MDSAP Audit Program: 10 Things to Know

TIPS: Medical Device Regulatory Compliance

The Medical Device Single Audit Program (MDSAP) allows a single regulatory audit to satisfy the requirements of five participating regulatory authorities: Australia (TGA), Brazil (ANVISA), Canada (Health Canada), Japan (PMDA/MHLW), and the United States (FDA). Understanding what MDSAP is, who it applies to, and what it means for audit preparation is foundational knowledge for quality and regulatory professionals in medical device manufacturing.

Participating Regulatory Authorities

Australia (TGA), Brazil (ANVISA), Canada (Health Canada), Japan (PMDA/MHLW), and the United States (FDA) participate in MDSAP. A single MDSAP audit satisfies audit requirements for all five jurisdictions simultaneously.

FDA, MDSAP Overview

Canada

MDSAP Is Mandatory for Health Canada

For manufacturers seeking to sell Class II, III, or IV medical devices in Canada, Health Canada requires MDSAP certification from an accredited Auditing Organization. Canada is the only MDSAP jurisdiction where participation is mandatory, not voluntary.

Health Canada, MDSAP Requirements

ISO

13485:2016 Is the Foundation

MDSAP audits assess compliance with ISO 13485:2016 (Quality Management Systems for Medical Devices) as interpreted through the jurisdiction-specific regulatory requirements of each participating authority. A compliant ISO 13485 QMS is necessary but not sufficient for MDSAP certification.

ISO 13485:2016

10 Things Every Medical Device Professional Needs to Know About MDSAP

MDSAP Audits Use a Grading Scale for Nonconformities

MDSAP introduced a grading system for audit nonconformities based on their potential impact on patient safety and regulatory compliance. Grade 1 nonconformities are the most serious and require immediate corrective action within 15 days. Grade 2 requires corrective action within 30 days. Grade 3 requires corrective action within 90 days. Understanding this grading system is essential for quality professionals preparing for or responding to an MDSAP audit, as grading directly affects regulatory authority response decisions.

FDA Uses MDSAP Audit Reports as Surveillance

FDA accepts MDSAP audit reports in lieu of routine FDA establishment inspections for most domestic and foreign device manufacturers enrolled in the programme. This does not mean FDA will never inspect a facility enrolled in MDSAP; FDA retains the authority to conduct inspections at any time, particularly for-cause inspections following an adverse event or recall. However, a facility with a clean MDSAP record significantly reduces its probability of a routine FDA inspection cycle.

The Audit Sequence Is Defined and Non-Negotiable

MDSAP audits follow a defined audit sequence across seven process areas: Management; Measurement, Analysis, and Improvement; Design and Development; Product and Service Controls; Production and Service Controls; Supporting Processes; and Device Marketing Authorization and Facility Registration. The Auditing Organization must follow this sequence. Understanding the sequence helps quality professionals organise documentation, escort responsibilities, and SME assignments efficiently before and during the audit.

Initial Certification Audits Are Longer Than Surveillance Audits

The initial MDSAP certification audit is a full-scope audit covering all seven process areas across all participating jurisdictions. It is typically longer than the subsequent annual surveillance audits, which may be partial-scope. The recertification audit every three years is again a full-scope assessment. Budget quality team time accordingly: an initial certification audit at a mid-sized device manufacturer may require three to five audit days on-site. First-time participants frequently underestimate the document retrieval and escort demands of a full-scope audit.

Only IMDRF-Recognised Auditing Organizations Can Conduct MDSAP Audits

MDSAP audits must be conducted by Auditing Organizations (AOs) recognised by the International Medical Device Regulators Forum (IMDRF). A list of recognised AOs is maintained on the IMDRF website. Manufacturers should verify that their selected AO is currently recognised and has experience auditing in all jurisdictions relevant to their markets, particularly Brazil (ANVISA), which has specific additional requirements beyond ISO 13485 that not all AOs are equally prepared to assess.

MDSAP Does Not Replace All Market Access Requirements

MDSAP certification satisfies quality system audit requirements for the participating jurisdictions. It does not replace pre-market submission requirements. Manufacturers still need 510(k) clearance or PMA approval for the US, Medical Device Licence for Canada, registration with ANVISA for Brazil, and the applicable pre-market pathway for Australia and Japan. MDSAP is a post-market quality system surveillance tool, not a single pre-market approval pathway. Conflating the two is a common misunderstanding in regulatory affairs teams new to MDSAP.

Corrective Action Responses Are Reviewed by the Auditing Organization

When an MDSAP audit identifies nonconformities, the manufacturer submits corrective action responses to the Auditing Organization within the grading-determined timeframe. The AO reviews the responses and may share the audit report and nonconformity information with the participating regulatory authorities. A Grade 1 nonconformity that is not resolved promptly can trigger regulatory authority action, including import holds or post-market surveillance requests. Corrective action plans must be specific, implemented, and effectiveness-verified : not simply described.

The MDSAP Audit Report Is Shared With Regulatory Authorities

MDSAP audit reports, including all identified nonconformities and the manufacturer’s corrective action responses, are shared with the regulatory authorities of all participating jurisdictions in which the manufacturer is registered. This is not optional and is a condition of programme participation. Manufacturers should prepare for MDSAP audits understanding that every finding will be reviewed not just by the AO but potentially by FDA, Health Canada, ANVISA, TGA, and PMDA simultaneously. A finding significant enough to interest one regulatory authority will be visible to all.

MDSAP Gap Assessments Are Essential Before Initial Certification

Manufacturers preparing for their first MDSAP certification audit should conduct a formal gap assessment against the MDSAP audit approach document, ISO 13485:2016, and the jurisdiction-specific regulatory requirements of their target markets. An internal or third-party gap assessment conducted 6 to 12 months before the certification audit allows time to address systemic gaps, update procedures, complete training, and verify that corrective actions are effective before the formal assessment. Attempting a certification audit without a gap assessment is the most common reason for a high-nonconformity initial audit.

Withdrawal From MDSAP Has Regulatory Consequences

A manufacturer who withdraws from MDSAP, or whose certification is suspended or withdrawn by the AO, loses the benefit of MDSAP audit substitution for FDA inspections and loses the Health Canada MDSAP certification required to maintain Medical Device Licence eligibility for Canadian-market Class II, III, and IV devices. Withdrawal or certification suspension is therefore a significant regulatory event with commercial consequences in all participating markets simultaneously. Maintaining MDSAP certification continuity requires sustained quality system performance, not just audit preparation.

Key Takeaways

Canada Is the Only Mandatory Jurisdiction

MDSAP is voluntary for the US, Australia, Brazil, and Japan but mandatory for Health Canada Class II, III, and IV device market access. Manufacturers selling in Canada must obtain and maintain MDSAP certification from an IMDRF-recognised Auditing Organization.

Grade 1 Nonconformities Are Serious

Grade 1 nonconformities require corrective action within 15 days and are shared with all participating regulatory authorities. An unresolved Grade 1 finding can trigger direct regulatory action from multiple authorities simultaneously.

MDSAP Covers Quality Systems, Not Pre-Market Approval

MDSAP certification satisfies quality system audit requirements for participating jurisdictions. Pre-market submissions (510(k), PMA, Medical Device Licence) remain required independently. MDSAP does not create a single global market access pathway.

Gap Assessment Before Certification Is Non-Negotiable

A formal gap assessment 6 to 12 months before the initial certification audit is the most impactful single preparation step for first-time MDSAP applicants. It identifies systemic gaps while there is still time to close them before findings appear in an official audit report shared with all regulatory authorities.

Frequently Asked Questions

Is MDSAP required for FDA compliance?

No. MDSAP participation is voluntary for FDA. Manufacturers enrolled in MDSAP may have their audit reports used by FDA in lieu of routine surveillance inspections, but FDA retains independent inspection authority. Manufacturers not enrolled in MDSAP remain subject to standard FDA inspection procedures under 21 CFR Part 820 (QMSR, effective February 2026).

How does MDSAP relate to ISO 13485 certification?

ISO 13485:2016 certification is the foundation for MDSAP, but they are not the same. An MDSAP audit assesses ISO 13485 compliance as interpreted through the specific regulatory requirements of the participating jurisdictions. A manufacturer can be ISO 13485 certified without being MDSAP certified, but cannot be MDSAP certified without meeting ISO 13485 requirements. MDSAP certification effectively replaces the need for separate ISO 13485 certification audits in most cases.

What happens if a manufacturer receives a Grade 1 nonconformity?

A Grade 1 nonconformity is the most serious MDSAP finding category and indicates a failure that significantly increases the risk of producing a device that does not conform to the applicable regulatory requirements and may create an unacceptable risk to patient safety. The manufacturer must submit a corrective action plan within 15 calendar days and implement it promptly. The Auditing Organization reports Grade 1 findings to all relevant regulatory authorities. Depending on the nature of the finding, regulatory authorities may take additional action including import holds or formal investigation.

How do manufacturers select an MDSAP Auditing Organization?

Manufacturers should select an Auditing Organization from the IMDRF list of recognised AOs, verifying the AO is currently active and recognised in all relevant jurisdictions. Key selection criteria include the AO’s experience with the specific device types and risk classes the manufacturer produces, their familiarity with the jurisdictions most important to the manufacturer’s market strategy, audit scheduling availability, and the AO’s process for managing corrective action follow-up. The IMDRF maintains a current list of recognised AOs at imdrf.org.

Can contract manufacturers or suppliers be included in an MDSAP audit?

Yes, with conditions. MDSAP audits can include supplier audits as part of the audit programme, but the scope and inclusion of specific suppliers must be agreed with the Auditing Organization in advance. Manufacturers with significant critical supplier relationships should discuss supplier audit scope with their AO during audit planning. Critical suppliers who are not themselves MDSAP certified may require the manufacturer to conduct and document their own supplier qualification and monitoring activities to satisfy the supplier controls requirements assessed during the audit.

What are the key documents to prepare for an MDSAP initial certification audit?

Core documents for an MDSAP initial certification audit include: the Quality Manual and quality policy; the complete SOP library with version control evidence; the management review records for the prior 12 months; CAPA log with open and closed items and effectiveness checks; internal audit programme and findings; design history files for the devices in scope; production and process validation records; supplier qualification files for critical suppliers; complaint handling and MDR records; calibration and equipment qualification records; and training records for all quality system personnel. Pre-organising these records by MDSAP process area rather than by document type significantly reduces retrieval time during the audit.

Does MDSAP cover software as a medical device (SaMD)?

Yes. MDSAP applies to manufacturers of software as a medical device that falls within the regulatory scope of any participating jurisdiction. The audit process area for Design and Development is particularly relevant for SaMD manufacturers, as it covers the software development lifecycle, validation, and change control requirements. SaMD manufacturers should ensure their quality management system addresses IEC 62304 (software lifecycle processes) and that their design controls documentation aligns with the software-specific requirements of each participating jurisdiction’s regulatory framework for SaMD.

Government and Regulatory Sources

FDA. Medical Device Single Audit Program (MDSAP): programme overview, participation requirements, and MDSAP audit report use by FDA.
Health Canada. MDSAP Requirements: mandatory MDSAP certification requirements for Class II, III, and IV devices entering the Canadian market.
IMDRF. MDSAP Working Group: programme governance, audit approach document, recognised Auditing Organization list, and MDSAP guidance documents.
ISO 13485:2016. Medical Devices: Quality Management Systems: the international QMS standard that forms the foundation of every MDSAP audit.

Introduction to MDSAP: 10 Things Every Medical Device Professional Needs to Know

Introduction to Toxicology in Cosmetics Manufacturing:…

Introduction to ESG: What the Legal…