MDSAP: Management Process

Slide 1

I am CAPT Kimberly Lewandowski-Walker, Senior Regulatory Officer at the Center for Devices and 

Radiological Health at the U.S. Food and Drug Administration. I will be your instructor for this course.

In this training module, we will be reviewing the Management process for the Medical Device Single 

Audit Program (or MDSAP) and how to audit this process.

Slide 2

The prerequisites for understanding this Management Process training module are the MDSAP training 

modules: “Introduction to the MDSAP Program” and the “Overview of the MDSAP Audit Process”. 

It is expected that the auditor is proficient in auditing to the Organization for Standardization 

13485:2016, Medical Devices- Quality management systems- Requirements for regulatory purposes (or 

ISO 13485:2016) and is familiar with the specific requirements of the regulatory authorities participating 

in the MDSAP program in addition to the Successful completion of the listed prerequisites.

Slide 3

In this training module, we will explain the Management process, describe the purpose of auditing the 

Management process, discuss the expected outcomes from audit of the Management process, and 

Explain the audit tasks in terms of the Description and related Clauses and Regulations for each audit 

task, the list of country-specific requirements and assessment of conformity for each audit task, and 

finally indicate the links of the Management process to other MDSAP processes.

Successful completion of this training module will give the basic knowledge required to audit the 

Management process.

Slide 4

Let’s begin with explaining the MDSAP Management Process.

Slide 5

The intention of the Management process is to provide adequate resources for device design, 

manufacturing, quality assurance, distribution, installation, and servicing activities, to assure the quality 

management system is functioning properly and effectively, and to monitor the quality management 

system and make necessary adjustments. 

A quality management system that has been implemented effectively and is monitored to identify and 

address existing and potential problems is more likely to produce medical devices that function as 

intended.

Slide 6

The management representative plays an important role in the quality management system. The 

management representative is responsible for ensuring that the requirements of the quality 

management system have been effectively defined, documented, implemented, and maintained. 
Prior to the review of any process, it may be helpful to interview the management representative, or the 

management representative’s designee, to obtain an overview of the process and a feel for 

management's knowledge and understanding of the process.

Slide 7

We will now move to discussion of the purpose of auditing the Management process.

So, why do we audit the Management process?

Slide 8

As you can see from this diagram, the Management process is the first process to be audited per the 

MDSAP audit sequence.

Slide 9

The purpose of auditing the Management process is to verify that top management ensures that an 

adequate and effective quality management system has been established and maintained and to 

determine whether top management demonstrated commitment for a quality management system and 

communicated that commitment to personnel.

Slide 10

A thorough assessment of the organization's Management process is most efficiently made by 

evaluating the management process both at the beginning of the audit and throughout the audit of the 

other processes. Therefore, the audit should commence and end with the management process. 

This doesn't mean that the audit tasks are repeated, but only that the final conclusions on the 

appropriateness and effectiveness of management activities and commitment can only be reached at 

the end of the audit by considering all the audit evidence collected.

Slide 11

We will now move to a discussion of the expected outcomes of auditing the Management process.

The next few slides will discuss these outcomes.

Slide 12

As a result of the audit of the Management process, objective evidence will show whether the 

organization has identified processes needed for the quality management system, their application 

throughout the organization, and their sequence and interaction; and has defined, documented, and 

implemented procedures and instructions to ensure the development and maintenance of an effective 

quality management system.

Slide 13

As a result of the audit of the Management process, objective evidence will show whether the 

organization has: established quality objectives at relevant functions and levels within the organization 

consistent with the quality policy and ensured that these are periodically reviewed for continued 

suitability; determined the criteria and methods needed to ensure the operation and control of quality 

management system processes, including the identification and management of interrelated processes; 

and committed the appropriate personnel and resources for infrastructure to the quality management 

system.

Slide 14
Objective evidence will show whether the organization has: assigned responsibility and authority to 

personnel and established the organizational structure to ensure processes assuring quality are not 

compromised; and performed risk management planning and ongoing review of the effectiveness of risk 

management activities to ensure that policies, procedures and practices are established for analyzing, 

evaluating and controlling risk.

Slide 15

As a result of the audit of the Management process, objective evidence will show whether the 

organization has: ensured the continued effectiveness of the quality management system and its 

processes and established a quality management system which is capable of producing devices that are 

safe, effective and suitable for their intended use.

Slide 16

We will now move to a discussion of each audit task.

The next few slides will Explain the audit tasks in terms of the description and related Clauses and 

Regulations for each audit task, the Country-specific requirements and assessment of conformity, and 

the Links of the Management process to other MDSAP processes.

Slide 17

Task 1. Confirm that quality management system planning is performed to ensure that all required 

processes are identified, documented, implemented, monitored and maintained in order to conform to 

the applicable requirements and meet quality objectives. Verify that changes to the quality 

management system are managed to maintain the conformity of the quality management system and of 

the devices produced. Verify that a quality manual has been documented. 

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 18

There are no additional country-specific requirements for this task.

Detailed Information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 1: Management, under task 1.

Slide 19

This task has links to various other MDSAP processes, including: Measurement, Analysis and 

Improvement; Design and Development; Purchasing; Production and Service Controls; and Device 

Marketing Authorization and Facility Registration. This is because while quality management system 

planning begins in Management, it spans throughout the other MDSAP processes to include change 

controls throughout the quality management system.

During the audit, whenever a change is identified, verify that the organization has implemented 

appropriate change controls.

Slide 20

Task 2: Confirm top management has documented the appointment of a management representative. 

Verify the responsibilities of the management representative include ensuring that quality management 
system requirements are effectively established and maintained, reporting to top management on the 

performance of the quality management system, and ensuring the promotion of awareness of 

regulatory requirements throughout the organization.

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 21

There are no additional country-specific requirements for this task.

Assessing conformity includes confirming the appointment of, evaluating the responsibility and 

authority of, and verify the required training of the management representative. Detailed information 

on how to assess conformity for this audit task can be found in the MDSAP Audit Approach, Chapter 1: 

Management, under task 2.

There are no additional linkages for this task to other audit processes.

Slide 22

Task 3: Verify that a quality policy and objectives have been set at relevant functions and levels within 

the organization. Ensure the quality objectives are measurable and consistent with the quality policy. 

Confirm appropriate measures are taken to achieve the quality objectives.

The related clauses of ISO 13485:2016 are listed on the slide along with the related regulations for the 

participating countries.

Slide 23

There are no additional country-specific requirements for this task.

Assessing conformity includes asking for examples of quality objectives and the status of these 

objectives. Detailed information on how to assess conformity for this audit task can be found in the 

MDSAP Audit Approach, Chapter 1: Management, under task 3.

There are no additional linkages for this task to other audit processes.

Slide 24

Task 4: Review the manufacturer's organizational structure and related documents to verify that they 

include provisions for responsibilities, authorities (e.g., management representative), personnel, 

resources for infrastructure, competencies, and training to ensure that personnel have the necessary 

competence to design and manufacture devices in accordance with the planned arrangements and 

applicable regulatory requirements. 

The related clauses of ISO 13485:2016 are listed on the slide along with the related regulations for the 

participating countries.

Slide 25

There are no additional country-specific requirements for this task.
Assessing conformity includes reviewing organizational charts, asking authority and responsibility 

questions, and asking the management representative to provide examples of recent requests for 

different types of resources. Detailed Information on how to assess conformity for this audit task can be 

found in the MDSAP Audit Approach, Chapter 1: Management, under task 4

There are no additional linkages for this task to other audit processes.

Slide 26

Task 5: Determine the extent of outsourcing of processes that may affect the conformity of product 

with specified requirements and verify the proper documentation of controls in the quality management 

system.

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 27

There are additional country-specific requirements for Australia and Canada.

Assessing conformity includes ascertaining the extent to which the medical device organization 

outsources processes that are essential for the proper functioning of the finished medical device. 

Detailed information on country-specific requirements and how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 1: Management, under task 5.

Slide 28

This task has a link to Purchasing processes.

At this stage in the audit, the audit team should take stock of the level of outsourcing practiced by the 

organization and consider the risk involved with this outsourcing. The audit team should determine 

what the organization’s policies regarding outsourcing and purchasing are and who has authority and 

responsibility for the approval and management of suppliers and supplied products. 

During the audit of the Management process, the audit team should begin to assess whether the 

organization has committed sufficient resources to the management of outsourcing and suppliers; this 

determination can only be completed by completing the audit of MDSAP Purchasing process, but the 

ground work for this is laid during the audit of the management process. The integration of risk 

management activities in the purchasing process should also form part of this task at a high level to 

assess management’s involvement in the management of product risk associated with outsourcing.

This preliminary work will allow the audit team to more effectively complete the audit of the 

organization’s Purchasing process, verifying that management has assured the appropriate level of 

control over suppliers, including an assessment of the relationship between supplied products and 

product risk.

Slide 29

Task 6: Confirm the medical device organization has determined the necessary competencies for 

personnel performing work affecting product quality, provided appropriate training, and made 

personnel aware of the relevance and importance of their activities on product quality and achievement 

of the quality objectives. Ensure records of training and competencies are maintained.
The related clauses of ISO 13485:2016 are listed on the slide along with the related regulations for the 

participating countries.

Slide 30

There are additional country-specific requirements for Brazil.

Assessing conformity includes reviewing employee training records. Detailed information on additional 

country-specific requirements and how to assess conformity for this audit task can be found in the 

MDSAP Audit Approach, Chapter 1: Management, under task 6.

Slide 31

There is a linkage between this task and the Productions and Service Controls process.

During the audit of the Production and Service Controls process, ensure that employees who are 

involved in key operations that affect product realization and product quality have been trained in their 

specific job tasks, as well as the quality policy and objectives. When appropriate, review the training 

records for those employees whose activities have contributed to process nonconformities.

Slide 32

Task 7: Verify that management has committed to and has responsibility for overall risk management 

planning, including ongoing review of the effectiveness of risk management activities ensuring that 

policies, procedures and practices are established and documented for analyzing, evaluating and 

controlling product risk throughout product realization. 

The related clauses of ISO 13485:2016 are listed on the slide along with the related regulations for the 

participating countries.

Slide 33

There are no additional country-specific requirements for this task.

Assessing conformity includes ensuring the provision of adequate resources, ensuring assignment of 

qualified personnel for risk management activities, and ensuring top management reviews the suitability 

of the risk management process. Detailed Information on how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 1: Management, under task 7.

Slide 34

There is a linkage between this task and the Design and Development process.

Risk management usually starts in conjunction with the Design and Development planning process at a 

point in the development when the results of risk analysis can affect the design process. 

During audit of the Design and Development process, evaluate top management’s commitment to risk 

management activities. Evidence of commitment to risk management may include the implementation 

of new or more stringent controls, external controls (e.g. additional supplier-related controls), or design 

changes to maintain an acceptable level of product risk.

Slide 35
Task 8: Verify that procedures have been defined, documented, and implemented for the control of 

documents and records required by the quality management system. Confirm the organization retains 

records and at least one obsolete copy of controlled documents for a period of time at least equivalent 

to the lifetime of the device, but not less than two years from the date of product release.

The related clauses of ISO 13485:2016 are listed on the slide along with the related regulations for the 

participating countries.

Slide 36

There are additional country-specific requirements for Australia, Brazil, Japan, and United States.

Assessing conformity includes ensuring at least one copy of obsolete controlled documents is 

maintained. Detailed information on additional country-specific requirements and how to assess 

conformity for this audit task can be found in the MDSAP Audit Approach, Chapter 1: Management, 

under task 8.

There are no additional linkages for this task to other audit processes.

Slide 37

Task 9: Verify that procedures for management review have been documented, management reviews 

are being conducted at planned intervals, that they include a review of the suitability and effectiveness 

of the quality policy, quality objectives, and quality management system to assure that the quality 

management system meets all applicable regulatory requirements.

The related clauses of ISO 13485:2016 are listed on the slide along with the related regulations for the 

participating countries.

Slide 38

There are no additional country-specific requirements for this task.

Assessing conformity includes ensuring that the quality policy and objectives have been reviewed for 

continued suitability and ensuring that any changes to regulatory requirements have been identified. 

Detailed information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 1: Management, under task 9.

Slide 39

There is a linkage between this task and the Measurement, Analysis and Improvement process.

During audit of the Measurement, Analysis and Improvement process, confirm when necessary that 

action items resulting from Management review are considered for corrective or preventive action.

Slide 40

Task 10: Confirm that the medical device organization has defined and implemented controls to ensure 

that only devices that have received the appropriate marketing authorization are distributed or 

otherwise offered for commercial distribution into the applicable markets. 

The related clauses of ISO 13485:2016 are listed on the slide. There are no related regulations for the 

participating countries.
Slide 41

There are no additional country-specific requirements for this task.

Assessing conformity includes verifying the identification and documentation of the responsibilities of 

employees and personnel, verifying obligations are carried out by competent personnel, and verifying 

controls to ensure appropriate market authorization. Detailed information on how to assess conformity 

for this audit task can be found in the MDSAP Audit Approach, Chapter 1: Management, under task 10.

Slide 42

There is a linkage between this task and the Device Marketing Authorization and Facility Registration 

process.

During the accomplishment of audit task 10, you may choose to perform a preliminary review of Device 

Marketing Authorization and Facility Registration. In some instances, this preliminary review may allow 

for adequate coverage of Device Marketing Authorization and Facility Registration. In other instances, 

you may need to revisit the Device Marketing Authorization and Facility Registration process if you find 

that changes were made to marketed devices, facilities, or the quality management system that need to 

be reported to the regulatory authorities participating in the Medical Device Single Audit Program. 

Slide 43

Task 11: At the conclusion of the audit, a decision should be made as to whether top management has 

demonstrated the necessary commitment to ensure a suitable and effective quality management 

system is in place and being maintained and whether the effectiveness of the system has been 

communicated to personnel. 

The related clauses of ISO 13485:2016 are listed on the slide along with the related regulations for the 

participating countries.

Slide 44

There are no additional country-specific requirements for this task.

Detailed information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 1: Management, under task 11.

Slide 45

In summary, the Management process is the first process to be audited per the MDSAP audit sequence.

The intent of the Management process is to provide adequate resources, to assure the quality 

management system is functioning properly and effectively and to monitor and make any necessary 

adjustments.

Finally, the purpose of auditing the Management process is to verify that top management ensures an 

adequate and effective quality management system has been established and maintained.

Slide 46

This concludes the training module for the MDSAP process: Management.