the 

medical device organization has considered regulatory requirements for registration, listing, notification 

and licensing; and has complied with these requirements prior to marketing the device in the applicable 

regulatory jurisdictions. 

Slide 27 

Task 6: Confirm the design and development inputs are complete, unambiguous, and not in conflict with 

each other. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 28

There are additional country-specific requirements for Australia. Assessing conformity includes verifying 

that the organization performed a design review after the initial requirements were determined. 

Detailed information on country-specific requirements and how to assess conformity for this audit task 

are in the MDSAP Audit Approach, Chapter 5: Design and Development, under Task 6. 

There are no links to other MDSAP processes for Task 6.

Slide 29

Task 7: Review medical device specifications to confirm that design and development outputs are 

traceable to and satisfy design input requirements. Verify that the design and development outputs 

essential for the proper functioning of the medical device have been identified. 

Outputs include, but are not limited to, device specifications, specifications for the manufacturing 

process, specifications for the sterilization process, if applicable, the quality assurance testing, and 

device labeling and packaging. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 30

There are additional country-specific requirements for Australia. Assessing conformity includes 

reviewing the medical device organization’s process for determining how the essential outputs were 

identified and if it was done in accordance with design output procedures. Detailed information on 

country-specific requirements and how to assess conformity for this audit task are in the MDSAP Audit 

Approach, Chapter 5: Design and Development, under Task 7.
 

6 

Slide 31 

This task has linkages to Purchasing and Production and Service Controls processes. During the review of 

a design project, the audit team should be mindful of production processes and supplied product that 

are essential to the proper functioning of the device. 

Production processes can include not only the manufacturing instructions, but also internal controls, 

such as the type and extent of acceptance activities, equipment calibration and maintenance intervals, 

environmental controls, and personnel controls. In addition, during the audits of the Purchasing process 

and Production and Service Controls process, the audit team should consider reviewing production 

processes and supplied products that have been the highest risk or greatest effect on the essential 

design outputs.

Slide 32 

Task 8: Verify that risk management activities are defined and implemented for product and process 

design and development. Confirm that risk acceptability criteria are established and met throughout the 

design and development process. Finally, verify that any residual risk is evaluated and, where 

appropriate, communicated to the customer through, for example, labeling documents, service 

documents, or advisory notices. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 33 

There are additional country-specific requirements for Brazil and the United States. Assessing 

conformity includes verifying that risk management is initiated early in the design and development 

process and confirming that the medical device organization’s risk management process involves the 

proactive evaluation, control, and monitoring of product risk, followed by the reactive response to 

quality data that indicates new or changing product risk. Detailed information on additional countryspecific requirements and how to assess conformity for this audit task are in the MDSAP Audit 

Approach, Chapter 5: Design and Development, under Task 8. 

There are no links to additional MDSAP processes for Task 8.

Slide 34 

Task 9: Confirm that design verification and/or design validation includes assurances that risk control 

measures are effective in controlling or reducing risk. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 35 

There are no additional country-specific requirements for Task 9. Information on country-specific 

requirements and how to assess conformity for this audit task are in the MDSAP Audit Approach, 

Chapter 5: Design and Development, under Task 9. 

There are no additional links to other MDSAP processes for Task 9.

Slide 36 
 

7 

Task 10: Verify that design and development validation data show that the approved design meets the 

requirements for the specified application or intended uses. Verify that design validation testing is 

adjusted according to the risk of the product and element being validated. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 37 

There are additional country-specific requirements for Australia (TGA). Assessing conformity includes 

confirming that the design validation data shows that the approved design met the predetermined user 

needs and intended uses. Detailed information on country-specific requirements and how to assess 

conformity for this audit task are in the MDSAP Audit Approach, Chapter 5: Design and Development, 

under Task 10. 

There are no links to additional MDSAP processes for Task 10.

Slide 38

Task 11: Verify that clinical evaluations and/or evaluation of the medical device safety and performance 

were performed as part of design validation if required by national or regional regulations. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 39 

There are additional country-specific requirements for Australia. Assessing conformity includes verifying 

whether clinical evaluations have been performed as part of design validation, when necessary and 

verifying whether the medical device organization has established acceptance criteria for the results in 

order to validate the devices and that the results obtained meet the defined acceptance criteria.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

are in the MDSAP Audit Approach, Chapter 5: Design and Development, under Task 11. 

There are no links to other MDSAP processes for Task 11.

Slide 40 

Task 12: If the medical device contains software, verify that the software was subject to the design and 

development process. Confirm the software was included within the risk management process. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 41

There are no country-specific requirements for Task 12. Assessing conformity includes confirming that 

the software is part of the design and development plan for the device, confirming that the medical 

device organization has conducted appropriate software verification activities, and reviewing the actual 

results of the elected software test to confirm that predetermined acceptance criteria have been met.

Detailed information on how to assess conformity for this audit task are in the MDSAP Audit Approach, 

Chapter 5: Design and Development, under Task 12. 
 

8 

There are no links to other MDSAP processes for Task 12.

Slide 42 

Task 13: Verify that design and development changes were controlled, verified or where appropriate 

validated, and approved prior to implementation. Confirm any new risks associated with the design 

change have been identified and mitigated to the extent practical. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 43 

There are additional country-specific requirements for Australia, Brazil, Canada, and the United States.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

are in the MDSAP Audit Approach, Chapter 5: Design and Development, under Task 13.

Slide 44 

This task has linkages to Measurement, Analysis and Improvement process and Device Marketing 

Authorization and Facility Registration. During the audit of the Measurement, Analysis and Improvement 

process, the auditors may encounter corrective actions or preventive actions that resulted in design 

changes. 

When corrective action or preventive action involves changing the design, confirm that design controls 

have been applied to the change, in accordance with the medical device organization’s procedures. 

Confirm these design changes were effective in addressing the quality issues or potential quality issues 

identified in corrective or preventive action. The design change should be evaluated under the 

organization’s risk management process to ensure that changes do not introduce new hazards. 

Some changes may require revalidation where it is not possible to verify that requirements have been 

met after the change has been implemented. The audit team should also confirm the medical device 

organization has considered regulatory requirements for registration, listing, notification and licensing 

and has complied with these requirements prior to marketing the changed device.

Slide 45 

Task 14: Verify that design reviews were conducted at suitable stages as required by the design and 

development plan. Confirm the participants in the reviews include representatives of functions 

concerned with the design and development stage being reviewed, as well as any specialist personnel 

needed. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 46

There are additional country-specific requirements for the United States. Assessing conformity includes 

confirming that the review included an individual who did not have direct responsibility for the design 

stage being reviewed and confirming that outstanding action items are being resolved or have been 

resolved. Detailed information on country-specific requirements and how to assess conformity for this 

audit task are in the MDSAP Audit Approach, Chapter 5: Design and Development, under Task 14. 
 

9 

There are no links to other MDSAP processes for Task 14.

Slide 47 

Task 15: Verify that design changes have been reviewed for the effect on products previously made and 

delivered, and that records of review results are maintained. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 48 

There are no additional country-specific requirements for Task 15. Assessing conformity includes 

ensuring the design change does not negatively impact products in distribution. Detailed information on 

how to assess conformity for this audit task are in the MDSAP Audit Approach, Chapter 5: Design and 

Development, under Task 15. 

There are no links to other MDSAP processes for this task.

Slide 49 

Task 16: Determine if the design was correctly transferred to production. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 50 

There are additional country-specific requirements for Brazil for Task 16. Assessing conformity includes 

reviewing how the design for the project was transferred into production specifications, reviewing 

significant elements of the manufacturing processes, including products from suppliers and the 

established tolerances for processes, and comparing these significant elements with the approved 

design outputs contained within the design records. Detailed information on country-specific 

requirements and how to assess conformity for this audit task are in the MDSAP Audit Approach, 

Chapter 5: Design and Development, under Task 16.

Slide 51 

This task has linkages to Production and Service Controls and Purchasing Processes. Verify production 

processes for the device, including process validation, if required, have been defined, documented, and 

implemented. Confirm potential hazards that could be introduced or exacerbated by the production 

process have been identified, and production controls have been established. Production processes 

include not only the manufacturing instructions, but also internal controls, such as the type and extent 

of acceptance activities, equipment calibration and maintenance intervals, environmental controls, and 

personnel controls. Confirm that the manufacturer has determined the type and extent of supplier 

controls based on the relationship between the supplied products and services and product risk.

Slide 52 

For the final task for this process, determine, based on the assessment of the design and development 

process overall, whether management provides the necessary commitment to the design and 

development process. 
 

10

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 53 

There are no additional country-specific requirements for Task 17. Detailed information on how to 

assess conformity for this audit task are in the MDSAP Audit Approach, Chapter 5: Design and 

Development, under Task 17. 

There are no links to other MDSAP processes for this task.

Slide 54 

In summary the Design and Development process is intended to control the design and development 

activities and to assure that devices meet user needs, intended uses, and specified requirements.

Slide 55 

This concludes the training module for MDSAP process: Design and Development.