ISO 13485 · Expert · 15 min lesson
MDSAP for auditors: audit model, chapters, grading and the five-day rule
MDSAP Audit Approach (MDSAP AU P0002), grading per GHTF/SG3/N19:2012 and MDSAP AU P0037, ISO 13485:2016 with FDA, Health Canada, TGA, ANVISA and MHLW requirements
What you will learn
- Describe the MDSAP audit model, the audit cycle and the seven audit chapters.
- Apply the grading method from 1 to 5 and the rule that sends a notice to the regulators within five working days.
- Prepare an MDSAP-ready internal audit that follows the audit sequence and tests jurisdiction-specific requirements.
Key takeaways
- MDSAP is one audit by a recognised auditing organization, usable by five regulators: TGA, ANVISA, Health Canada, MHLW with PMDA, and FDA.
- The cycle is an initial audit in two stages, partial surveillance audits in years one and two, and a recertification audit in year three.
- The audit model has seven chapters and a defined task sequence, with Management first and links between processes tested on purpose.
- Nonconformities are graded from 1 to 5; one grade 5 or more than two grade 4 findings means notification to the regulators within five working days.
- An MDSAP-ready internal audit follows the same sequence, tests each national requirement and grades findings on the same scale.
Free practice question
A MDSAP audit of a fictional firm, Calden Instruments, finds one grade 5 nonconformity and one grade 3. The auditor asks what happens next.
What is required of the auditing organization?
Wait until the audit report is issued.
Not quite. The rule sets five working days, not the report date, under the MDSAP audit approach.
Notify the participating regulators within five working days, because one grade 5 finding triggers the rule.
Correct. One or more grade 5 nonconformities require notification to the regulators under the program rules. This reading matches the MDSAP audit approach and the grading method for nonconformities.
Notify only if there are three grade 3 findings.
Not quite. Grade 3 findings do not trigger the rule; grade 5 or more than two grade 4 do. This reading matches the MDSAP audit approach and the grading method for nonconformities.
Do nothing, because manufacturers notify regulators.
Not quite. The auditing organization has the notification duty under MDSAP, not the manufacturer alone.
Key terms
- MDSAP: A program in which one audit of a manufacturer's quality system by a recognised auditing organization serves several regulators.
- auditing organization: A third party recognised under MDSAP to audit manufacturers and issue the audit report and certificate.
- grade 5: The most critical nonconformity grade on the MDSAP 1 to 5 scale; one is enough to require notification within five working days.
- audit chapter: One of seven process groups in the MDSAP audit model, each with tasks and links to other chapters.
- recertification audit: The complete audit in year three of the cycle that restarts the three year cycle.
- working day: A day on which the auditing organization is open for business; the five day notification rule counts these.
Official sources
- FDA - MDSAP Audit Approach, MDSAP AU P0002
- FDA - Medical Device Single Audit Program frequently asked questions
- MDSAP - Audit Approach (official program site)
- FDA - Quality Management System Regulation (QMSR) overview
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.