Preparing for an MDSAP Audit Without Running Five Separate Programmes
One auditing organization, five regulators: plan the three-year cycle and keep one matrix for the country extras.
In Short
- Used for Canadian device licences.
- Three-year audit cycle.
- One matrix for country extras.
Quality Management Buyer Guide
For quality, regulatory and operations teams choosing quality management software. Use it with or without V5.
- Map every issue from raised to human closure.
- Set CAPA effectiveness criteria before you act.
- Separate regulation, configured workflow and lab features.
We ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
Quality Management Buyer Guide
For quality, regulatory and operations teams choosing quality management software. Use it with or without V5.
The Medical Device Single Audit Program (MDSAP) lets one recognised auditing organization audit a device maker against ISO 13485 plus the requirements of the participating regulators: Australia's TGA, Brazil's ANVISA, Health Canada, Japan's MHLW and PMDA, and the US FDA. This guide covers the audit cycle, the jurisdiction layer and how auditors follow your records. It is orientation, not regulatory advice. Sources checked 4 Oct 2026.
Who uses MDSAP and why
Health Canada moved licensed manufacturers of class II to IV devices to MDSAP, and all manufacturers holding Canadian medical device licences now participate. FDA says it may accept MDSAP audit reports as a substitute for routine inspections; its MDSAP FAQ says for-cause and compliance follow-up inspections are not affected.
More on who uses MDSAP and why
The other participants use the reports in their own review and inspection decisions. For a maker selling into several of these markets, one well-run audit replaces several separate ones.
The Three-Year Cycle
The cycle starts with an initial certification audit in two stages, followed by surveillance audits in each of the next two years and a recertification audit in the third. Special audits, unannounced audits and audits by the regulators themselves can happen at any point in the cycle.
The MDSAP Cycle
- Year 1Initial audit, stage 1 and stage 2Auditing organization
- Year 2Surveillance auditAuditing organization
- Year 3Surveillance auditAuditing organization
- ThenRecertification audit starts the next cycleAuditing organization
More on the Three-Year Cycle
Plan the year around the cycle so that management review, internal audit coverage and supplier evaluations are complete before the auditor arrives, not assembled during the visit.
The audit follows linked processes
The MDSAP audit model walks through management; device marketing authorization and facility registration; measurement, analysis and improvement; adverse events and advisory notices; design and development; production and service controls; and purchasing. The processes link, so a CAPA sample can lead into complaints, then into production records and supplier controls.
More on the audit follows linked processes
Gaps tend to show up at those hand-offs.
The Jurisdiction Layer
Worked Example: One Requirement Matrix Row
| Topic | Where it is met |
|---|---|
| Complaint handling (ISO 13485 8.2.2) | SOP-021 |
| US adverse event reporting (Part 803) | SOP-021 section 6 |
| Canadian mandatory problem reporting | SOP-021 section 7 |
| Records retention by market | SOP-004 table 2 |
- Complaint handling (ISO 13485 8.2.2)
- Where it is met
- SOP-021
- US adverse event reporting (Part 803)
- Where it is met
- SOP-021 section 6
- Canadian mandatory problem reporting
- Where it is met
- SOP-021 section 7
- Records retention by market
- Where it is met
- SOP-004 table 2
More on the Jurisdiction Layer
Keep one matrix mapping each country requirement to the procedure that meets it, instead of separate manuals that diverge.
Nonconformities and Follow-Up
Findings are graded from 1 to 5. Under the MDSAP post-audit policy, the auditing organization must tell the regulators within 5 working days if it finds any grade 5 or more than two grade 4 nonconformities.
More on nonconformities and Follow-Up
Respond with a correction, root cause, corrective action and evidence of effectiveness by the agreed date. Your management representative owns the response and the auditing organization decides whether it is adequate.
Questions
Is MDSAP mandatory?
Health Canada has moved licence holders for class II to IV devices into MDSAP. For the other participants, check how each uses MDSAP reports for your devices.
Does MDSAP replace FDA inspections?
FDA says it may accept MDSAP audit reports as a substitute for routine inspections. Its FAQ says for-cause and compliance follow-up inspections are not affected, and PMA pre-approval inspections are outside the program.
How long is the audit cycle?
Three years: an initial two-stage certification audit, two annual surveillance audits and a recertification audit in the third year.
Where does V5 fit?
V5 keeps controlled documents, training, complaints, CAPA, supplier records and device production records linked, so a sample can be followed across processes. Your team owns the audit responses.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.