Meeting regulatory and quality compliance in multiple markets is a difficult and complex challenge.
Manufacturers must comply with strict regulatory requirements and undergo regular quality system audits, which can interfere with daily operations. Auditors often duplicate efforts when evaluating approved systems.
The Medical Device Single Audit Program (MDSAP) simplifies compliance with global quality management system (QMS) standards and reduces the industry's resource burden.
MDSAP is a somewhat new program headed by the International Medical Device Regulators Forum. It was launched as a pilot program in 2012 through 2013 and was fully implemented in 2016 after a successful trial.
The program was established by the Global Harmonization Task Force, which comprises of international medical regulators who aimed to streamline the requirements for getting QMS certifications for international companies.
This single audit program has two primary objectives:
MDSAP aims to create a global coalition for medical device manufacturing oversight, reducing regulatory burden and business interruptions. A reliable, universally accepted audit program, the idea goes, would save costs and reduce multiple audits.
Manufacturers from anywhere in the world have the opportunity to take part in the MDSAP. Any manufacturer can participate as long as a product falls under the jurisdiction of at least one participating Regulatory Authority and meets its quality management system requirements.
It's important to note that only the countries participating in MDSAP will have direct access to the audit reports.
The general concept of the MDSAP can be thought of as a dynamic relationship between manufacturers (Mfr), regulatory authorities (RA), and auditing organizations (AO) as shown in the diagram below.
Official MDSAP audits are conducted by private AOs that are qualified to meet MDSAP auditor requirements. Manufacturers can hire an AO to perform MDSAP audits, and often, these AOs can also perform ISO 13485 audits simultaneously.
The MDSAP audit process encompasses seven key process elements:
During a MDSAP audit, the impact of risk management on various processes is carefully analyzed. To ensure preparedness, each section has specific questions that must be answered. This allows manufacturers to anticipate the auditor's expectations. The actual audit takes a process-by-process approach, with some interconnections, which ensures that the auditor and client understand the entire MDSAP audit process.
The MDSAP audit renewal timeline closely aligns with ISO 13485. Once certified, the validity of the certification lasts for three years, starting with an initial audit. Throughout that period, two surveillance audits and a recertification audit must be conducted. This ensures that your organization maintains compliance and meets the expectations set by the MDSAP program.
Diving into the details of how these auditing and assessment activities work, the MDSAP operates on a three-year cycle involving four separate audits:
Let's break this audit sequence down:
Two Surveillance Audits are conducted in years one and two to assess any changes made to your products or QMS processes since the initial assessment was completed. Typically, these audits are structured so that each half of your system is assessed with each audit.
Following the second audit, your Notified Body will review any findings observed during the prior audits. Theoretically, these should be cheaper and shorter; however, in this early phase of the program, this still remains to be seen.
While technically included in the MDSAP audit cycle, a Re-Recognition Assessment is actually conducted in year four. This audit will evaluate your QMS for continued suitability and effectiveness in meeting QMS requirements under the MDSAP.
Typically, this and the prior Surveillance Assessments should not include an in-depth evaluation of procedures unless significant changes have been made to your quality system, facility, or products, such as moving from one device class to another or after adding manufacturing operations to what was solely a design-based organization.
In situations like these, your Notified Body will likely evaluate any impacted documentation and associated procedures.
One of the most significant new concepts the MDSAP brings is its point-based nonconformity grading system. To make nonconformity grading more consistent, the MDSAP does away with traditional grading criteria such as “significant finding,” “regular finding,” and “significant opportunity for improvement,” and instead uses a point system described at length in the Global Harmonization Task Force (GHTF)’s Quality management system - Medical devices - Nonconformity Grading System for Regulatory Purposes and Information Exchange.
We’ve summarized this complex reference guide in simpler terms below. The grading system works in two steps. First by assigning points to nonconformities written against requirements in ISO 13485:2016 using a 4-point grading matrix and then applying that initial point score to a series of escalation rules that may or may not result in a higher final point grade.
Let’s explore the key concepts for both steps.
Step one: the grading matrix
Point grades in step one are determined using the grading matrix below. This divides the clauses of ISO 13485:2016 into two categories: those that indirectly impact the QMS and those that directly impact the QMS.
The occurrence of the nonconformity also plays a factor in the grading system, as illustrated in the visual matrix above. The details of what constitutes a first or repeat occurrence can get somewhat complicated, so we’ve summarized the key concepts in the simplest terms possible:
It’s important to note that an “occurrence” is directed at the frequency of a nonconformity cited from one audit to the next performed by the same auditing organization. It is not the occurrences of examples within a given sample size that the auditor may take to determine if a nonconformity exists during an audit.
Since nonconformities can be written up against more than one clause, it’s up to the auditor to determine the impact of the nonconformity on the QMS and assign the appropriate clause. The GHTF document offers helpful examples that illustrate how grading works in this initial step.
Step two: grading escalation rules
Once a point grade (1 through 4) is determined using the matrix, it’s then subjected to an escalation process to address areas of higher risk that could affect product safety and performance. The grade determined by step one is increased by 1 point for each rule that applies in the...
Absence of a documented process or procedure. (In this case, a process or procedure is “absent” when it hasn’t been documented for the requirement.)
or
Release of a Nonconforming Medical Device. (If a nonconformity resulted in releasing a nonconforming medical device to the market, it’s direct evidence of a QMS failure. However, if a nonconforming device is released with adequate technical and scientific justification, the nonconformity is considered to be resolved, and the rule will not apply.)
The final nonconformity grade will be between 1 and 6, however, a grade of 5 or above is determined to carry a high enough risk that intervention is required. Grades of 6 will be listed as 5 since the differentiation between the two scores offers no benefit within the grading system.
Scores will be recorded on the standardized Regulatory Audit Information Exchange Form, which offers a common means of exchanging audit information between regulatory authorities. This form will be given to manufacturers following MDSAP audits during the closing meeting.
It’s important to note that grades assigned to nonconformities should not be changed following any corrective actions taken by the manufacturer, however, they may be amended on the conditions of the auditing organization’s appeals process.
The importance of a MDSAP preliminary auditGiven the costs and commitments that come with the MDSAP, it’s critically important to prepare for success before AO auditors arrive. One of the most effective ways to ensure readiness for the initial audit is by performing a preliminary preparatory audit. Contact us to learn more about our MDSAP preliminary audit services » |
At present, MDSAP has the active participation of five countries, each of which includes specific market requirements within the framework of this single audit program. Although the European Union currently holds the status of an "Official Observer," it is not a member of MDSAP.
There are several genuine advantages of participating in MDSAP:
Regulators and industry also likes MDSAP because lowers the regulatory burden and accelerates the process of getting medical devices to patients across multiple markets.
The MDSAP audit approach is explained in full detail in MDSAP's 224-page guide.
The audit sequence is designed to be flexible, allowing for adjustments to ensure an efficient and effective audit. Auditors can make justified exceptions to the sequence to optimize audit time and planning, ensuring core elements and risk-based sample selections are respected.
Here's a top-line overview of each broad component of an audit.
(Page 19) The management process audit ensures that internal audits are conducted according to established procedures by trained individuals. It checks the compliance and effectiveness of quality management system (QMS) procedures. The audit team confirms that the output of internal audits is an input to management review, ensuring a loop of continuous improvement.
|
Key audit activities:
|
(Page 51) Auditors review the Measurement, Analysis, and Improvement process early in the audit. They focus on corrective actions resulting from design changes or product nonconformities attributed to design. The audit team considers selecting designs for review, especially those related to identified quality problems.
|
Key audit activities:
|
(Page 37) This part of the audit ensures that the organization has followed proper channels to obtain authorization for device marketing and facility registration. It also checks for evidence of marketing clearance or approval and the notification process for changes to marketed devices or the QMS.
|
Key audit activities:
|
(Page 77) The audit examines the organization’s process for notifying adverse events and advisory notices. It ensures that the procedures are in place and are followed to report incidents effectively and comply with regulatory requirements.
|
Key audit activities:
|
(Page 89) Auditors review the design and development planning, focusing on addressing corrective actions and product nonconformities. They pay special attention to the relationship between identified quality problems and specific aspects of design and development, ensuring that risk control methods are effective.
|
Key audit activities:
|
(Page 116) The audit of this section begins after gathering enough information from the review of core elements in previous sections. It ensures that the production and service processes are well-controlled, monitored, and measured for product conformity.
|
Key audit activities:
|
(Page 157) Auditors assess the planning activities regarding purchased products and outsourced processes. They review the selection and evaluation of suppliers, verification of purchased products, and the top management's commitment to the purchasing process.
|
Key audit activities:
|
(Page 17) These are extraordinary audits not part of the planned audit cycle, used when necessary. They focus on specific elements of the organization’s QMS and may include audits conducted in response to an application for an extension to the scope of certification.
The annexes provide additional detailed information and guidance on specific audit areas, including product/process-related technologies, requirements for sterile medical devices, and adverse events and advisory notices reporting process.
In 2012, the International Medical Device Regulators Forum (IMDRF) initiated the Medical Devices Single Audit Program (MDSAP) to streamline global auditing of medical device manufacturers for enhanced safety. Manufacturers can hire an Auditing Organization to evaluate their Quality Management System annually, aligning with regulations in Australia, Brazil, Canada, Japan, and the U.S. The MDSAP reduces the frequency of audits, with each country interpreting the results based on its laws. Currently, only Canada mandates MDSAP participation for certain classes of medical devices. Audit results are stored in a shared database accessible to all member countries' regulatory authorities.
Participation in the MDSAP is optional in Australia, Brazil, Japan, and the United States, but it's mandatory in Canada for class II, III, and IV medical devices since January 1, 2019, as per the details on the Health Canada website. Manufacturers opting for MDSAP must specify the countries where they market or plan to market their devices in the certification contract. The on-site audit evaluates the manufacturer’s QMS compliance against the regulations of the listed countries.
The MDSAP is a global initiative that unifies quality management system audits for enhanced medical device safety worldwide. It benefits manufacturers aiming to market in its five core countries and two new affiliates, South Korea and Argentina. Participants gain streamlined regulatory approval in these nations and ISO 13485:2016 certification for QMS compliance.
Participation in the MDSAP is optional in Australia, Brazil, Japan, and the United States, but it's mandatory in Canada for class II, III, and IV medical devices since January 1, 2019, as per the details on the Health Canada website. Manufacturers opting for MDSAP must specify the countries where they market or plan to market their devices in the certification contract. The on-site audit evaluates the manufacturer’s QMS compliance against the regulations of the listed countries.
The MDSAP audit criteria encompass the provisions of ISO 13485 and additional requirements from participating regulatory authorities. Manufacturers can tailor the criteria to exclude regulations of countries where they don't intend to market their devices. Thus, the audit criteria combine ISO 13485 and specific regulatory requirements of the countries where the manufacturer operates or plans to enter.
If your company is participating or considering participating in the MDSAP, our experienced auditing professionals can assess your current processes against the MDSAP requirements and help you identify and remediate key areas while training staff to maintain compliance under MDSAP. As an auditing and remediation resourcing organization independent of certification or regulatory bodies, this preparatory audit enables you to assess and remediate your system confidentially.
Our experienced MDSAP auditors use the same MDSAP process-based audit model that the Auditing Organizations (AO) will use to calculate your MDSAP audit score and identify your areas of biggest risk. Many clients choose to include an assessment of their quality system against ISO 13485:2016 and the MDSAP requirements to allow for a more comprehensive evaluation.
We recognize the challenges of developing and managing an effective quality system under the watchful eye of regulators. Our quality system resourcing professionals draw on years of experience and highly specialized skills to ensure objective, accurate, and actionable recommendations are made each step of the way.
Our proprietary talent selection process brings together a diverse array of skill sets, experience, and expertise to offer a truly unique opportunity for companies interested in receiving personal and professional attention.
Contact us today to learn more about our MDSAP auditing and support services.
See how we successfully partnered with a multinational pharmaceutical company to address deviation and CAPA backlogs, implement corrective actions, provide staff training, and achieve the goal of eliminating all backlogs within the allocated time and budget.