Medical device manufacturers often have to meet quality-system requirements in more than one country. Under MDSAP, they can undergo a single audit whose results several participating regulators are able to use.
Australia, Brazil, Canada, Japan and the United States participate in the program. Audits are carried out by Auditing Organizations recognized under MDSAP. Along with ISO 13485, each audit covers the additional regulatory requirements of the countries included in its scope.
This article covers the audit process, the participating countries and what manufacturers should have in place before an audit.
What Does MDSAP Certification Mean?
MDSAP certification may be issued after satisfactory completion and closure of an initial or recertification audit under the Medical Device Single Audit Program. An MDSAP-recognized Auditing Organization is responsible for carrying out that audit.
A certificate of this kind applies to the manufacturer’s quality management system only. Access to each market is handled separately, under that country’s own registration or approval rules.
The Role of ISO 13485 in MDSAP
An MDSAP audit draws on two sets of requirements. The first is ISO 13485:2016, the international quality management system standard for medical devices. The second covers the regulatory requirements of the participating markets within the manufacturer’s scope. These include requirements from Australia, Brazil, Canada, Japan and the United States. For example, the current MDSAP Audit Approach includes:
- Australia: The Therapeutic Goods (Medical Devices) Regulations
- Brazil: Good Manufacturing Practices under RDC 665/2022
- Canada: The Medical Devices Regulations
- Japan: the QMS Ordinance, MHLW Ministerial Ordinance No. 169
- United States: The Quality Management System Regulation (21 CFR Part 820) and other applicable FDA requirements
Which of these requirements are audited depends on the manufacturer’s markets: those where it already sells, plans to sell or has devices registered.
MDSAP Participating Regulatory Authorities
MDSAP is built around five main regulatory authorities:
| Country | Regulatory authority |
| Australia | Therapeutic Goods Administration (TGA) |
| Brazil |
Brazilian Health Regulatory Agency (ANVISA)
|
| Canada | Health Canada |
| Japan |
Ministry of Health, Labour and Welfare (MHLW) and Pharmaceuticals and Medical Devices Agency (PMDA)
|
| United States | U.S. Food and Drug Administration (FDA) |
All five take part in the same program, but each regulator uses the audit results within its own system.
Health Canada’s licensing framework requires evidence of an ISO 13485 quality management system certificate issued under MDSAP for Class II, III and IV medical devices.
In Brazil, MDSAP audit results can feed into ANVISA’s Good Manufacturing Practice certification process, as well as certain GMP certificate renewals.
TGA can use MDSAP certificates and audit reports as evidence in conformity assessment and may reduce or avoid additional onsite QMS audits when the MDSAP evidence is sufficient.
Japan uses MDSAP reports in certain QMS conformity assessments.
In the United States, FDA may accept MDSAP audit reports as a substitute for certain routine surveillance inspections. It still retains the authority to inspect when necessary.
MDSAP Auditing Organizations
MDSAP audits are carried out by Auditing Organizations that have been accepted into the program and assessed by the participating regulatory authorities.
The current MDSAP framework distinguishes between:
- Recognized Auditing Organizations: fully recognized to conduct MDSAP audits.
- Authorized Auditing Organizations: allowed to conduct MDSAP audits while completing the recognition process. Participating regulators accept their audit reports and certificates.
- Accepted Applicants: organizations still at the assessment stage. They have been accepted into the process but are not yet authorized to conduct MDSAP audits.
An organization’s status can change as it progresses through recognition, so manufacturers should consult the current MDSAP list before selecting an Auditing Organization.
After satisfactory completion and closure of an initial or recertification audit, the Auditing Organization may issue the MDSAP certification document.
MDSAP Audit Process
The MDSAP audit process depends on where the manufacturer is in the three-year certification cycle. An initial audit is more extensive, while surveillance audits have a reduced scope.
For a manufacturer entering MDSAP for the first time, the process starts with an initial audit, which has two stages.
Stage 1 Audit
Stage 1 focuses mainly on documentation and audit readiness. The Auditing Organization reviews the manufacturer’s quality management system and checks whether it is ready to move on to Stage 2.
Stage 2 Audit
Stage 2 looks at how the QMS is actually being implemented. The Auditing Organization reviews the applicable MDSAP processes and regulatory requirements based on the manufacturer’s activities and the markets covered by the audit.
The current MDSAP Audit Approach follows these main process areas:
- Management
- Measurement, Analysis and Improvement
- Design and Development
- Production and Service Controls
- Purchasing
- Device Marketing Authorization and Facility Registration
- Medical Device Adverse Events and Advisory Notice Reporting
Risk management does not appear as a separate process in this list. Auditors examine it within each relevant process instead.
How Nonconformities Are Graded
Nonconformities identified during an MDSAP audit are graded from 1 to 5, with higher grades indicating greater regulatory significance. Detailed remediation and reporting requirements are discussed later in this article.
Audit Report Submission and Closure
Once the audit is complete, the Auditing Organization writes up the audit report, recording any nonconformities found.
When the audit report package is final, the Auditing Organization sends it to the MDSAP Regulatory Authorities through the Regulatory Exchange Platform-secure (REPs).
MDSAP Audit Cycle and Annual Audits
MDSAP follows a three-year certification cycle.
The cycle starts with an initial audit. This is followed by two surveillance audits, usually one in each of the next two years.
In the third year, the manufacturer goes through a recertification audit. This is a full re-audit of the quality management system and starts the next three-year cycle.
Surveillance audits are narrower than the initial or recertification audit. They do not cover every audit task, but manufacturers still have to respond to any nonconformities that are identified.
An MDSAP certificate is normally issued after a successful initial or recertification audit. A surveillance audit does not usually result in a new certificate.
Special audits, unannounced audits and audits by participating regulatory authorities can also take place outside the normal audit cycle when needed.
MDSAP certification documents have a maximum validity period of three years, subject to continued satisfactory surveillance audits.
Preparing for an MDSAP Audit
The first step is to establish which regulatory requirements the audit will cover. The Auditing Organization determines the applicable jurisdictions and audit scope in collaboration with the manufacturer.
The QMS then needs to reflect both the applicable ISO 13485 requirements and the additional regulatory requirements of each market covered. Manufacturers should work from the latest version of the MDSAP Audit Approach while preparing.
It is also useful to review the areas that MDSAP auditors will examine, such as management, design and development, production controls, purchasing, adverse event reporting and other applicable regulatory processes.
Manufacturers should also check that records are current, procedures are being followed in practice and previous quality issues have been addressed.
A mock audit can be used as an internal preparation tool to find gaps before the formal MDSAP audit. MDSAP itself does not require one.
With preparation in place, the manufacturer contacts a recognized MDSAP Auditing Organization directly to schedule the audit.
Corrective Actions for MDSAP Nonconformities
The manufacturer must address every finding. The response should identify the cause of the problem and explain the correction and corrective action planned.
MDSAP recommends that the remediation plan be sent within 15 calendar days of the audit.
For Grade 4 and Grade 5 findings, the manufacturer is also expected to provide evidence that the corrective actions have been put in place. MDSAP recommends doing this within 30 calendar days after the audit. For such higher-grade findings, additional evidence and follow-up may be required before the audit can be closed.
The Auditing Organization then reviews the response. It may check the effectiveness of the corrective actions during the next audit or through an additional follow-up audit if needed.
Some findings must be reported to the MDSAP Regulatory Authorities quickly. This applies to situations such as a Grade 5 nonconformity, more than two Grade 4 nonconformities, a public health threat, fraudulent activity or counterfeit product. In these cases, the Auditing Organization has a five-working-day reporting requirement.
Benefits of MDSAP
MDSAP is meant to make regulatory oversight more efficient by using one audit process across several participating authorities.
For manufacturers, the most direct gain is fewer repeated audits. A single MDSAP audit can address the relevant QMS requirements of more than one participating regulator, which may mean fewer overlapping QMS audits across the markets MDSAP covers.
Regulators benefit as well. They can rely on the same audit results rather than each carrying out a separate review of the same quality system. Because MDSAP follows one structured audit approach, assessments are more consistent across the participating authorities. The program also gives regulators a common way to share audit information and align their oversight activities.
MDSAP can be a useful part of a multi-market regulatory strategy. It does not, however, take the place of product registration or approval in each country, which remains a separate requirement.
Conclusion
MDSAP gives manufacturers a way to use one audit across several participating regulatory systems.
Reducing repeated QMS audits is a clear advantage, but the manufacturer’s ongoing obligations remain in place. Findings from each audit must be addressed, and every market still has its own registration or approval requirements.
Before the formal audit, companies can review their QMS, check the regulatory requirements that apply to their markets, and fix any gaps they find.
For support with medical device QMS, audit preparation and regulatory compliance, explore Artixio’s MedTech Regulatory Services.
