MDSAP: Production and Service Controls Process: Part 2

Slide 1

I am CAPT Kimberly Lewandowski-Walker, Senior Regulatory Officer at the Center for Devices and 

Radiological Health at the U.S. Food and Drug Administration. I will be your presenter for this module.

In this training module, we will be reviewing the second of three modules for the Medical Device Single 

Audit Program (MDSAP) process: Production and Service Controls.

Slide 2

Successful completion of the following MDSAP training modules “Introduction to the MDSAP Program”, 

“Overview of the MDSAP Audit Process”, “Management Process”, “Measurement, Analysis and 

Improvement Process”, “Design and Development Process”, and Production and Service Controls 

Process: Part 1 are prerequisites to this training module.

Slide 3

In this training module, we will review the purpose of auditing the Production and Service Controls 

process and continue with explaining the audit tasks for Production and Service Controls process: Part 2 

in terms of description and related Clauses and Regulations; country-specific requirements and 

assessment of conformity; and links to other MDSAP processes.

Slide 4

We will begin with reviewing the purpose of auditing the Production and Service Controls process.

Slide 5

The purpose of auditing the production and service controls process (including testing, infrastructure, 

facilities, equipment, and servicing) is to verify that the manufacturer’s processes are capable of 

ensuring that products will meet specifications.

Accomplishment of the outcomes for the Production and Service Controls process is accomplished 

through the completion of the audit tasks. We will now continue our discussion of the audit tasks and 

links to the interrelated MDSAP processes. 

Slide 6

We will now continue our discussion of the audit of the Production and Service Controls process by 

explaining the audit tasks for the Production and Service Controls process, Part 2 in terms of the 

description and related Clauses and Regulations; the country-specific requirements and assessment of 

conformity; and links to other MDSAP processes.

Slide 7

Audit tasks 1-10 were discussed in MDSAP training Production and Service Controls: Part 1.

Part 2 will commence with audit task 11.

Slide 8

Task 11: Verify that the processes used in production and service are appropriately controlled, 

monitored, operated within specified limits and documented in the product realization records. In 

addition, verify that risk control measures identified by the manufacturer for production processes are 

implemented, monitored and evaluated.
The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 9

There are additional country-specific requirements for Australia.

Assessing conformity includes confirming that the procedures available to the production personnel are 

the most current approved revisions, comparing work instructions with what is actually being done, and 

comparing product acceptance criteria with acceptance activity results, and reviewing control charts 

against specified requirements.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, under Task 11.

Slide 10

This task has a link to Design and Development processes. The design outputs for a device include 

documents such as diagrams, drawings, specifications, procedures, and the production processes that 

are essential to the proper manufacturing of the device. Production processes can include not only the 

manufacturing instructions, but also internal controls, such as the type and extent of acceptance 

activities, equipment calibration and maintenance intervals, environmental controls, and personnel 

controls.

During audit of the Production and Service Controls process, consider reviewing production processes 

that have the highest risk or greatest effect on the essential design outputs.

Slide 11

Task 12: Verify that personnel are competent to implement and maintain the processes in accordance 

with the requirements identified by the organization.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 12

There are no additional country-specific requirements for this task. Detailed information on countryspecific requirements and how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 6: Production and Service Controls, under Task 12.

Slide 13

This task has a link to Management processes. During the audit of the Production and Service Controls 

process, ensure that employees who are involved in key operations that affect product realization and 

product quality have been trained in their specific job tasks, as well as the quality policy and objectives.

When appropriate, review the training records for those employees whose activities have contributed to 

process nonconformities.

Slide 14

Task 13: Confirm the organization has determined the monitoring and measuring devices needed to 

provide evidence of conformity to specified requirements. Verify that the monitoring and measuring 
equipment used in production and service control has been identified, adjusted, calibrated and 

maintained, and capable of producing valid results.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 15

There are no additional country-specific requirements for Task 13. Assessing conformity includes 

confirming that the production and test equipment selected for review is suitable for its intended 

purpose and capable of giving valid results, reviewing the maintenance, control, and calibration 

procedures (and records) for the equipment selected for review, and verifying that the medical device 

organization made an assessment of the effect of the out-of-tolerance situation on in-process, finished, 

or released devices, based on risk.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, under Task 13.

There are no links to other MDSAP processes for Task 13.

Slide 16

Task 14: Confirm the organization assesses and records the validity of previous measurements when 

equipment is found not to conform to specified requirements and takes appropriate action on the 

equipment and any product affected. Verify that the control of the monitoring and measuring devices is 

adequate to ensure valid results. Confirm that monitoring and measuring devices are protected from 

damage or deterioration.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 17

There are additional country-specific requirements for Australia. Assessing conformity includes 

confirming that the organization has the proper procedures and controls in place to preserve the proper 

functioning of monitoring, measuring, and test equipment.

Detailed information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 6: Production and Service Controls, under Task 14.

There are no links to other MDSAP processes for Task 14.

Slide 18

Task 15: If the selected process is software controlled or if software is used in production equipment or 

the quality management system, verify that the software is validated for its intended use. Software 

validation may be part of equipment qualification. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 19
There are no additional country-specific requirements for Task 15. Assessing conformity includes 

reviewing the software validation documents and records if the production process the audit team 

selected for review is controlled with software, and assessing the systems most likely to have an impact 

on the finished device’s ability to meet specified requirements if multiple software driven systems are 

used in the production process.

Detailed information on how to assess conformity for this audit task can be found in the MDSAP Audit 

Approach, Chapter 6: Production and Service Controls, under Task 15.

There are no links to other MDSAP processes for Task 15.

Slide 20

Task 16: Determine if the medical device organization has established and maintained a file for each 

type of device that includes or refers to the location of device specifications, production process 

specifications, quality assurance procedures, traceability requirements, packaging and labeling 

specifications, and when applicable requirements for installation and servicing. Confirm that the 

manufacturer determined the extent of traceability based on the risk posed by the device in the event 

the device does not meet specified requirements.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 21

There are additional country-specific requirements for Australia. Assessing conformity includes 

confirming that the required records have been established

Detailed information on country-specific requirements and how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, under Task 16.

Slide 22

This task has a link to Design and Development processes. During the design and development of the 

device, the essential design outputs for the proper functioning of the device should have been 

identified. During audit of the Design and Development process, confirm that the essential design 

outputs for the proper functioning of the device have been identified. Raw materials, components, and 

subassemblies should have been considered for traceability if their nonconformity could result in the 

finished device not meeting its specified requirements and essential design outputs. 

Slide 23

Task 17: Determine if the medical device organization has established and maintained a record of the 

amount manufactured and approved for distribution for each batch of medical devices, the record is 

verified and approved, the device is manufactured according to the file referenced in Task 16, and the 

requirements for product release were met and documented.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 24
There are additional country-specific requirements for Brazil and the United States. Assessing 

conformity includes verifying that each batch of devices was manufactured in accordance with product 

and production specifications, being mindful that in some instances, a batch can be a single device. It 

includes confirming that the nonconformities were handled appropriately with input into the 

Measurement, Analysis and Improvement process when appropriate.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, under Task 17.

There are no links to other MDSAP processes to Task 17.

Slide 25

Task 18: If the medical device organization manufactures active or nonactive implantable medical 

devices, life-supporting or life-sustaining devices, confirm the manufacturer maintains traceability 

records of all components, materials, and work environment conditions (if these could cause the 

medical device to not satisfy its specified requirements) in addition to records of the identity of 

personnel performing any inspection or testing of these devices. Confirm that the organization requires 

that agents or distributors of these devices maintain distribution records and makes them available for 

inspection. Verify that the organization records the name and address of shipping consignees for these 

devices.

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 26

There are additional country-specific requirements for Canada and the United States. Assessing 

conformity includes confirming that the medical device organization has the necessary systems in place 

to provide for tracking each device to the end user if the organization manufactures or distributes a 

device that falls under a tracking requirement.

Detailed information on country-specific requirements and how to assess conformity for this audit task 

can be found in the MDSAP Audit Approach, Chapter 6: Production and Service Controls, under Task 18.

There are no links to other MDSAP processes to Task 18.

Slide 27

Task 19: Verify that product status identification is adequate to ensure that only product which has 

passed the required inspections and tests is dispatched, used, or installed. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 28

There are no additional country-specific requirements for Task 19. Detailed information on how to 

assess conformity for this audit task can be found in the MDSAP Audit Approach, Chapter 6: Production 

and Service Controls, under Task 19.

There are no links to other MDSAP process for Task 19.
Slide 29

Task 20: Verify that the organization has implemented controls to identify, verify, protect, and safeguard 

customer property provided for use or incorporation into the product. Verify the organization treats 

patient information and confidential health information as customer property. 

The related clauses of ISO 13485:2016 are listed on this slide along with related regulations for the 

participating countries.

Slide 30

There are no additional country-specific requirements for Task 20. Detailed information on how to 

assess conformity for this audit task can be found in the MDSAP Audit Approach, Chapter 6: Production 

and Service Controls, under Task 20.

There are no links to other MDSAP processes for Task 20.

Slide 31

In summary, production processes can include not only the manufacturing instructions, but also internal 

controls, such as the type and extent of acceptance activities, equipment calibration and maintenance 

intervals, environmental controls, and personnel controls

The purpose of auditing the production and service controls process (including testing, infrastructure, 

facilities, equipment, and servicing) is to verify that the manufacturer’s processes are capable of 

ensuring that products will meet specifications.

Slide 32

This concludes part 2 of the training module for MDSAP process: Production and Service Controls.

Please continue to part 3 to complete the discussion of the audit tasks for the Production and Service 

Controls process, as well as the links to other processes.