Overview Of The MDSAP Audit Process

Slide 1

I am CAPT Kimberly Lewandowski-Walker, Senior Regulatory Officer at the Center for Devices and 

Radiological Health at the U.S. Food and Drug Administration. 

In this training module, an Overview of the Medical Device Single Audit Program (or MDSAP) Audit 

Process will be provided including an example of auditing one of the processes.

Slide 2

In this training module, the learning objectives are to: list the prerequisites for an MDSAP Auditor, 

describe the MDSAP Audit process and provide examples, and review requirements for writing 

nonconformity statements and the final report.

Slide 3

Let’s begin with identifying certain prerequisites for an MDSAP Auditor.

Slide 4

In order to participate in the MDSAP program, individual auditors must: Be affiliated with an MDSAPrecognized auditing organization or be employed by one of the MDSAP participating regulatory 

authorities; demonstrate competence or be proficient in auditing to the International Organization for 

Standardization (ISO) 13485:2016: Medical devices — Quality management systems – Requirements for 

regulatory purposes document, (here in referred to as ISO 13485:2016); be familiar with or demonstrate 

knowledge of the specific regulatory requirements of the participating regulatory authorities; and 

successfully complete the MDSAP training program.

It is expected that the auditor is proficient in auditing to ISO 13485:2016 and is familiar with the specific 

requirements of the regulatory authorities participating in the Medical Device Single Audit Program or 

the MDSAP.

Slide 5

Now, let’s discuss the MDSAP process and review examples of auditing one of the MDSAP processes.

Slide 6

Each MDSAP Audit process contains a purpose and a number of anticipated outcomes or objectives that 

are further broken down into specific tasks. Each task has audit criteria associated with it. 

The audit tasks are based on the clauses in ISO 13485:2016 and the regulatory requirements of the 

participating Regulatory Authorities. Each task has criteria associated with it.

Slide 7

Prior to conducting an MDSAP audit, it is expected that the auditor is proficient in auditing to ISO 

13485:2016 and has knowledge of specific requirements of Australia's Therapeutic Goods 

Administration, Brazil’s ANVISA, Health Canada requirements, Japan’s MHLW, and United States’ Food 

and Drug Administration

Slide 8
Specifically, in addition to the requirements in ISO 13485:2016, auditors should be familiar with 

Australia’s Therapeutic Goods Act of 1989, the Therapeutic Goods Regulations of 2002, and the Uniform 

Recall Procedure for Therapeutic Goods.

While Brazil has not adopted ISO 13485:2016, the Brazilian Good Manufacturing Practices is largely 

aligned with the concepts in ISO 13485:2016, with some differences. The auditor should be familiar with 

Brazilian Good Manufacturing Practices and be aware that some of the requirements in RDC ANVISA are 

more prescriptive than in ISO 13485:2016. The Brazilian Health Surveillance Agency, commonly known 

as ANVISA, is an abbreviation from Portuguese “Agencia Nacional de Vigilancia Sanitaria,”

Slide 9

For Canada, in addition to ISO 13485:2016, the auditor should be familiar with the Canadian Medical 

Device Regulations.

And for Japan, the auditor should be familiar with Japan Ordinance on Standards for Manufacturing 

Control and Quality Control of Medical Devices and In Vitro Diagnostic Reagents (Ministry of Health, 

Labour, and Welfare, MHLW. Ministerial Ordinance No. 169).

Slide 10

The United States is a participating MDSAP regulatory authority. While the United States has not 

adopted ISO 13485:2016 as regulation, the Quality System Regulation, codified in Title 21 Code of 

Federal Regulations, Part 820 (or 21 CFR 820), is largely aligned with the concepts in ISO 13485:2016, 

with some differences. The auditor should be familiar with the Quality System Regulation and be aware 

that some of the requirements in 21 CFR 820 are more prescriptive than in ISO 13485:2016. 

Additionally, for the United States, auditors should be familiar with the Medical Device Reporting 

regulation, regulations for the reporting of Corrections and Removals, the requirements for 

Establishment Registration and Device Listing for Manufacturers and Initial Importers of Devices, the 

Medical Device Tracking regulation, and the labeling and other requirements for unique device 

identification. 

Slide 11

Let’s discuss the audit tasks, which are contained within each MDSAP process.

During the accomplishment of the audit task, the auditor will be assessing the organization's conformity 

to the applicable clause of ISO 13485:2016 and any additional country-specific requirement.

The audit task is written to incorporate the requirement of the applicable ISO 13485:2016 clause and 

aspects of country-specific requirements. The auditor is expected to fully address the requirement of 

ISO 13485:2016, the additional country-specific requirement, if there is one, and fully address the audit 

task.

Slide 12

The question inevitably comes up as to “Why not just perform an audit to ISO 13485:2016?”

The answer to this question is two-fold. Not all of the regulatory authorities participating in MDSAP have 

adopted ISO 13485:2016 as their regulatory requirement. While the regulatory requirements of Brazil 

and the United States are aligned with the majority of ISO 13485:2016, there are additional 

requirements contained in Brazilian Good Manufacturing Practices (RDC ANVISA) and FDA Quality

System Regulation (21 CFR Part 820).
Slide 13

The second reason an audit addressing only ISO 13485:2016 is not sufficient is that the regulatory 

authorities participating in MDSAP have additional requirements regarding marketing authorization and 

adverse event reporting that are not fully captured in ISO 13485:2016. 

Slide 14

Another question that comes up is whether the audit tasks within each MDSAP process must be 

followed in the specific order that they appear. The audit tasks have been arranged in a logical order to 

conduct an audit of the MDSAP process, but the audit tasks may be performed in any order to facilitate 

a thorough and efficient audit of the process. So, while the MDSAP audit sequence must be followed in 

terms of the order that the different MDSAP processes are audited, the auditor has flexibility within the 

process to address the tasks in a manner to efficiently and thoroughly perform the audit.

Slide 15

As you move through the audit tasks within each audit process, you will note linkages. Linkages are the 

interactions between MDSAP processes and noted in the red box in the document. You will also note 

that tasks involving risk management and risk-based decisions are also identified in blue. 

Slide 16

During the audit of the firm’s quality management system as identified in the seven MDSAP processes, 

the audit team will be asked to be mindful of “linkages” 

In order for an organization’s quality management system to function effectively, it has to identify and 

manage numerous interrelated (linked) processes. The output of one process often directly forms the 

input of other processes, or the activities of a supporting process are relevant to other processes.

Slide 17

Linkages were built into the MDSAP audit sequence and audit tasks to remind the audit team of the 

interactions between the processes. 

Linkages assist auditors to make appropriate selections when moving to the next process. It is essential 

to the MDSAP audit process that the auditors are mindful of linkages because nonconformities that 

appear in one process may actually have their roots in another process. For example, during your audit 

of the organization's complaint files, you may note that the organization appears to have a trend in 

complaints for a particular device with a particular underlying cause. If you note that the underlying 

cause is a purchased component that is malfunctioning, you should consider selecting the supplier of 

that component for review during your audit of the Purchasing process, as well as reviewing the 

acceptance activities for that component during your audit of Production and Service Controls. 

Slide 18

The audit team is also asked to assess risk management activities during the audit of the organization’s 

quality management system processes. 

Risk management is an integral aspect of an organization’s quality management system and it is the 

responsibility of top management to provide the necessary commitment and resources for risk 

management.
By being mindful of risk management and risk-based decision making during the MDSAP audit, the 

auditors can focus the audit on products, processes, and nonconformities that pose the highest risk to 

users. 

Slide 19

Effective risk management usually starts in conjunction with the design and development process, 

proceeds through product realization, including the selection of suppliers, and continues until the time 

the product is decommissioned.

Risk-based decisions occur throughout the various quality management system processes, and each 

organization must decide how much risk is acceptable to ensure medical devices are as safe as practical.

However, organizations should not misuse risk-management activities in an effort to minimize rather 

than address device problems. 

Slide 20

Guidance on assessing conformity is available for most tasks via the process-specific MDSAP Audit 

Approach.

It is advisable that you have the MDSAP Audit Approach available to you as you complete the training 

modules for the MDSAP processes

Slide 21

Let’s look at an example of an MDSAP process. In this example, we will look at the Measurement, 

Analysis and Improvement process. You will note that the process contains an audit purpose. For this 

process, the purpose of auditing the Measurement, Analysis and Improvement process is to verify that 

the manufacturer’s processes ensure that information related to products, processes, or the quality 

management system is collected and analyzed to identify actual and potential product, process, or 

quality system nonconformities, that problems and potential problems are investigated, and that 

appropriate and effective corrective actions and preventive actions are taken.

Slide 22

The MDSAP process also contains a number of outcomes, which can be thought of as objectives for the 

audit of the process. For this process, the outcomes are the determination, through audit of the 

process, as to whether the organization has: defined, documented, and implemented procedures for 

measurement, analysis and improvement that address the requirements of the quality management 

system standard and participating MDSAP regulatory authorities; and Identified, analyzed, and 

monitored appropriate sources of quality data to identify nonconformities or potential nonconformities 

and determined the need for corrective or preventive action.

Slide 23

The outcomes are the determination, through audit of the process, as to whether the organization has:

ensured investigations are conducted to identify the underlying causes of nonconformities and potential 

nonconformities, where possible; and has implemented appropriate corrective action to eliminate the 

recurrence or preventive action to prevent the occurrence of product or quality system 

nonconformities, commensurate with the risks associated with the nonconformities or potential 

nonconformities encountered.
Slide 24

In addition, the outcome of auditing the Measurement, Analysis and Improvement process is objective 

evidence that will demonstrate whether the organization has reviewed the effectiveness of corrective 

action and preventive action, and utilized information from the analysis of production and postproduction quality data to amend the analysis of product risk, as appropriate.

Slide 25

You will also see the links to other MDSAP processes from the Measurement, Analysis and Improvement 

process. 

More specific information on linkages is provided with the individual audit tasks, as we will see shortly.

Slide 26

In continuing the example, we will look at the seventh task in the Measurement, Analysis and 

Improvement process. 

This task is to determine when a corrective or preventive action results in a process change, confirm that 

the process change is assessed to determine if any new risks to the product are introduced. Verify the 

manufacturer has performed revalidation of processes where appropriate. The text shown in blue font 

reminds the auditor that this task involves risk management activities and risk-based decision making. 

Slide 27

For this audit task, there is also three country-specific requirements. When auditing task 7 of the 

Measurement, Analysis and Improvement process, if the organization markets to Australia, Canada, or 

Japan, the auditor needs to audit the additional country-specific requirements. Here are the 

requirements for Australia.

These are the country-specific requirements for Canada. When auditing task 7 of the Measurement, 

Analysis and Improvement process, if the organization markets to Canada, the auditor needs to audit 

the additional country-specific requirements listed.

These are the country-specific requirements for Japan. When auditing task 7 of the Measurement, 

Analysis and Improvement process, if the organization markets to Canada, the auditor needs to audit 

the additional country-specific requirements listed

Slide 28

For this audit task, there are also linkages. In this example, the linkages are to the Production and 

Service Controls and the Purchasing process. During the audit of task 7 of the Measurement, Analysis 

and Improvement process, if the corrective action or preventive action involves changing a production 

process, the audit team should consider selecting this change for evaluation during audit of Production 

and Service Controls. For changes to production processes that are performed by suppliers, the audit 

team should consider selecting those suppliers for evaluation during audit of the Purchasing process. In 

cases where the organization makes a change to a validated process performed by a supplier, the audit 

team should evaluate whether re-validation is required. If re-validation of production processes is 

required, confirm the results show the process meets the planned result.

Slide 29
According to the MDSAP audit sequence, the Purchasing process may be reviewed in conjunction with 

the Measurement, Analysis and Improvement process, the Design and Development process, and the 

Production and Service Controls process.

Slide 30

The question comes up as to whether the auditor is expected to immediately move to the audit of the 

firm’s production and service controls or purchasing controls process during the audit task. This can be 

handled in a couple ways. 

If during the assessment of this audit task, the auditor notes that a corrective or preventive action 

resulted in a process change, the auditor should make note of these.

Then during the audit of the Production and Service Controls process, or the Purchasing process if the 

process change involves an outsourced process, the audit team should consider selecting those 

processes or suppliers to audit involving the process change that was made as a result of corrective or 

preventive actions.

Slide 31

Let’s discuss the sampling of records during an MDSAP audit. 

According to ISO 19011:2011 - Guidelines for auditing management systems, sampling of records may 

be made using judgment-based sampling or statistically based sampling plans. 

Judgment-based sampling is more flexible than statistically-based sampling plans. It allows the auditor 

to consider factors beyond the population size, expected value, and desired confidence level. Using 

judgment-based sampling, the auditor can consider knowledge and past experience of the 

manufacturer, the complexity of the requirements, the likelihood of uncovering a nonconforming 

situation, the risk associated with the area and requirements involved, and information previously 

collected during the audit.

This flexibility allows the auditor to generally sample fewer records than would be required using a 

statistical sampling plan. The drawback, however is that unlike statistically based sampling, judgmentbased sampling does not give a measure of uncertainty and is generally not representative of the 

underlying population of records. The implication is that while an auditor can demonstrate that a 

nonconformity exists using judgment-based sampling, it is not possible to infer with any level of 

statistical certainty that the absence of nonconformity in the sample selected indicates overall 

conformity.

In other words, failure to detect a nonconformity using judgment-based sampling does not provide 

confirmation of conformity.

On the other hand, statistical sampling can be used to demonstrate either conformity or nonconformity. 

Sample size using these methods is determined using probability theory and factors related to the 

underlying population of records being sampled such as size. Auditors can adjust the confidence level of 

statistical sampling plans based on the risk of the activities or process being sampled. 

Regardless of the sampling methodology used, the limitations of sampling should be acknowledged by 

the auditor and made known to the users of audit reports, that is, the Regulatory Authorities.
Slide 32

Often the most-appropriate sampling method to achieve the MDSAP audit outcomes is judgment-based 

sampling as it allows flexibility and produces results faster and using less resources than statistical 

sampling. 

Judgment based sampling takes into account the complexity and interaction of the organization’s 

processes and quality management system element and key risk areas. Auditors should be mindful to 

nonetheless sample an appropriate amount of records to produce credible audit findings and 

conclusions. 

Slide 33

Statistical sampling may be appropriate in cases where no high-risk nonconformities have been 

identified.

Statistical sampling is also helpful in making a statistical estimate of the effect of uncertainty in the 

findings of the audit and the conclusions reached.

The level of sampling risk needs to be assessed by the auditor. Higher risk nonconformities and higher 

risk processes should be sampled using a higher level of confidence than lower risk nonconformities or 

processes.

Statistical sampling is particularly useful in ambiguous situations where the conformity status of an 

activity is unclear but should be used judiciously since it does involve larger sample sizes and requires 

more audit time to perform than judgment-based sampling.

Slide 34

During the course of the audit cycle, all product families and significant processes should be assessed. 

The degree of assessment depends on a number of factors, including the risk of the product and 

process, whether significant nonconformities can be attributed to the product or process, and whether 

any significant changes have been made to the products or processes. For some product families, a 

review of nonconformities and corrective actions might reveal quality problems can be linked to the 

product’s design, production, or purchased components. In this case, the auditor should perform 

thorough audit coverage involving this product and its processes. In other cases, a particular product 

family may have minimal complaints and nonconformities. In this case, it may be sufficient for this 

product to audit significant processes that are also used in the manufacture of other products at the 

manufacturer. 

Slide 35

Let’s discuss outsourcing, exclusions, and non-applicability.

The design and implementation of an organization’s quality management system is a strategic decision, 

based on the needs of the organization, the size of the organization, the processes employed, and the 

products provided. 

If the organization does not perform certain processes, such as Design and Development, then the 

organization’s quality management system does not need to address such a requirement and the 

corresponding MDSAP process does not need to be audited. 

Slide 36
Outsourcing has become much more common in the area of device design and manufacturing. If the 

organization chooses to outsource any processes related to the design and/or manufacture of medical 

devices for which the organization has responsibility, these suppliers and supplied processes must be 

controlled within the organization’s quality management system.

Essentially, organizations can outsource the design and manufacturing activities, but they cannot 

outsource responsibility for the device. 

Slide 37

In addition to the exclusions and non-applications permitted by ISO13485, the organization may exclude 

the requirements of markets where the organization does not intend to supply product.

The audit scope and audit criteria must take into account any justified exclusions or non-applications. 

When an organization claims an exclusion from the requirements of a target market, the auditor should 

use caution when applying the guidance provided in the MDSAP processes. Some requirements may not 

be applicable. For example, if the organization only manufactures low-risk devices that are exempt from 

design controls, the requirements for design would be a permitted exclusion. Similarly, if an 

organization does not distribute devices in the United States, the specific requirements for the United 

States would not be applicable.

Exclusions must be clearly identified in the audit report.

Slide 38

Now we will review requirements for writing nonconformity statements and the final report.

Slide 39

The organization needs to demonstrate its ability to provide medical devices that consistently meet 

customer and regulatory requirements.

During the audit, it is important that the auditors are mindful of any instances where the organization 

demonstrates failure to fulfill any of the requirements in ISO 13485:2016 or portion of the requirements 

listed in the audit activities and tasks, and that these nonconformities are recorded in appropriate 

detail. 

Slide 40

Particular attention should be paid to the potential interrelationship of the nonconformities observed. 

For example, audit findings in both purchasing controls and acceptance activities may indicate a 

significant nonconformity because control over suppliers, and the products they supply, depends on an 

effective combination of both these activities, and deficiencies in one or the other may affect the quality 

of the finished device.

Slide 41

When generating audit findings, nonconformities should be recorded along with supporting evidence 

and reviewed with the auditee. The goal of such a review is to ensure that both the auditor and the 

auditee agree on the accuracy of the objective evidence supporting the nonconformity. 
Nonconformities should include a reference number or identifier, the date, and identification of the 

organization that is audited, including the actual location where necessary, an initial classification of 

severity, the requirement that is not being met, a clear statement of nonconformity, the supporting 

audit evidence, and the name of the auditor issuing the nonconformity.

Slide 42

When nonconformities are observed related to country-specific requirements, these must be written as 

an audit finding and documented in the audit report.

Exceptions to this are the exclusions and non-applications permitted by ISO13485:2016, and the 

requirements of markets where the organization does not intend to supply product.

Slide 43

Any observations related to device safety must be documented in the audit report.

Any observations related to the organization’s failure to report individual adverse events, advisory 

notices, or changes to device marketing authorization and facility registration must be written as a 

nonconformity and documented in the audit report.

This information is crucial for the regulatory authorities. Each regulatory authority will determine how 

the MDSAP audit will be assessed within its jurisdiction in accordance with its legislation. Failure to 

include observations related to device safety or changes to device marketing authorization will reduce 

the regulatory authorities’ confidence in the MDSAP process and will reduce confidence in the auditing 

organization. 

Slide 44

Reports must be in the format described in Medical Device Single Audit Program: Quality Management 

System Audit Reports, using the Fillable MDSAP Audit Report Form.

Slide 45

This slide and the next several slides in this module contain references to the standards and regulations.

Slide 46

The FDA MDSAP website contains all the procedures and forms that Auditing Organizations will utilize 

regarding the MDSAP. This slide lists some of the most frequently used forms and procedures for Audit 

Time calculation, the Non-conformity grading and exchange form, and the MDSAP fillable audit report 

form. 

Slide 47

This slide lists References for regulatory requirements for Australia and Brazil.

Slide 48

This slides lists References for regulatory requirements for Canada and Japan.

Slide 49

This slide lists References for regulatory requirements for the United States.

Slide 50
In conclusion, there are prerequisites for an MDSAP Auditor.

The MDSAP Audit process includes: a purpose; expected Outcomes; audit tasks; and a Final Report.

Nonconformities should be documented in the Final Report using the fillable MDSAP Audit Report Form.

Slide 51

This concludes the Overview of the MDSAP Audit Process training module.