How MDSAP Grading and Nonconformities Actually Work

QMS & Auditing
Written By Adam Isaacs Rae

The International Medical Device Regulators Forum (IMDRF) had it’s inaugural meeting in Singapore in 2012 about a Medical Device Single Audit Program (MDSAP).

Here we are 13 years later, and there are 5 MDSAP members (in alphabetical order - OF COURSE):

  • Therapeutic Goods Administration of Australia

  • Brazil’s Agência Nacional de Vigilância Sanitária

  • Health Canada

  • Japan’s Ministry of Health, Labour and Welfare, and the Japanese Pharmaceuticals and Medical Devices Agency

  • U.S. Food and Drug Administration

The beauty of MDSAP, and it’s original intentions were indeed focused around harmonisation.

Thanks for reading The Other Consultants! Subscribe for free to receive new posts and support my work.

Any recognised Auditing Organisation is enabled to conduct a single regulatory audit of a medical device manufacturer that satisfies the relevant requirements of the regulatory authorities participating in the program.

Who are the auditing organisations? Well it just so happened here is a link - https://www.fda.gov/medical-devices/medical-device-single-audit-program-mdsap/auditing-organization-availability-conduct-mdsap-audits

These are your BSIs, GMEDs, DEKRAs etc.,

So, BSI could inspect your facility and give assurance to the rest of the MDSAP members that you comply. One audit, one report…so life is easier if you’re a manufacturer, right?

This does genuinely make things easier from a pure auditing perspective. The manufacturer only needs to schedule and host one audit.

As an auditor, it also makes things a bit easier to verify all of the individual country requirements.

How does MDSAP work? (If you know feel free to skip this bit)

A key document for MDSAP is MDSAP AU P0002 Audit Approach. This document outlines the MDSAP criteria for the MDSAP members including criteria of ISO 13485 + specific in country regulatory requirements is identified within this audit approach document.

MDSAP consists of 7 chapters:

  1. Management

  2. Device Marketing Authorisation and Facility Registration

  3. Measurement, Analysis and Improvement

  4. Medical Device Adverse Events and Advisory Notices Reporting

  5. Design and Development

  6. Production and Service Controls

  7. Purchasing Controls

Each chapter is made up from a number of tasks, starting at 1 and the last task always ends with an assessment to top management commitment for the chapter.

How are nonconformances managed within MDSAP?

The MDSAP grading system is a bit like arithmetic, you can keep your simple major or minor grading as that’s not welcome here.

Firstly, the nonconformance is broken into Indirect or Direct QMS Impact. These are defined as follows:

  • Indirect QMS Impact: ISO 13485:2016 clauses 4.1 through 6.3 (with the exception of 4.2.3 – Medical device file, which is considered to have Direct QMS impact) are seen as “enablers” (making it possible or feasible) for the QMS processes to operate. These clauses are therefore considered to have indirect influence on medical device safety and performance and are generally analogous to “minor” nonconformities as defined in ISO 17021-1:2015 clause 3.13.

  • Direct QMS impact: ISO 13485:2016 clauses 6.4 through 8.5 (with the exception of 8.2.4 – Internal audits, which is considered to have indirect QMS impact) are seen as having direct influence on design, and manufacturing controls. These clauses are therefore considered to have direct influence on medical device safety and performance and are more likely to be analogous to “major” nonconformities as defined in ISO 17021-1:2015 clause 3.12 when there is a significant doubt that effective process control is in place, or that products or services will meet specified requirements.

Indirect impact is assigned a 1 and direct impact is assigned a 3.

Furthermore, there are additional sets of rules for grading:

  • Repeat nonconformity (yes: 1 or no: 0)

  • Combination of the absence of a documented process or procedure and failure to implement (yes: 1 or no: 0)

  • Release of nonconforming devices (yes: 1 or no: 0)

The grading is out of 6.

What is the current state with MDSAP?

I’ve worked with a good number of manufacturers with MDSAP, so I know that it is actually used and that it is actually beneficial.

In my experience, however, it is more typically used by large organisations.

I’ve never worked with an Small to Medium Enterprise (SME) that has gained MDSAP, or had any interest beyond finding out the perceived fee’s, as I think these can just sometimes be too offputting to SMEs.

If the fees of MDSAP are something people would like me to provide further info on I’d be happy to bring something out on this. This one of the usual suspects that is answered with “it depends’, but it really does, I promise.

The time for an MDSAP audit depends predominantly number of tasks to be audited.

You can make a rough determination out from the MDSAP Calculator that is provided:

MDSAP AU F0008.2.002 Audit Duration Calculation Form (Audit Model 2017)

As if by magic it is here.

When using this example, we can see that if all tasks are applicable (90 out of 90) for an initial certification audit that the calculator defines it will take approximately 49 hours and 58 minutes worth of auditing to verify the MDSAP requirements. Now if you think of this, in terms of fees associated just with the auditing time of this, things add up.

Again, it is worth considering that in this case this is around 6 days, which would then be able to verify across each country. So it is beneficial as you wouldn’t have to host the other MDSAP members.I’d really recommend any manufacturers considering MDSAP to utilise the audit duration calculator and gap assess this against their current or expected certification durations.

But back to the current state, we’ve got Australia, Brazil, Canada, Japan and the USA that form the MDSAP members.

So, out of the entire world, all the countries, all the medical device regulations, we only have 5 countries.

I am not sure about you, but when I think about the name of the program MDSAP -Medical Device Single Audit Program - (That only applies to 5 countries). I think it slightly misses the mark. I don’t mean to come across as harsh and I know there are lots of reasons as to why. However, enter the EU. The main jurisdiction that comes to mind was the initiator for this newsletter - the European Union and MedTech Europe.

In February of this year (2025), MedTech Europe and COCIR published a joint reflection paper calling on the European Union to join the Medical Device Single Audit Program (MDSAP) as a full member, and to enable the recognition of MDSAP certificates for the purpose of CE marking medical devices and In vitro medical devices.

You can find their paper here - https://www.medtecheurope.org/news-and-events/news/european-medical-technology-industry-calls-for-the-eu-to-join-the-medical-device-single-audit-program-as-a-full-member/

As I’m in the UK, I often see there is a lot of focus on the EU regulatory framework, as well as the UK and MDSAP members. The EU will add a massive amount of access for manufacturers in MDSAP and vice versa, but my thought just keeps going towards the world is much larger than these 7 territories.

The entirety of south east Asia for example, who have their own ASEAN Directive - which is close to the directives we previously had in the EU.

I don’t think it’sfair to say MDSAP has failed, as it is a very complex thing with lots of moving parts. However, I am most definitely not alone in thinking it’s a shame that we haven’t expanded it faster or wider and I am in support of it’s expansion.

Mutual Recognition, International Reliance and/or Recognition

So why don’t we see more harmonisation?

Politics is ultimately the answer, unfortunately.

Respective countries all have their own method of recognition / reliance. I’ve put some examples and links for some of the countries we’ve mentioned throughout to their latest news on recognition:

We all will have seen the drama between America and Canada recently - that’s why we’re not seeing them on each others recognised list…awkward.

What does a merger of MDSAP with the EU look like?

Well, if we look at the harmonised EN ISO 13458: 2016 + A11: 2021 Annex ZA and ZB, this provides a comparison between the standard and the regulation already.

So firstly, for each respective point of the section in EN ISO 13485, it can be mapped against the current MDSAP and the reference to the respective section of MDR be applied.

This covers it from a perspective of ISO 13485 against the regulation article 10, but it needs to be ensured that gaps are covered specifically. For example, requirements from EU regulations within MDR or IVDR such as PMCF / PMPF shall be specifically mentioned within MDSAP to ensure the requirements are driven from within the QMS.

My closing thoughts

MedTech Europe have real influence and generally when they speak up about topics like this that do make complete sense, I imagine we will see something progressing.

I do think MDSAP is at the moment, despite that it doesn’t include the EU, is the closest thing to the idea of the all encompassing one medical device regulation that we have. If expanded to the EU, it will become a far more significant model than it already is.

Big fan of this.

Adam Isaacs Rae
Previous

Team NB's Best Practice Guidance v3, Explained
Next

Auditor Independence Under ISO 13485 Clause 8.2.4