MDSAP · Basic · 15 min lesson
Basic case study - Brannock Spinal Systems first-cycle audit
MDSAP AU P0002 Audit Approach, MDSAP AU P0037 grading, MDSAP FAQ: cycle, grading, notification and response
What you will learn
- Apply lessons 1 to 7 to a full first-cycle audit file.
- Grade the findings with the two-step MDSAP method and decide who must be notified.
- Write a response that meets the deadlines and plan the following year.
Key takeaways
- Grading has two steps: base 1 (indirect) or 3 (direct) by clause, then plus 1 per escalation rule, capped at 5.
- Notification to regulators within 5 working days follows a grade 5, more than two grade 4, a public health threat, or fraud or counterfeit.
- The remediation plan is due within 15 calendar days of the report; evidence for grade 4 or 5 within 30 calendar days of the audit end.
- Corrections never lower a grade; only the appeals process of the auditing organization can.
- The cycle is initial audit, two partial surveillance audits and a re-audit in year three.
Free practice question
Brannock holds its certificate after the initial audit. A colleague asks what the next audits are.
What does the MDSAP three-year cycle provide after the initial audit?
Two partial surveillance audits, one each year, then a full re-audit in year three
Correct. The MDSAP cycle has partial surveillance audits in years one and two and a re-audit in year three.
Three full audits, one each year
Not quite. Surveillance in the MDSAP cycle is partial, and the full audit is the re-audit in year three.
One audit only, at the end of three years
Not quite. MDSAP audits the manufacturer every year, so waiting three years is wrong.
Audits only when a complaint arrives
Not quite. MDSAP routine audits are planned; complaints might prompt special audits but do not define the cycle.
Key terms
- nonconformity grade: A number from 1 to 5 given to each finding from the clause cited and the escalation rules (MDSAP AU P0037).
- direct impact: Clause 4.2.3 and clauses 6.4 to 8.5 except 8.2.4; base grade 3 (MDSAP AU P0037).
- indirect impact: Clauses 4.1 to 6.3 except 4.2.3, and clause 8.2.4; base grade 1 (MDSAP AU P0037).
- escalation rule: One added point for a repeat citation, a missing procedure with no implementation, or release of a nonconforming device.
- auditing organization (AO): The recognized body that performs MDSAP audits and takes the certification decision.
- Stage 1 and Stage 2: Stage 1 reviews documentation and readiness; Stage 2 checks effective implementation (MDSAP FAQ).
- remediation plan: Investigation outcome, corrections and corrective actions sent within 15 calendar days of the report date (MDSAP FAQ).
- re-audit: A complete audit in year three of the cycle that starts a new cycle (MDSAP FAQ).
Official sources
- MDSAP AU P0002.009 MDSAP Audit Approach (FDA)
- MDSAP AU P0037.001 Guidelines on the use of the nonconformity grading system (GHTF/SG3/N19:2012) for MDSAP purposes (FDA)
- Medical Device Single Audit Program (MDSAP) Frequently Asked Questions (FDA)
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.