SITUATIONAL: MDSAP Chapter 4, Adverse Events and Advisory Notices
The Audit That Found 14 Unreported Adverse Events:
What Went Wrong and What Every Facility Must Fix
What Went Wrong and What Every Facility Must Fix
A mid-size infusion pump manufacturer with distribution in the US, Canada, and Australia entered their annual MDSAP audit confident their quality system was sound. Eighteen months earlier they had passed with only minor findings. This time, the auditor reviewed their complaint files against their MDR event records and found a gap: 14 complaints involving pump alarms and unplanned therapy interruptions had been evaluated for reportability, determined not reportable, and filed, but the evaluation records were missing the written rationale required under 21 CFR 803.18. Three events that should have triggered 30-day MDR reports to the FDA had not been reported at all. And one field correction, a software update already pushed to 340 devices, had not been reported to Health Canada as an advisory notice. The auditor graded two Major findings. This is what happened, what drove it, and what the facility had to fix.
96%
Rise in FDA Warning Letters 2023 to 2024
FDA issued 47 medical device warning letters in fiscal year 2024, a 96% increase from 24 in 2023. MDR-related deficiencies were among the most common findings alongside CAPA failures and design control violations.
MedDeviceGuide FDA MDR Analysis 2026
2
MDSAP Chapter 4 Audit Tasks
Chapter 4 has exactly two tasks: Task 1 covers adverse event notification to regulatory authorities, and Task 2 covers advisory notice reporting. A Major finding in either task requires a CAPA plan and can threaten the facility’s MDSAP certificate.
MDSAP Audit Approach Document
30 days
Standard MDR Reporting Window
Manufacturers must report a death or serious injury within 30 calendar days of becoming aware of the event. A 5-working-day window applies when remedial action is needed to prevent unreasonable public health risk.
21 CFR Part 803
The Scenario: What the Auditor Found on Day Two
The MDSAP Chapter 4 adverse events audit at a mid-size infusion pump manufacturer began as a routine supporting process review, a two-task chapter that rarely generates major findings at facilities that have been through the programme before. The Auditing Organisation had scheduled approximately three hours for Chapter 4. By the end of hour two, the auditor had graded two Major findings.
The facility manufactured volumetric infusion pumps distributed in the US, Canada, and Australia. They had approximately 4,200 units in the field. Their complaint intake volume averaged 22 complaints per month. Their QMS included written MDR procedures, a designated MDR decision-maker in the regulatory affairs team, and a complaint management database.
The conditions that made this audit go wrong
The facility had processed 264 complaints in the 12 months under audit review. Of those, the MDR decision-maker had evaluated 41 for reportability. 38 were determined not reportable. 3 were submitted as 30-day MDR reports to the FDA. The auditor’s concern was not the numbers, it was what was missing from the records. The non-reportable determination files contained a checkbox outcome but no written rationale. The three submitted reports had event files. The 38 non-reportable determinations did not. And a software field correction completed four months earlier had no advisory notice record for Health Canada at all.
Timeline: How the Gaps Accumulated
Month 1
New MDR decision-maker appointed
The previous regulatory affairs manager who owned the MDR programme left the company. A quality engineer with device regulatory experience was appointed as the interim MDR decision-maker. No formal handover documentation was completed. The new decision-maker was unaware that the facility’s written MDR procedures required a written rationale for every non-reportable determination, not just a checkbox in the complaint database.
Months 2-8
38 non-reportable determinations made with checkbox only
The interim decision-maker processed complaints and evaluated each for reportability using the complaint database. The outcome was recorded as “Not Reportable” in the database field. No written rationale was attached to any of the 38 files. The decision-maker considered the database entry to be sufficient, consistent with how complaint records had been managed in other parts of the quality system.
Month 9
Three complaints evaluated not reportable, but should have been 30-day MDRs
Among the 38 non-reportable determinations, three described events where a patient had experienced an unplanned therapy interruption requiring nursing intervention to restart the infusion. The interim decision-maker classified these as “service events” rather than adverse events requiring medical intervention, a classification inconsistent with FDA’s definition of serious injury under 21 CFR 803.3. These events should have generated 30-day MDR reports. They did not.
Month 11
Software field correction pushed to 340 devices, no advisory notice submitted to Health Canada
Engineering identified a software defect that could cause incorrect dose calculation under specific programming sequences. A field correction was initiated. A software update was pushed to all 340 affected devices in the Canadian market over a three-week period. The regulatory affairs team submitted a voluntary recall report to the FDA under 21 CFR Part 806. They did not submit an advisory notice to Health Canada under the Medical Devices Regulations. The field correction qualified as an advisory notice under Canadian requirements, it was a corrective action taken in respect of a device that could harm a patient if used.
What Went Wrong: Root Causes
Root Cause 1: Personnel transition without procedure handover
The MDR programme’s institutional knowledge lived in one person’s head. When that person left, the procedural requirements for MDR event files, specifically the written rationale requirement under 21 CFR 803.18, did not transfer. A quality system that depends on personnel memory rather than documented procedures is fragile by design. The written MDR procedures existed. They were not read before the new decision-maker began processing complaints.
Root Cause 2: Misapplication of the “serious injury” definition
The three events that should have generated 30-day MDR reports were misclassified because the decision-maker applied a lay interpretation of “serious” rather than the regulatory definition. Under 21 CFR 803.3, a “serious injury” includes any injury or illness that requires medical or surgical intervention to preclude permanent impairment. A nursing intervention to restart an interrupted infusion meets this threshold, it is medical intervention, regardless of whether the patient was ultimately harmed. The decision-maker’s rationale (“no patient harm occurred”) is the wrong test. The correct test is whether medical intervention was required.
Root Cause 3: Jurisdiction-specific advisory notice requirements not embedded in the field action process
The facility had a field correction SOP that included a step for FDA Part 806 voluntary recall reporting. It did not include a parallel step for Health Canada advisory notice submission. MDSAP Chapter 4 Task 2 requires the organisation to have a process for identifying when advisory notices must be reported to regulatory authorities and for completing those reports within the applicable timeframes. The Canadian requirement was not mapped into the process. As a result, the regulatory affairs team completed the FDA-facing actions and considered the field correction closed.
Root Cause 4: Internal audit did not cover MDSAP Chapter 4 controls
The facility conducted quarterly internal audits. None of the quarterly audit schedules in the 12-month period under review had included a specific check of MDR event file completeness against the 21 CFR 803.18 written rationale requirement. Had one internal audit reviewed a sample of non-reportable determination files, the missing rationale documentation would have been identified and corrected before the MDSAP auditor arrived.
Regulatory Failures: What Was Violated and How
| Requirement | Standard | What the Facility Did | Finding Grade |
|---|---|---|---|
| MDR event files must include written rationale for non-reportable determinations | 21 CFR 803.18 (MDSAP Ch.4 Task 1) | Recorded “Not Reportable” checkbox only, no written rationale on 38 of 41 files | Major |
| Reportable events must be reported to FDA within 30 calendar days | 21 CFR 803.50(a) (MDSAP Ch.4 Task 1) | 3 events requiring nursing intervention classified as “service events”, no MDR submitted | Major |
| Advisory notices must be reported to Health Canada for field corrections affecting patient safety | Canada Medical Devices Regulations, Part 1 (MDSAP Ch.4 Task 2) | Software field correction notified to FDA only, no Health Canada advisory notice submitted | Major |
| Internal audit must cover MDR programme controls | ISO 13485:2016 clause 8.2.2 (MDSAP Ch.3) | 12 months of internal audits did not include MDR event file completeness checks | Minor |
Corrective Actions: What the Facility Was Required to Do
Immediate: Submit late MDR reports for the three misclassified events
The three events involving nursing intervention were submitted as late 30-day MDR reports to the FDA within 72 hours of the audit finding. Each report included an explanation of the delay and the circumstances of the misclassification. Supplemental reports were also prepared as investigation of each event proceeded. Late reports must still be filed, the filing deadline does not extinguish the reporting obligation.
Immediate: Submit advisory notice to Health Canada for the software field correction
An advisory notice was submitted to Health Canada within five business days of the audit close. The notice described the software defect, the dose calculation risk, the 340 affected devices, and the corrective action already taken. Health Canada acknowledged receipt and confirmed no further regulatory action was required given the correction had already been implemented, but the late submission was noted in the file.
CAPA: Retroactively document written rationale for all 38 non-reportable determinations
All 38 non-reportable determination files were reopened. The MDR decision-maker, now re-trained on the written rationale requirement, documented the reasoning behind each determination. Where the original file lacked sufficient information to reconstruct the rationale from complaint records, a notation was made explaining what information was available and why the determination was made. The CAPA records documented both the retroactive correction and the systemic fix.
Systemic fix: Revise MDR written procedures and field action SOP with jurisdiction-specific steps
The written MDR procedures were revised to include an explicit step requiring a written rationale document for every reportability determination, reportable or not. The field action SOP was revised to include a jurisdiction-specific regulatory notification checklist: FDA Part 806, Health Canada advisory notice, TGA recall reporting, ANVISA, and MHLW requirements, each with the applicable trigger criteria and timeframes. Both SOPs were re-trained to all relevant personnel within 30 days.
Systemic fix: Add MDSAP Chapter 4 controls to the internal audit schedule
The internal audit schedule was revised to include a dedicated semi-annual check of MDR event file completeness, adverse event trending, and advisory notice records. The audit checklist was written to mirror the MDSAP Chapter 4 Task 1 and Task 2 assessment criteria, specifically verifying that every reportability determination file contains a written rationale and that every field action record has been evaluated against advisory notice requirements for each market.
Lessons Learned
Personnel transitions are a Chapter 4 risk event, treat them as one
Every change to the MDR decision-maker role should trigger a structured handover: a review of open event files, a read of the written MDR procedures, confirmation of credentials and training records, and supervisor sign-off before the new decision-maker processes any complaint for reportability. MDSAP auditors can and do ask: “who is your MDR decision-maker and how were they trained?” The answer must be documented, not verbal.
The test for serious injury is “medical intervention required”, not “patient harmed”
This is the single most common misapplication of the MDR reportability threshold. If a device malfunction or failure required a healthcare professional to take an action to prevent patient harm, a nurse restarting an infusion, a physician ordering a repeat dose, a clinician performing a procedure, medical intervention has occurred. The absence of a documented adverse patient outcome does not remove the reporting obligation. Train every MDR decision-maker on this distinction explicitly and test their understanding with case scenarios before they evaluate actual complaints.
Advisory notice requirements are not the same as FDA recall reporting requirements
Filing a Part 806 voluntary recall notification with the FDA does not satisfy Health Canada’s advisory notice requirement. Each jurisdiction has its own trigger criteria, its own timeframes, and its own submission process. A field correction SOP that is only mapped to one jurisdiction’s requirements will miss the others every time. The MDSAP framework is deliberately designed to expose this gap, Chapter 4 Task 2 asks specifically about each participating country’s advisory notice requirements.
Internal audit is the last line of defence before the MDSAP auditor
Every Major finding in this audit would have been caught by an internal audit that reviewed a 10-file sample of MDR event records. Missing written rationale is visible in two minutes per file. An internal auditor does not need regulatory expertise to identify a missing document, they need a checklist that mirrors the MDSAP Chapter 4 assessment criteria. Facilities that run internal audits against their own SOPs rather than against the MDSAP audit tasks miss the gaps the Auditing Organisation will find.
MDSAP Chapter 4 Prevention Checklist
Task 1, Adverse Event Notification
Written rationale documented in every MDR event file, reportable or not
MDR decision-maker trained on regulatory definition of “serious injury” with documented case scenarios
30-day reporting window tracked from date of awareness, not date of event
Adverse event trends reviewed periodically, not only individual events
Personnel transition for MDR decision-maker role includes structured handover and re-training
Task 2, Advisory Notice Reporting
Field action SOP includes advisory notice requirements for each MDSAP jurisdiction separately
Health Canada advisory notice submitted separately from FDA Part 806 notification
Advisory notices comply with applicable timeframes in each jurisdiction
Field correction records link to advisory notice records for each market
Internal audit covers advisory notice records semi-annually
Internal Audit Readiness
Chapter 4 Task 1 and Task 2 assessment criteria in internal audit checklist
Sample of non-reportable MDR files reviewed for written rationale each audit cycle
Adverse event reporting procedure reviewed against current regulatory requirements annually
MDR decision-maker training records current and accessible for audit review
Key Takeaways
The MDSAP Chapter 4 audit checks process, not just outcomes
A facility that correctly identifies non-reportable events but lacks written rationale in the event files fails Chapter 4 Task 1 regardless. The auditor is verifying that the process works, not only that the right answer was reached. Written rationale is not bureaucracy: it is the evidence that a defensible evaluation occurred, and it is what allows a subsequent auditor (or the FDA) to confirm the determination was appropriate.
FDA warning letter volume for MDR deficiencies is rising sharply
A 96% increase in medical device warning letters in 2024, with MDR deficiencies among the most common findings, is a direct signal that the FDA is prioritising post-market reporting enforcement. MDSAP facilities that are removed from the FDA’s routine inspection schedule are not exempt from this enforcement environment: the MDSAP audit report goes to the FDA, and Major Chapter 4 findings can trigger FDA follow-up activity.
MDSAP Chapter 4 findings expose the gap between what a facility thinks its compliance programme covers and what it actually covers
The facility in this scenario had written procedures, a trained decision-maker, and a complaint management system. They had passed their previous audit. What they did not have was a system that survived a personnel transition, a reportability definition that matched the regulatory standard, or a field action SOP that covered all five MDSAP jurisdictions. Chapter 4 findings are rarely about whether the facility cares about patient safety. They are about whether the system functions correctly when the people who built it are no longer in the room.
Frequently Asked Questions
What does MDSAP Chapter 4 cover?
Chapter 4 of the MDSAP Audit Approach covers the Medical Device Adverse Events and Advisory Notices Reporting process. It has two tasks: Task 1 verifies that the organisation has implemented procedures for identifying and reporting adverse events to regulatory authorities within applicable timeframes, and Task 2 verifies that advisory notices, field corrections and recalls, are reported to regulatory authorities when required, in compliance with each jurisdiction’s recordkeeping requirements. Chapter 4 is a supporting process audited alongside the five core MDSAP processes. Source: MDSAP Audit Approach Document
What is the difference between an adverse event report and an advisory notice?
An adverse event report (MDR in the US, Mandatory Problem Report in Canada) is a report submitted when a device may have caused or contributed to a death or serious injury, or when a malfunction would likely cause or contribute to harm if it recurred. An advisory notice is a communication to users about a corrective action taken for a device already on the market, a recall, a field correction, or a safety notice. They are separate regulatory obligations with separate triggers, separate timelines, and separate recipients. A field correction that does not involve a reportable adverse event still requires an advisory notice submission in applicable jurisdictions.
Why does Chapter 4 require written rationale for non-reportable determinations?
Under 21 CFR 803.18 and equivalent requirements in other MDSAP jurisdictions, organisations must maintain MDR event files for all events evaluated for reportability, including those determined not to be reportable. The written rationale serves as evidence that a proper assessment occurred: that someone applied the regulatory definition of death, serious injury, and malfunction to the specific facts of the event and reached a defensible conclusion. Without it, an MDSAP auditor or FDA investigator cannot verify whether the determination was correct. A checkbox outcome is not evidence of an assessment, it is only evidence that someone made a selection.
Can a facility submit a late MDR report after a Chapter 4 finding?
Yes, and it is required. A reporting deadline that has passed does not eliminate the obligation, it creates a late report situation that must be addressed as part of the CAPA response to the finding. Late reports should be submitted as soon as the reporting obligation is identified, with an explanation of the circumstances of the delay. The FDA has stated that late reports are preferable to no report at all. A CAPA that corrects the systemic cause without also submitting the outstanding late reports does not fully resolve the finding.
What is a Major finding in MDSAP Chapter 4 and what happens next?
A Major finding in MDSAP is a significant failure of a QMS requirement that is not likely to result in an immediately unsafe product or serious risk to patients, but does indicate a serious QMS gap. In Chapter 4, a Major finding typically means the organisation either failed to report a reportable event, failed to report an advisory notice, or lacks the process controls to ensure consistent compliance with these obligations. The organisation must submit a CAPA plan to the Auditing Organisation within a defined timeframe. Major findings are visible to all participating regulatory authorities via the shared MDSAP audit report database. Health Canada may take additional action on Major findings that relate to the Canadian MDL requirements.
How does the FDA use MDSAP Chapter 4 audit results?
The FDA accepts MDSAP audit reports as a substitute for its routine quality system inspections. Major findings in Chapter 4, particularly those involving unreported adverse events, are the type of finding most likely to prompt the FDA to conduct a follow-up inspection despite the MDSAP report. FDA warning letters for MDR deficiencies have increased sharply: 47 were issued in FY2024, up 96% from 23 in FY2023. MDR-related deficiencies appear in warning letters from Medtronic, Smiths Medical, and numerous smaller manufacturers, indicating consistent FDA enforcement focus on post-market reporting compliance. Source: MedDeviceGuide FDA MDR Analysis 2026
What is the difference between a Chapter 4 adverse event finding and a warning letter?
A Chapter 4 MDSAP finding is an audit observation graded by the Auditing Organisation. It is not an enforcement action, it is a quality system finding that requires a CAPA response. A warning letter is an FDA enforcement action that follows an inspection or other regulatory review and is publicly posted. A Major Chapter 4 finding does not automatically generate a warning letter, but it is visible to the FDA and can prompt a follow-up inspection that leads to one. An unreported adverse event identified during a Chapter 4 audit that also constitutes a clear 21 CFR Part 803 violation is both a Chapter 4 finding and potentially the basis for an FDA enforcement referral, depending on severity and the FDA’s assessment of the situation.
Sources
Government and Regulatory Sources
- FDA: MDSAP Audit Approach Document (MDSAP AU P0002.009): the authoritative MDSAP process document describing Chapter 4 Task 1 (adverse event notification) and Task 2 (advisory notice reporting), their links to Measurement Analysis and Improvement, and country-specific requirements for each participating authority.
- FDA: MDSAP Chapter 4 Training Slides, Medical Device Adverse Events and Advisory Notices Reporting: FDA CDRH training module covering Chapter 4 audit tasks, ISO 13485:2016 clause references (4.2.1, 7.2.3, 8.2.2, 8.2.3), and country-specific requirements for each MDSAP authority.
- 21 CFR Part 803: Medical Device Reporting: the FDA MDR regulation governing adverse event notification obligations for manufacturers, importers, and device user facilities, including 803.18 (MDR event files), 803.50(a) (30-day manufacturer reports), and 803.53 (5-day reports).
- Health Canada: MDSAP Programme: Health Canada’s advisory notice requirements for manufacturers of medical devices distributed in Canada, including field correction notification obligations under the Medical Devices Regulations.
Research and Industry Sources
- MedDeviceGuide: FDA Medical Device Adverse Event Reporting, MDR Rules Under 21 CFR Part 803 (2026): source for FDA warning letter volume data (47 in FY2024, 96% increase from FY2023), enforcement precedents including Medtronic and Smiths Medical citations, and the MDR written procedure requirements under 803.17 and 803.18.
- MedDeviceGuide: MDSAP Audit Preparation Guide 2026: updated adverse event reporting requirements in the 2026 MDSAP audit approach revision, including jurisdiction-specific changes for Brazil (RDC 751/2022 and RDC 830/2023) and expanded US records review requirements under Compliance Program 7382.850.
Related VelSafe Articles
Worker Safety
MDSAP Chapter 2: What Every Worker Needs to Know
The worker-facing guide to MDSAP Chapter 2, device marketing authorization, facility registration, and the change notification requirements that connect directly to Chapter 4 advisory notice obligations.
Guides
21 CFR Part 803: Medical Device Reporting Requirements
The complete guide to FDA MDR reporting obligations, the 30-day, 10-day, and 5-day timelines, routing rules for each entity type, and event file requirements that Chapter 4 directly audits.
Insights
EU MDR 2017/745: What Articles 1 and 2 Mean for Compliance
Evidence-based analysis of EU MDR scope and definitions, covering the parallel EU regulatory framework for adverse event reporting and field safety corrective actions that apply alongside MDSAP obligations for manufacturers distributing in both markets.
MDSAP COMPLIANCE LIBRARY
Prepare for Your Next MDSAP Audit
Explore VelSafe’s regulated industry library for situational analyses, worker guides, and compliance references covering all seven MDSAP chapters.
Explore Situational Articles
