MDSAP Gap Analysis and readiness assessment

MDSAP Audit Cycle

To maintain alignment with ISO 13485:2016 and relevant regulatory standards, the MDSAP audit follows a structured three-year schedule:

• Initial Certification: 1st Year
• Surveillance Checks: 2nd and 3rd Year
• Recertification: After 3rd Year

MDSAP Audit Approach includes

• Chapter 1 – Management

The core QMS foundation by establishing management responsibilities, organizational structures, quality policies, and personnel training while overseeing outsourced processes. It requires setting up strict controls for documents, records, risk management, and regulatory compliance to distribute authorized devices safely. Finally, it relies on regular management reviews and dedicated leadership commitment to drive continuous QMS effectiveness and quality standards.

• Chapter 2 - Device Marketing Authorization and Facility Registration

It focuses on submitting applications for device marketing authorization and registering operational facilities with regulatory authorities. It requires maintaining verifiable evidence of valid marketing clearance or approval prior to commercial release. Additionally, it mandates timely notification to authorities regarding any significant changes made to marketed devices or the QMS.

• Chapter 3 - Measurement, Analysis and Improvement

This section details processes for gathering quality data, conducting internal audits, and investigating existing or potential nonconformities to implement effective corrective and preventive actions (CAPA). It governs the control of nonconforming products both before and after delivery, while assessing any resulting design or process changes. Furthermore, it handles post-production complaint evaluations, adverse event reporting, advisory notices, and external communications under strong management oversight.

• Chapter 4 - Medical Device Adverse Events and Advisory Notices Reporting

This section outlines protocols for promptly notifying regulatory authorities about adverse events associated with medical devices. It also mandates issuing official advisory notices and safety alerts to communicate critical risks or field corrective actions effectively.

• Chapter 5 - Design And Development

It guides the end-to-end device development lifecycle, from initial planning, documentation, and input definition. It enforces systematic risk management alongside design verification, validation, and clinical evaluations to confirm safety and performance prior to manufacturing transfer. Furthermore, it details design review protocols, top management oversight, and procedures for evaluating how design modifications affect previously distributed products.

• Chapter 6 - Production and Service Controls

This chapter details operational planning, infrastructure, and work environment management, while enforcing strict process validations—including sterilization and production software controls. It establishes measures for product cleanliness, traceability, device master files, acceptance activities, nonconforming product handling, and measuring equipment calibration. Also, it regulates post-production operations, including product preservation, installation, servicing, transport risk controls, distribution records, and top management commitment.

• Chapter 7 – Purchasing

This chapter covers planning, procedures, and control mechanisms for purchased products and outsourced processes, including supplier selection, evaluation, and auditing. It requires clear documentation of purchasing requirements, written change-notification agreements, and verification of received goods. Additionally, it integrates purchasing performance into quality data monitoring for ongoing improvement under top management commitment.

Annexures of MDSAP Audit approach includes

• Annex 1 - Audit Of Product/Process Related Technologies and Technical Documentation
• Annex 2 - Audit Of Requirements for Sterile Medical Devices
• Annex 3 - Medical Device Adverse Events and Advisory Notices Reporting Process Quick Reference
• Annex 4 - Japan’s QMS Ordinance Revision – Tables
• Annex 5 - Acceptable Exclusions from An Organisation’s Scope of Certification

NC Grading System

Grading Matrix

• The Y-axis of the Grading Matrix is QMS Impact. It is related to the influence of the QMS clause on medical device safety and performance. It is vitally important to highlight that all the clauses of the standard are equally required if applicable, to effectively establish and maintain a quality management system that will meet regulatory purposes.

For the purpose of improved stratification in the grading system, the clauses of the standard are divided into two categories:

• Indirect QMS Impact: ISO 13485:2016 clauses 4.1 through 6.3, are seen as “enablers” (making it possible or feasible) for the QMS processes to operate. These clauses are therefore considered to have indirect influence on medical device safety and performance.
• Direct QMS impact: ISO 13485:2016 clauses 6.4 through 8.5, are seen as having direct influence on design, and manufacturing controls. These clauses are therefore considered to have direct influence on medical device safety and performance.
• The X-axis of the Grading Matrix is Occurrence and is divided into two categories:
• First: The first category addresses a nonconformity in a particular sub-clause (X.X.X) of ISO 13485:2003 identified for the first time. The first time is defined as not observed in the two previous QMS audits which evaluated the same sub-clause.
• Repeat: The second category is a nonconformity that has been identified within either of two previous QMS audits which evaluated the same sub-clause (X.X.X). Such a nonconformity poses an increased risk because it is an indicator that a corrective action has not been adequately taken or implemented.
• Applying the Nonconformity Grading System: Step 1 – Using the Nonconformity Grading Matrix
• Direct or Indirect Impact: When a nonconformity is written and the clause assigned, identify whether it is “direct impact” (score of 3) or “indirect impact” (score of 1), as defined above.
• Repeat nonconformities against the same QMS sub-clause (X.X.X): The auditor should check the previous two audit reports which evaluated the same sub-clause to see if a nonconformity that is identified in the current audit was previously raised. The nonconformity does not have to be identical to the nonconformity in the previous audit, just cited to the same QMS sub-clause (X.X.X). If the nonconformity is a repeat, the grade increases by 1.

Step 2 – Application of Escalation Rules

In this step of grading, the Nonconformity Grading Matrix is no longer used. Each rule below is applied to determine the final grade of the nonconformity.

• Rule 1 - Absence: Absence of a documented process or procedure of any requirement, the grade increases by 1.
• Rule 2 - Medical Device: Release of a Nonconforming Medical Device outside of the controls of the manufacturer’s QMS, the grade increases by 1.

The final grade for a nonconformity under this grading scheme will be a number between 1 and 6. However, the grade of “5” was determined to be the maximum, because this represents a significantly high enough risk that some intervention is required. The differentiation between 5 and 6 was not felt to be of benefit in the grading system. Therefore, if a grade of 6 is achieved, the final grade is documented as “5.”

Benefits of MDSAP certification

• Single audit programme accepted by TGA, ANVISA, Health Canada, MHLW/PMDA and US FDA.
• Implementation Country-specific Quality management System Requirements
• Eliminates the multiple regulatory audits which saves resources i.e., time and cost
• MDSAP certification is mandatory for Health Canada to sell medical device in Canada.
• Reduces the additional audits by regulators
• Covers implementation of ISO 13485 and country-specific regulatory requirements.
• Improves MDQMS by Strengthening risk management, CAPA, and post-market surveillance