Design and Development Process 

CAPT Kimberly Lewandowski - Walker 

Senior Regulatory Officer 

Center for Devices and Radiological Health 

U.S. Food and Drug Administration
Course Prerequisites

• Successful completion of the following MDSAP training 

module is a prerequisite to this course: 

– Introduction to the MDSAP Program 

– Overview of the MDSSAP Audit Process 

– MDSAP: Management Process 

– MDSAP: Measurement, Analysis and Improvement
Learning Objectives

• Explain the Design and Development process 

• Describe the purpose of auditing the Design and Development 

process 

• Discuss the expected outcomes from audit of the Design and 

Development process 

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country - specific requirements and assessment of conformity 

– Links to other MDSAP processes 
Learning Objectives

• Explain the Design and Development process 

• Describe the purpose of auditing the Design and Development 

process 

• Discuss the expected outcomes from audit of the Design and 

Development process 

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country - specific requirements and assessment of conformity 

– Links to other MDSAP processes 
Design and Development process

• The Design and Development process: 

– Controls the design and development activities 

– Assure that devices meet user needs, intended uses, and specified requirements 

• Attention to: 

– design and development planning 

– identifying design inputs, developing design outputs 

– verifying that design outputs meet design inputs 

– validating the design 

– controlling design changes 

– reviewing design results 

– transferring the design to production 

– compiling the appropriate records 

will help an organization assure that resulting designs will meet user 

needs, intended uses, and requirements
MDSAP Audit Sequence
Learning Objectives

• Explain the Design and Development process 

• Describe the purpose of auditing the Design and Development 

process 

• Discuss the expected outcomes from audit of the Design and 

Development process 

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country - specific requirements and assessment of conformity 

– Links to other MDSAP processes 
Purpose of Auditing

• Design and Development process is audited to: 

– Verify that the organization establishes, documents, 

implements, and maintains controls 

– Ensure that medical devices meet user needs, 

intended uses and specified requirements 
Learning Objectives

• Explain the Design and Development process 

• Describe the purpose of auditing the Design and Development 

process 

• Discuss the expected outcomes from audit of the Design and 

Development process 

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country - specific requirements and assessment of conformity 

– Links to other MDSAP processes
Expected Outcomes

As a result of the audit of the Design and Development 

process, objective evidence will show whether the 

organization has: 

A. Defined, documented and implemented procedures to ensure 

medical devices are designed according to specified requirements 

B. Effectively planned the design and development of a device 

C. Established mechanisms, including systematic review, for 

addressing incomplete, ambiguous or conflicting requirements
Expected Outcomes

As a result of the audit of the Design and Development process, 

objective evidence will show whether the organization has: 

D. Determined the internally or externally imposed 

requirements for safety, function, and performance for the 

intended use, including regulatory requirements, risk 

management, and human factors requirements 

E. Verified that design outputs satisfy design input 

requirements 

F. Identified and mitigated, to the extent practical, the risks 

associated with the device, including the device software
Expected Outcomes

As a result of the audit of the Design and Development process, 

objective evidence will show whether the organization has: 

G. Ensured that changes to device designs are controlled, that 

risks associated with design changes are identified and 

mitigated, to the extent practical, and that devices will 

continue to perform as intended 

H. Performed design validation to ensure devices conform to 

user needs and intended use 

I. Confirmed that designs are correctly transferred into 

production through methods and procedures 
Learning Objectives

• Explain the Design and Development process 

• Describe the purpose of auditing the Design and Development 

process 

• Discuss the expected outcomes from audit of the Design and 

Development process 

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country - specific requirements and assessment of conformity 

– Links to other MDSAP processes
Task 1

1. Verify that those devices that are, by regulation, subject 

to design and development procedures have been 

identified. (See Annex 1)

Clause and Regulation: [ISO 13485:2016: 4.1.1, 4.2.1, 7.1, 

7.3.10 ;TG(MD)R Regs Division 3.2; MHLW MO169: 5 - 1, 6, 

26, 36-2 (Old: 5, 6, 26); 21 CFR 820.30(a)]

MDSAP Audit Approach
Task 1

• Additional country - specific requirements: Australia (TGA); Brazil 

(ANVISA); Canada (HC); and Japan (MHLW) 

• Assessing conformity: 

– Verify that organization maintain a design change procedure 

– Verify that controls and records related to design trans to production 

have been determined 

– Verify that production line meets production requirements 

Detailed information on country - specific requirements and how 

to assess conformity for this audit task can be found in the 

MDSAP Audit Approach, Chapter 5: Design and Development, 

under task 1 

15
Task 1

• Links: 

– Purchasing 

ØIf the organization outsources design and 

development activities, or any portion of the design 

and development, confirm that: 

o The organization treats the outsourced firm as a supplier; 

o Has appropriately qualified and maintains control over 

the supplier; 

o Communicates requirements to the supplier, including 

regulatory requirements 

o Has arrangements to verify that the design and 

development activities satisfy those requirements
Task 2

2. Select a completed design and development project for review. 

Priority criteria for selection: 

– complaints or known problems with a particular device 

– product risk 

– recent design changes, particularly design changes made to correct quality 

problems associated with the device design 

– combination product (if marketed to Australia) 

– age of design (prefer most recent) 

– designs that have not been recently audited 

Clause and Regulation: None

MDSAP Audit Approach
Task 2

• Additional country - specific requirements: None 

• Assessing conformity: 

Detailed information on how to assess conformity for this audit task can be 

found in the MDSAP Audit Approach, Chapter 5: Design and Development, 

under task 2 

18
Task 2

• Links: 

– Measurement, Analysis and Improvements 

ØBe mindful of how the identified quality 

problems from the Measurement, Analysis and 

Improvement process are related to specific 

aspects of the design and development of the 

device
Task 3

3. Verify the design and development process is planned and 

controlled. Review the design plan for the selected design and 

development project to understand the design and development 

activities; including the design and development stages, the review, 

verification, validation, and design transfer activities that are 

appropriate at each stage; and the assignment of responsibilities, 

authorities, and interfaces between different groups involved in 

design and development. 

Clause and Regulation: [ISO 13485:2016: 4.2.1, 7.1, 7.3.2; TG(MD)R 

Sch3 P1 Cl 1.4(4)&(5)(c); RDC ANVISA 16/2013: 4.1.2, 4.1.11; MHLW 

MO169: 6, 26, 30; 21 CFR 820.30(b), 820.30(j)] 

MDSAP Audit Approach
Task 3 

• Additional country - specific requirements: Australia (TGA); 

Canada (HC) 

• Assessing conformity: 

– Review design plans such as flowcharts, Gantt charts, Program 

Evaluation Review Technique(PERT) charts 

– Expect to see interfacing between research and development, 

marketing, regulatory, manufacturing, and quality departments 

Detailed information on country - specific requirements and how to 

assess conformity for this audit task can be found in the MDSAP 

Audit Approach, Chapter 5: Design and Development, under task 3 
Task 4

4. For the device design and development record(s) selected, verify 

that design and development procedures have been established 

and applied. Confirm the design and development procedures 

address the design and development stages, review, verification, 

validation, design transfer, and design changes. 

Clause and Regulation: [ISO 13485:2016: 4.2.1, 7.3.1, 7.3.10; 

TG(MD)R Sch3 P1 Cl 1.4(4)&(5)(c); RDC ANVISA 16/2013: 4.1.1; 

MHLW MO169: 6, 30, 36 - 2 (Old: 6, 30); 21 CFR 820.30(a), 820.30(j)] 

MDSAP Audit Approach
Task 4 

• Additional country - specific requirements: United States 

(FDA) 

• Assessing conformity: 

– Verify that Design and Development procedures address the 

regulatory requirements 

– Ensure that organization maintains defined and documented 

design change procedures 

Detailed information on country - specific requirements and how to 

assess conformity for this audit task can be found in the MDSAP 

Audit Approach, Chapter 5: Design and Development, under task 4 
Task 5

5. Verify that design and development inputs were established, 

reviewed and approved; and that they address customer,

functional, performance and safety requirements, intended 

use, applicable regulatory requirements, and other 

requirements including those arising from human factors 

issues, essential for design and development. Verify that any 

risks and risk mitigation measures identified during the risk 

management process are used as an input in the design and 

development process.

Clause and Regulation: [ISO 13485:2016: 4.2.1, 5.2, 7.2.1, 

7.3.3; TG(MD)R Sch1 P1 2, Sch3 P1 Cl 1.4(2)&(5)(c); RDC 

ANVISA 16/2013: 2.4, 4.1.3, 4.1.11; CMDR 10 - 20, 21 - 23, 66, 

67,68; MHLW MO169: 6, 11, 27, 31, 55 - 1 (Old: 6, 11, 27, 31, 

55); 21 CFR820.30(c), 820.30(g)] 

MDSAP Audit Approach
Task 5

• Additional country - specific requirements: Australia (TGA); 

and United States (FDA) 

• Assessing Conformity: 

– Review the sources used to develop the inputs 

– Determine that relevant aspects of the requirements for the 

device were covered 

Detailed information on country - specific requirements and how to 

assess conformity for this audit task can be found in the MDSAP 

Audit Approach, Chapter 5: Design and Development, under task 5 
Task 5

• Links: 

– Device Marketing Authorization and Facility 

Registration 

ØConfirm the organization has considered 

regulatory requirements for registration, listing, 

notification and licensing 

ØConfirm if organization has complied with these 

requirements prior to marketing the device
Task 6

6. Confirm the design and development inputs are 

complete, unambiguous, and not in conflict with each 

other. 

Clause and Regulation: [ISO 13485:2016: 7.3.3; TG(MD)R 

Sch 3 Part 1.4(4), RDC ANVISA 16/2013: 4.1.3; MHLW 

MO169: 31; 21 CFR820.30(c)] 

MDSAP Audit Approach
Task 6

• Additional country-specific requirements: Australia (TGA) 

• Assessing Conformity: 

– Verify that the organization performed a design review after 

the initial requirements were determined 

Detailed information on country - specific requirements and 

how to assess conformity for this audit task can be found in the 

MDSAP Audit Approach, Chapter 5: Design and Development, 

under task 6
Task 7

7. Review medical device specifications to confirm that design and 

development outputs are traceable to and satisfy design input 

requirements. Verify that the design and development outputs 

essential for the proper functioning of the medical device have 

been identified. Outputs include, but are not limited to, device 

specifications, specifications for the manufacturing process, 

specifications for the sterilization process (if applicable), the quality 

assurance testing, and device labeling and packaging. 

Clause and regulation: [ISO 13485:2016: 4.2.1, 4.2.3, 7.3.4; TG(MD)R 

Sch3 P1 Cl 1.4(5)(c); RDC ANVISA 16/2013: 4.1.5, 4.1.4, 4.1.11; MHLW 

MO169: 6, 7 - 2, 32 (Old: 6, 32); 21 CFR 820.30(d), 820.30(f)] 

MDSAP Audit Approach
Task 7

• Additional country - specific requirements: Australia (TGA) 

• Assessing Conformity: 

– Review the process for determining how the essential outputs 

were identified 

– Verify that determination of essential outputs was done in 

accordance with design output procedures 

Detailed information on country - specific requirements and how to 

assess conformity for this audit task can be found in the MDSAP 

Audit Approach, Chapter 5: Design and Development, under task 7 
Task 7

• Links: 

– Purchasing 

– Production and Service Controls 

ØBe mindful of production processes and supplied 

product that are essential to the proper functioning 

of the device 

ØConsider reviewing production processes and 

supplied products that have been the highest risk or 

greatest effect on the essential design outputs
Task 8

8. Verify that risk management activities are defined and 

implemented for product and process design and development. 

Confirm that risk acceptability criteria are established and met 

throughout the design and development process. Verify that any 

residual risk is evaluated and, where appropriate, communicated to 

the customer (e.g., labeling, service documents, advisory notices, 

etc ). 

Clause and Regulation: [ISO 13485:2016: 4.2.1, 7.1, 7.3.3, 7.3.4; 

TG(MD)R Sch1 P1 2, Sch3 P1 Cl 1.4(5)(c)(iii); RDC ANVISA 16/2013: 

2.4, 4.1.11, RDC ANVISA 56/2001; CMDR 10, 11, 15, 16; MHLW 

MO169: 6, 26, 31,32; 21 CFR 820.30(g)] 

MDSAP Audit Approach
Task 8

• Additional country - specific requirements: Brazil (ANVISA); and 

the United States (FDA) 

• Assessing Conformity: 

– Verify that risk management is initiated early in the design and 

development process 

– Confirm risk management process involves the proactive and 

reactive response to quality data that indicates new or changing 

product risk 

Detailed information on country - specific requirements and how to 

assess conformity for this audit task can be found in the MDSAP 

Audit Approach, Chapter 5: Design and Development, under task 8 
Task 9

9. Confirm that design verification and/or design validation 

includes assurances that risk control measures are 

effective in controlling or reducing risk. 

Clause and Regulation: [ISO 13485:2016: 7.1, 7.3.6, 7.3.7; 

TG(MD)R Sch1 P1 2, Sch3 P1 Cl 1.4(5)(c); RDC ANVISA 

16/2013: 2.4, 4.1.4, 4.1.8, 4.1.11; CMDR 10,11, 15, 16; 

MHLW MO169: 26, 34, 35 - 1 (Old: 26, 34, 35); 21 CFR 

820.30(f), 820.30(g)] 

MDSAP Audit Approach
Task 9

• Additional country - specific requirements: None 

• Assessing Conformity: 

– Confirm that the identified risk control measures are actually 

effective in reducing or controlling risk 

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 5: 

Design and Development, under task 9 
Task 10

10. Verify that design and development validation data show that the 

approved design meets the requirements for the specified 

application or intended use(s). Verify that design validation testing 

is adjusted according to the risk of the product and element being 

validated.

Clause and Regulation: [ISO 13485:2016: 4.2.1, 7.3.7; TG(MD)R 

Sch1 P1 2; Sch3 P1 Cl1.4(5)(d); RDC ANVISA 16/2013: 2.4, 4.1.8, 

4.1.11; CMDR 12, 18, 19; MHLW MO169: 6, 35-1 (6, 35); 21 CFR 

820.30(g)] 

MDSAP Audit Approach
Task 10

• Additional country - specific requirements: Australia (TGA) 

• Assessing Conformity: 

– Confirm that the design validation data show that the 

approved design met the predetermined user needs and 

intended uses 

Detailed information on country - specific requirements and 

how to assess conformity for this audit task can be found in the 

MDSAP Audit Approach, Chapter 5: Design and Development, 

under task 10 
Task 11

11. Verify that clinical evaluations and/or evaluation of the 

medical device safety and performance were performed as 

part of design validation if required by national or regional 

regulations. 

Clause and Regulation: [ISO 13485:2016: 4.2.1, 7.3.7; TG(MD)R 

Reg 3.11, Sch3 P1 Cl 1.4(5)(c)(vii), Sch3 P8; RDC ANVISA 

16/2013: 4.1.8, 4.1.11, RDC ANVISA 56/2001; CMDR 12, 18, 19; 

MHLW MO169: 6, 35 - 1 (Old: 6, 35); 21 CFR 820.30(g)] 

MDSAP Audit Approach
Task 11

• Additional country - specific requirements: Australia (TGA) 

• Assessing Conformity: 

– Verify whether clinical evaluations have been performed as 

part of design validation 

– Verify whether acceptance criteria has been established 

Detailed information on country - specific requirements and 

how to assess conformity for this audit task can be found in the 

MDSAP Audit Approach, Chapter 5: Design and Development, 

under task 11 
Task 12

12. If the medical device contains software, verify that the 

software was subject to the design and development process. 

Confirm the software was included within the risk 

management process.

Clause and Regulation: [ISO 13485:2016: 7.3.2, 7.3.10; 

TG(MD)R Sch1 P1 2, Sch1 EP12.1; RDC ANVISA 16/2013: 2.4, 

4.1.8, 4.1.11; CMDR 20; MHLW MO169: 30, 36 - 2 (Old: 30); 21 

CFR 820.30(g)] 

MDSAP Audit Approach
Task 12

• Additional country - specific requirements: None 

• Assessing Conformity: 

– Confirm that the software is part of the design and 

development plan for the device 

– Confirm that appropriate software verification activities were 

conducted 

– Review actual results of selected software tests 

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 5: 

Design and Development, under task 12 
Task 13

13. Verify that design and development changes were controlled, 

verified (or where appropriate validated), and approved prior to 

implementation. Confirm any new risks associated with the design 

change have been identified and mitigated to the extent practical. 

Clause and Regulation: [ISO 13485:2016: 4.2.1, 4.2.3, 7.1, 7.3.9, 

7.3.10; TG(MD)R Sch1 P1 2, Sch3 P1 Cl 1.4(5)(f), Sch3 P1Cl1.5(4); RDC 

ANVISA 16/2013: 2.4, 4.1.4, 4.1.8, 4.1.10, 4.1.11, Brazilian Law 

6360/76 - Art. 13; CMDR 1, 34; MHLW MO169: 6, 7 - 2, 26, 36 - 1, 36 - 2, 

55 - 1 (Old: 6, 26, 36); 21 CFR 820.30(i)] 

MDSAP Audit Approach
Task 13

• Additional country - specific requirements: Australia 

(TGA); Brazil (ANVISA); Canada (HC); Japan (MHLW), 

and the United States (FDA) 

• Assessing Conformity:

Detailed information on country - specific requirements and 

how to assess conformity for this audit task can be found in the 

MDSAP Audit Approach, Chapter 5: Design and Development, 

under task 13 
Task 13

• Links: 

– Measurement, Analysis and Improvement 

process Device Marketing 

ØConfirm that design controls have been applied to the 

change, in accordance with the organization’s 

procedures 

ØConfirm design changes were effective 

– Device Marketing Authorization and Facility 

Registration 

ØConfirm regulatory requirements for registration, 

listing, notification and licensing were considered 
Task 14

14. Verify that design reviews were conducted at suitable stages 

as required by the design and development plan. Confirm the 

participants in the reviews include representatives of 

functions concerned with the design and development stage 

being reviewed, as well as any specialist personnel needed.

Clause and Regulation: [ISO 13485:2016: 4.2.1, 7.3.2, 7.3.5; 

TG(MD)R Sch3 P1 C1.4(5)(c)(i); RDC ANVISA 16/2013: 4.1.6, 

4.1.11; MHLW MO169: 6, 30, 33; 21 CFR 820.30(e)] 

MDSAP Audit Approach
Task 14

• Additional country - specific requirements: Unites States 

(FDA) 

• Assessing Conformity: 

– Confirm that the review included an individual who did not have 

direct responsibility for the design stage being reviewed 

– Confirm that outstanding action items are being resolved or have 

been resolved 

Detailed information on country - specific requirements and how to 

assess conformity for this audit task can be found in the MDSAP 

Audit Approach, Chapter 5: Design and Development, under task 14 
Task 15

15. Verify that design changes have been reviewed for the effect 

on products previously made and delivered, and that records 

of review results are maintained.

Clause and Regulation: [ISO 13485:2016: 7.3.9; RDC ANVISA 

16/2013: 4.1.10; MHLW MO169: 36 - 1 (Old: 36); 21 CFR 

820.30(i)] 

MDSAP Audit Approach
Task 15

• Additional country - specific requirements: None 

• Assessing Conformity: 

– Ensure the design change does not negatively impact 

products in distribution 

Detailed information on how to assess conformity for this 

audit task can be found in the MDSAP Audit Approach, 

Chapter 5: Design and Development, under task 15 
Task 16

16. Determine if the design was correctly transferred to 

production. 

Clause and Regulation: [ISO 13485:2016: 4.2.1, 4.2.3, 

7.3.8; RDC ANVISA 16/2013: 4.1.7, 4.1.9, 4.1.11, 4.2; 

MHLW MO169: 6, 7-2, 35-2 (Old: 6, 30); 21 CFR 830.30(h)] 

MDSAP Audit Approach
Task 16

• Additional country - specific requirements: Brazil (ANVISA) 

• Assessing Conformity: 

– Review how the design for the project was transferred into 

production specifications 

– Review significant elements of the manufacturing processes 

– Compare the significant elements with the approved design 

outputs 

Detailed information on country - specific requirements and how to 

assess conformity for this audit task can be found in the MDSAP 

Audit Approach, Chapter 5: Design and Development, under task 16 
Task 16

• Links: 

– Production and Service Controls 

ØVerify production processes for the device 

have been defined, documented, and 

implemented 

ØConfirm potential hazards that could be 

introduced or exacerbated by the production 

process have been identified, and production 

controls have been established 

– Purchasing 

ØConfirm that the manufacturer has determined 

the type and extent of supplier controls
Task 17

17. Determine, based on the assessment of the design and 

development process overall, whether management provides 

the necessary commitment to the design and development 

process. 

Clause and Regulation: [ISO 13485:2016: 4.1.3, 5.1, 5.5.1; 

TG(MD)R Sch3 P1 Cl 1.4(5)(b)(ii); RDC ANVISA 16/2013: 2.2.1; 

MHLW MO169: 5, 10, 15] 

MDSAP Audit Approach
Task 17

• Additional country - specific requirements: None 

• Assessing Conformity: 

Detailed information on how to assess conformity for this 

audit task can be found in the MDSAP Audit Approach, 

Chapter 5: Design and Development, under task 17 
Summary

• Design and Development process is intended to: 

– Control the design and development activities 

– Assure that devices meet user needs, intended uses, 

and specified requirements. 
Conclusion

This concludes the training module for MDSAP process : Design and 

Development