MDSAP audit checklist and audit approach

HAVGATE includes the MDSAP audit checklist from AU P0002.010 so you can plan, run and report the process-based audit across all seven chapters, with ISO 13485, FDA QMSR and EU MDR references on the task.

What the MDSAP audit approach is

The Medical Device Single Audit Program uses one audit of a manufacturer's quality system to satisfy the participating regulatory authorities. The audit model is process-based. It is written in the MDSAP audit approach, companion document AU P0002.010, rather than as a straight reading of ISO 13485 from clause 4 to clause 8. The sequence is built so an auditing organization can sample management, marketing authorization, measurement and improvement, adverse-event reporting, design, production and purchasing in an order that follows how a device company actually works. HAVGATE pre-loads those tasks, with the task number, the description and the audit criteria, so an internal or supplier audit can follow the same sequence the auditing organization will use.

The seven chapters in the product data are: 1 Management; 2 Device Marketing Authorization and Facility Registration; 3 Measurement, Analysis and Improvement; 4 Medical Device Adverse Events and Advisory Notices Reporting; 5 Design and Development; 6 Production and Service Controls; and 7 Purchasing. Task counts differ by chapter. Management and measurement are long. Adverse-event reporting is short and still mandatory to consider. The checklist page shows each chapter and sample tasks from the data set shipped in the product. Use that list as the working checklist. It is the content to export or print for a planning meeting.

MDSAP versus an ISO 13485 certification audit

An ISO 13485 certification audit samples the standard, usually by process, against the clauses and your exclusions. An MDSAP audit samples the same quality system against the audit approach, and it adds the regulatory tasks the participating authorities care about: facility registration and device listing, adverse-event reporting, and advisory notices, among others. You can conform to ISO 13485 and still be unprepared for MDSAP if nobody has walked task 2 or task 4. You can also collect MDSAP evidence that doubles as 13485 evidence, because the tasks cite the standard. HAVGATE's multi-standard session, on Pro and above, records both on one pass so you are not writing two reports from the same notes.

Participating authorities referenced on the product page are the US FDA, Health Canada, ANVISA, TGA and Japan's MHLW/PMDA. Confirm the current list of participating and affiliate authorities on the official MDSAP site when you plan a regulatory audit. The product checklist is an internal and readiness tool. It does not replace the auditing organization, and it does not issue a certificate.

Nonconformity grading

MDSAP grades nonconformities instead of stopping at minor and major. The published grading method looks at whether the nonconformity has a direct or indirect impact on the quality system, and whether it is a first occurrence or a repeat. Direct impact scores higher than indirect. A repeat scores higher than a first occurrence. Further escalation applies when a required process is absent or when nonconforming product was released. Grades run from 1 up to 5. Higher grades draw faster follow-up from the auditing organization. The exact matrix and any timeline attached to a grade are defined in the current MDSAP nonconformity grading guidance. Use that document as the authority when you write a grade. Do not rely on a remembered number of days.

Inside HAVGATE, findings on an MDSAP task are classified and tied to the task number. The product language on this page uses minor, major and critical as the severity words on the nonconformance, and the task number as the MDSAP anchor. If your procedure requires the numeric MDSAP grade as well, record the grade in the finding narrative with the two factors you used (impact and occurrence) so a reviewer can see the arithmetic. A severity word with no task number is hard to defend. A grade with no evidence is hard to defend. Keep both.

Using the seven chapters in an internal program

You do not have to clone a full MDSAP audit every quarter. You do need a plan that, over the audit cycle, covers the processes the approach contains. A practical internal program audits management and measurement every year, because they include management review, internal audit, CAPA, complaints and document control. It audits production and purchasing on a risk basis. It audits design when you have an active or recently completed project, which is what Chapter 5 asks the auditing organization to select. It audits adverse-event reporting whenever you sell in a jurisdiction that requires it, even if the task list is short. HAVGATE's schedule and the pre-loaded tasks are how you show that plan. The report then reads in chapter order, which is what people who know MDSAP expect to see.

Cross-references to ISO 13485, 21 CFR Part 820 under QMSR, and EU MDR are on the task cards so a single interview can collect the evidence once. That is the efficiency argument for MDSAP, used internally: one story, several citations. It fails if the auditor only fills the MDSAP column and leaves the others blank when the site really does sell in Europe or the United States. Decide the citations before the opening meeting.

The sample audit report shows the shape of a finished HAVGATE report with fictional data. Pair it with this checklist when you train a new internal auditor. The knowledge base holds longer articles on ISO 13485 and related regulations. This page is the operational checklist. The glossary entry for MDSAP is the short definition. The glossary entry on grading is the short version of the matrix described above.

What this page does not claim

HAVGATE does not claim to be an auditing organization, a certification body or a regulator. Completing every task in the software does not produce an MDSAP certificate. The checklist is only as good as the evidence you attach and the independence of the auditor. Grading described here is educational and should be checked against the current official grading document before you send a response to an auditing organization. Customer outcomes are not cited because none are published.