MDSAP: Guiding Your Company Through the Audit Process

EDITOR’S NOTE: This article is Part 2 of a three-part  series focusing on the MDASP (the Medical Device Single Audit Program). Read Part 1 of the series here and Part 3 here.

The Model Audit and MDSAP Audit Bodies

The aim of this article is to set out exactly what is expected of the audit team during a Medical Device Single Audit Program (MDSAP) audit. Each audit assesses how well a medical device company's quality management system (QMS) complies with the requirements issued by the five-member countries'(Australia, Brazil, Canada, Japan and the U.S.) regulatory authorities.

At the heart of MDSAP audit is a document referred to as “the model audit.” It acts as a roadmap for the auditors and establishes their mission. However, there is no reason why it can't also be used to build a QMS. The model audit allows the team to assess conformity with the requirements of the five regulatory authorities. It introduces a specific audit approach, and provides detailed methods for calculating how long the audits will take. The audit reports are sent to the five regulatory authorities. Each country maintains its own authority and has decided how the program can be incorporated into its own regulations.

MDSAP audits are based on the model audit, which includes the following criteria:

ISO 13485:2016 provisions

Applicable regulatory requirements for the five countries

Specific requirements from the five countries relating to:

• Registering the company or its sponsor
• Approval of medical devices
• Monitoring and reporting incidents (e.g. adverse drug effects)

The audit criteria are built into the model audit, which serves both as a reference document and a set of procedures.

There are four main processes:

1. Management
2. Measurement, analysis and improvement
3. Design and development
4. Control of production and services

And three support process:

• Procurement: An MDSAP audit uses a risk-management-based approach to take samples from these five processes and select records to examine.
• Marketing authorization and company registration.
• Reporting of adverse events and advisory notices.

The model audit provides the same structure for each of the seven processes:

• The goal of the process audit
• The expected results
• The various audit tasks
• Links with other processes
• How it relates to the corresponding clause from ISO 13485
• Country-specific requirements

MDSAP Audit Bodies

To be awarded certification for the MDSAP program, manufacturers of medical devices need to hire an approved audit body (AB) to audit its QMS. ABs are entirely responsible for determining whether a manufacturer meets the requirements and for issuing certification documents. Each regulatory authority involved in MDSAP can use reports created by the ABs to support regulatory decisions within their own jurisdiction.

The following is a list of the ABs currently approved for MDSAP audits:

• BSI Group America Inc.
• Dekra Certification B.V.
• DQS Medizinprodukte GmbH
• Intertek Testing Services NA Inc.
• LNE/G-MED (Laboratoire National de métrologie et d'essais)
• Lloyd's Register Quality Assurance Inc.
• National Standards Authority of Ireland
• NSF Health Science Certification LLC
• QMI-SAI Canada Limited
• SGS United Kingdom Ltd
• TÜV Rheinland of North America Inc.
• TÜV SÜD America Inc.
• TUV USA Inc.
• UL Medical and Regulatory Services LLC

For more information and to contact the ABs, see the table published by the U.S. Food and Drug Administration (FDA).

The MDSAP program provides a certain level of transparency. It allows participating regulatory authorities to closely examine both the ABs and the manufacturers. ABs are assessed on a range of factors such as the code of conduct, impartiality and quality of special/unannounced audits, independence and ability of auditors, and training requirements.

Need guidance in meeting regulatory requirements? Don't hesitate to get in touch with us at www.apsalys.com.