MDSAP: One Audit, Five Regulators, Zero Surprises

MDSAP audits are structured around seven processes: Management, Measurement Analysis and Improvement, Design and Development, Production and Service Controls, Purchasing, Device Marketing Authorisation and Facility Registration, and Medical Device Adverse Events and Advisory Notices Reporting. Each process has defined tasks, a sequence, and links to specific clauses of ISO 13485, 21 CFR Part 820 (now QMSR), and the country-specific regulations. The audit follows the linkages — a finding in Production has explicit ties to Measurement Analysis and to Management Responsibility, so a single nonconformity often touches three processes. Manufacturers who prepare process-by-process without rehearsing the linkages are caught off guard.

The MDSAP Audit Approach (the 'Companion Document') is the public auditor's playbook — every task, every input, every expected output, every linkage. Reading it is non-optional preparation. Each task has a defined input (the artefact the auditor will ask for first), the activities the auditor will perform, the outputs they document, and the regulation-specific tasks that get layered on. A manufacturer who has run their internal audit against the Companion Document tasks knows precisely what will be asked and in what order; a manufacturer who has prepared against ISO 13485 alone will lose three days of audit time to surprise.

MDSAP nonconformities are graded 1 to 5 using a structured methodology: the starting grade is based on the QMS sub-clause (with critical clauses starting at Grade 4), then escalates by one if the nonconformity is repeated from a prior audit, and by one more if it involves a release of nonconforming product. Grade 4 and Grade 5 findings trigger a 5-day notification to all participating regulators and, for FDA specifically, can lead to a routine for-cause inspection regardless of the MDSAP coverage. Understanding the grading mechanics changes how a manufacturer responds to a finding in real time — the order of escalation factors matters.

Each participating regulator adds country-specific tasks to the core audit. FDA: 21 CFR 803 medical device reporting, 21 CFR 806 corrections and removals, 21 CFR 820 specifics. Health Canada: SOR/98-282 incident reporting, mandatory problem reporting, CMDR-specific licensing tasks. ANVISA: RDC 16/2013 GMP for medical devices and RDC 67/2009 distribution. TGA: Australian Medical Device Regulations including manufacturer evidence and IVD-specific tasks. PMDA: Japan's MAH/D-MAH relationships, post-market obligations under the PMD Act. The country-specific tasks are the most common source of findings because they are the easiest to underprepare for.

An MDSAP certification cycle runs initial Stage 1 (documentation review and readiness), Stage 2 (full on-site audit of all seven processes), then annual surveillance audits (covering a subset of processes on a rotation) and a triennial recertification (full re-audit of all seven). Each surveillance has a defined process scope, and Management Responsibility plus the customer-feedback-and-CAPA cluster are audited every visit. Manufacturers who prepare only for recertification routinely take surveillance findings because they let the off-year processes drift.

MDSAP audits are conducted by recognised Auditing Organisations (BSI, TUV SUD, TUV Rheinland, DEKRA, DNV, Intertek, NSAI, SGS, UL and others). The choice matters more than manufacturers usually allow. AO auditor pools differ in country specialisation — an AO whose audit team has deep PMDA experience produces a different audit dynamic than one whose Japan task coverage is thinner. Contract terms (audit duration days, surveillance scope rotation, observer rights, language of audit) also vary materially. The relationship is multi-year and switching mid-cycle is expensive, so the original AO selection should be treated as a strategic procurement decision with input from regulatory, quality and operations — not as a quote comparison. Manufacturers operating across multiple sites and product lines often hold one AO for the corporate certificate with site-specific add-ons rather than one AO per site, because cross-site finding consistency is easier to manage that way.

The single skill that differentiates well-run MDSAP audits from poorly-run ones is the ability to handle an auditor observation in real time, before it crystallises into a written nonconformity. Auditors typically signal an emerging finding several hours before they write it up — a request for additional records, a return visit to the same area, a specific question repeated to a different person. A management representative who recognises the signal can produce supplementary evidence, demonstrate the missing linkage, or accept the finding at the lowest defensible grade before the escalation factors apply. The MDSAP grading rules reward this — a finding that is not a repeat from a prior audit, and not associated with released nonconforming product, starts and ends lower. The escalation matters: a Grade 3 closed in 30 days is a routine event; a Grade 4 triggers the 5-day notification, the corporate-level response, and the FDA follow-up risk.

Days 1 to 20: gap assessment against the seven processes using the current Companion Document; identify weakest processes and weakest country-specific tasks. Days 21 to 50: rebuild the documentation and records for the weakest processes, prioritising Production, Measurement Analysis, and CAPA; close country-specific gaps (FDA reporting, Health Canada licensing, others as applicable). Days 51 to 80: run an internal audit task-by-task against the Companion Document; close findings with the MDSAP grading mechanics applied. Days 81 to 110: management review with the internal audit and country-task evidence; mock audit with the Auditing Organisation if offered. Days 111 to 120: pre-audit logistics, evidence packs, and rehearsal of the opening meeting where the auditor sets the linkage expectations.