Management Process

CAPT Kimberly Lewandowski-Walker

Senior Regulatory Officer

Center for Devices and Radiological Health 

U.S. Food and Drug Administration
Course Prerequisites

• Successful completion of the following MDSAP training is a

prerequisite to this course:

– “Introduction to the MDSAP Program”

– “Overview of MDSAP Audit Process”

• It is expected that the auditor is :

– proficient in auditing to International Organization for Standardization

13485:2016, Medical Devices- Quality management systems- Requirements

for regulatory purposes (ISO 13485:2016)

– is familiar with specific requirements of the regulatory authorities

participating in the Medical Device Single Audit Program (MDSAP) 
Learning Objectives

• Explain the Management Process

• Describe the purpose of auditing the Management process

• Discuss the expected outcomes from audit of the Management 

process

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country-specific requirements and assessment of conformity

– Links to other MDSAP processes
Learning Objectives

• Explain the Management Process

• Describe the purpose of auditing the Management process

• Discuss the expected outcomes from audit of the Management 

process

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country-specific requirements and assessment of conformity

– Links to other MDSAP processes
Management Process

• Provides adequate resources for device design and 

manufacturing

• Assures the quality management system is functioning 

properly and effectively

• Monitors the quality management system and make 

necessary adjustments
Role of the management representative

• Responsibilities include:

– Ensuring that the requirements of the quality management 

system have been effectively defined, documented, 

implemented, and maintained 

• Interview the management representative (or 

designee) to obtain an overview of the process as 

needed
Learning Objectives

• Explain the Management Process

• Describe the purpose of auditing the Management process

• Discuss the expected outcomes from audit of the Management 

process

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country-specific requirements and assessment of conformity

– Links to other MDSAP processes
MDSAP Audit Sequence

• The Management process is the first process to be audited per the MDSAP audit 

sequence.
Purpose of Auditing

• The Management process is audited to:

– Verify that top management ensure that an adequate and 

effective quality management system has been established 

and maintained

– Determine whether top management demonstrated 

commitment for a quality management system and 

communicated that commitment
Purpose of Auditing

• The audit should:

– Commence with management process 

– End with an assessment of management’s control of the 

organization activities by quality management system
Learning Objectives

• Explain the Management Process

• Describe the purpose of auditing the Management process

• Discuss the expected outcomes from audit of the Management 

process

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country-specific requirements and assessment of conformity

– Links to other MDSAP processes
Expected Outcomes 

As a result of the audit of the Management process, objective 

evidence will show whether the organization has:

A. Identified processes needed for the quality management system, their application 

throughout the organization, and their sequence and interaction

B. Defined, documented, and implemented procedures and instructions to ensure the 

development and maintenance of an effective quality management system
Expected Outcomes 

As a result of the audit of the Management process, objective 

evidence will show whether the organization has:

C. Established quality objectives at relevant function and levels within the 

organization consistent with quality policy and ensured that these are 

periodically reviewed for continued suitability

D. Determined the criteria and methods needed to ensure the operation and 

control of quality management system processes, including the 

identification and management of interrelated processes

E. Committed the appropriate personnel and resources for infrastructure to 

the quality management system
Expected Outcomes

As a result of the audit of the Management process, objective 

evidence will show whether the organization has:

F. Assigned responsibility and authority to personnel and 

established the organizational structure to ensure processes 

assuring quality are not compromised

G. Performed risk management planning and ongoing review of 

the effectiveness of risk management activities to ensure that 

polices, procedures and practices are established for analyzing, 

evaluation and controlling risk
Expected Outcomes

As a result of the audit of the Management process, objective 

evidence will show whether the organization has:

H. Ensured the continued effectiveness of the quality 

management system and its processes

I. Established a quality management system which is capable of 

producing devices that are safe, effective and suitable for their 

intended use

15
Learning Objectives

• Explain the Management Process

• Describe the purpose of auditing the Management process

• Discuss the expected outcomes from audit of the Management 

process

• Explain the audit tasks to include: 

– Description and related Clauses and Regulations

– Country-specific requirements and assessment of conformity

– Links to other MDSAP processes
Task 1

1. Confirm that quality management system planning is performed to ensure 

that all required processes are identified, documented, implemented, 

monitored and maintained in order to conform to the applicable 

requirements and meet quality objectives. Verify that changes to the 

quality management system are managed to maintain the conformity or 

the quality management system and of the devices produced. Verify that a 

quality manual has been document.

Clause and Regulation: [ISO 13485:2016: 4.1.1, 4.1.2; 4.1.3; 4.2.2, 4.1.4; 5.4.2; 

TG(MD)R Sch3 P1 1.4(4); RDC ANVISA 16/2013: 2.1, 5.6; MHLW MO169: 5-1, 

5-2, 5-3, 5-4, 7, 14; (Old: 5, 7, 14); 21 CFR 820.20] 

MDSAP Audit Approach
Task 1

• Additional country-specific requirements: None

• Assessing conformity:

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 1: 

Management under task 1
Task 1

• Links:

– Measurement, Analysis and Improvement

– Design and Development

– Purchasing

– Production and Service Controls

– Device Marketing Authorization and Facility 

Registration

During the audit:

o Verify that the organization has implemented 

appropriate change controls
Task 2

2. Confirm top management has documented the appointment of a 

management representative. Verify the responsibilities of the 

management representative include ensuring that quality management 

system requirements are effectively established and maintained, 

reporting to top management on the performance of the quality 

management system, and ensuring the promotion of awareness of 

regulatory requirements throughout the organization.

Clause and Regulation: [ISO 13485:2016: 5.5.2; TG(MD)R Sch3 P1 

1.4(5)(b)(ii); RDC ANVISA 16/2013: 2.2.5; MHLW MO169: 16; 21 CFR 

820.20(b)]

MDSAP Audit Approach
Task 2

• Additional country-specific requirements: None

• Assessing conformity:

– Confirm appointment of management representative

– Evaluate responsibility and authority of the management 

representative

– Verify training as required

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 1: 

Management under task 2
Task 3

3. Verify that a quality policy and objectives have been set at 

relevant functions and levels within the organization. Ensure 

the quality objectives are measurable and consistent with the 

quality policy. Confirm appropriate measures are taken to 

achieve the quality objectives.

Clause and Regulation: [ISO 13485:2016: 5.3, 5.4.1; TG(MD)R 

Sch3 P1 1.4(5)(a); RDC ANVISA 16/2013: 2.2.1; MHLW MO169: 

12, 13; 21CFR 820.20(a)]

MDSAP Audit Approach
Task 3

• Additional country-specific requirements: None

• Assessing conformity:

– Ask for examples of quality objectives and the status of these 

objectives

Detailed Information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 1: 

Management under task 3
Task 4

4. Review the manufacturer’s organizational structure and 

related documents to verify that they include provisions for 

responsibilities, authorities (e.g., management 

representative), personnel, resources for infrastructure, 

competencies, and training to ensure that personnel have the 

necessary competence to design and manufacture devices in 

accordance with the planned arrangements and applicable 

regulatory requirements. 

Clause and Regulation: [ISO 13485:2016: 5.1, 5.5.1, 5.5.2, 6.1, 6.2; TG(MD)R Sch3 P1 1.4(5)(b)(; RDC ANVISA 16/2013: 2.2.2, 

2.2.3. 2.2.4, 2.3; MHLW MO169: 10, 15, 16, 21, 22, 23; 21 CFR 

820.20(b), 820.25]

MDSAP Audit Approach
Task 4

• Additional country-specific requirements: None

• Assessing conformity:

– Review organizational charts

– Ask authority and responsibility questions

– Ask the management representative to provide 

examples of recent requests for resources

Detailed Information on how to assess conformity for this 

audit ask can be found in the MDSAP Audit Approach, 

Chapter 1: Management under task 4
Task 5

5. Determine the extent of outsourcing of processes that 

may affect the conformity of product with specified 

requirements and verify the proper documentation of 

controls in the quality management system.

Clause and Regulation: [ISO 13485:2016: 4.1.5, 4.2.1;TG (MD)R 

Sch3 P1 1.4(5) (b)(iii), (d)(ii); RDC ANVISA 16/2013: 2.5; MHLW 

MO169: 5-5, 6; (Old: 5, 6); 21 CFR 820.50]

MDSAP Audit Approach
Task 5

• Additional country-specific requirements: Australia 

(TGA); Canada (HC)

• Assessing conformity:

– Ascertain the extent the organization outsources 

essential processes

Detailed Information on country-specific requirements 

and how to assess conformity for this audit task can be 

found in the MDSAP Audit Approach, Chapter 1: 

Management under task 5
Task 5

• Links: 

– Purchasing

During audit of the organization’s Purchasing 

process:

o Ensure that management has assured the 

appropriate level of control over suppliers 

o Ensure management has assessed the 

relationship between supplied products and 

product risk
Task 6

6. Confirm the medical device organization has determined the 

necessary competencies for personnel performing work 

affecting product quality, provided appropriate training, and 

made personnel aware of the relevance and importance of 

their activities on product quality and achievement of the 

quality objectives. Ensure records of training and 

competencies are maintained.

Clause and Regulation: [ISO 13485:2016: 4.2.1, 6.2; RDC ANVISA 16/2013: 2.2.3, 2.2.4, 2.3; MHLW MO169: 6, 22, 23, 

25.4; 21 CFR 820.20(b)(2), 820.25]

MDSAP Audit Approach
Task 6

• Additional country-specific requirements: Brazil 

(ANVISA)

• Assessing conformity:

– Review employee training records

Detailed Information on how to assess conformity for this 

audit task can be found in the MDSAP Audit Approach, 

Chapter 1: Management under task 6
Task 6

• Links:

– Production and Service Controls 

During the audit of the Production and Service 

Controls process: 

o Ensure that employees have been trained in 

their specific job tasks, as well as the quality 

policy and objectives

o Review the training records for those 

employees whose activities have contributed to 

process nonconformities
Task 7 

7. Verify that management has committed to and has 

responsibility for overall risk management planning, including 

ongoing review of the effectiveness of risk management 

activities ensuring that policies, procedures and practices are 

established and documented for analyzing, evaluating and 

controlling product risk throughout product realization.

Clause and Regulation: [ISO 13485:2016: 4.1.2 (b), 7.1; TG(MD)R Sch1 P1 2; RDC ANVISA 16/2013: 2.4; MO169: 5-2.1.2, 

26; (Old: 26); 21 CFR 820.30(g)]

MDSAP Audit Approach
Task 7

• Additional country-specific requirements: None

• Assessing conformity:

– Ensure the provision of adequate resources

– Ensure assignment of qualified personnel for risk 

management activities

– Ensure top management reviews the suitability of the risk 

management process

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 1: 

Management under task 7
Task 7

• Links:

– Design and Development

Risk management usually starts in conjunction 

with the design and development planning 

process

During audit of the Design and Development 

process:

o Evaluate top management’s commitment to 

risk management activities
Task 8

8. Verify that procedures have been defined, documented, and 

implemented for the control of documents and records of both 

internal and external origin required by the quality 

management system. Confirm the organization retains records 

and at least one obsolete copy of controlled documents for a 

period of time at least equivalent to the lifetime of the device, 

but not less than two years from the date of product release.

Clause and Regulation: [ISO 13485:2016: 4.1.4; 4.2.1, 4.2.4, 4.2.5; TG(MD)R Sch3 P1 1.4(4); RDC ANVISA 16/2013: 3.1; 

MO169: 5-4, 6, 8, 9; (Old: 5, 6, 8, 9); 21 CFR 820.40, 820.180]

MDSAP Audit Approach
Task 8

• Additional country-specific requirements: Australia 

(TGA); Brazil (ANVISA); Japan (MHLW); and United 

States (FDA)

• Assessing conformity:

– Ensure at least one copy of obsolete controlled 

documents is maintained

Detailed information on country-specific requirements and 

how to assess conformity for this audit task can be found in the 

MDSAP Audit Approach, Chapter 1: Management under task 8
Task 9

9. Verify that procedures for management review have been 

documented, management reviews are being conducted at 

planned intervals, that they include a review of the suitability 

and effectiveness of the quality policy, quality objectives, and 

quality management system to assure that the quality 

management system meets all applicable regulatory 

requirements.

Clause and Regulation: [ISO 13485:2016: 5.6; TG(MD)R Sch3 P1 1.4(5)(b)(iii)(f); RDC ANVISA 16/2013: 2.2.6; MHLW MO169: 18, 

19, 20; 21 CFR820.20(c)]

MDSAP Audit Approach
Task 9

• Additional country-specific requirements: None

• Assessing conformity:

– Ensure that the quality policy and objectives have been 

reviewed for continued suitability

– Ensure that any changes to regulatory requirements 

have been identified

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 1: 

Management under task 9
Task 9

• Links:

– Measurement, Analysis and Improvement

During audit of the Measurement, Analysis 

and Improvement process:

o Confirm when necessary that action items 

resulting from Management review are 

considered for corrective or preventive action
Task 10

10.Confirm that the medical device organization has defined 

and implemented controls to ensure that only devices 

that have received the appropriate marketing 

authorization are distributed or otherwise offered for 

commercial distribution into the applicable markets. 

Clause and Regulation: [ISO 13485:2016: 4.1.1; 4.2.1, 5.2; 

7.2.1;7.2.3]

MDSAP Audit Approach
Task 10

• Additional country-specific requirements: None

• Assessing conformity:

– Verify identification and documentation of the 

responsibilities of employees and personnel 

– Verify obligations are carried out by competent personnel

– Verify controls to ensure appropriate market authorization

Detailed information on how to assess conformity for this audit 

task can be found in the MDSAP Audit Approach, Chapter 1: 

Management under task 10
Task 10

• Links: 

- Device Marketing Authorization and Facility 

Registration

During audit of the Device Marketing 

Authorization ad Facility Registration process:

o Perform a preliminary review that may allow for 

adequate coverage
Task 11

11. At the conclusion of the audit, a decision should be made as 

to whether top management has demonstrated the necessary 

commitment to ensure a suitable and effective quality 

management system is in place and being maintained and 

whether the effectiveness of the system has been 

communicated to personnel. 

Clause and Regulation: [ISO 13485:2003: 5.1, 5.5.3; RDC ANVISA 16/2013: 2.2.1; MO169: 5-1, 5-4, 10, 17; (Old: 5, 10, 17); 21 CFR 820.20(a), 820.5]

MDSAP Audit Approach
Task 11

• Additional country-specific requirements: None

• Assessing conformity:

Detailed information on how to assess conformity for this 

audit task can be found in the MDSAP Audit Approach, 

Chapter 1: Management under task 11
Summary

• The Management process is the first process to be audited 

per the MDSAP audit sequence.

• The intent of the Management process is to:

– provide adequate resources,

– assure the quality management system is functioning 

properly and effectively

– and to monitor and make any necessary adjustments

• The purpose of auditing the Management process is to 

ensure a quality management system has been established 

and maintained.
Conclusion

This concludes the training module for the MDSAP process: 

Management Process.
47