GUIDE: MDSAP Chapter 6 Part II, Production and Service Controls
MDSAP Production and Service Controls:
A Complete Guide to Chapter 6 Part II
A Complete Guide to Chapter 6 Part II
Chapter 6 Part II of the MDSAP audit covers Tasks 16 through 29 of the Production and Service Controls process. These tasks span product monitoring and measuring equipment, Device History Records, labelling and packaging, handling storage and distribution, nonconforming product control, servicing, and top management commitment to the production process. Part II is where operational evidence is tested against records, and where open CAPAs, incomplete Device History Records, and handling and distribution gaps generate the most preventable findings. This guide covers every task group in Part II, explains what auditors examine, provides a compliance checklist, and gives compliance and quality teams the preparation framework to close gaps before the auditor arrives.
#1
Source of Grade 3 MDSAP Findings
Open CAPAs older than 6 months are the single most common source of Grade 3 MDSAP nonconformity findings. CAPAs that are raised but not closed, or closed without verified effectiveness, are a direct Task 22-24 failure that every preparation programme must address first.
MD Regulatory: MDSAP Audit Guide 2026
14
Tasks in Chapter 6 Part II
Tasks 16 through 29 of Chapter 6 cover the second half of Production and Service Controls: product monitoring, Device History Records, packaging and labelling, handling, nonconforming product, installation, servicing, and top management commitment.
MDSAP AU P0002.010
Task 29
Top Management Closes the Chapter
Chapter 6 ends with Task 29: top management commitment to the production and service process. The auditor confirms that top management has demonstrated commitment to risk management by ensuring adequate resources, qualified personnel, and review of risk management suitability throughout the production process.
MDSAP AU P0002.010, Ch.6 Task 29
Overview: What Chapter 6 Part II Covers and Why It Matters
MDSAP production and service controls in Part II (Tasks 16-29) are the operational close-out of the production process audit. By the time the auditor reaches Task 16, they have assessed production planning, infrastructure, process validation, software validation, and labelling from Part I. Part II moves into the output end of production: how product is identified when it leaves the production line, what records confirm it was built correctly, how nonconforming product is handled, and whether the organisation’s response to quality problems is systematic and effective.
Part II also contains the two tasks most directly connected to quality system maturity: nonconforming product control (Tasks 18-21) and CAPA (Tasks 22-24). These areas generate a disproportionate share of serious findings because they are where an organisation demonstrates whether it learns from quality events, or whether it processes them and moves on without addressing root causes. Open CAPAs are the leading source of Grade 3 findings in MDSAP audits.
Why Part II findings are more operationally disruptive than Part I findings
Part I findings (process validation, infrastructure gaps) often require technical corrective action, revalidation, maintenance record completion, environmental mapping. Part II findings in nonconforming product and CAPA often require systemic corrective action: retraining, SOP revision, and retrospective review of previously closed events. These systemic corrections are harder to define, harder to verify, and harder to close within the MDSAP CAPA response window.
Prerequisites Before Preparing for Chapter 6 Part II
Complete Chapter 6 Part I before Part II preparation
The MDSAP audit sequence requires Chapter 6 to be audited after Chapters 1, 3, and 5. Within Chapter 6, the auditor works through the task sequence from Task 1 to Task 29. Findings from Part I (infrastructure, process validation, UDI) directly inform which Part II areas the auditor will scrutinise more closely, particularly nonconforming product and CAPA, where Part I deficiencies often manifest as downstream failures.
Close or actively manage all open CAPAs before audit
MD Regulatory’s 2026 MDSAP audit guidance explicitly identifies open CAPAs older than 6 months as the number one source of Grade 3 findings. Before entering Part II preparation, the quality team must review every open CAPA: either close with verified effectiveness evidence, or document the current status and a credible completion timeline. An auditor who finds a CAPA raised 18 months ago still open with no effectiveness check is looking at a potential Grade 3 nonconformity regardless of what Part II records show.
Prepare the data room: complaint logs, CAPA list, DHR samples
Part II auditors draw on complaint logs, CAPA registers, Device History Records for specific lots, nonconforming product records, and servicing records. Before the audit, compile these in a structured data room: the CAPA list with current status, complaint logs for the audit period, DHRs for the device types most likely to be selected, and nonconforming product disposition records. Auditors who cannot access records quickly during a session consume audit time that should be spent on demonstration of conformity.
Train production operators and complaint handlers on audit interaction
MD Regulatory’s guidance specifically calls out production operators and complaint handlers as two groups who need pre-audit briefing on what to say and what not to say during auditor interviews. These workers have direct knowledge of nonconforming product events, CAPA actions, and quality incidents. A worker who gives an honest but contextually incomplete account of a nonconforming product event can generate a finding that accurate documentation review would not have produced.
MDSAP Production and Service Controls Part II: Task-by-Task Requirements
Tasks 16-17: Product Monitoring, Measuring Equipment, and Device History Records
Tasks 18-21: Nonconforming Product Control
Nonconforming product control is one of the most auditor-scrutinised areas in Chapter 6 Part II. Tasks 18 through 21 form a connected sequence that examines how the organisation identifies, documents, evaluates, disposes of, and records decisions about product that does not conform to requirements.
Tasks 22-24: Corrective and Preventive Action (CAPA)
CAPA is the mechanism through which a quality system demonstrates learning. Tasks 22 through 24 examine whether the organisation’s CAPA process actually delivers corrective action that prevents recurrence and preventive action that anticipates problems before they occur. Open CAPAs and CAPAs closed without verified effectiveness are the most cited Chapter 6 Part II gaps.
Tasks 25-27: Handling, Storage, Distribution, and Servicing
Tasks 25-26: Handling and storage preserve product conformance
Tasks 25 and 26 verify that the organisation has defined and implemented methods to prevent damage or deterioration during handling and storage. Storage conditions must be documented and controlled, particularly for temperature-sensitive devices, sterile products, and devices with defined shelf lives. Distribution records must be maintained, traceability from the production lot to the distribution destination. For devices distributed to multiple markets, distribution records must allow all affected product to be rapidly located in the event of a field action. Country-specific requirements exist for Brazil and Japan. Source: MDSAP AU P0002.010, Ch.6 Tasks 25-26; ISO 13485:2016 clause 7.5.11
Task 27: Servicing procedures and records where applicable
Task 27 applies to manufacturers who provide post-market servicing for their devices. Where servicing is a specified requirement, the organisation must have documented servicing procedures. Servicing reports must be maintained, and the organisation must have a process for reviewing servicing reports as a potential source of field feedback, including information that might indicate a product performance issue requiring CAPA or regulatory notification. Servicing records that are maintained as administrative documents without systematic review for quality signals fail Task 27. Source: MDSAP AU P0002.010, Ch.6 Task 27; ISO 13485:2016 clause 7.5.12
Tasks 28-29: Feedback, Installation, and Top Management Commitment
Task 28: Post-market feedback loop confirmed active
Task 28 verifies that the organisation has implemented a post-market feedback system that provides early warning of quality problems and inputs into the CAPA and risk management processes. This includes complaints, returns, servicing reports, and post-market surveillance data. The feedback system must be systematic, a reactive complaint response process does not satisfy this task if there is no periodic trend analysis and no mechanism to translate feedback signals into preventive action. The auditor asks: how does information from the field reach the people who make quality decisions? Source: MDSAP AU P0002.010, Ch.6 Task 28; ISO 13485:2016 clause 8.2.1
Task 29: Top management commitment to the production and service process
Chapter 6 closes with Task 29: confirming that top management has demonstrated commitment to risk management by ensuring provision of adequate resources, assignment of qualified personnel, and review of the suitability of risk management activities throughout the production process. The auditor reviews evidence of top management engagement with production process quality: management review minutes that address production quality data, resource allocation for quality activities, and personnel qualification decisions. A management team that reviews financial metrics but has no documented engagement with production quality findings fails Task 29. This final task is both a standalone assessment and a capstone: if top management has not been engaged with the production process audit trail, the auditor’s picture of the facility’s quality culture is complete. Source: MDSAP AU P0002.010, Ch.6 Task 29; MDSAP Companion Document; ISO 13485:2016 clauses 5.1, 5.6
Chapter 6 Part II Compliance Checklist
Calibration and DHR (Tasks 16-17)
All production measurement equipment calibrated with current certificates
Out-of-calibration equipment removed and impact on prior product assessed
DHR exists for each batch/lot confirming conformance to DMR
Quantity manufactured and released for distribution recorded per batch
Nonconforming Product (Tasks 18-21)
NCP procedure covers identification, segregation, evaluation, disposition, and notification
Concession (use of NCP) documented with written authorisation
Reworked product has re-inspection records in DHR
Post-distribution NCP triggers MDR/advisory notice assessment (linked to Chs. 2 and 4)
CAPA (Tasks 22-24)
No open CAPAs older than 6 months without current status and timeline
Every closed CAPA has documented effectiveness review with evidence
Root cause documented for every CAPA (not just corrective action description)
Preventive action pipeline fed from trend data, not only reactive events
Handling, Servicing, and Top Management (Tasks 25-29)
Storage conditions documented and monitored for controlled products
Distribution records maintained to trace lot to customer destination
Servicing records reviewed periodically for quality signals
Management review records demonstrate top management engagement with production quality data
Troubleshooting: Common Chapter 6 Part II Failures and How to Fix Them
Problem: CAPA closed without effectiveness review
The CAPA procedure defines an effectiveness check, but auditors find CAPAs marked “Closed” where the only evidence of closure is the corrective action description, not evidence that the action prevented recurrence. Fix: revise the CAPA closure checklist to require a mandatory effectiveness evidence field. Define what constitutes effectiveness evidence for different CAPA types: a follow-up audit, a trend chart showing reduction in the nonconformity type, a verification inspection. Retroactively reopen CAPAs closed without this evidence and add the effectiveness documentation before the MDSAP audit.
Problem: Nonconforming product after delivery has no MDR/advisory notice assessment
Quality events involving product already distributed are processed through the CAPA system but not assessed against MDR reporting or advisory notice criteria. Fix: add a mandatory regulatory notification assessment step to every nonconforming product event that involves product in distribution. The assessment must be documented, not just the outcome, but the evaluation: what events were considered, what criteria were applied, and why the determination was made. Link this step explicitly to the MDR procedures and the field action SOP so that a nonconforming product event that reaches Task 21 is automatically evaluated against Chapter 2 and Chapter 4 requirements.
Problem: Calibration programme has expired certificates with no impact assessment
Calibration scheduling is managed but certificates lapse without triggering an impact assessment on product produced during the out-of-calibration period. Fix: build an automatic impact assessment trigger into the calibration management process, when any instrument is identified as out-of-calibration at recall, the system or procedure must require a documented assessment of whether product produced since the last valid calibration date meets specifications. This assessment must be completed before the instrument returns to service, not after.
Problem: Management review does not include production quality performance data
Management review meetings address strategic and financial performance but do not include production quality metrics, CAPA status, nonconforming product rates, or calibration programme status. Task 29 requires top management commitment to the production process to be documented. Fix: add a standing agenda item to management review for production and service controls: CAPA programme status (open count, aging, effectiveness trend), nonconforming product rate, and production process performance trends. Document these discussions in management review minutes with any decisions made and resources allocated.
Key Takeaways
Open CAPAs are the leading source of Grade 3 findings, close them or document them before audit
An open CAPA older than 6 months is not evidence of a working quality system, it is evidence of an unresolved quality problem. Before the MDSAP audit, every open CAPA must be either closed with documented effectiveness evidence or actively managed with a credible completion plan. The auditor’s CAPA review in Task 24 will surface the full open register. What they find there sets the tone for the rest of the Part II review.
Post-distribution nonconforming product must trigger a regulatory notification assessment, not just a CAPA
Task 21 findings generate linked Chapter 2 and Chapter 4 findings when nonconforming product in distribution is handled internally without assessing MDR and advisory notice obligations. This is the most consequential cross-chapter gap in Chapter 6 Part II, a single gap in the nonconforming product procedure produces three simultaneous findings across three chapters.
Chapter 6 Part II ends with top management, and that is intentional
Task 29 is not an administrative closing task. It is the MDSAP programme’s architectural statement: quality is a management responsibility, not a quality department function. After 28 tasks examining the production floor, the auditor’s final Chapter 6 question is whether leadership has been engaged with what those 28 tasks revealed. Management review records that include production quality performance data, CAPA status, and resource allocation decisions are the evidence Task 29 requires. Organisations whose senior leadership is disconnected from production quality data will fail Task 29, and the auditor will know it before they finish Chapter 6.
Frequently Asked Questions
What does Chapter 6 Part II of MDSAP cover?
Chapter 6 Part II covers Tasks 16 through 29 of the Production and Service Controls process: monitoring and measuring equipment and calibration (Task 16), Device History Records (Task 17), nonconforming product control (Tasks 18-21), CAPA (Tasks 22-24), handling, storage, and distribution (Tasks 25-26), servicing (Task 27), post-market feedback (Task 28), and top management commitment to the production and service process (Task 29). Source: MDSAP AU P0002.010
Why are open CAPAs the most common Grade 3 MDSAP finding?
An open CAPA represents a documented quality problem that the organisation has acknowledged but not resolved. Under the MDSAP nonconformity grading scheme, a CAPA that has been open for more than 6 months without a credible completion plan indicates that the corrective action system is not functioning effectively, a significant QMS failure. The MDSAP audit examines not just whether CAPAs exist, but whether the CAPA process results in effective corrective actions that prevent recurrence. A backlog of open, unresolved CAPAs directly undermines the demonstration that the QMS is capable of addressing quality problems. Source: MD Regulatory MDSAP Audit Guide 2026
What is the difference between corrective action and preventive action in MDSAP Tasks 22-23?
Corrective action (Task 22) responds to an actual nonconformity: a quality event has occurred, the root cause is determined, and action is taken to prevent recurrence. Preventive action (Task 23) is initiated before a failure occurs: trend data, risk analysis, complaint patterns, or internal audit findings indicate a potential nonconformity, and action is taken to address the root cause of the potential problem before it materialises. ISO 13485:2016 requires both. Organisations that have corrective action programmes but treat preventive action as a philosophical concept rather than a documented process with initiated actions fail Task 23. Source: MDSAP AU P0002.010, Ch.6 Tasks 22-23; ISO 13485:2016 clauses 8.5.2-8.5.3
What does “effectiveness review” mean for a CAPA under Task 22?
An effectiveness review is evidence-based confirmation that the corrective action taken actually prevented recurrence of the nonconformity. It is not a declaration by the quality manager that the action was appropriate. Effectiveness evidence must show that the condition that led to the nonconformity has been measured or observed after the corrective action and found to have improved. Examples: a follow-up audit showing no recurrence of the cited condition; a trend chart showing that the nonconformity type declined after the action was implemented; an inspection record confirming that a corrected process step is now being performed as required. Effectiveness reviews should be conducted after a defined verification period, typically 30 to 90 days after implementation, depending on the severity of the CAPA.
When does a post-distribution nonconforming product event require an MDR report or advisory notice?
Task 21 requires assessment of nonconforming product already delivered to determine what action is appropriate given the actual or potential effects of the nonconformity. If the nonconformity may have caused or contributed to a death or serious injury, or if a malfunction would be likely to cause serious harm if it recurred, an MDR report to the FDA is required under 21 CFR Part 803. If the nonconformity requires a corrective field action, whether or not a patient was harmed, an advisory notice may be required to Health Canada, TGA, ANVISA, or MHLW depending on the markets where the device is distributed. The regulatory notification assessment must be documented as part of the nonconforming product disposition record, not handled separately or verbally. Source: 21 CFR Part 803; MDSAP AU P0002.010 Chapter 2 Task 3 and Chapter 4 Task 1
What does the MDSAP auditor examine for Task 29 (top management commitment)?
Task 29 asks the auditor to confirm that top management has demonstrated commitment to risk management throughout the production process by ensuring adequate resources and qualified personnel. The auditor reviews management review meeting records for evidence that top management was presented with production quality performance data, CAPA status, nonconforming product rates, and risk management findings, and that management made documented decisions in response. Verbal assurances that management is engaged are insufficient. The auditor looks for records: management review minutes referencing production quality data, resource allocation decisions for quality activities, and management approval of risk management policies for the production process. Source: MDSAP AU P0002.010, Ch.6 Task 29; MDSAP Companion Document
How does Chapter 6 Part II connect to other MDSAP chapters?
Chapter 6 Part II has direct audit linkages to three other chapters. Task 12 links to Chapter 1 (Management) for training records of employees whose activities contributed to process nonconformities. Task 21 links to Chapter 2 (Marketing Authorization) and Chapter 4 (Adverse Events) for regulatory notification of nonconforming product already distributed. Task 24 (CAPA review) links to Chapter 3 (Measurement, Analysis and Improvement) where complaint handling and CAPA are primarily audited. These linkages mean that a finding in one chapter often creates or reveals a finding in another. The auditor’s Chapter 6 Part II review is informed by what they found in Chapters 1, 3, 4, and 5, and any Part II finding may trigger re-examination of a related area in those chapters.
Sources
Government and Regulatory Sources
- MDSAP AU P0002.010: MDSAP Audit Approach (February 2026): primary audit approach document; Chapter 6 table of contents confirming Tasks 16-29 scope, task descriptions for nonconforming product control (Tasks 18-21), CAPA (Tasks 22-24), handling and storage (Tasks 25-26), and top management commitment (Task 29).
- FDA CDRH: MDSAP Production and Service Controls Part 2 Training: FDA training slides covering Tasks 12-17 of Chapter 6 Part II, including calibration requirements (Task 13/16), Device History Record requirements (Task 17), and country-specific requirements for Brazil and the US.
- 21 CFR Part 803: Medical Device Reporting: FDA MDR requirements that apply when post-distribution nonconforming product events (Task 21) meet the reporting threshold for death, serious injury, or malfunction under the MDR regulation.
- MDSAP G0002.1004 Companion Document: supplementary MDSAP guidance confirming Task 29 requirements for top management commitment to production risk management, including adequate resource provision and assignment of qualified personnel.
Industry Sources
- MD Regulatory: MDSAP Audits, No More Secrets (2026): source for open CAPAs older than 6 months as the number one source of Grade 3 findings; preparation guidance for production operator and complaint handler briefing before MDSAP audit; data room preparation guidance.
- UL Solutions: Key Considerations for a Successful MDSAP Audit: description of the Chapter 6 Part II scope including complaint handling, CAPA, nonconforming materials, and post-market surveillance as core processes; MDSAP nonconformity grading scheme (Grade 1-5) and CAPA response requirements.
Related VelSafe Articles
Insights
MDSAP Production Controls: Where Audit Findings Hide
Evidence analysis of Chapter 6 Part I, why production controls generate the most MDSAP findings and what compliance leaders consistently underestimate about the first 15 tasks.
Situational
MDSAP Chapter 4: What 14 Missed Reports Cost One Facility
Case study showing how post-distribution nonconforming product events (Chapter 6 Task 21) that were not assessed for MDR reporting generated simultaneous Chapter 4 findings, exactly the multi-chapter gap this guide addresses.
Guides
21 CFR Part 803: Medical Device Reporting Requirements
The complete FDA MDR guide, covering the 30-day, 10-day, and 5-day reporting obligations that apply when Chapter 6 Task 21 nonconforming product events meet the MDR reporting threshold.
MDSAP PRODUCTION CONTROLS GUIDE LIBRARY
Is Your Chapter 6 Part II Audit-Ready?
Explore VelSafe’s MDSAP compliance library, guides, insights, and regulatory analysis covering all 29 Chapter 6 tasks and all seven MDSAP chapters.
Explore All Guides
