MDSAP · Basic · 13 min lesson
Auditing organizations and governance - Regulatory Authority Council, recognition, certificates and impartiality
IMDRF MDSAP WG N3 (2016, Edition 2) sections 5.2, 9.4 to 9.6 and 11; N4 (2021); MDSAP AU P0026; MDSAP P0003
What you will learn
- Explain recognition under IMDRF N3/N4 and the assessment of AOs.
- Read the certificate requirements (AU P0026).
- Choose and manage an AO, transfers, appeals and withdrawal.
Key takeaways
- The Regulatory Authority Council decides by consensus and recognises auditing organizations against IMDRF N3 and N4.
- Impartiality limits in N3 section 5.2 and grading limits in section 9.5.1 protect every certificate.
- AU P0026 controls certificate content: numbering, YYYY-MM-DD dates, listed sites, specific scope wording, three-year maximum validity.
- Select the AO on verified status and fit, sign a written agreement with change duties, and keep a regulatory calendar.
- Use the AO's appeal and complaint processes for disagreements and plan for withdrawal consequences.
Free practice question
Corvane receives a quote from an organization that says it is accredited for ISO 13485 certification. The project lead wants to sign because the quote is 30 percent cheaper.
What should QA do first under MDSAP?
Verify the organization's status on the programme's list and its scope for your technologies before any decision.
Correct. Recognition is decided by the RAC against IMDRF N3, so status must be checked on the programme's own list in MDSAP.
Accept the quote because ISO accreditation is the same as recognition.
Not quite. Accreditation to other schemes is not MDSAP recognition, and P0026 forbids other scheme marks on the MDSAP certificate.
Ask the supplier to certify that it is recognised.
Not quite. A self-declaration is not objective evidence; recognition is a regulator decision under IMDRF N3 and the RAC.
Sign now and verify after the audit.
Not quite. Verifying after the audit risks an unusable certificate and wasted audit cost under the MDSAP programme rules.
Key terms
- auditing organization (AO): A body recognised by the Regulatory Authority Council to audit manufacturers under the programme (IMDRF N3).
- Regulatory Authority Council (RAC): The decision-making body of the programme made of the participating regulatory authorities (MDSAP P0003).
- Official Observer: An authority or the WHO that observes and contributes without the decision rights of a member (MDSAP P0003).
- impartiality: Independence of the AO from clients and competitors, with conflict handling rules (IMDRF N3 section 5.2).
- certification document: The AO-issued document with scope, sites, dates and statements required by AU P0026.
- surveillance audit confirmation: A notice issued after a surveillance audit instead of a new certificate (AU P0026).
- recognised versus authorised AO: Statuses with different certificate wording; only recognised AOs may use the programme logo (AU P0026).
- REPs facility ID: The facility identification number of the manufacturer shown for each audited site on the certificate (AU P0026).
Official sources
- IMDRF/MDSAP WG/N3 FINAL:2016 (Edition 2), Requirements for Medical Device Auditing Organizations for Regulatory Authority Recognition
- IMDRF/MDSAP WG/N4 FINAL:2021 (Edition 2), Competence and Training Requirements for Auditing Organizations
- MDSAP AU P0026, Certificate Document Requirements (FDA)
- MDSAP P0003, MDSAP Roles and Responsibilities (FDA)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.