1

MDSAP: Measurement Analysis and Improvement Process

Slide 1

I am CAPT Kimberly Lewandowski-Walker, Senior Regulatory Officer at the Center for Devices and 

Radiological Health at the U.S. Food and Drug Administration. In this training module, we will be 

reviewing the Measurement, Analysis and Improvement process for the Medical Device Single Audit 

Program.

Slide 2

The prerequisites for understanding this Measurement, Analysis and Improvement process training 

module are the MDSAP training modules: ‘Introduction to the MDSAP Program”, “Overview of the 

MDSAP Process”, “MDSAP: Management Process”, and “MDSAP: Device Marketing Authorization and 

Facility Registration Process”.

Slide 3

In this Measurement, Analysis and Improvement process training module, we will explain the 

Measurement, Analysis and Improvement process, describe the purpose of auditing the Measurement, 

Analysis and Improvement process, discuss the expected outcomes from the audit of this process, and 

explain the audit tasks in terms of the description and related Clauses and Regulations, list countryspecific requirements and assessment of conformity for each audit task, and indicate the links to other 

MDSAP processes.

Slide 4

We will begin with explaining the Measurement, Analysis and Improvement process.

Slide 5

One of the most important activities in the quality management system is the identification of existing 

and potential causes of product and quality problems. Such causes must be identified so that 

appropriate and effective corrective or preventive actions can take place. These activities are carried out 

under the Measurement, Analysis and Improvement process.

Slide 6

The purpose of an organization’s Measurement, Analysis and Improvement process is to collect and 

analyze information, identify and investigate existing and potential causes of product and quality 

problems, and take appropriate and effective corrective or preventive action to prevent recurrence or 

occurrence. It is essential that an organization verify or validate these actions, communicate corrective 

and preventive action activities to responsible people, provide relevant information for management 

review, and document these activities. These activities will help the organization deal effectively with 

existing or potential product and quality problems, prevent their recurrence or occurrence, and prevent 

or minimize device failures or other quality problems.

Slide 7

What is the purpose of auditing the Measurement, Analysis and Improvement process?

Slide 8

As you can see from this diagram, the Measurement, Analysis and Improvement process is the second 

primary process to be audited per the MDSAP audit sequence. When applicable, information regarding 

device or identified quality management system nonconformities observed during the audit of the 
2

Measurement, Analysis and Improvement process should be used to make decisions as to design 

projects or design changes to assess during audit of the design and development process, suppliers to 

evaluate during audit of the Purchasing process, and processes to review during audit of the Production 

and Service Controls process. 

Slide 9

The purpose of auditing the Measurement, Analysis and Improvement process is to verify that the 

manufacturer’s processes ensure that information related to products, processes, or the quality 

management system is collected and analyzed to identify actual and potential product, process, or 

quality system nonconformities, that problems and potential problems are investigated, and that 

appropriate and effective corrective actions and preventive actions are taken.

Slide 10

We will now move to a discussion of the expected outcomes from the audit of the Measurement, 

Analysis and Improvement process.

Slide 11

As a result of the audit of the Measurement, Analysis and Improvement process, objective evidence will 

show whether the organization has: defined, documented, and implemented procedures for 

measurement, analysis and improvement that address the requirements of the quality management

system standard and participating MDSAP regulatory authorities and has identified, analyzed, and 

monitored appropriate sources of quality data to identify nonconformities or potential nonconformities 

and determined the need for corrective or preventive action.

Slide 12

Additional outcomes include ensuring investigations are conducted to identify the underlying causes of 

nonconformities and potential nonconformities, where possible; and implementing appropriate 

corrective action to eliminate the recurrence, or preventive action to prevent the occurrence, of product 

or quality system nonconformities, commensurate with the risks associated with the nonconformities or 

potential nonconformities encountered.

Slide 13

Objective evidence will show whether the organization has reviewed the effectiveness of corrective 

actions and preventive actions and utilized information from the analysis of production and postproduction quality data to amend the analysis of product risk, as appropriate.

Slide 14

We will now explain the audit tasks in terms of the description and related Clauses and Regulations, list 

country-specific requirements and assessment of conformity for each audit task, and indicate the links 

to other MDSAP processes.

Slide 15

Task 1: Verify that procedures for measurement, analysis and improvement which address the 

requirements of the quality management system standard and regulatory authorities have been 

established and documented. Confirm the organization maintains and implements procedures to 

monitor and measure product conformity throughout product realization, as well as procedures that 

provide for mechanisms for feedback to provide early warnings of quality 
3

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 16

There are additional country-specific requirements for Brazil and the United States.

Detailed information on country specific requirements and how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 3: Measurement, Analysis and Improvement, 

under task 1. 

There are no additional linkages for this task to other audit processes.

Slide 17

Task 2: Determine if appropriate sources of quality data have been identified for input into the 

measurement, analysis and improvement process, including customer complaints, feedback, service 

records, returned product, internal and external audit findings, and data from the monitoring of 

products, processes, nonconforming products, and suppliers. Confirm that data from these sources are 

accurate and analyzed using valid statistical methods (where appropriate) to identify existing and 

potential product and quality management system nonconformities that may require corrective or 

preventive action. Information from the organization’s analysis of quality data should be used to inform 

the audit team’s decision as to specific complaint records to review in Task 12, and products and 

processes to audit during the Design and Development, Production and Service Controls, and Purchasing 

processes. 

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 18 

There are no additional country-specific requirements for this task. Assessing conformity includes 

reviewing the previous audit report if there is one for the medical device organization, considering 

reviewing service records again to determine whether the previous deficiency was effectively addressed, 

and sampling raw quality data. Detailed information on how to assess conformity for this audit task can 

be found in the MDSAP Audit Approach, Chapter 3: Measurement, Analysis and Improvement, under 

task 2.

Slide 19

This task has a link to Purchasing processes. During the audit of the Measurement, Analysis and 

Improvement process, the audit team may encounter data involving product nonconformities, including 

complaints involving finished devices, where the underlying cause of the quality problem has been 

traced to a supplied product. During the audit of the Purchasing process, the audit team should 

consider selecting suppliers to audit that have corrective action indicators of nonconformities with 

supplied components or processes.

Slide 20

Task 3: Determine if investigations are conducted to identify the underlying causes of detected 

nonconformities, where possible. Confirm investigations are commensurate with the risk of the 

nonconformity. 
4

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 21

There are no additional country-specific requirements for this task. Assessing conformity includes 

selecting records of investigation where nonconformity has a higher risk of adversely affecting the ability 

of the finished device to meet its essential design outputs or the nonconformity affects the safety and 

efficacy of the product. Detailed information on how to assess conformity for this audit task can be 

found in the MDSAP Audit Approach, Chapter 3: Measurement, Analysis and Improvement, under task 

3.

There are no additional linkages for this task to other audit processes.

Slide 22

Task 4: Determine if investigations are conducted to identify the underlying causes of potential 

nonconformities, where possible. Confirm investigations are commensurate with the risk of the 

potential nonconformity.

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 23

There are no additional country-specific requirements for this task. Assessing conformity includes 

selecting records of investigation where the potential nonconformity has a higher risk of adversely 

affecting the ability of the finished device to meet its essential design outputs or the potential 

nonconformity could affect the safety and efficacy of the product. Detailed information on how to 

assess conformity for this audit task can be found in the MDSAP Audit Approach, Chapter 3: 

Measurement, Analysis and Improvement, under task 4.

There are no additional linkages for this task to other audit processes.

Slide 24

Task 5: Confirm that corrections, corrective actions, and preventive actions were determined, 

implemented, documented, effective, and did not adversely affect finished devices. Ensure corrective 

action and preventive action is appropriate to the risk of the nonconformities or potential 

nonconformities encountered.

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 25

There are no additional country-specific requirements for this task. Assessing conformity includes 

confirming that the medical device organization’s decision not to take corrective action has been made 

using appropriate risk based decision making including a determination that the finished device meets 

risk acceptability criteria and looking for product or quality problems or trends that continued or began 

after the actions were implemented. Detailed information on how to assess conformity for this audit 
5

task can be found in the MDSAP Audit Approach, Chapter 3: Measurement, Analysis and Improvement, 

under task 5.

Slide 26

This task has a link to Medical Device Adverse Events and Advisory Notices Reporting processes.

Determine whether any of the organization's corrective actions require reporting to participating 

MDSAP authorities. The organization should be able to demonstrate to the auditor how it evaluates 

corrective actions to determine whether they require reporting to authorities. At this point in the audit, 

if you have found a number of corrective actions that require reporting to one or more of the regulatory 

authorities in the MDSAP, you can opt to move into the Medical Device Adverse Events and Advisory 

Notices Reporting process.

Slide 27

Task 6: When a corrective or preventive action results in a design change, verify that any new hazard(s) 

and any new risks are evaluated under the risk management process. 

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 28

There are no additional country-specific requirements for this task. Detailed information on how to 

assess conformity for this audit task can be found in the MDSAP Audit Approach, Chapter 3: 

Measurement, Analysis and Improvement, under task 6.

Slide 29

This task has a link to Design and Development processes. If the corrective action or preventive action 

involves changing the design, design controls should be applied to the change where applicable. 

When necessary, confirm that design controls were applied to the change according to the 

organization’s procedures. In addition, the organization should evaluate design changes as part of its 

risk management activities to ensure that changes do not introduce new hazards.

Slide 30

Task 7: When a corrective or preventive action results in a process change, confirm that the process 

change is assessed to determine if any new risks to the product are introduced. Verify the manufacturer 

has performed revalidation of processes where appropriate.

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 31

There are additional country-specific requirements for Australia, Canada, and Japan. Assessing 

conformity includes reviewing the medical device organization’s evaluation of the process change to 

determine if revalidation is needed. For changes to production processes that are performed by 

suppliers, consider selecting suppliers for evaluation during audit of the Purchasing process.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 3: Measurement, Analysis and Improvement, 

under task 7.
6

Slide 32

This audit task has linkages to the Production and Service Controls and Purchasing processes. 

If the corrective action or preventive action involves changing a production process, the audit team 

should consider selecting this process for evaluation during the audit of Production and Service Controls. 

For changes to production processes that are performed by suppliers, the audit team should consider 

selecting those suppliers for evaluation during audit of the Purchasing process. 

In cases where the organization makes a change to a validated process performed by a supplier, 

the audit team should evaluate when necessary if re-validation is required. If re-validation of 

production processes is required, confirm the results show the process meets the planned 

result.

Slide 33

Task 8: Verify that controls are in place to ensure that product which does not conform to product 

requirements is identified and controlled to prevent its unintended use or delivery. Confirm that an 

appropriate disposition was made, justified, and documented; and that any external party responsible 

for the nonconformity was notified.

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 34

There are no additional country-specific requirements for this task. Review procedures and controls for 

preventing the unintended distribution of nonconforming product. Assessing conformity includes: 

selecting a sample of records involving nonconforming product that was in stock or returned to review 

how the procedures and controls were applied to control the nonconforming Product; confirming that 

the medical device organization’s decision to use nonconforming product under concession has been 

made using appropriate risk-based decision making; and selecting records of nonconforming products to 

review where the nonconformity has a higher risk of adversely affecting the ability of the finished device 

to meet its essential design outputs or the nonconformity affects the safety and efficacy of the product. 

Detailed information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 3: Measurement, Analysis and Improvement, under task 8.

There are no additional linkages for this task to other audit processes.

Slide 35

Task 9: Confirm that when nonconforming product is detected after delivery or use, appropriate action 

is taken commensurate with the risk, or potential risks, of the nonconformity.

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 36

There are no additional country-specific requirements for this task. Assessing conformity includes 

confirming that the medical device organization has determined the control and actions to be taken on 

nonconforming products detected after delivery or use, commensurate with the risk associated with a 

product failure and confirming that the decision is made using an adequate risk justification.
7

Detailed information on how to assess conformity for this audit task can be found in the MDSAP 

Audit Approach, Chapter 3: Measurement, Analysis and Improvement, under task 9

Slide 37

This task has a link to Medical Device Adverse Events and Advisory Notices Reporting processes.

If the organization has taken field action on products already distributed, confirm that the appropriate 

MDSAP regulatory authorities have been notified, as necessary. At this point in the audit, if you have 

found a number of corrective actions that resulted in recalls or field actions that require reporting to 

one or more of the regulatory authorities in the MDSAP, you can opt to move into the Medical Device 

Adverse Events and Advisory Notices Reporting process if you haven’t already completed this.

Slide 38

Task 10: Verify that internal audits of the quality management system are being conducted according to 

planned arrangements and documented procedures to ensure the quality management system is in 

compliance with the established quality management system requirements and applicable regulatory 

requirements, and to determine the effectiveness of the quality system. Confirm the internal audits 

include provisions for auditor independence over the areas being audited, corrections, corrective 

actions, follow-up activities, and the verification of corrective actions.

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 39

There are no additional country-specific requirements for this task. Assessing conformity includes 

interviewing auditors and ask how are audits conducted, how long audits typically last, and what 

documents are typically reviewed. Detailed information on how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 3: Measurement, Analysis and Improvement, 

under task 10.

Detailed information on how to assess conformity for this audit task can be found in the MDSAP 

Audit Approach, Chapter 3: Measurement, Analysis and Improvement, under task 10

Slide 40

This task has a link to Management processes. During the audit of the Management process, the audit 

team should confirm that the output of internal audits is an input to management review.

Slide 41

Task 11: Determine if relevant information regarding nonconforming product, quality management 

system nonconformities, corrections, corrective actions, and preventive actions has been supplied to 

management for management review. 

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 42
8

There are no additional country-specific requirements for this task. Assessing conformity includes 

selecting a recent, significant corrective or preventive action and determine which records or 

information regarding the event was submitted for management review. Detailed information on how 

to assess conformity for this audit task can be found in the MDSAP Audit Approach, Chapter 3: 

Measurement, Analysis and Improvement, under task 11.

Slide 43

This task has a link to Management processes. During the audit of the Management process, the audit 

team should have confirmed that the status of corrective and preventive actions is an input to 

management review. During the audit of the Measurement, Analysis and Improvement process, 

determine that top management is aware of higher-risk quality problems, as well as significant 

corrective and preventive actions, when necessary.

Slide 44

Task 12: Confirm that the manufacturer has made effective arrangements for gaining experience from 

the post-production phase, handling complaints, and investigating the cause of nonconformities related 

to advisory notices with provision for feedback into the Measurement, Analysis and Improvement 

process. Select records of complaints for review that represent the highest risk to the user or have the 

largest impact on the ability of the device to meet its essential design outputs. Verify information from 

the analysis of production and post-production quality data was considered for amending the analysis of 

product risk, as appropriate. 

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 45

There are additional country-specific requirements for Australia, Brazil, Canada, Japan, and the United 

States. Assessing conformity includes reviewing complaints and customer feedback, reviewing the 

analysis of complaint data and postmarket surveillance activities, and selecting one or more complaint 

failure modes preferably failure modes associated with higher risk to the patient or user. Detailed 

information on country-specific requirements and how to assess conformity for this audit task can be 

found in the MDSAP Audit Approach, Chapter 3: Measurement, Analysis and Improvement, under task 

12.

Slide 46

This task has linkages to Medical Device Adverse Events and Advisory Notices Reporting, Design and 

Development, and Production and Services Controls processes. During the review of complaints and 

feedback, confirm that individual medical device reports were made to the appropriate regulatory 

authorities when necessary. Information from reviewing post-production sources, including complaints 

and postmarket surveillance reports, should guide the audit team in selecting designs to review and 

production processes to audit.

Slide 47

Task 13: Where investigation determines that activities outside the organization contributed to a 

customer complaint, verify that records show that relevant information was exchanged between the 

organizations involved.
9

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 48

There are no additional country-specific requirements for this task. Assessing conformity includes 

confirming that information related to quality problems or nonconforming product, including 

complaints, is disseminated to those directly responsible for assuring the quality of product.

Detailed information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 3: Measurement, Analysis and Improvement, under task 13.

Slide 49

This task has a link to Medical Device Adverse Events and Advisory Notices Reporting processes. 

During the audit of the Measurement, Analysis and Improvement process, if significant nonconformities 

are related to supplied product, the audit team should consider selecting those suppliers for evaluation 

during the audit of the organization’s Purchasing process.

Slide 50

Task 14: Verify that the medical device organization has defined and documented procedures for the 

evaluation of complaints for adverse event reporting. Confirm that decisions to not report complaints 

were made according to established procedures and a documented rationale. 

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 51

For additional country-specific requirements, refer to MDSAP process Medical Device Adverse Events 

and Advisory Notices Reporting. Assessing conformity includes assessing whether the complaint was 

evaluated to determine whether the criteria for reporting was met, confirming the appropriate reports 

and information was provided to the regulatory authority when appropriate, comparing the submitted 

reports to the associated complaint and complaint investigation, and confirming that reportable events 

were evaluated for corrective action when necessary. Detailed information on how to assess conformity 

for this audit task can be found in the MDSAP Audit Approach, Chapter 3: Measurement, Analysis and 

Improvement, under task 14.

There are no additional linkages for this task to other audit processes.

Slide 52

Confirm that the manufacturer has made effective arrangements for the timely evaluation of quality 

problems involving distributed product for potential issuance and implementation of advisory notices. 

Select records for review of quality problems that were evaluated for potential issuance of advisory 

notices (include records where a decision was made not to issue an advisory notice as well as records of 

decision to issue advisory notices) and assess whether the organization has taken actions appropriately 

based on risk and documented the rationale. 

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 53
10

For additional country-specific requirements, refer to MDSAP process Medical Device Adverse Events 

and Advisory Notices Reporting. Assessing conformity includes selecting quality issues that were 

evaluated for potential advisory actions, assessing whether appropriate actions were taken and the 

organization’s decisions were justified based on the risk of the quality problem to device users, and 

assessing whether the organization appropriately determined the scope of the quality issue. Detailed 

information on how to assess conformity for this audit task can be found in the MDSAP Audit Approach, 

Chapter 3: Measurement, Analysis and Improvement, under task 15.

There are no additional linkages for this task to other audit processes.

Slide 54

Task 16: Determine, based on the assessment of the Measurement, Analysis and Improvement process 

overall, whether management provides the necessary commitment to detect and address product and 

quality management system nonconformities, and ensure the continued suitability and effectiveness of 

the quality management system.

The related clauses of ISO 13485:2016 are listed on this slide along with the related regulations for the 

participating countries.

Slide 55

There are no additional country-specific requirements for this task. Detailed information on how to 

assess conformity for this audit task can be found in the MDSAP Audit Approach, Chapter 3: 

Measurement, Analysis and Improvement, under task 16.

There are no additional linkages for this task to other audit processes.

Slide 56

In summary, the Measurement, Analysis and Improvement process is the second primary process to be 

audited per the MDSAP audit sequence. The identification of existing and potential causes of product 

and quality problems is one of the most important activities in the quality management system and is 

carried out under the Measurement, Analysis and Improvement process.

Slide 57

This concludes the training for the MDSAP process: Measurement, Analysis and Improvement.