Medical Device Single Audit Program (MDSAP)


In an attempt to accelerate international medical device regulatory device harmonization and convergence, the International Medical Device Regulators Forum (IMDRF) developed a global approach to auditing and monitoring the manufacturing of medical devices to hopefully improve their safety and oversight on an international scale. The Medical Device Single Audit Program (MDSAP) offers medical device manufacturers a mechanism to streamline audits required by regulatory authorities around the world. Under MDSAP, a single audit performed by an authorized Auditing Organization (AO) is deemed sufficient to assess compliance with the quality management system requirements of regulatory agencies in multiple medical device markets: United States, Canada, Japan, Brazil and Australia. This single audit approach reduces the need for duplicate quality management audits, helping device manufacturers to better manage costs and ease market access.

Benefits of the MDSAP Program for Medical Device Manufacturers:

The MDSAP is based on the use of third party auditors that conduct quality and compliance audits using the guidelines and regulations established by regulatory authorities. MDSAP is designed to allow medical device manufacturers to undergo a single audit by an authorized auditing organization that will satisfy the relevant requirements of the regulatory authorities participating in the pilot program. The MDSAP Pilot includes representatives from the Australian Therapeutic Goods Administration (TGA), Brazil’s Agência Nacional de Vigilância Sanitária (ANVISA), Health Canada, the U.S. Food and Drug Administration (FDA) and Japan’s Ministry of Health, Labor and Welfare (MHLW) and the Japanese Pharmaceuticals and Medical Devices Agency. The benefits of this program include:

  1. Can provide time and resource savings for medical device manufacturers marketing products globally.
  2. Reduced number of audits or inspections for medical device manufacturers marketing products in multiple international regions.
  3. Medical device manufacturer is given the freedom to choose which authorized Auditing Organization will perform audits.
  4. Standardize regulatory programs by promoting consistency, predictability, and transparency.
  5. Does not add additional requirements for medical device manufacturers; includes the existing requirements from ISO 13485:2003 (and will include requirements from ISO 13485:2016) and the requirements from regulatory authorities that are participating.
  6. The audit follows a preset step by step checklist that details the exact time an auditor will spend on each process.
  7. IMDRF participants represent some of the world’s largest markets for medical devices which include the EU, Brazil, Japan, Australia and China. This broad acceptance of MSDAP QMS audit reports in major medical device markets will potentially lead to even more widespread acceptance of MDSAP audits among non-IMDRF participants.

Audit Process:

The MDSAP audit sequence was designed and developed to allow audits be conducted in a logical and efficient manner. The audit sequence follows a process approach and has four primary processes: (1) Management; (2) Measurement, Analysis and Improvement; (3) Design and Development; (4) Production and Service Controls; and a supporting process, (5) Purchasing. There are also two additional supporting processes: (1) Device Marketing Authorization and Facility Registration and (2) Medical Device Adverse Events and Advisory Notices Reporting; both of these processes are necessary to fulfill specific requirements of participating MDSAP regulatory authorities. There are several audit tasks depending on the process being audited. Audit time is calculated based on the number of applicable audit tasks associated with the type of audit to be conducted; a company must only certify to the regulatory requirements of the countries that are applicable to them.

The MDSAP audit program follows a 3-year cycle. The cycle begins with an initial authorization, followed by annual surveillance assessments for two consecutive years. The initial audit consists of a Stage 1 and a Stage 2 audit. A Stage 1 audit consists of a documentation review and the evaluation of the readiness of the manufacturer to undergo a Stage 2 audit. The purpose of a Stage 2 audit is to determine if all applicable QMS requirements of ISO 13485 and all other applicable regulatory requirements from participating regulatory authorities are effectively implemented. The initial Audit is followed by partial Surveillance Audits conducted once a year for two consecutive years. The cycle recommences with a complete Recertification Audit in the third year.

Timeline for the Implementation of MDSAP:

Health Canada

Health Canada has adopted MDSAP as the sole mechanism for manufacturers to demonstrate compliance with the quality management system requirements of the Medical Devices Regulations. As such, the Health Canada requirements are driving MDSAP timelines for those companies currently or intending to market a device in Canada.

MDSAP will replace the Canadian Medical Devices Conformity Assessment System (CMDCAS) program, even when a manufacturer intends to only sell in Canada. Manufacturers who only intend to sell in Canada will not be subject to the quality management system requirements of the other MDSAP participants.

Health Canada will begin accepting certificates issued under both its current Canadian Medical Devices Conformity Assessment System (CMDCAS) program and the MDSAP program as of January 1, 2017 and as of January 1, 2019, Health Canada will accept only MDSAP certificates. Manufacturers who market their devices in Canada will need to transition their existing QMS audit certificate issued by a CMDCAS recognized registrar to MDSAP Certification issued by an AO.

If a company has a current medical device license using a CMDCAS certificate, as of January 1, 2019 that license is not valid in Canada. Licenses that are not supported by an MDSAP certificate as of January 1, 2019 will be subject to suspension. Holding a valid quality systems certificate is a regulatory requirement for a manufacturer to have an active medical device license. If a company receives a CMDCAS certificate during 2017/2018, it will need to transition to MDSAP before January 1, 2019; an early recertification audit with an AO will accomplish this or in lieu of a CMDCAS certificate the company could certify to MDSAP before the January 1st deadline. 

Health Canada has provided some Q&A on the transition to MDSAP:

Q1: I received a medical device license using a CMDCAS certificate. Will my license be suspended if I don’t have a MDSAP certificate on January 1, 2019?

A: Yes. Licenses not supported by a valid MDSAP certificate as of January 1, 2019, will be subject to suspension. Holding a valid quality systems certificate is a regulatory requirement for a manufacturer to have an active medical device license. All device license applications and F202 notifications received after January 1, 2019, must contain a MDSAP certificate; a manufacturer’s CMDCAS certificate will not be accepted. Additionally, auditing organizations (AOs) will soon begin issuing MDSAP certificates after recertification or special upgrade audits and these are to be submitted to Health Canada using the Form F202 notification process.

U.S. Food and Drug Administration (FDA)

In the United States, MDSAP audit reports will be accepted for routine FDA inspections. However, “Compliance Follow-up” and “For Cause” inspections cannot be performed as part of the MDSAP. Additionally, inspections associated with Premarket Approval cannot be conducted as part of the MDSAP program and will continue to be conducted by FDA staff. Unannounced audits may also continue to occur within an audit cycle for a medical device manufacturer.