1

MDSAP: Production and Service Controls Process, Part 1

Slide 1

I am CAPT Kimberly Lewandowski-Walker, Senior Regulatory Officer at the Center for Devices and 

Radiological Health at the U.S. Food and Drug Administration. I will be your presenter for this training 

module. In this training module, we will be reviewing the first of three training modules for the Medical 

Device Single Audit Program (MDSAP) process: Production and Service Controls.

Slide 2

The prerequisites for understanding this Production and Service Controls Process, Part 1 training module 

are the MDSAP training modules “Introduction to the MDSAP Program”, “Overview of the MDSAP 

Process”, “MDSAP: Management Process”, “MDSAP: Measurement, Analysis and Improvement 

Process”, and “MDSAP: Design and Development Process”.

Slide 3

In this Production and Service Controls Process, Part 1 training module, we will explain the Production 

and Service Controls process, describe the purpose of auditing the Production and Service Controls 

process, discuss the expected outcomes from the audit of the Production and Service Controls process, 

and explain the audit tasks for Production and Service Controls Process, Part 1 in terms of description 

and Clauses and Regulations, list country-specific requirements and assessment of conformity for each 

audit task in Part 1, and indicate the links to other MDSAP processes.

Slide 4 

We will begin this three-part training with first explaining the Production and Service Controls process.

Slide 5

The intention of the Production and Service Controls process is to manufacture products that meet 

specifications. Developing processes that are adequate to produce devices that meet specifications, 

validating, or fully verifying the results of, those processes, and monitoring and controlling those 

processes are all steps that help to ensure that the result will be devices that meet specified 

requirements.

After completing the audit of the organization’s Production and Service Controls process, the audit team 

will return to the Management process to make a final decision of whether top management ensures 

that an adequate and effective quality management system has been established and maintained at the 

organization.

Slide 6

The organization must understand when deviations from device specifications could occur as a result of 

the production process or environment in order to meet the Production and Service Controls 

requirements of ISO 13485:2016, the Quality Management System requirements of the Conformity 

Assessment Procedures of the Australian Therapeutic Goods (Medical Devices) Regulations, the Brazilian 

Good Manufacturing Practices.

Slide 7

The medical device organization must understand when deviations from device specifications could 

occur as a result of the production process or environment in order to meet the Production and Service 

Controls requirements also of the Japan Ordinance on Standards for Manufacturing Control and Quality 
2

Control of Medical Devices and In Vitro Diagnostic Reagents, the US Quality System Regulation, and 

specific requirements of medical device regulatory authorities participating in the MDSAP program.

Slide 8 

The management representative is responsible for ensuring that the requirements of the quality 

management system have been effectively defined, documented, implemented, and maintained. 

Prior to the audit of any process, it may be helpful to interview the management representative (or 

designee) to obtain an overview of the process and a feel for management's knowledge and 

understanding of the process.

Slide 9

We will now move to a discussion of the purpose of auditing the Production and Service Controls 

process.

Slide 10 

Audit of the Production and Service Controls process will follow audit of the Measurement, Analysis and 

Improvement process and the Design and Development process per the MDSAP audit sequence. 

Information the audit team has learned about device and quality management system nonconformities 

during audit of the Measurement, Analysis and Improvement process, as well as higher risk elements 

and essential design outputs from the design projects reviewed during audit of the Design and 

Development process, should be used to make decisions regarding the production processes to be 

reviewed during the audit of the Production and Service Controls process.

Slide 11 

The purpose of auditing the Production and Service Controls process, including testing, infrastructure,

facilities, equipment, and servicing, is to verify that the manufacturer’s processes are capable of 

ensuring that products will meet specifications.

Slide 12 

In this training, we will describe the purpose of the Design and Development process, discuss the 

expected outcomes from the audit of the Design and Development process, explain the audit tasks and 

links to other MDSAP processes, recognize country-specific requirements, and review the assessment of 

conformity for the audit tasks.

Slide 13

As a result of the audit of the Production and Service Controls process, objective evidence will show 

whether the organization has: defined, documented and implemented procedures to ensure production 

and service processes are planned, developed, conducted, controlled, and monitored to ensure 

conformity to specified requirements; developed production and service process controls 

commensurate with the potential effect of the process on product risk.

Slide 14 

As a result of the audit of the Production and Service Controls process, objective evidence will show 

whether the organization has: ensured that when the results of a process cannot be verified by 

subsequent monitoring or measurement, the process is validated with a high degree of assurance to 

ensure that the process will consistently achieve the planned result; and Implemented procedures for 

the validation of the application of computer software for production and service processes that affect 
3

the ability of the product to conform to specified requirements, including validation of computer 

software used in the quality management system.

Slide 15 

As a result of the audit of the Production and Service Controls process, objective evidence will show 

whether the organization has: maintained records for each batch of medical devices that provides 

information for traceability and confirmation that the batch meets specified requirements; and 

implemented controls to protect customer property, including intellectual property, confidential health 

information, and other forms of customer property that is used or incorporated into products.

Slide 16 

Accomplishment of the outcomes for the Production and Service Controls process is accomplished 

through the completion of the audit tasks. We will now discuss the audit tasks for the Production and 

Service Controls process Part 1 and the links to the interrelated MDSAP processes. 

Slide 17

Task 1: Verify that the product realization processes are planned, including any necessary controls, 

controlled conditions, and risk management activities required for the product to meet the specified or 

intended uses, the statutory and regulatory requirements related to the product, and when applicable, 

the unique device identifier requirements. Confirm that the planning of product realization is consistent 

with the requirements of the other processes of the quality management system and performed in 

consideration of the quality objectives. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 18

There are additional country specific requirements for the United States. Detailed information on 

country-specific requirements and how to assess conformity for this audit task can be found in the 

MDSAP Audit Approach, Chapter 6: Production and Service Controls, under Task 1.

Slide 19 

This task has a link to the Management process. During audit of the Management process, confirm when 

necessary that the quality objectives related to the product were considered for inclusion in 

management review.

Slide 20

Task 2: Review production processes considering the following criteria. Select one or more production 

processes to audit. When selecting production processes for review, information the audit team has 

learned about device and quality management system nonconformities during audit of the 

Measurement, Analysis and Improvement process, as well as higher risk elements and essential design 

outputs from the design projects reviewed during audit of the Design and Development process should 

be used to make decisions as to the production processes to be reviewed.

There are no related Clauses and Regulations for Task 2.

Slide 21 
4

The audit team should consider the following priorities when selecting production processes for review: 

corrective and preventive action indicators of process problems or potential problems; use of 

production process for higher risk products; use of production processes that directly impact the ability 

of the device to meet its essential design outputs; new production processes or new technologies; use 

of the process in manufacturing multiple products; processes that operate over multiple shifts; 

processes not covered during previous audits.

Slide 22 

There are no additional country-specific requirements for this Task 2. Detailed information on how to 

assess conformity for this audit task are in the MDSAP Audit Approach, Chapter 6: Production and 

Service Controls, under Task 2.

There are no links to other MDSAP processes for Task 2.

Slide 23 

Task 3: For each selected process, determine if the production and service process is planned and 

conducted under controlled conditions that include the availability of information describing product 

characteristics, the availability of documented procedures, requirements, work instructions, reference 

materials, reference measurements, and criteria for workmanship, the use of suitable equipment, the 

availability and use of monitoring and measuring devices, the implementation of monitoring and 

measurement of process parameters and product characteristics during production.

Slide 24 

In addition, for each selected process, determine if the production and service process is planned and 

conducted under controlled conditions that include the implementation of release, delivery and postdelivery activities, the implementation of defined operations for labeling and packaging, and the 

establishment of documented requirements for changes to methods and processes.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 25

There are no additional country-specific requirements for Task 3. Detailed information on how to assess 

conformity for this audit task in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, 

under Task 3.

There are no links to other MDSAP processes for Task 3.

Slide 26

Task 4: Determine if the organization has established documented requirements for product cleanliness 

including any cleaning prior to sterilization, cleanliness requirements if provided non-sterile, and 

assuring that process agents are removed from the product if required.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 27
5

There are additional country-specific requirements for Brazil. Assessing conformity includes confirming 

that the medical device organization has identified the cleanliness requirements for the finished device 

and the proper controls to achieve the required level of cleanliness. It includes confirming that the 

medical device organization has made effective arrangements to control the process agent 

(manufacturing material) in a manner commensurate with the risk the agent poses to the finished 

device. Detailed information on country-specific requirements and how to assess conformity for this 

audit task are in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, under Task 4.

There are no links to other MDSAP processes for task 4.

Slide 28 

Task 5: Verify that the organization has determined and documented the infrastructure requirements to 

achieve product conformity, including buildings, workspace, process equipment, and supporting 

services. Confirm that buildings, workspaces, and supporting services allow product to meet 

requirements. Verify that there are documented and implemented requirements for maintenance of 

process equipment, where important for product quality, and that records of maintenance are 

maintained.

The related clauses of ISO 13485:2016 are listed on this slide along with related 

regulations for the participating countries.

Slide 29 

There are additional country-specific requirements for Brazil. Detailed information on country-specific 

requirements and how to assess conformity for this audit task are in the MDSAP Audit Approach, 

Chapter 6: Production and Service Controls, under Task 5.

There are no links to other MDSAP processes for Task 5.

Slide 30 

Task 6: Verify documented requirements have been established, implemented and maintained for: 

health, cleanliness, and clothing of personnel that could have an adverse effect on product quality; 

monitoring and controlling work environment conditions that can have an adverse effect on product 

quality; training or supervision of personnel who are required to work under special environmental 

conditions; and controlling contaminated or potentially contaminated product (including returned 

products) in order to prevent contamination of other product, the work environment, or personnel.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 31 

There are additional country-specific requirements for Brazil. Detailed information on country-specific 

requirements and how to assess conformity for this audit task are in the MDSAP Audit Approach, 

Chapter 6: Production and Service Controls, under Task 6.

There are no links to other MDSAP processes for Task 6.

Slide 32 
6

Task 7: Determine if the selected processes and sub-processes have been reviewed, including any 

outsourced processes, to determine if validation of these processes is required. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 33 

There are additional country-specific requirements for Brazil and the United States. Assessing 

conformity includes confirming that, when applicable, the medical device organization has identified 

processes which require validation, including validation requirements for any outsourced processes. 

Detailed information on country-specific requirements and how to assess conformity for this audit task 

are in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, under Task 7.

Slide 34

There are links to Purchasing process for this task. The audit team may encounter situations where the 

organization outsources processes that require validation. During the review of the Purchasing process, 

review the controls the organization has instituted over suppliers that perform validated processes.

This linkage can be particularly important for higher risk validated processes performed by suppliers, 

since the finished device manufacturer does not have immediate control over those processes.

Slide 35

Task 8: Verify that the selected processes have been validated if the result of the process cannot be fully 

verified, or can be verified, but is not. Confirm that the validation demonstrates the ability of the 

processes to consistently achieve the planned result. In the event changes have occurred to a previously 

validated process, confirm that the processes were reviewed and evaluated, and re-validation was 

performed where appropriate. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 36 

There are country-specific requirements for Australia. Assessing conformity includes determining when 

applicable whether: the instruments used to generate the data were properly calibrated and 

maintained; predetermined product and process specifications were established; sampling plans used to 

collect test samples are based on a statistically valid rationale; data demonstrates predetermined 

specifications were met consistently; process tolerance limits were challenged; process equipment was 

properly installed, adjusted, and maintained; process monitoring instruments were properly calibrated 

and maintained; changes to the validated process were appropriately challenged (if applicable) and 

process operators were appropriately qualified.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

are in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, under Task 8.

There are no links to other MDSAP process for Task 8.

Slide 37

Task 9: If product is supplied sterile, verify that the sterilization process is validated, periodically revalidated, and records of the validation are available, that devices sold in a sterile state are 
7

manufactured and sterilized under appropriately controlled conditions, and determine whether the 

sterilization process and results are documented and traceable to each batch of product.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 38

There are country-specific requirements for Australia. Assessing conformity includes ensuring cleaning, 

packaging, and sterilization processes are validated and ensuring the medical device organization 

maintains appropriate controls over: routine monitoring and measure of the cleaning, packaging and 

sterilization processes; routine acceptance criteria of the cleaning, packaging and sterilization processes; 

requalification, reverification, recalibration and maintenance of the cleaning, packaging and sterilization 

equipment; environmental control of production areas (cleanroom design and monitoring); storage of 

device parts, components, and packaging material; storage of finished sterile product and management 

of shelf life; and handling processes for non-sterile devices for re-sterilization.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, under task 9.

There are no links to other MDSAP processes for Task 9.

Slide 39

Task 10: Verify that the system for monitoring and measuring of product characteristics is capable of 

demonstrating the conformity of products to specified requirements. Confirm that product risk is 

considered in the type and extent of product monitoring activities.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 40

There are no country-specific requirements for task 10. Assessing conformity includes confirming that 

the control measures are suitable for detecting process or product nonconformities. Detailed 

information on how to assess conformity for this audit task are in the MDSAP Audit Approach, Chapter 

6: Production and Service Controls, under Task 10. 

There are no links to other MDSAP processes for this task.

Slide 41 

In summary, the Production and Service Controls process is intended to manufacture products that 

meet specifications and the organization must understand when deviations from device specifications 

could occur as a result of the production process or environment in order to meet the Production and 

Service Controls requirements.

Slide 42

This concludes part 1 of the training module for MDSAP process: Production and Service Controls.

Please continue to part 2 to complete the discussion of the audit tasks for the Production and Service 

Controls process, as well as the links to other MDSAP processes.