Introduction to the MDSAP Program

Slide 1

I am CAPT Kimberly Lewandowski-Walker, Senior Regulatory Officer at the Center for Devices and 

Radiological Health at the U.S. Food and Drug Administration. 

In this training module, an Introduction to the Medical Device Single Audit (MDSAP) program will be 

provided including an explanation and examples of the MDSAP audit model and audit sequence.

Slide 2

In order to participate in the MDSAP program, individual auditors must: be affiliated with an MDSAPrecognized auditing organization or be employed by one of the MDSAP participating regulatory 

authorities; demonstrate competence or be proficient in auditing to the International Organization for 

Standardization (ISO) 13485:2016: Medical devices — Quality management systems – Requirements for 

regulatory purposes document, (here in referred to as ISO 13485:2016); be familiar with or demonstrate 

knowledge of the specific regulatory requirements of the participating regulatory authorities; 

successfully complete the MDSAP training program.

It is expected that the auditor is proficient in auditing to ISO 13485:2016 and is familiar with the specific 

requirements of the regulatory authorities participating in the Medical Device Single Audit Program or 

the MDSAP.

Slide 3

In this training module, the learning objectives are to: give an overview of the MDSAP training; describe 

the MDSAP program; review the MDSAP Audit Approach; explain the sequence and planning of MDSAP 

audits; and explain how surveillance audits are planned and performed.

Slide 4

We will begin with providing an overview of the MDSAP training.

Slide 5

For simplicity and completeness, MDSAP training will primarily focus on the assessment of the 

organization’s entire quality management system and additional country-specific requirements as 

required by the Medical Device Single Audit Program. 

This type of complete assessment is described as a “certification” audit in ISO/IEC 17021-1:2015 

Conformity assessment - Requirements for bodies providing audit and certification of management 

systems. While there are no MDSAP specific certificates, the terms “certification audit” and “recertification audit” may come up occasionally in order to use terminology that is consistent with ISO 

standards that are used in the MDSAP.

Surveillance audits will assess only a portion of the organization’s quality management system as 

described later in this presentation

Slide 6

The MDSAP training program is composed of the following modules: Introduction to the MDSAP

Program, the current module; Overview of the MDSAP Process; Management; Measurement, Analysis 

and Improvement; Design and Development; Production and Service Controls, parts 1-3; Purchasing; 
Device Marketing Authorizations and Facility Registration; and Medical Device Adverse Events and 

Advisory Notices Reporting

Slide 7

Let’s Describe the MDSAP program?

Slide 8

MDSAP is the acronym for Medical Device Single Audit Program (MDSAP). It is a regulatory audit 

program that was initially jointly developed by four jurisdictions. 

MDSAP is unique because it allows a medical device manufacturer to have a single quality management 

system audit to satisfy the requirements of all participating regulatory authorities. The MDSAP is also 

different from other harmonized programs in that it only requires a single audit report used by all 

participating jurisdictions.

Slide 9

The current participating regulatory authorities (RAs) are Australia’s Therapeutic Goods Administration, 

Brazil’s Agencia Nacional de Vigilancia Sanitaria, Health Canada, Japan’s Ministry of Health, Labour, and 

Welfare (MHLW) and Pharmaceuticals and Medical Devices Agency (PMDA), and the United States Food 

and Drug Administration. 

Slide 10

As currently implemented, MDSAP allows any medical device manufacturer to contract with an MDSAP 

recognized Auditing Organization to have a single regulatory quality management system audit that 

meets the requirements of all five Regulatory Authorities. 

Each country defines how MDSAP outcomes are used within its jurisdiction in accordance with its 

legislation and regulatory framework.

Slide 11

The Medical Device Single Audit Program was developed to jointly leverage regulatory resources to 

manage an efficient, effective, and sustainable single audit program focused on the oversight of medical 

device manufacturers’ quality management systems. 

The overall goal is to create an international coalition of countries dedicated to pooling technology, 

resources, and services to improve the safety and oversight of medical devices in a more efficient 

manner that is also less burdensome for industry. For example, rather than a manufacturer receiving 

five separate audits from Australia, Brazil, Canada, and the United States, the Medical Device Single 

Audit program allows a manufacturer to have one audit, performed by an MDSAP- recognized Auditing 

Organization, that satisfies the needs of all five regulatory authorities. This saves time and resources for 

both the manufacturer and the Regulatory Authorities.

Slide 12

In developing the Medical Device Single Audit Program, the primary objectives were to operate a single 

audit program that provides confidence in program outcomes to enable the appropriate regulatory 

oversight of medical device manufacturers' quality management systems while minimizing regulatory 

burden on industry.
Slide 13

Additional objectives are to promote more efficient and flexible use of regulatory resources through 

work-sharing and mutual acceptance among regulators while respecting the independence of each 

authority, and to promote, in the longer term, greater alignment of regulatory approaches and technical 

requirements globally based on international standards and best practices.

Slide 14

Let’s discuss the MDSAP Audit Approach.

Slide 15

The MDSAP Audit Approach has a total of seven processes, arranged in a set sequence, and built on a 

foundation of risk management. Each process is designed to address a set of related quality 

management system and other regulatory requirements comprehensively and logically.

Slide 16

Let’s take a closer look at the MDSAP audit sequence and the audit planning.

Slide 17

The MDSAP audit sequence follows a process approach and has four primary processes. The four 

primary processes are Management, Measurement, Analysis and Improvement, Design and 

Development, and Production and Service Controls. Purchasing is considered to be a supporting process 

to each of the primary processes and may therefore be audited at different points during the sequence -

we will discuss this later in this module.

Slide 18

The five MDSAP audit sequence processes, Management, Measurement, Analysis and Improvement, 

Design and Development, Production and Service Controls, and Purchasing are built on a foundation of 

requirements for risk management and comprise the requirements of a quality management system for 

medical device manufacturers according to: ISO 13485:2016 - Medical devices - Quality management 

systems - Requirements for regulatory purposes; the Quality Management System requirements of the 

Conformity Assessment Procedures of the Australian Therapeutic Goods (Medical Devices) Regulations 

(TG(MD)R Sch3), Brazilian Good Manufacturing Practices (RDC ANVISA 16/2013), Japan Ordinance on 

Standards for Manufacturing Control and Quality Control of Medical Devices and In Vitro Diagnostic 

Reagents (MHLW Ministerial Ordinance No. 169), and the Quality System Regulation (21 CFR Part 820). 

Slide 19

The MDSAP audit process has two additional supporting processes: Medical Device Adverse Events and 

Advisory Notices Reporting; and Device Marketing Authorization and Facility Registration. 

These processes are necessary to fulfill specific requirements of the participating MDSAP regulatory 

authorities that are not addressed elsewhere in MDSAP processes.

Slide 20

The MDSAP Audit Approach was designed for the audit of the MDSAP processes in the following 

sequence: first, Management, then Measurement, Analysis and Improvement, followed by Design and 

Development, and finally Production and Service Controls. The Purchasing process can be audited as a 

supporting process to the Measurement, Analysis and Improvement process, the Design and 
Development process, or the Production and Service Controls process, depending on the audit evidence 

uncovered.

The Device Marketing Authorization and Facility Registration process is audited as a linkage to the 

Management process.

The Medical Device Adverse Events and Advisory Notices Reporting process is audited as a linkage to the 

Measurement, Analysis and Improvement process since the input to this supporting process is normally 

captured by the Measurement, Analysis and Improvement process.

Slide 21

The Purchasing process can be audited as a supporting process to the Measurement, Analysis and 

Improvement process, the Design and Development process, or the Production and Service Controls 

process, depending on the audit evidence uncovered.

The Device Marketing Authorization and Facility Registration process is audited as a linkage to the 

Management process and from the Design and Development processes as needed

The Medical Device Adverse Events and Advisory Notices Reporting process is audited as a linkage to the 

Measurement, Analysis and Improvement process since the input to this supporting process is normally 

captured by the Measurement, Analysis and Improvement process.

Slide 22

The MDSAP audit sequence was designed and developed to allow for the audit to be conducted in a 

logical, focused, and efficient manner. Information learned during the audit of one process will be used 

to make decisions about what to select for audit during the next process. 

The MDSAP audit sequence is designed to not only manages the flow of audit activities, but to also 

manage the flow of information between audit activities in order to maximize audit effectiveness. 

Slide 23

By using information learned during the audit of one process to make decisions as to what to select for 

audit in the next process, the audit team will be able to better assess the inter-relationship of processes 

and nonconformities and avoid following unproductive audit trails while focusing on higher-risk areas. 

Slide 24

Let's discuss some examples of what we mean by interrelationship of processes and nonconformities. If 

during the audit of the Measurement, Analysis and Improvement process, a change was made to the 

design of a device to remedy nonconformities, consider selecting that design change for review during 

audit of the Design and Development process. If complaints were noted by the auditors during the audit 

of the Measurement, Analysis and Improvement process and the investigations of those complaints 

revealed quality problems with supplied product or services, consider selecting those supplier files for 

review during your audit of the Purchasing process. Likewise, if nonconformities were identified that 

were shown to be the result of a process problem, considering selecting that process for review during 

audit of Production and Service Controls. 

Slide 25
If the audit of the Measurement, Analysis and Improvement process reveals quality problems that have 

arisen that were found to be design-related, those designs, including design changes, should be 

considered when making decisions as to the design and development projects to be reviewed. The audit 

of this process, the Design and Development process, follows the audit of the Measurement Analysis 

and Improvement process per the MDSAP audit sequence.

Slide 26

Audit of the Production and Service Controls process will follow audit of the Measurement, Analysis and 

Improvement process and the Design and Development process per the MDSAP audit sequence. 

Information the audit team has learned about device and quality management system nonconformities

during audit of the Measurement, Analysis and Improvement process, as well as higher risk elements 

and essential design outputs from the design projects reviewed during audit of the Design and 

Development process, should be used to make decisions as to the production processes to be reviewed 

during the audit of the Production and Service Controls process.

Slide 27

Many auditors may not be accustomed to performing an audit in such a prescribed manner. The 

question inevitably comes up whether utilizing the MDSAP audit sequence will still allow the lead 

auditor to provide the organization with an audit plan, as described in ISO/IEC 17021-1:2015. The 

answer is yes. The audit plan will still contain the audit scope, objectives, roles and responsibilities of the 

audit team members, allocation of appropriate resources to the audit, and other information. The audit 

activities will follow the MDSAP audit sequence, and the audit plan will transpose the MDSAP audit 

sequence to the physical locations or areas of the manufacturer.

Slide 28

Let’s review an example of an audit to be conducted by one auditor over four days. For this scenario, a 

sample audit plan might look something like the plan on the this slide. Please note that this example is 

simplified, it does not include all the information required by ISO 17021-1:2015. 

The audit starts as normal with the opening meeting, followed by a plant tour. The Management 

process is the first process to be audited. According to the MDSAP audit sequence, the Device 

Marketing Authorization and Facility Registration may be initially reviewed. 

Slide 29

For day two, the Measurement, Analysis and Improvement process is the next primary process to be 

audited. According to the MDSAP audit sequence, the Medical Device Adverse Events and Advisory 

Notice Reporting process is audited as a linkage from the Measurement, Analysis and Improvement 

process.

Slide 30

On day three, Design and Development is audited, followed by audit of Purchasing. Purchasing may be 

audited as a linkage from Measurement, Analysis and Improvement, Design and Development, and 

Production and Service Controls.

Slide 31

On the last day, Production and Service Controls is audited, followed by writing of nonconformities and 

conducting the closing meeting. 

Slide 32
Let's review an example of an audit being conducted by two auditors over two days. Again, this is a 

simplified version of an audit plan.

The audit starts as it normally would: an opening meeting, followed by a facility tour. The first process 

to be audited per the MDSAP audit sequence is Management. Since the initial review of Device 

Marketing Authorization and Facility Registration may be performed as a linkage from the Management 

process, the second auditor can be addressing the audit tasks in the Device Marketing Authorization and 

Facility Registration process while the first auditor is addressing the audit tasks in the Management 

process.

The Measurement, Analysis and Improvement process is the second process to be audited per the 

MDSAP audit sequence. Since the Medical Device Adverse Events and Advisory Notice Reporting 

process may be audited as linkage from the Measurement, Analysis and Improvement process, the 

second auditor can be completing the tasks in the Medical Device Adverse Events and Advisory Notice 

Reporting process while the first auditor completes the audit tasks in the Measurement, Analysis and 

Improvement process. 

It is essential to maintain communication between the members of the audit team when auditing linked 

processes. For example, if the first auditor notes several complaints that appear to be reportable 

events, the second auditor should be made aware of these in order to confirm that the appropriate 

reports were filed for those complaints with the applicable regulatory authority. 

Slide 33

Day two of the two auditor, two-day audit starts with one auditor reviewing Design and Development, 

while the second auditor is reviewing Purchasing. 

Since there are quite a few audit tasks in the Production and Service Controls process, in our example, 

both auditors are covering the audit tasks. 

The audit will conclude with the audit team meeting, including writing the nonconformities, followed by 

the closing meeting with the organization's management. 

Slide 34

The MDSAP audit cycle consists of a three-year cycle as described in ISO/IEC 17021-1:2015. The cycle is:

A full or 'certification' audit initially, a partial or surveillance audit the following two years, and a full 'recertification' or 're-audit' in the third year.

Slide 35

Finally, let’s explain how surveillance audits are planned and performed.

Slide 36

Surveillance audits are not complete audits and do not cover all the MDSAP processes.

Surveillance audits have a number of fixed tasks to be covered as well as a variable component dictated 

by the circumstances of the audit

Slide 37
All surveillance audits must cover at least the following: a review of changes to the manufacturer, QMS, 

or products since the last audit, and the items described in MDSAP AU P0008: Audit Time Determination 

Procedure, Appendix 1.

Slide 38

When the audit evidence collected during the fixed tasks indicates existing or potential nonconformity, 

the auditor follows audit trails into the Design and Development Process and the Production and Service 

Controls Process as appropriate. Audits tasks should be completed as applicable to the audit trails.

For example, if a review of complaints shows a trend with packaging failures for a sterile device, the 

auditor could audit the design and development process to see what risks and parameters were 

considered for the packaging. This could be followed by auditing the process validation and monitoring 

of sealing and handling activities. The auditor might also need to audit the purchasing process if there is 

an indication that purchased packaging material is nonconforming. 

Slide 39

If the audit evidence collected during the fixed tasks does not indicate particular audit trails to follow, 

the auditor will complete either the Design and Development Process or the Production and Service 

Controls Process. 

So, if in the first surveillance year there were no particular trails to follow and the auditor audited the 

Design and Development process, the following surveillance audit should focus on the Production and 

Service Controls process to ensure complete coverage.

The Purchasing process can be audited as needed at any point during a surveillance audit.

Slide 40

This slide and the next several slides in this presentation contain references to the standards and 

regulations.

Slide 41

The FDA MDSAP website contains all the procedures and forms that Auditing Organizations will utilize 

regarding the MDSAP. This slide lists some of the most frequently used forms and procedures for Audit 

Time calculation, the Non-conformity grading and exchange form, and the MDSAP fillable audit report 

form. 

Slide 42

This slide lists References for regulatory requirements for Australia and Brazil.

Slide 43

This slides lists References for regulatory requirements for Canada and Japan.

Slide 44

This slide lists References for regulatory requirements for the United States.

Slide 45

In conclusion, MDSAP training focus on the assessment of the organization’s entire quality management 

system and the assessment of additional participating country-specific requirements.
MDSAP Audits allows a medical device manufacturer to have a single quality management system audit.

MDSAP Audit approach has a total of seven processes arranged in a set sequence.

MDSAP audits have a number of fixed tasks to be covered.

Slide 46

This concludes the Introduction to the MDSAP Program training module.