May 26, 2016

The pilot for the international Medical Device Single Audit Program (MDSAP) is set to end in December 2016, but challenges including low manufacturer participation levels and lack of coordination among some regulators must still be addressed before full-blown implementation of the program can occur.

In this first of a two-part blog post, we'll provide an overview and brief background on MDSAP. Our follow-up post will discuss the program's current status, as well as ongoing challenges MDSAP proponents must address.

Part Two of our MDSAP analysis is available here.

With the management committee of the International Medical Device Regulators Forum (IMDRF) chaired by Brazil’s National Health Surveillance Authority (ANVISA) in 2016, the most recent meeting of the committee was held from 8 to 10 March 2016 in Brasília.

Among the topics tabled by the committee was the Medical Device Single Audit Program (MDSAP), specifically an update on this pilot program and an expression of continued support for this program by the committee. Minor changes were also presented for IMDRF/MDSAP WG/N3:FINAL (2016) Requirements for Medical Device Auditing Organizations for Regulatory Authority Recognition in order to bring in alignment with the requirements of ISO 17021:2015 Conformity Assessment – Requirements for Bodies Providing Audit and Certification of Management Systems – Part 1:Requirements.

A brief history and pilot objectives/criterion

In an effort to address the growing burden on government agencies for resources necessary to ensure continued medical device and IVD manufacturer compliance with quality system regulations and standards, at its first meeting in Singapore (2012), the IMDRF established a work group to establish a single, global audit program known as MDSAP as a substitute for regulatory authority (RA) inspections. The idea being that qualified auditing organizations (AOs) could prepare audit reports accepted by the IMDRF participating RAs  (ANVISA, the US Food and Drug Administration, Health Canada, Japan’s Pharmaceutical and Medical Devices Agency and the Australian Therapeutic Goods Administration) as evidence of compliance.

The IMDRF work group spent the next years developing the supporting requirements for this program, including the establishment of requirements for AOs for RAs, including the competence and training requirements for auditors used by such organizations.

The pilot was started on 1 January, 2014 and was originally slated to finish on 31 December, 2016. AOs selected to participate in this pilot were the following thirteen organizations within the Canadian Medical Device Conformity Assessment System (CMDCAS):

  • BSI Group America Inc.
  • TÜV SÜD America Inc.
  • SAI Global Cert. Services PTY Ltd.
  • TÜV USA Inc.
  • Intertek Testing Services NA Inc.
  • UL, LLC
  • DQS MED GmbH
  • NSAI
  • TÜV Rheinland of NA Inc.
  • DEKRA Certification B.V.
  • SGS UK Ltd.
  • LRQA Inc.

Furthermore, both objectives and acceptance criterion (proof of concept criterion, or PoCC) were established by the IMDRF work group in order to track the performance of the pilot. Details of these objectives and criterion include:


(1) The MDSAP recognition of CMDCAS auditing organizations.

               a. Application review and Head Office Assessments:

3-5 AOs by May 2014, December 2014 and May 2015, and any remainder of the 13 CMDCAS AOs by December 2015

b. Witness Audits for each of the respective 3-5 AOs within 6 months of their Head Office Audit

c. Completion of several Surveillance Assessments of AOs prior to the completion of the Pilot

d. Recognition of an AO will occur after successful application review and completion at a minimum of one (1) successful certification assessment and at a minimum one (1) successful assessment by the MDSAP Regulatory Authority(ies) during a witness audit of the AO auditing a medical device manufacturer(s) using the MDSAP audit process and reporting requirements.

(2) The analysis and evaluation of the results of the implementation of MDSAP program requirements and processes to confirm “proof-of-concept”.

(3) The identification and correction of existing and potential weaknesses within the MDSAP program based on study findings.

(4) Enable a fully operational program no later than 2016.


PoCC No.

Performance Indicator


Performance Measurement



Whether the format and content of audit and nonconformity reports comply with prescribed requirements

> 70% of the sampled and evaluated reports comply.

By a comparison of an evaluation of reports with the requirements of P0019 and the NC Grading & Exchange Form

# of satisfactory reports / # reports evaluated


Whether the evidence provided in audit and nonconformity reports, for common QMS requirements, supports the findings and NC grades

> 80% consistency in the conclusions of the regulators

By a comparison of the evaluations of audit evidence and NC grading performed by different RA on the same sampled reports

# consistent reports among regulators / # reports on which comparison was performed


Whether audit and nonconformity reports would substantiate regulatory decisions

> 80% of reports evaluated would substantiate regulatory decisions

By evaluation of the evidence in audit and nonconformity reports for their capability to substantiate regulatory decisions

# reports suitable for regulatory decisions / # reports evaluated by RAs


Whether the audit model and task sequence appropriately assesses QMS and regulatory requirements

< 5% of audit model tasks requires a correction or corrective action.

By RA assessors observing the application of the audit tasks, as well as feedback from AOs

# of audit tasks requiring corrections / # of audit model tasks


Whether the assessment model and task sequence appropriately assesses MDSAP requirements

< 25% of assessment model tasks require a correction or corrective action

By RA self-evaluation and AO’s feedback about the application of the assessment tasks at HO, CL assessments and at witnessed audits

# of assessment tasks for which a NC is raised / # of assessment model tasks


Whether time provided in the audit duration model is suitable for evaluating and recording evidence of conformity / nonconformity with requirements

The duration for an MDSAP audit is ≥ 100% and ≤ 120% of the calculated duration

By observing the duration of witnessed audits and, at the conclusion, deducting the duration calculated by the AO to account for parallel activities

Duration of witnessed audit / calculated MDSAP audit duration


Whether a sufficient number of candidate AOs are recognised

> 75% of Health Canada MD Licences could be assessed by candidate AOs

By determining the # of MD Licenses supported by a CMDCAS/ MDSAP QMS cert from a Registrar that is a candidate AO

# of MDL supported by CMDCAS / MDSAP AO cert / # of MDLs


Whether a sufficient number of manufacturers participate in MDSAP

> 10% of a candidates AO’s CMDCAS clients

By determining the number of medical device manufacturers (MDMs) that have applied to participate

# of MDMs that have applied to participate / # of CMDCAS clients of all candidate AOs


Michael Dun is Country Manager for Emergo Australia.




  • Michael Dun