What should I expect at an initial audit

An MDSAP audit cycle includes the following activities:

  • Initial (Stage 1 and 2) audits, also called certification audits
  • Surveillance audits
  • Re-audits (also called recertification audits).

Special audits and unannounced audits may be conducted in addition to audits performed within a normal audit cycle, when required.  

Audits may be conducted offsite, onsite, or in a remote or hybrid capacity depending on the type and nature of the audit.

Once a manufacturer has entered a contract with an AO, the AO will perform a Stage 1 audit. This consists of a documentation review and evaluation of readiness of the manufacturer to progress to a Stage 2 audit. Once the AO is satisfied that the requirements for a Stage 1 audit have been met, the manufacturer will progress to a Stage 2 audit.  

The purpose of a Stage 2 audit is to determine if all applicable QMS requirements and regulatory requirements have been effectively implemented. The AO will develop an audit plan that considers the scope of activities performed by the manufacturer and the audit tasks to be performed in accordance with the Audit Approach. A team of competent auditor/s is assigned to the audit by the AO, and the audit duration is calculated. Dates of the audit and supporting logistics are worked out through communication between the manufacturer and the AO.

On the first day of the audit, the AO auditors will conduct an opening meeting with the manufacturer’s representatives. They will introduce themselves and outline their role in the audit, confirm the audit scope, audit criteria and audit objectives, confirm the audit plan, and relay other information to ensure the audit progresses as smoothly as possible.

During the audit, the AO auditors will review documentation and records, interview staff, and physically tour and inspect the facilities to determine that the requirements have been met. If there is no evidence that a requirement has been met, a nonconformity will be raised. The audit team typically performs periodic debriefs with the manufacturer, ensuring that the manufacturer is aware of any potential gaps or nonconformities throughout the audit.

At the end of the audit, the AO auditors will conduct a formal closing meeting with the manufacturer’s representatives. The AO will issue any identified nonconformities during this meeting and discuss the next steps in the audit process. The nonconformity will be issued on a standard template called the NGE form and graded from 1 to 5 using standard grading criteria. 

The manufacturer is required to respond to all nonconformities raised; however, the amount of information required to be submitted to the AO varies depending on the grading of the nonconformity. The manufacturer and AO use the NGE form to communicate their response and assessment back and forth until the nonconformity is closed. The manufacturer is recommended to provide a remediation plan for each nonconformity, including the outcome of the investigation and the cause of the nonconformity, planned corrections and planned corrective actions, within 15 calendar days from the end date of the audit. The manufacturer is recommended to provide evidence of implementation of the remediation actions, for grade 4 and 5 nonconformities within 30 calendar days from the end date of the audit. AOs may verify the implementation of corrections and corrective actions, and the effectiveness of these actions, at the next routine audit, or in some instances at a follow-up special audit.

If the AO identifies one or more grade 5 nonconformities, or more than two grade 4 nonconformities, a public health threat, or any fraudulent activity or counterfeit product, they must inform the MDSAP RAs within 5 working days from the end date of the audit. This is called a MDSAP 5-day Notice.

Whilst the manufacturer is working to address any nonconformities raised, the AO audit team prepares the audit report. This document is a written record of the audit team’s determination of the extent of fulfillment of the requirements and represents a significant portion of the objective evidence of the implementation of a conformity assessment procedure.  

Once the audit report is finalized, the AO collates the Audit Report Package ready for submission into the Regulatory Exchange Platform-secure (REPs). REPs is an electronic repository where RAs can access information to support their pre- and post-market regulatory activities. The Audit Report Package includes:

  • The Audit Report, and any relevant attachments
  • Any nonconformities that were opened during the audit  
  • Any open nonconformities where the AO has reviewed the results of the remediation plan  
  • Evidence of implementation for corrections and corrective actions provided by the manufacturer to remedy any grade 4 or 5 nonconformities.

The AO is required to submit the package into REPs within 90 calendar days from the end date of the audit. For audits where a MDSAP 5-day Notice was made, the Audit Report Package must be submitted within 45 calendar days from the end date of the audit.

Once a successful initial audit is completed, the AO can issue the manufacturer with a MDSAP certificate. The certificate identifies the certification criteria including any applicable RA’s regulatory requirements, the activities performed by the medical device manufacturer, and the devices covered by the certification document.