INSIGHTS: MDSAP Chapter 6, Part I
MDSAP Production Controls: What Chapter 6
Reveals About Where Most Audit Findings Hide
Reveals About Where Most Audit Findings Hide
MDSAP Chapter 6 has 29 audit tasks and covers everything that happens between design transfer and product release. It is the longest chapter in the programme and, by most accounts, the one where audit findings concentrate. Part I of Chapter 6 spans Tasks 1 through approximately 15, covering production planning, process controls, infrastructure, work environment, process validation, sterilisation process validation, software validation, identification and traceability, and labelling. This analysis examines what the data on production and service control findings shows, why certain Chapter 6 tasks generate disproportionate findings, and what compliance leaders at MDSAP-certified facilities consistently underestimate about this chapter.
29
Audit Tasks in Chapter 6
MDSAP Chapter 6 has 29 tasks, the most of any chapter in the programme. Production and Service Controls covers infrastructure, process validation, sterilisation, software validation, identification and traceability, labelling, non-conforming product, and post-market servicing.
UL Solutions: Key MDSAP Audit Considerations
90
Total MDSAP Audit Tasks
The full MDSAP audit programme spans 90 tasks across seven chapters. Chapter 6 alone accounts for 32% of all tasks. A facility that prepared for its Chapter 6 audit with the same depth it prepared for Chapter 5 will not have prepared enough.
MD Regulatory: MDSAP Audit Checklist (2026)
4th
Chapter Audited in the MDSAP Sequence
Chapter 6 is audited fourth in the MDSAP sequence, after Management, Measurement Analysis and Improvement, and Design and Development. By the time the auditor reaches Chapter 6, they have already formed a picture of the facility’s quality system maturity from the first three chapters.
MDSAP AU P0002.010 Audit Approach
Key Statistics: What the Data Shows About Chapter 6 Findings
32%
of all MDSAP tasks are in Chapter 6
29 of 90 total MDSAP audit tasks are in the Production and Service Controls chapter. This proportional weight means Chapter 6 is not one process among seven, it is the dominant process in the audit. Source: MD Regulatory MDSAP Audit Checklist 2026
Top 3
Most cited QMS non-conformity types globally
WHO prequalification data and global QMS inspection analysis identifies product realization (Chapter 6 equivalent), resource management, and measurement and improvement as the three chapters generating the most non-conformities in absolute numbers. Source: WHO Prequalification QMS Hybrid Meeting, Dec 2024
6 months
Lead time for Stage 1 audit booking with major AOs
Major Auditing Organisations including BSI, DEKRA, TUV SUD, DNV, and Intertek are reporting Stage 1 booking lead times exceeding 6 months. Chapter 6 preparation, which requires evidence of process validations, infrastructure records, and UDI systems, is typically the longest preparation pathway. Source: MD Regulatory MDSAP Audit Guide, 2026
ISO 7.5
Primary ISO 13485 clause for Chapter 6
ISO 13485:2016 clause 7.5 (Production and Service Provision) is the primary clause for most Chapter 6 Part I tasks. Sub-clauses 7.5.1 through 7.5.5 cover controlled conditions, cleanliness, installation, servicing, and particular requirements for sterile devices. Source: MDSAP AU P0002.010
What the Data Shows
DATA
WHO prequalification joint meeting data (December 2024) covering global QMS inspection outcomes identifies product realization, the ISO 13485 equivalent of Chapter 6, as generating the most non-conformities in absolute numbers, ahead of resource management and measurement and improvement. Risk assessment incomplete or inappropriate, environmental conditions not mapped, inadequate monitoring and sampling, trending of processes, data integrity issues, and training gaps after extended leave are explicitly listed as the most common non-conformity examples. Source: WHO Prequalification QMS Non-Conformity Data, December 2024
INTERPRETATION
Product realization dominates non-conformity counts because it is where the QMS meets the physical product. Every other MDSAP chapter, management, design, adverse event reporting, purchasing, operates at a level of abstraction removed from the production line. Chapter 6 does not. It examines whether the facility actually controls what it claims to control, in the building where production happens, on the equipment in use today.
WHY IT MATTERS
For compliance leaders, the implication is uncomfortable: the chapter most likely to generate findings is also the one most commonly under-resourced in audit preparation. Facilities that invest disproportionately in regulatory affairs preparation for Chapter 2 (marketing authorization) while treating Chapter 6 as a production matter leave the largest gap in the most consequential area of the audit.
DATA
UL Solutions’ MDSAP audit preparation guidance identifies Chapter 6 as covering “everything that goes into manufacturing devices” including infrastructure, work environment, production process validations, production quality control testing, storage, identification and traceability, handling of non-conforming materials, and sales. The firm notes that Chapter 6 findings are among the most operationally disruptive, because corrective actions frequently require production process re-validation, which can delay distribution of affected products. Source: UL Solutions: Key Considerations for Successful MDSAP Audit
INTERPRETATION
Production process re-validation is not a paperwork exercise. Depending on the process and the device, it can take weeks to months and may require product already produced to be quarantined or destroyed pending revalidation results. A Chapter 6 Major finding in process validation is therefore not only an audit event, it is potentially a supply continuity event with direct patient access implications.
WHY IT MATTERS
Compliance leaders who treat process validation as a one-time activity at device launch, rather than a maintained, periodically re-evaluated programme, are exposed on two fronts: the MDSAP audit will surface the gap, and the practical consequence of the CAPA is production disruption. The same failure that generates the finding generates the market impact.
MDSAP Production Controls Chapter 6 Part I: Task Groups
Chapter 6 Part I spans Tasks 1 through approximately 15 in the MDSAP audit sequence, covering the foundational production control requirements before the chapter moves into traceability, non-conforming product, and post-market service controls in Part II. Each task group below represents what auditors examine in the first half of the Chapter 6 review.
Tasks 1-4: Production Planning and Process Control
Task 1-2: Planning and process selection
Task 1 covers planning of the production and service process. Task 2 requires the auditor to select one or more production and service processes to examine in detail. The auditor verifies that selected processes are planned and conducted under controlled conditions including the availability of information describing product characteristics, documented procedures and work instructions, reference materials, criteria for workmanship, suitable equipment, and monitoring and measuring devices. Controlled conditions also include the implementation of labelling and packaging operations, release activities, and delivery and post-delivery activities. ISO 13485:2016 clause 7.5.1 governs these tasks. Source: MDSAP Ch.6 Part I Training Slides, Tasks 1-2
Tasks 3-4: Control of production process implementation
Tasks 3 and 4 go deeper into the selected production processes. The auditor verifies that processes are implemented as documented and that records confirm the results meet requirements. Task 4 examines whether the production and service process implementation at the facility meets the requirements established during design transfer, creating a direct link between Chapter 6 and Chapter 5 Task 16 (design transfer). A production process that has drifted from the validated process without change control records fails both chapters simultaneously. Source: MDSAP Ch.6 Part I Training Slides, Tasks 3-4
Tasks 5-6: Infrastructure and Work Environment
Task 5: Infrastructure requirements determined and maintained
Task 5 verifies that the organisation has determined and documented infrastructure requirements including buildings, workspace, process equipment, and supporting services, and that buildings, workspaces, and supporting services allow product to meet requirements. Where process equipment maintenance is important for product quality, documented maintenance requirements and maintenance records must exist. This is a broader requirement than many facilities realise: an HVAC system, a controlled environment room, a calibration schedule, and a cleaning programme are all infrastructure components. Undocumented infrastructure that is critical to product quality is a Task 5 finding. There are Brazil-specific ANVISA requirements for this task. Source: MDSAP Ch.6 Training, Task 5; ISO 13485:2016 clause 6.3
Task 6: Work environment controlled where it affects product quality
Task 6 examines whether the facility has determined and managed work environment conditions that can have an adverse effect on product quality. This includes the health, cleanliness, and clothing of personnel; monitoring and controlling environmental conditions; training or supervision of personnel working under special environmental conditions; and controlling contaminated or potentially contaminated product including returned products. The WHO non-conformity data explicitly identifies “environmental conditions of infrastructure not mapped” as one of the most common findings in product realization. Facilities that have a cleanroom protocol but no documented evidence that environmental parameters were monitored during production of specific lots fail this task. Source: MDSAP Ch.6 Training, Task 6; ISO 13485:2016 clause 6.4
Tasks 7-9: Process Validation and Sterilisation
Task 7-8: Processes subject to validation identified and validation completed
Task 7 requires the organisation to have identified which production and service processes require validation, specifically processes where the output cannot be verified by subsequent monitoring or measurement. Common examples include sterilisation, cleanroom environment monitoring, aseptic filling, welding, and software-controlled process steps. Task 8 verifies that validation was performed for those processes. Validation must establish criteria for equipment qualification, process qualification, and the repeatability of the process. Records must show that the validation was completed and approved before routine production. A process identified as requiring validation that has no validation records is a Major Chapter 6 finding. Source: MDSAP AU P0002.010, Ch.6 Tasks 7-8; ISO 13485:2016 clause 7.5.6
Task 9: Sterilisation process validation completed for sterile devices
Task 9 applies specifically to manufacturers of sterile devices and addresses sterilisation process validation in detail. The task goes beyond Task 8’s general validation requirement to examine the specific requirements of applicable sterilisation standards and the validated parameters under which sterile production occurs. Country-specific requirements apply for Australia (TGA), Canada (Health Canada), Japan (MHLW), and the US (FDA QMSR). A sterile device manufacturer whose sterilisation validation references a superseded version of the relevant standard may fail Task 9 even if the validation itself was sound, because the standard reference must be current. Source: MDSAP AU P0002.010, Ch.6 Task 9; ISO 13485:2016 clause 7.5.7
Tasks 10-11: Software Validation and UDI
Task 10: Software used in production and service validated
Task 10 requires validation of computer software used in production and service that can affect product quality. This is broader than many facilities appreciate: it includes manufacturing execution systems (MES), quality management database software, automated inspection systems, laboratory information management systems (LIMS), and enterprise resource planning (ERP) systems where they are used to control production or release decisions. The auditor reviews software validation documents and records, assessing systems most likely to affect the finished device’s ability to meet specified requirements. An ERP system used to manage lot release without documented software validation records is a Task 10 finding. Source: MDSAP Ch.6 Part 2 Training, Task 15 (software); ISO 13485:2016 clause 7.5.6
Tasks 11-12: Product identification and UDI requirements
Chapter 6 Tasks 11 and 12 address product identification throughout the production process and Unique Device Identification (UDI) requirements. All devices distributed in the US, Canada, and Australia require UDI labelling under applicable regulations. The auditor verifies that UDI assignments are current, that UDI information has been submitted to applicable databases (FDA GUDID for US; Health Canada UDI database for Canada), and that UDI labelling on product matches the registered information. A label with a mismatched UDI, an expired GUDID registration, or a missing Canadian UDI database submission is a direct Chapter 6 finding with simultaneous Chapter 2 implications. Source: MDSAP AU P0002.010, Ch.6 Tasks 11-12; 21 CFR Part 830
Tasks 13-15: Traceability, Device Master Record, and Labelling
Task 13-14: Traceability requirements established and maintained
Task 13 verifies that the organisation has determined the extent of traceability required, based on the risk posed by the device if it were to require a field action. Higher-risk devices require more granular traceability, to individual components, suppliers, and production records. Task 14 requires the Device Master Record (DMR) to be established and maintained for each type of device. The DMR must include or reference device specifications, production process specifications, quality assurance procedures, traceability requirements, packaging and labelling specifications, and installation and servicing requirements where applicable. An organisation that cannot produce a complete, current DMR for the device type selected by the auditor fails Task 14 regardless of how well individual production records are maintained. Source: MDSAP Ch.6 Part 2, Task 16; ISO 13485:2016 clause 4.2.3
Task 15: Labelling requirements met for each MDSAP jurisdiction
Task 15 examines whether labelling meets the applicable regulatory requirements for each MDSAP jurisdiction where the device is distributed. Labelling errors are described in industry guidance as among the most common triggers for MDSAP findings, specifically because the jurisdiction-specific requirements for Canada, Australia, Brazil, Japan, and the US differ in format, language, required symbols, and mandatory statements. A label that satisfies FDA requirements but omits mandatory French-language text for Canada, or that uses a symbol not approved under ISO 15223-1, can generate a finding under this task. MD Regulatory’s MDSAP guidance explicitly identifies “labelling errors can trigger serious nonconformities” as a key preparation warning. Source: MD Regulatory MDSAP Audit Guide 2026; ISO 13485:2016 clause 7.5.2
What This Means for Compliance Leaders
Chapter 6 preparation must start from the MDSAP task list, not the ISO clause list
Most facilities organise their internal audits around ISO 13485:2016 clauses. MDSAP auditors follow the Chapter 6 task sequence, not the clause sequence. The result is that facilities with strong ISO audit programmes can still generate Chapter 6 findings when they have not mapped their documentation to the MDSAP task structure. Preparation that mirrors the MDSAP task sequence, not the ISO clause sequence, is the single most impactful change a facility can make to its Chapter 6 readiness. MD Regulatory’s 2026 guidance confirms this explicitly.
Process validation is a maintained programme, not a launch-time document
Chapter 6 Tasks 7 and 8 require current, complete validation records for processes whose outputs cannot be verified by subsequent monitoring. Validation conducted at device launch but never re-evaluated after process changes, equipment replacements, or supplier changes is not current validation. The MDSAP auditor will ask: has this process changed since it was validated, and if so, has revalidation been conducted? Facilities that cannot answer this with records fail Tasks 7-8, regardless of how thorough the original validation was.
Labelling compliance is a multi-jurisdiction audit task, not a single label review
Task 15 examines labelling for each jurisdiction where the device is distributed. A facility distributing to the US, Canada, and Australia is simultaneously subject to FDA labelling requirements, Health Canada mandatory bilingual label requirements, and TGA applicable standard requirements. Labels reviewed by regulatory affairs for one market may not have been reviewed for another. A matrix review approach, mapping each label element against each jurisdiction’s requirements, is the only systematic way to prevent Task 15 findings for multi-market distributors.
The auditor’s picture of your facility is formed before they reach Chapter 6
Chapter 6 is audited fourth in the MDSAP sequence. By the time the auditor reaches production controls, they have already formed a picture of the facility’s quality system maturity from Chapter 1 (management), Chapter 3 (measurement and improvement), and Chapter 5 (design and development). Findings in those chapters create a lens through which Chapter 6 evidence is interpreted. A facility with multiple Minor findings in Chapters 1-5 entering Chapter 6 is an auditor who is already looking more closely. Strong Chapter 1-5 performance is not separate from Chapter 6 readiness, it is part of it.
What Is Driving the Trend: Chapter 6 Part I Finding Risk Profile
Key Takeaways
Chapter 6 generates more findings than any other MDSAP chapter, because production is where the QMS meets the physical product
Abstract quality system documentation is tested against reality in Chapter 6. Does the work instruction match what operators actually do? Is the environment actually controlled to the documented parameters? Is the validation still valid after the changes made six months ago? The WHO non-conformity data and industry guidance converge on product realization as the highest-volume finding area precisely because it is where documentation claims are verified against physical evidence.
Process validation failures are the most operationally disruptive Chapter 6 findings
When a Chapter 6 process validation finding is issued, the CAPA typically requires revalidation before production can continue or product can be released. For a sterile device manufacturer, this can mean weeks of production hold. For a facility with a multi-step validation programme, it can mean months. The finding that takes an auditor ten minutes to issue can take a compliance team six months to close. This asymmetry is the reason process validation maintenance is a programme management priority, not a document management task.
The counterintuitive finding: Chapter 6 audit preparation is primarily an operations responsibility, not a regulatory affairs responsibility
Most MDSAP audit preparation programmes are led by regulatory affairs. Chapter 6 findings are generated by conditions on the production floor: an unmapped environmental parameter, a work instruction that no longer matches practice, a validation not updated after an equipment change, a software system without validation records. These conditions are controlled by operations and quality, not regulatory affairs. Compliance leaders who do not have a direct reporting relationship with production operations during Chapter 6 preparation are preparing for the wrong chapter. The preparation conversation for Chapter 6 belongs in the production area, with the people who run the processes.
Frequently Asked Questions
What does MDSAP Chapter 6 Production and Service Controls Part I cover?
Chapter 6 Part I covers Tasks 1 through approximately 15 of the 29-task Production and Service Controls chapter. Task groups include production planning and process controls (Tasks 1-4), infrastructure and work environment (Tasks 5-6), process validation and sterilisation validation (Tasks 7-9), software validation and UDI identification (Tasks 10-12), and traceability, Device Master Record, and labelling requirements (Tasks 13-15). These tasks cover every foundational control from production setup through product identification and labelling for each MDSAP jurisdiction. Source: MDSAP AU P0002.010
Why does Chapter 6 generate the most MDSAP findings?
Chapter 6 has the most tasks (29 of 90) and covers the manufacturing operations where documentation claims are verified against physical reality. WHO non-conformity data from December 2024 identifies product realization, the ISO 13485 equivalent, as generating the most non-conformities in absolute numbers across global QMS inspections. The findings concentrate here because this is where abstract quality system documentation meets the production floor: process drift, unmapped environmental parameters, outdated validations, and labelling gaps cannot be corrected with document revisions alone.
Which processes require validation under MDSAP Chapter 6 Tasks 7-8?
Any production or service process where the output cannot be verified by subsequent monitoring or measurement requires validation. Common examples include sterilisation, aseptic filling, lyophilisation, welding, cleanroom monitoring, potting and encapsulation, soldering, heat sealing, and any software-controlled process step where the software decision cannot be independently verified by inspection of the finished product. The organisation is responsible for identifying its own validation-required processes, and must be able to demonstrate that identification was systematic, not ad hoc. A process that meets the criteria for validation that has not been identified or validated is a Major finding. Source: MDSAP AU P0002.010, Ch.6 Task 7; ISO 13485:2016 clause 7.5.6
What software must be validated under Chapter 6 Task 10?
Any computer software used in production and service that can affect product quality must be validated. This includes manufacturing execution systems (MES), laboratory information management systems (LIMS), enterprise resource planning (ERP) systems used to control or release production, automated inspection systems, process control software, and quality management database software where it is used to make or document release decisions. The scope is broader than many facilities assume, a spreadsheet used to calculate batch yields or release limits is software that affects product quality and requires validation documentation, including evidence of version control and testing of the calculation logic. Source: MDSAP Ch.6 Part 2 Training; ISO 13485:2016 clause 7.5.6
What UDI requirements does Chapter 6 audit for Canadian and Australian markets?
For Canada, UDI requirements under Health Canada’s Medical Device Regulations require submission of UDI information to the Canadian UDI Database (CUD). The auditor verifies that UDI assignments are current and that the CUD submission is complete for devices distributed in Canada. For Australia, TGA has implemented UDI requirements aligned with the International Medical Device Regulators Forum (IMDRF) UDI guidance. The auditor verifies that ARTG-listed devices carry compliant UDI labelling and that UDI information has been submitted as required. Labelling that meets FDA GUDID and 21 CFR Part 830 requirements but has not been assessed for Canadian or Australian UDI requirements is a Task 11-12 finding for multi-market distributors.
What is a Device Master Record and what must it include under Chapter 6 Task 14?
The Device Master Record (DMR) is a compilation of records or references to records containing the design basis and manufacturing specifications for a device type. Under Chapter 6 Task 14, the DMR must include or reference: device specifications including drawings, composition, formulation, component specifications, and software specifications; production process specifications including equipment, production methods, production procedures, and production environment; quality assurance procedures and specifications; device packaging and labelling specifications; and installation, maintenance, and servicing procedures where applicable. The DMR must be established for each type of device, not each device unit or lot. An organisation that maintains these records in separate systems without a linking DMR document that identifies and locates all components fails Task 14. Source: MDSAP Ch.6 Part 2 Training, Task 16; ISO 13485:2016 clause 4.2.3
How should a facility prepare for Chapter 6 if it has been preparing using ISO 13485 clause-based internal audits?
Remap the internal audit programme to the MDSAP Chapter 6 task sequence before the next MDSAP audit. The MDSAP AU P0002.010 document (available at mdsap.global) lists each Chapter 6 task with its audit objective, ISO 13485 clause reference, and jurisdiction-specific requirements. MD Regulatory provides a free Excel MDSAP audit checklist covering all 90 tasks across all seven chapters. Run at minimum one internal audit using the task-based checklist before the MDSAP audit. Areas most likely to surface gaps during this remapping: process validation currency, software validation coverage, UDI database compliance for non-US markets, and environmental monitoring documentation. Source: MD Regulatory MDSAP Audit Guide 2026
Sources
Government and Regulatory Sources
- MDSAP AU P0002.010: MDSAP Audit Approach (February 2026): primary audit approach document; Chapter 6 table of contents confirming 29 tasks, task structure for Production and Service Controls, and ISO 13485:2016 clause references for each task group including 7.5.1, 7.5.6, 7.5.7, 4.2.3, and 6.3.
- FDA CDRH: MDSAP Production and Service Controls Part I Training Slides: FDA training slides for Chapter 6 Part I Tasks 1-10, including controlled conditions requirements (Task 2), infrastructure (Task 5), work environment (Task 6), process validation identification (Task 7), and sterilisation validation (Task 9).
- FDA CDRH: MDSAP Production and Service Controls Part II Training: transcript covering software validation (Task 15 in Part 2), Device Master Record requirements (Task 16 in Part 2), and traceability requirements from the MDSAP audit approach.
- WHO Prequalification: QMS Non-Conformity Data, Hybrid Joint Meeting, December 2024: data identifying product realization (Chapter 6 equivalent) as the leading source of non-conformities in absolute numbers across global QMS inspections; common examples listed include environmental conditions not mapped, inadequate monitoring and trending, data integrity issues, and training gaps.
Industry Sources
- UL Solutions: Key Considerations for a Successful MDSAP Audit: description of Chapter 6 scope covering infrastructure, work environment, process validations, quality control testing, storage, identification and traceability, non-conforming materials, and sales; operational disruption of process validation CAPAs noted.
- MD Regulatory: MDSAP Audits, No More Secrets (2026): source for 90 total task count, 6-month AO booking lead times, labelling errors as a common serious non-conformity trigger, and the recommendation to remap internal audits from ISO 13485 clause structure to MDSAP task structure.
Related VelSafe Articles
Law
MDSAP Design and Development: Legal Requirements
The Chapter 5 law explainer covering all 17 design and development audit tasks, including design transfer (Task 16) and the change control linkage that directly precedes Chapter 6 production process controls.
Situational
MDSAP Chapter 4: What 14 Missed Reports Cost One Facility
A case study in MDSAP Chapter 4 adverse event reporting failures, showing how production process gaps in Chapter 6 can feed directly into Chapter 4 findings when device malfunctions go unreported.
Worker Safety
MDSAP Chapter 2: What Every Worker Needs to Know
The worker guide to Chapter 2 device marketing authorization and facility registration, including how Chapter 6 labelling errors and change control gaps in production create simultaneous Chapter 2 advisory notice obligations.
MDSAP PRODUCTION CONTROLS INSIGHTS
Is Your Chapter 6 Preparation Covering All 29 Tasks?
Explore VelSafe’s MDSAP insight and compliance library for evidence-based analysis across all seven MDSAP chapters, from management and design development through production controls and purchasing.
Explore All Insights
