MDSAP · Expert · 15 min lesson
Audit task workshop - chapter by chapter document audits with planted nonconformities and grading drills
MDSAP AU P0002 Audit Approach chapters 1 to 7, AU P0037 grading (sections 5.1 to 5.3), 21 CFR 803.50, ISO 13485:2016 clauses 5.6, 7.3.9, 7.4, 7.5.6, 8.2.2, 8.2.3 and 8.5.2
What you will learn
- Audit a record or document from each of the seven MDSAP chapters by stating the requirement, finding the evidence and testing the links to other chapters.
- Grade ten findings with the two step method of AU P0037, including the escalation rules and the cap at grade five.
- Write three nonconformity reports that state the requirement, the traceable evidence and a factual statement of nonfulfilment.
Key takeaways
- Every document audit starts from the requirement the document must satisfy, then tests completeness, approval, content and links to other chapters.
- A complaint file links chapters 3, 4 and 5: no investigation means no reportability decision, and the 30 day clock under 21 CFR 803.50 runs from awareness.
- Grading step one scores 1 for indirect clauses (4.1 to 6.3 except 4.2.3, and 8.2.4) and 3 for direct clauses; step two adds 1 for each of three escalation rules; the final grade is capped at 5.
- Corrections and corrective actions never change a grade; only the documented appeals process of the auditing organization can amend it.
- A good nonconformity cites one requirement with its source, gives evidence that can be found again, and states nonfulfilment in factual sentences without advice.
Free practice question
The management review minutes MR-25-02 list audit results and CAPA status as inputs. Complaints and regulatory reporting are not discussed, and the only output is: continue as planned.
Which requirement should the nonconformity report cite?
ISO 13485:2016 clause 7.4.1, supplier evaluation.
Not quite. Supplier evaluation under clause 7.4.1 is a purchasing matter, while the defect is in the review inputs and outputs.
ISO 13485:2016 clauses 5.6.2 and 5.6.3, review inputs and outputs.
Not quite. Clause 5.6.2 lists the required inputs and 5.6.3 the outputs, so both are unmet in the minutes.
ISO 13485:2016 clause 8.2.4, internal audit.
Correct. Clause 8.2.4 concerns the internal audit programme, which is not the failure shown in the review minutes.
21 CFR Part 803, medical device reporting.
Not quite. Part 803 is a reporting regulation, and the record under test is a management review of the quality system.
Key terms
- document audit: Examination of a record against the requirement it should satisfy, testing completeness, approval, content and links to other processes.
- planted nonconformity: A deliberate defect placed in a training document so that learners practise finding, citing and grading it.
- direct impact clause: Clauses 4.2.3 and 6.4 to 8.5 of ISO 13485:2016 except 8.2.4, which score 3 at step one of the AU P0037 grading.
- escalation rule: One of three AU P0037 rules (repeat, missing and unimplemented process, release of nonconforming device) that each add 1 to the step one grade.
- awareness date: The date from which the 30 day manufacturer report period under 21 CFR 803.50 is counted, when any employee becomes aware of a reportable event.
- nonconformity report (NCR): The auditor's record of one nonconformity: requirement, evidence, statement of nonfulfilment and grade.
Official sources
- MDSAP AU P0002.009 MDSAP Audit Approach (FDA)
- MDSAP AU P0037.001 Guidelines on the use of the nonconformity grading system for MDSAP purposes (FDA)
- MDSAP AU P0008.008 Audit Time Determination Procedure (FDA)
- GHTF SG3 N19:2012 Nonconformity Grading System for Regulatory Purposes and Information Exchange (IMDRF)
- FDA, Medical Device Reporting for manufacturers (21 CFR Part 803 training presentation)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.