1

Overview Of The MDSAP Audit Process

CAPT Kimberly Lewandowski-Walker

Senior Regulatory Officer

Center for Devices and Radiological Health 

U.S. Food and Drug Administration
Learning Objectives

• List the prerequisites for a Medical Device Single Audit 

Program (MDSAP) Auditor

• Describe the MDSAP Audit process and provide 

examples 

• Review requirements for writing nonconformity 

statements and the final report
Learning Objectives

• List the prerequisites for an MDSAP Auditor

• Describe the MDSAP Audit process and provide 

examples 

• Review requirements for writing nonconformity 

statements and the final report
MDSAP Auditor Prerequisites

MDSAP Auditor is expected to:

-Be affiliated with an MDSAP recognized auditing organization or

- Be employed by one of the MDSAP participating regulatory 

authorities

- Be proficient in auditing to the International Organization for 

Standardization (ISO) 13485: 2016 standard

- Be familiar with the specific requirements of participating 

regulatory authorities

- Successfully complete the MDSAP training program
Learning Objectives

• List the prerequisites for an MDSAP Auditor

• Describe the MDSAP Audit process and provide 

examples 

• Review requirements for writing nonconformity 

statements and the final report
MDSAP Audit Process

• Each MDSAP Audit process contains:

– A purpose

– A number of anticipated outcomes or objectives that are 

further broken down into specific tasks 

• The audit tasks are based on the clauses in ISO 

13485:2016 and the regulatory requirements of the 

participating Regulatory Authorities

• Each task has audit criteria associated with it

6
MDSAP Audit Process

• It is expected that the auditor is proficient in auditing 

to ISO 13485:2016 and is familiar with specific 

requirements of:

– Australia's Therapeutic Goods Administration,

– Brazil’s ANVISA,

– Health Canada

– Japan’s MHLW

– United States’ Food and Drug Administration

7
MDSAP Audit Process

• Australia requirements

– Therapeutic Goods Act 1989

– Therapeutic Goods (Medical Devices) Regulations 2002

– Uniform Recall Procedure for Therapeutic Goods (URPTG)

• Brazilian Medical Device Regulation 

– Brazilian Good Manufacturing Practices (RDC ANVISA 

16/2013)

8
MDSAP Audit Process

• Health Canada requirements

– Medical Device Regulations (SOR/98-282)

• Japan requirements

– Japan Ordinance on Standards for Manufacturing Control 

and Quality Control of Medical Devices and In Vitro 

Diagnostic Reagents (MHLW Ministerial Ordinance No. 169)

9
MDSAP Audit Process

• United Sates Food and Drug Administration requirements

– Labeling (21 CFR 801)

– Quality System Regulation (21 CFR 820)

– Medical Device Reporting (21 CFR 803)

– Medical Devices: Reports of Corrections and Removals (21 CFR 806)

– Establishment Registration and Device Listing for Manufacturers and 

Initial Importers of Devices (21 CFR 807)

– Medical Device Tracking Requirements (21 CFR 821)

– Unique Device Identification (21 CFR 830)

10
MDSAP Audit Process

• Audit Tasks

– The auditor assesses the organization's conformity 

to the applicable clause of ISO 13485:2016 

– The auditor assesses any additional country-specific 

requirement

– Incorporate the requirements of the applicable ISO 

13485:2016 clause and aspects of country-specific 

requirements

11
MDSAP Audit Process

• Why not just perform an audit to ISO 13385:2016?

– Not all of the regulatory authorities have adopted ISO 

13485:2016 as their regulatory requirement 

– There are additional requirements contained in Brazilian 

Good Manufacturing Practices (RDC ANVISA) and FDA Quality 

System Regulation (21 CFR Part 820)

12
MDSAP Audit Process

• Why not just perform an audit to ISO 13485:2016?

– There are specific requirements for each MDSAP 

participating regulatory authority

Medical device adverse event reporting

Advisory notice reporting

 Device marketing authorization

Facility registration

13
MDSAP Audit Process

• Audit tasks within an MDSAP audit process

– Are flexible

– Are arranged in a logical order

– May be performed in any order to facilitate a thorough and 

efficient audit of the process

14
MDSAP Audit Process

• Linkages and interactions between the MDSAP 

processes are indicated throughout the process (in the 

red box)

• Tasks involving risk management and risk based 

decisions are also indicated (in blue font)

15
MDSAP Audit Process

• The audit team will be asked to be mindful of 

“linkages” 

• Quality management system has to identify and 

manage numerous interrelated (linked) processes 

• The output of one process often directly forms the 

input of other processes

• The activities of a supporting process are relevant to 

other processes

16
MDSAP Audit Process

Linkages:

– Built into the MDSAP audit sequence and audit tasks 

– Remind the audit team of the interactions between the 

processes 

– Assist auditors in making appropriate selections when 

moving to the next process

17
MDSAP Audit Process

Risk Management:

– Assessed by the audit team during the audit

– An integral aspect of an organization’s quality 

management system 

– Top management provide the necessary commitment 

and resources for risk management activities

18
MDSAP Audit Process

• Effective risk management

– Usually starts in conjunction with the design and 

development process 

– Proceeds through product realization, including the selection 

of suppliers

– Continues until the time the product is decommissioned

• Risk-based decisions occur throughout the various 

quality management system processes 

• Each organization must decide how much risk is 

acceptable 19
MDSAP Audit Process

• Guidance on assessing conformity is available in the 

MDSAP Audit Approach document

• Reference the MDSAP Audit Approach document as 

you complete the MDSAP training modules

20
Example 1 : MDSAP process

Auditing the Measurement, Analysis and Improvement 

Process

– Purpose: 

Verify that the manufacturer’s processes ensure that information 

related to products, processes, or the quality management system is 

collected and analyzed 

Identify actual and potential product, process, or quality 

management system nonconformities

Ensure that problems and potential problems are investigated

Ensure that appropriate and effective corrective actions and 

preventive actions are taken

21
Example 1: MDSAP Process

Auditing the Measurement, Analysis and Improvement 

Process

– Outcomes: objective evidence that demonstrate whether the 

organization has:

A. Defined, documented, and implemented procedures for 

measurement, analysis and improvement

B. Identified, analyzed, and monitored appropriate sources of quality 

data and determined the need for corrective or preventive action 

22
Example 1: MDSAP Process

Auditing the Measurement, Analysis and Improvement 

Process

– Outcomes: objective evidence will demonstrate whether the 

organization has:

C. Ensured investigations are conducted to identify the underlying 

causes of nonconformities and potential nonconformities, where 

possible

D. Implemented appropriate corrective action or preventive action

23
Example 1: MDSAP Process

Auditing the Measurement, Analysis and 

Improvement Process

– Outcomes: objective evidence will 

demonstrate whether the organization has:

E. Reviewed the effectiveness of corrective action and 

preventive action, 

F. Utilized information from the analysis of production and post- production quality data to amend the analysis of product risk, 

as appropriate

24
Example 1: MDSAP Process

• Linkages to other MDSAP processes:

– Design and Development process

– Production and Service Controls

– Purchasing

– Medical Device Adverse events and Advisory Notice 

Reporting

– Management

25
Example 1: MDSAP Process

Audit task

7. When a corrective or preventive action results in a process change, 

confirm that the process change is assessed to determine if any new 

risks to the product are introduces. Verify the manufacturer has 

performed revalidation of processes where appropriate.

Clause and regulation:[ISO 13485: 2016; 4.1.2, 4.1.4, 4.1.6, 4.2.1, 7.1, 7.5.2, 7.5.6, 7.5.7; 

TG(MD)R Sch1 P1 2; Sch3 P1 1.5(4); RDC ANVIS 16/2013: 2.4, 5.6, 7.1.1.4; MHLW MO169: 5, 6, 

26, 45, 46; 21 CFR 820.100(a)(4), 820.100(a)(5), 820.70(b), 820.75(c )]

26
Example 1: MDSAP Process

Audit Task 7.

– Additional country-specific requirements (see MDSAP Audit 

Approach):

Australia (TGA): [TG(MD)R Sch3 P1 1.5(2)]

Canada (HC): [CMDR 1, 34]

Japan (MHLW): [MHLW MO169: 29]

27
Example 1: MDSAP Process

Audit Task 7. – Links:

 Production and Service Controls and Purchasing processes

– The audit team considers:

 Selecting changed production processes for evaluation during Production 

and Service Control audit

 Selecting suppliers who performed changes to production processes for 

evaluation

 Re-validation, when the organization makes a change to a validated process 

performed by a supplier

– If re- validation is required, confirm the results show the 

process meets the planned results

28
Example 1: MDSAP Process

• Managing the linkage

– The Purchasing process may be reviewed in conjunction 

with:

The Measurement, Analysis and Improvement process

The Design and Development process, and 

The Production and Service Controls process

29
Example 1: MDSAP Process

• Managing the linkage:

– Consider if corrective or preventive action resulted in 

process change

– Consider selecting those processes or suppliers to audit 

involving the process change that was made as a result 

of corrective or preventive actions

30
MDSAP Audit Process

• Sampling Records:

– Judgement-based sampling

Flexible

Generally, fewer records sampled

– Statistical sampling

Demonstrates conformity or nonconformity

31
MDSAP Audit Process

• Sampling Records:

– Judgement-based sampling

Often the most-appropriate sampling methods to achieve 

the MDSAP audit outcomes

Takes into account:

o Complexity and interaction of the organization’s processes 

and quality management system elements 

o Key risk areas

32
MDSAP Audit Process

• Sampling Records

– Statistical sampling

May be appropriate in cases where no high risk 

nonconformities have been identified.

Helpful in making a statistical estimate of the effect of 

uncertainty in the findings of the audit and the 

conclusions reached

The level of sampling risk needs to be assessed by the 

auditor

33
MDSAP Audit Process

• Sampling products and processes

– Assess all product families and significant processes 

during audit cycle

– Degree of assessment depends on:

Risk of the product and process

Whether significant nonconformities can be attributed to the 

product or process

Whether any significant changes have been made to the 

products or processes 

34
MDSAP Audit Process

• Design and implementation of an organization’s quality 

management system is based on:

– The needs of the organization 

– The size of the organization

– The processes employed

– The products provided

• If the organization does not perform certain processes, 

then:

– The organization’s quality management system does not need to 

address such a requirement 

– The corresponding MDSAP process does not need to be audited 35
MDSAP Audit Process

• Outsourcing 

– Much more common in the area of device design and 

manufacturing

– Organizations can choose to outsource any processes 

related to the design and/or manufacture of medical 

devices 

The suppliers of the processes must be controlled within 

the organization’s quality management system

The supplied processes must be controlled within the 

organization’s quality management system

– Organizations cannot outsource responsibility for the device 36
MDSAP Audit Process

• Exclusions and Non-applicability

– The organization may exclude the requirements of markets 

where the organization does not intend to supply product 

– The audit scope and audit criteria must take into account any 

justified exclusions or non-applications 

– Some MDSAP requirements may not be applicable when an 

organization claims an exclusion from the requirements of a 

target market

– Exclusions must be clearly identified in the audit report

37
Learning Objectives

• List the prerequisites for an MDSAP Auditor

• Describe the MDSAP Audit process and provide 

examples 

• Review requirements for writing nonconformity 

statements and the final report
Nonconformity Statements

• During the audit, auditors must be mindful:

– Of any instances where the organization demonstrates 

failure to fulfill any of the requirements in ISO 13485:2016 

– Of any instances where the organization demonstrates 

failure to fulfill any portion of the requirements listed in the 

audit activities and tasks

– That these nonconformities are recorded in appropriate 

detail 

39
Nonconformity Statements

• Pay attention to the potential interrelationship of the 

nonconformities observed

– For example:

Audit findings in both purchasing controls and acceptance 

activities 

May indicate a significant nonconformity because control 

over suppliers, and the products they supply, depends on 

an effective combination of both these activities

Deficiencies in one or the other may affect the quality of 

the finished device

40
Nonconformity Statements

• Generating audit findings

– Nonconformities should be:

 Recorded along with supporting evidence

 Reviewed with the auditee 

– Nonconformities should include 

 A reference number or identifier

 The date

 Identification of the organization

 Grading 

 The requirement that is not met 

 Supporting audit evidence

 The name of the auditor issuing the nonconformity

41
Nonconformity Statements

• Nonconformities regarding country-specific 

requirements 

– Written as an audit finding

– Documented in the audit report

• Exceptions to nonconformities regarding country- specific requirements 

– Exclusions and non-applications permitted by ISO13485:2016

– Requirements of markets where the organization does not 

intend to supply product

42
Nonconformity Statements

• Document in the audit report:

– Any observations related to device safety

– Any observations related to the organization’s

 Failure to report individual adverse events

Advisory notices

Changes to device marketing authorization 

Changes to facility registration

43
Final Report

• Report Format

– Reports must be in the format described in the MDSAP 

AU P0019: Medical Device Regulatory Audit Reports 

Policy

– Use the Fillable MDSAP Audit Report Form

44
References

• Medical device- Quality management systemsRequirements for regulatory purposes (ISO 

13485:2016)

• Guidelines for auditing management systems (ISO 

19011:2011)

• Conformity assessment-Requirements for bodies 

providing audit and certification of management 

systems (IS0/IEC 17021:2015) 45
References

• MDSAP AU P0002.5: MDSAP Audit Approach

• MDSAP AU P0008: Audit Time Determination Procedure

• MDSAP AU F0008.2: Audit Duration Calculation Form (Audit Model 

2017)

• MDSAP AU P0019: Medical Device Regulatory Audit Reports Policy

• MDSAP AU F0019.1: Medical Device Regulatory Audit Report

• MDSAP AU F0019.2: NC Grading and Exchange Form

• MDSAP AU P0019.3: Medical Device Regulatory Audit Report Form 

Guidelines

• MDSAP AU G0019.4: NC Grading Exchange Form Guidelines

46
References

• Australia (TGA)

– Therapeutic Goods Act 1989

– Therapeutic Goods (Medical Devices) Regulations 2002

– Uniform Recall Procedure for Therapeutic Goods 

(URPTG)

• Brazil (ANVISA)

– Brazilian Good Manufacturing Practices (RDC ANVISA 

16/2013)

47
References

• Health Canada (HC)

– Medical Devices Regulations (SOR/98-282)

• Japan

– Japan Ordinance on Standards for Manufacturing Control and 

Quality Control of Medical Devices and In Vitro Diagnostic 

Reagents (MHLW Ministerial Ordinance No. 169)

– The Act on Securing Quality, Efficacy and Safety of 

Pharmaceuticals, Medical Devices, Regenerative and Cellular 

Therapy Products, Gene Therapy Products, and Cosmetics (Law 

No. 145, 1960)

48
References

• United States (FDA)

– Labeling (21 CFR 801)

– Quality System Regulation (21 CFR 820)

– Medical Device Reporting (21 CFR 803)

– Medical Devices: Reports of Corrections and Removals (21 CFR 806)

– Establishment Registration and Device Listing for Manufacturers and 

Initial Importers of Devices (21 CFR 807)

– Medical Device Tracking Requirement (21 CFR 821)

– Unique Device Identification (21 CFR 830)

49
Conclusion

• There are prerequisites for an MDSAP Auditor

• The MDSAP Audit process includes:

– A purpose

– Expected Outcomes

– Audit tasks

– Final Report

• Nonconformities should be documented in the Final Report 

using the fillable MDSAP Audit Report Form
Conclusion

This concludes the Overview of the MDSAP Audit Process

training module.
52