MDSAP audit readiness: how medical device manufacturers prepare for one audit that five regulators read

What MDSAP audit readiness means

A manufacturer is ready for an MDSAP audit when its quality system already runs to ISO 13485:2016 and to the regulatory requirements of every country in its scope, and when it has the records to show it.

The Medical Device Single Audit Program lets one audit serve the regulators of Australia, Brazil, Canada, Japan and the United States. That changes what the auditor is doing. In an ordinary ISO 13485 audit the question is whether the system conforms to the standard. In an MDSAP audit the question includes whether each regulator can rely on what it reads, because the report is written for them.

For many manufacturers the trigger is Canada. Health Canada requires manufacturers of Class II, III and IV devices sold in Canada to hold MDSAP certification, a rule that has applied since 1 January 2019. This guide assumes the decision is made; if it is not, start with MDSAP and ISO 13485: what the single audit adds.

Who audits, and who reads the report

Only an Auditing Organization recognised under the programme can conduct an MDSAP audit. Sterling does not audit and does not certify; the Auditing Organization plans the audit, raises and grades the findings and issues the certificate.

The audience for the report matters to how you prepare. Findings are graded under the programme's guidelines for GHTF/SG3/N19:2012, the nonconformity grading system for regulatory purposes and information exchange, and the graded results are shared with the regulators in your scope.

The United States shows how the report is used. The FDA uses MDSAP audit reports as a substitute for its surveillance inspections for manufacturers that volunteer to take part, and it does not carry out surveillance inspections at sites actively enrolled. Every manufacturer remains subject to the FDA's other inspections, including for-cause and compliance follow-up visits, and FDA inspections under the QMSR do not follow the MDSAP audit plan. The detail of that relationship is in the guide on ISO 13485 and the FDA QMSR: what to check.

What the auditor will look for

The programme's audit approach is process-based. It focuses on a set of defined processes, links them in a defined way and builds all of them on a foundation of risk management. In practice the auditor follows the thread from management into design, production, purchasing and post-market activity. The audit model itself, process by process, is covered in the MDSAP hub's own guide (The MDSAP audit model explained, process by process). The table is a readiness view: what to expect in each area and the evidence to have ready.

If your internal audit programme cannot produce this evidence on request, the gap is in the system rather than in the preparation. The guide on ISO 13485 internal audit: planning, conduct and reporting covers how to build a programme that finds it first.

A readiness sequence for the months before the audit

Work backwards from the audit date. Durations depend on how much of the system already runs and how many markets are in scope.

1. Fix the scope in writing

List the device families, sites and the countries where you sell or will sell during the certificate's life. The jurisdictions decide which regulatory requirements the auditor examines.

2. Build a jurisdiction matrix

For each country, record the requirements that go beyond ISO 13485, where each is met in your procedures and who owns it. It shows the auditor that regulatory obligations belong to a process, not to one person's memory.

3. Let the system generate records

New or changed procedures need to run before the audit so that complaint decisions, change assessments, supplier reviews and CAPAs exist as records of real work.

4. Audit internally the way the Auditing Organization will

Run the internal audit along the same processes and grade your own findings with the same logic the programme uses. Close them with evidence and take the results to a management review that covers regulatory change in every market.

5. Hold a rehearsal

A mock audit a few weeks before the date tests people as much as paperwork. Process owners should be able to walk an auditor from a requirement to its record without a script, and document retrieval should be tried once before the real day.

6. Plan the response capacity

Reserve the time of the people who will answer findings in the weeks after the audit. The regulators have set an initial response period of 15 calendar days.

Findings, grading and the response window

Every nonconformity in an MDSAP audit is graded, and the grade travels with the report to the regulators. The programme publishes its guidelines on the GHTF/SG3/N19:2012 grading system and a nonconformity assessment rubric, and both are worth reading before the audit so that your internal auditors grade the same way. Look first for repeat findings and for any control failure that let a nonconforming device reach the market.

After the closing meeting, the clock starts. Your initial response to the findings is due within the 15 calendar day period the regulators have imposed. A useful response names the correction, the root cause, the corrective action, the owner and the date, and it attaches evidence wherever the action is already complete.

The certificate follows the Auditing Organization's decision once findings are addressed; the general mechanics of certification are in ISO 13485 certification process, step by step.

Where MDSAP readiness breaks down

The same weaknesses appear again and again when a certified ISO 13485 system meets an MDSAP audit for the first time.

• Registrations held outside the system. Licences are known to regulatory affairs but absent from the quality system and from change control.
• Reportability decided but not recorded. The decision not to report an event, and its reasoning per country, is missing from the file.
• Risk management that stops at design transfer. The risk file has not been updated since launch, although complaints and CAPAs carry risk information.
• Suppliers controlled by paperwork alone. Critical suppliers are monitored no differently from minor ones.
• Internal audits that never grade. The first time anyone grades a finding is when the auditor does.

MDSAP audit readiness: questions buyers ask