What are the relevant requirements?

The MDSAP Audit Approach covers the requirements of:

• ISO13485:2016 - Medical devices – Quality management systems – Requirements for regulatory purposes and the regulatory requirements from relevant MDSAP RAs (see ISO - ISO 13485 — Medical devices)
• the Australian Therapeutic Goods (Medical Devices) Regulations (2002) Schedule 3 Part 1, excluding 1.6, and Schedule 3 Part 4 
• the Brazilian Good Manufacturing Practices (RDC ANVISA 16/2013) 
• the Canadian Medical Devices Regulations (Parts 1 and 1.1)
• the Japanese QMS Ordinance (MHLW MO 169) 
• the American Quality System Regulation (21 CFR Part 820), and 
• other specific requirements of medical device regulatory authorities participating in the MDSAP program including 21 CFR Part 803 and 21 CFR Part 806.

Manufacturers will be audited to the jurisdictional regulatory requirements based on the countries where they sell or intend to sell or have devices registered. The MDSAP AO will determine which regulatory requirements are applicable and within scope of the audit in collaboration with the manufacturer.

How AOs perform audits

AOs perform MDSAP audits based on documents developed by the MDSAP RAs. Some key features include:

• Following the sequence of processes in the Audit Approach and determining audit duration based on planned tasks.
• Issuing an audit report using a standard template for medical device regulatory audits.
• Grading nonconformities from 1 (least critical) to 5 (most critical) and managing them according to GHTF/SG3/N19:2012.
• Manufacturers must develop and implement action plans for non-conformities identified during audits.
• AOs share audit outcomes with RAs to support their programs. Upon successful audits, AOs issue MDSAP-specific certification documents stating compliance with ISO 13485:2016 and regulatory requirements. 

The Audit Approach document provides a comprehensive guide on what manufacturers should expect during an audit under the MDSAP. Here are the key points and steps: 

Audit Approach and Sequence:

• The audit is process-based, focusing on several defined processes and built on a foundation of risk management requirements.
• The audit sequence includes four primary processes: Management, Measurement, Analysis and Improvement, Design and Development, and Production and Service Controls
• These primary processes all have linkages to the supporting Purchasing process

• Two additional supporting processes are Device Marketing Authorization and Facility Registration, and Medical Device Adverse Events and Advisory Notices Reporting.

  Conducting the Audit:

• Auditors will follow a prescribed sequence but may adjust based on specific circumstances to ensure an efficient and effective audit as described in MDSAP Audit Approach.
• The audit will assess the extent to which the QMS is applying risk management principles.
• Linkages between processes will be emphasized to ensure a comprehensive evaluation of the audited processes.

1. Management Process:
   • The audit will verify that top management ensures an adequate and effective QMS is established and maintained.
   • Key tasks include verifying QMS planning, management representative responsibilities, quality policy and objectives, organizational structure, and risk management planning.
2. Device Marketing Authorization and Facility Registration:
   • The audit will verify compliance with regulatory requirements for device marketing authorization and facility registration.
   • This includes ensuring that changes to marketed devices or the QMS are appropriately notified to regulatory authorities.
3. Measurement, Analysis, and Improvement:
   • The audit will assess the processes for collecting and analyzing information, identifying and investigating causes of product and quality problems, and taking corrective and preventive actions.

   • Key tasks include verifying procedures for measurement, analysis, and improvement, sources of quality data, investigation of nonconformities, and internal audits.

      

4. Medical Device Adverse Events and Advisory Notices Reporting [content under draft]

• The audit will verify that processes are in place to ensure that device-related adverse events are reported to regulatory authorities as required.
• This includes a review of whether the established reporting criteria, timelines and record keeping requirements comply with the requirements for each regulatory authority.  

5. Design and Development:
   • The audit will verify that the design and development process ensures medical devices meet user needs, intended uses, and specified requirements.
   • This includes reviewing design inputs, outputs, verification, validation, and changes.
6. Production and Service Controls:
   • The audit will verify that production and service processes are planned, developed, conducted, controlled, and monitored to ensure conformity to specified requirements.
   • This includes process validation, control of monitoring and measuring devices, and preservation of product conformity.
7. Purchasing:
   • The audit will verify that purchased products and services conform to specified requirements.
   • This includes evaluating and selecting suppliers based on their ability to meet specified requirements and ensuring continued supplier capability.

Overall, manufacturers should expect a thorough evaluation of their QMS, focusing on risk management, process controls, and compliance with regulatory requirements. The audit will involve detailed reviews of documentation, processes, and records to ensure the manufacturer consistently produces safe and effective medical devices.