1

Introduction To The MDSAP Program

CAPT Kimberly Lewandowski-Walker

Senior Regulatory Officer

Center for Devices and Radiological Health 

U.S. Food and Drug Administration
MDSAP Auditor Prerequisites

MDSAP Auditor is expected to:

-Be affiliated with an MDSAP recognized auditing organization or

- Be employed by one of the MDSAP participating regulatory 

authorities

- Be proficient in auditing to ISO 13485: 2016

- Be familiar with the specific requirements of participating 

regulatory authorities

-Successfully complete the MDSAP training program
Learning Objectives

• Give an overview of the MDSAP training

• Describe the MDSAP program

• Review the MDSAP Audit Approach

• Explain the MDSAP Audit sequence and plan

• Explain how surveillance audits are planned and 

performed
Learning Objectives

• Give an overview of the MDSAP training

• Describe the MDSAP program

• Review the MDSAP Audit Approach

• Explain the MDSAP Audit sequence and plan

• Explain how surveillance audits are planned and 

performed
MDSAP Training

• MDSAP training will primarily focus on:

– The assessment of the organization’s entire quality management 

system

– The assessment of additional country-specific requirements 

• Complete assessment described as a “certification 

audit” in ISO/IEC 17021-1:2015 Conformity 

assessment-Requirements for bodies providing audit and certification of management systems

• Surveillance audits will assess only a portion of the 

organization’s quality management system
MDSAP Training

The MDSAP training program is composed of the 

following modules: – Introduction to the MDSAP Program (this current module)

– Overview of the MDSAP Process

– Management

– Measurement, Analysis and Improvement

– Design and Development

– Production and Service Controls, parts 1-3

– Purchasing

– Device Marketing Authorizations and Facility Registration

– Medical Device Adverse Events and Advisory Notices Reporting
Learning Objectives

• Give an overview of the MDSAP training

• Describe the MDSAP program

• Review the MDSAP Audit Approach

• Explain the MDSAP Audit sequence and plan

• Explain how surveillance audits are planned and 

performed
MDSAP Program

MDSAP:

– Is the acronym for the Medical Device Single Audit Program

– Is a regulatory audit program 

– Initially jointly developed by four jurisdictions

– Allows a medical device manufacturer to have a single 

quality management system audit

– Only requires a single audit report used by all participating 

jurisdictions
MDSAP Program

The current participating regulatory authorities (RAs):

Therapeutic 

Goods 

Administration 

(TGA)

Agencia

Nacional de 

Vigilancia

Sanitaria 

(ANVISA)

Health Canada 

(HC)

Japan (MHLW/ 

PMDA)

Food and Drug 

Administration 

(FDA)
MDSAP Program

MDSAP:

– Allows any medical device manufacturer to contract with an 

MDSAP recognized Auditing Organization

– Requires/Allows each country to define how MDSAP 

outcomes are used within its jurisdiction
MDSAP Program

MDSAP:

– Developed to jointly leverage regulatory resources to 

manage an efficient, effective, and sustainable single audit 

program 

– Focused on the oversight of medical device manufacturers’ 

quality management systems

– Goal is to create an international coalition of countries 

dedicated to pooling technology, resources, and services
MDSAP Program

MDSAP Objective is:

– To operate a single audit program that provides confidence in 

program outcomes 

– To enable the appropriate regulatory oversight of medical 

device manufacturers' quality management systems 

– To minimize regulatory burden on industry
MDSAP Program

MDSAP Objective is:

– To promote more efficient and flexible use of regulatory 

resources 

– To respect the independence of each authority

– To promote greater alignment of regulatory approaches and 

technical requirements
Learning Objectives

• Give an overview of the MDSAP training

• Describe the MDSAP program

• Review the MDSAP Audit Approach

• Explain the MDSAP Audit sequence and plan

• Explain how surveillance audits are planned and 

performed
MDSAP Audit Approach 

• Has a total of seven processes 

• Arranged in a set sequence

• Built on a foundation of risk management 

• Document: MDSAP Audit Approach
Learning Objectives

• Give an overview of the MDSAP training

• Describe the MDSAP program

• Review the MDSAP Audit Approach

• Explain the MDSAP Audit sequence and plan

• Explain how surveillance audits are planned and 

performed
MDSAP Audit Approach 

• The MDSAP audit sequence follows a process approach 

• The MDSAP audit sequence has four primary 

processes:

– Management

– Measurement, Analysis and Improvement

– Design and Development

– Production and Service Controls.

• Supporting process:

– Purchasing
MDSAP Audit Approach 

• The five audit sequence processes are:

– Built on a foundation of requirements for risk management

– Comprise the requirements of a quality management system for 

medical device manufacturers according to: 

 Medical devices - Quality management systems - Requirements for 

regulatory purposes (ISO 13485:2016)

Quality Management System requirements of the Conformity 

Assessment Procedures of the Australian Therapeutic Goods (Medical 

Devices) Regulations (TG(MD)R Sch3)

Brazilian Good Manufacturing Practices (RDC ANVISA 16/2013)

Japan Ordinance on Standards for Manufacturing Control and Quality 

Control of Medical Devices and In Vitro Diagnostic Reagents (MHLW 

Ministerial Ordinance No. 169)

Quality System Regulation (21 CFR Part 820)
MDSAP Audit Approach 

• The MDSAP audit process has two additional 

supporting processes: 

1) Medical Device Adverse Events and Advisory Notices 

Reporting

2) Device Marketing Authorization and Facility Registration. 

• These processes are necessary to fulfill specific 

requirements of the participating MDSAP regulatory 

authorities.
MDSAP audit sequence

The MDSAP Audit Approach was designed for the audit of 

the MDSAP processes in the following sequence:
MDSAP Supporting Processes

• Purchasing process linked to:

– Measurement, Analysis and Improvement process

– the Design and Development process

– Production and Service Controls process

• The Device Marketing Authorization and Facility Registration 

process linked to:

– Management process 

– Design and Development processes as needed

• The Medical Device Adverse Events and Advisory Notices 

Reporting process linked to:

– Measurement, Analysis and Improvement process
MDSAP Audit Sequence

• Designed and developed to allow for the audit to be:

– Logical 

– Focused

– efficient

• Information learned during the audit of one process 

will be used to make decisions about what to select for 

audit during the next process 
MDSAP Audit Sequence

• Use of the MDSAP audit sequence:

– Assess the inter-relationship of processes and 

nonconformities

– Avoid following unproductive audit trails while focusing on 

higher-risk areas
Example 1: Audit Sequence

• Nonconformances observed during audit of the 

Measurement, Analysis and Improvement process

• Use information observed regarding device and quality 

management system nonconformities to decide:

– Design projects or design changes to assess during audit of 

the Design and Development process

– Suppliers to evaluate during audit of the Purchasing process

– Processes to review during audit of Production and Service 

Controls process. 

24
Example 2: Audit Sequence

• Audit of the Design and Development process follows audit 

of the Measurement, Analysis and Improvement process 

• Consider information regarding nonconformances 

observed during audit of the Measurement, Analysis and 

Improvement process

– Decide design and development projects to be reviewed 

during audit of the Design and Development process

– Decide design changes resulting from corrective actions to be 

reviewed during audit of the Design and Development 

process

25
Example 3: Audit Sequence

• Audit of the Production and Service Controls process follows 

audit of the Measurement, Analysis and Improvement 

process and the Design and Development process

• Decide production processes to be reviewed during audit of 

the Production and Service Controls process

– Consider information regarding nonconformances observed during audit 

of the Measurement, Analysis and Improvement process

– Consider information regarding nonconformities observed during audit of 

Design and Development process

– Consider higher risk elements and essential design outputs from design 

projects reviewed

26
MDSAP Audit Plan 

• The audit team will still provide an audit plan per ISO/IEC 17021- 1:2015

• The audit activities will follow the MDSAP audit sequence

• The audit plan will still contain

– the audit scope

– objectives

– roles and responsibilities of the audit team members

– allocation of appropriate resources to the audit

– other information. 

• The audit plan will transpose the MDSAP audit sequence to the 

physical locations of the manufacturer.

27
Example 1: Audit Plan

• Day 1 Morning:

– Opening meeting

– Plant Tour

– Audit Management process

• Afternoon:

– Review Device Marketing Authorization and Facility 

Registration

• Daily Wrap-up

28
Example 1: Audit Plan

• Day 2 Morning:

– Audit Measurement, Analysis and Improvement process

• Afternoon:

– Continue auditing Measurement, Analysis and Improvement

– Audit Medical Device Adverse Events and Advisory Notices

• Daily Wrap-up

29
Example 1: Audit Plan

• Day 3 Morning:

– Audit Design and Development process

• Afternoon:

– Continue auditing Design and Development process

– Audit Purchasing

• Daily Wrap-up

30
Example 1: Audit Plan

• Day 4 Morning:

– Audit Production and Service Controls

• Afternoon

– Continue auditing Production and Service Controls

– Write nonconformities

• Closing Meeting

31
Example 2: Audit Plan

32

Day 1 Auditor 1 Auditor 2

Morning Opening Meeting Opening Meeting

Plant Tour Plant Tour

Audit Management 

Process

Audit Device Marketing 

Authorization and Facility 

Registration process

Afternoon Audit Measurement, 

Analysis and 

Improvement Process

Audit Adverse Events and 

Advisory Notices process

Daily Wrap-up Daily Wrap-up
Example 2: Audit Plan

Day 2 Auditor 1 Auditor 2

Morning Audit Design and 

Development process

Audit Purchasing process

Afternoon Audit Production and 

Service Controls process

Audit Production and 

Service Controls process

Audit team meeting Audit team meeting

Closing Meeting Closing Meeting

33
MDSAP Audit Cycle

• Consists of a three-year cycle as described in ISO/IEC 

17021-1:2015:

– A full or “certification” audit initially

– A partial or surveillance audit the following two years

– A full “re-certification” or “re-audit’ in the third year

34
Learning Objectives

• Give an overview of the MDSAP training

• Describe the MDSAP program

• Review the MDSAP Audit Approach

• Explain the MDSAP Audit sequence and plan

• Explain how surveillance audits are planned and 

performed
Surveillance Audits

• Not complete audits and do not cover all the MDSAP 

processes

• Have a number of fixed tasks to be covered 

• Have a variable component dictated by the 

circumstances of the audit

36
Surveillance Audits

• All surveillance audits must cover at least the 

following: 

– A review of changes to the manufacturer, QMS, or products 

since the last audit

– The items described in MDSAP AU P0008: Audit Time 

Determination Procedure, Appendix 1

37
Surveillance Audits

• Audit evidence collected during the fixed tasks 

indicates existing or potential nonconformity:

– The auditor follows audit trails into the Design and 

Development process 

– The auditor follows trails into the Production and Service 

Controls process as appropriate 

• Audits tasks should be completed as applicable to the 

audit trails 38
Surveillance Audits

• Audit evidence collected during the fixed tasks does 

not indicate particular audit trails to follow

– The auditor will complete either the Design and 

Development process or the Production and Service Controls 

process 

• The Purchasing process can be audited as needed at 

any point during a surveillance audit

39
References

• Medical device- Quality management systemsRequirements for regulatory purposes (ISO 

13485:2016)

• Guidelines for auditing management systems (ISO 

19011:2011)

• Conformity assessment-Requirements for bodies 

providing audit and certification of management 

systems (IS0/IEC 17021:2015) 40
References

• MDSAP AU P0002.5: MDSAP Audit Approach

• MDSAP AU P0008: Audit Time Determination Procedure

• MDSAP AU F0008.2: Audit Duration Calculation Form (Audit Model 

2017)

• MDSAP AU P0019: Medical Device Regulatory Audit Reports Policy

• MDSAP AU F0019.1: Medical Device Regulatory Audit Report

• MDSAP AU F0019.2: NC Grading and Exchange Form

• MDSAP AU P0019.3: Medical Device Regulatory Audit Report Form 

Guidelines

• MDSAP AU G0019.4: NC Grading Exchange Form Guidelines

41
References

• Australia (TGA)

– Therapeutic Goods Act 1989

– Therapeutic Goods (Medical Devices) Regulations 2002

– Uniform Recall Procedure for Therapeutic Goods 

(URPTG)

• Brazil (ANVISA)

– Brazilian Good Manufacturing Practices (RDC ANVISA 

16/2013)

42
References

• Canada (HC)

– Medical Devices Regulations (SOR/98-282)

• Japan

– Japan Ordinance on Standards for Manufacturing Control and 

Quality Control of Medical Devices and In Vitro Diagnostic 

Reagents (MHLW Ministerial Ordinance No. 169)

– The Act on Securing Quality, Efficacy and Safety of 

Pharmaceuticals, Medical Devices, Regenerative and Cellular 

Therapy Products, Gene Therapy Products, and Cosmetics (Law 

No. 145, 1960)

43
References

• United States (FDA)

– Labeling (21 CFR 801)

– Quality System Regulation (21 CFR 820)

– Medical Device Reporting (21 CFR 803)

– Medical Devices: Reports of Corrections and Removals (21 CFR 806)

– Establishment Registration and Device Listing for Manufacturers and 

Initial Importers of Devices (21 CFR 807)

– Medical Device Tracking Requirement

– Unique Device Identification (21 CFR 830)

44
Conclusion

• MDSAP training will focus on the assessment of the 

organization’s entire quality management system and the 

assessment of additional participating country-specific 

requirements.

• MDSAP Audits allows a medical device manufacturer to 

have a single quality management system audit.

• MDSAP Audit approach has a total of seven processes 

arranged in a set sequence.

• MDSAP audits have a number of fixed tasks to be 

covered.
Conclusion

This concludes the Introduction to the MDSAP Program

training module.
47