MDSAP audit approach: how auditors work through your QMS

When the Medical Device Single Audit Program (MDSAP) pilot started on 1 January 2014, the idea was simple: one regulatory audit of a manufacturer's quality management system that satisfies several regulators at once. The pilot ran until 31 December 2016, and the programme has since become a condition for market access in Canada, where Health Canada has required an MDSAP certificate for Class II, III and IV device licences since 1 January 2019 (Medical Devices Regulations, SOR/98-282). In the United States, the FDA may accept MDSAP audit reports as a substitute for routine inspections, with the exception of activities under the Electronic Product Radiation Control provisions. The participating authorities are Australia's TGA, Brazil's ANVISA, Health Canada, Japan's MHLW and PMDA, and the US FDA.

What is often overlooked is that the MDSAP audit approach is published in full. The current version, MDSAP AU P0002.011 (revision date 3 August 2026), sets out the order in which auditors cover your processes, the tasks they complete within each process, and the country-specific requirements they verify along the way. Few audit schemes hand the auditee the auditor's script; this one does. Our article on MDSAP members, audit cycle and regulator use covers who takes part and how each regulator uses the report. In this post we outline how the audit approach is structured, how findings are graded and reported, what version 011 changes for software manufacturers, and how to use all of this to prepare.

Background

The audit approach covers ISO 13485:2016 together with the quality management system requirements of each participating authority: Schedule 3 of the Australian Therapeutic Goods (Medical Devices) Regulations, RDC ANVISA 665/2022 in Brazil, the Canadian Medical Devices Regulations, MHLW Ministerial Ordinance No. 169 in Japan, and the Quality Management System Regulation (21 CFR Part 820) in the United States (AU P0002.011, Overview). Each audit task links an ISO 13485 requirement to the country-specific requirements that apply to it, so a single piece of evidence is often assessed against several regulators' expectations at the same time.

Version 010, published in February 2026, removed the references to the former FDA Quality System Regulation and aligned the audit approach with the QMSR, which took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. Where an authority still has requirements of its own, such as FDA device listing, which must be updated between 1 October and 31 December (AU P0002.011, Summary of Changes), those requirements remain in the relevant tasks. We discussed the QMSR transition itself in our article on FDA QMSR and ISO 13485 alignment.

One boundary is worth stating plainly. The European Union is an official observer to MDSAP, not a participating authority (FDA). An MDSAP audit therefore does not replace conformity assessment by a notified body under the MDR or IVDR. A manufacturer selling in the EU and Canada will run two audit programmes, although the same ISO 13485 quality management system can, and should, serve both. Manufacturers based outside the EU also need an EU authorised representative under Article 11 of the MDR; MedQAIR's Digital AR service covers that role.

Audit sequence

The audit approach is process-based. It has four primary processes (Management; Measurement, Analysis and Improvement; Design and Development; Production and Service Controls), linked to the supporting Purchasing process, plus two additional supporting processes: Device Marketing Authorization and Facility Registration, and Medical Device Adverse Events and Advisory Notices Reporting (AU P0002.011, Audit Sequence). Purchasing is not folded into the other processes: it has its own tasks, and the auditor also follows supplier links from the processes that rely on it. Risk management is expected to be the foundation of all of them.

The order of the processes is prescribed. Since version 008, auditors may also take Production and Service Controls directly after Measurement, Analysis and Improvement and only then move to Design and Development, as a reasonable deviation from the standard sequence. The order of tasks within a process is not prescribed.

The table below sets out the seven processes and the version 011 changes that matter most for software, SaMD and AI-enabled device manufacturers.

Source: MDSAP AU P0002.011, Summary of Changes from Prior Revisions.

The practical consequence of a process-based audit is that the auditor follows connections rather than clauses. A complaint leads into investigation and CAPA, the CAPA into a design change, the design change into verification, release and, since version 011, cybersecurity review. If those records live in separate systems with no traceable link between them, each record may look acceptable on its own while the chain between them fails, and it is the chain the auditor is asked to verify.

The audit cycle runs over three years: an initial audit in two stages (Stage 1 and Stage 2), two surveillance audits, and a recertification audit. Surveillance audits do not require a Stage 1 audit, and they must include a review of complaints, problem reports, vigilance reports and recalls, field corrections and advisory notices since the previous audit (AU P0002.011, Overview).

Nonconformity grading

MDSAP does not use the familiar "major" and "minor" labels. Findings are graded from 1 to 5 under MDSAP AU P0037.002, the MDSAP guidelines on the use of GHTF/SG3/N19:2012. The starting grade depends on where the cited ISO 13485 clause sits, and escalation criteria are then added.

Two deviations from the original GHTF document are worth knowing: a nonconformity against the medical device file (clause 4.2.3) is treated as direct impact, and one against internal audits (clause 8.2.4) as indirect impact. The choice of clause is therefore not a formality. The guidance requires auditors to cite the most specific requirement, and where a gap does or could affect device safety or performance, the finding belongs under a direct-impact clause. P0037 itself gives the example of a manufacturer selling in Australia, Canada and the US whose adverse event procedure covers Canadian and US reporting but not Australian reporting: because that gap can affect safety, the finding is graded as direct impact.

The repeat criterion also has a nuance that is easily missed. If a manufacturer is implementing accepted corrective actions for a nonconformity from a previous audit within the expected timeframes, auditors should avoid citing it again as a repeat (P0037.002, 5.2.2). The protection only holds while the corrective action is on schedule, which makes CAPA timeliness a grading issue as much as a QMS one.

After the audit

The post-audit timeline is set by MDSAP AU P0027.007, the Post Audit Activities and Timeline Policy. Nonconformity reports are issued on the last day of the audit (D0), and the deadlines run from that date.

The audit report package includes the audit report, the grading form, the nonconformity reports with the manufacturer's remediation plan and the auditing organisation's review of it, and, for grade 4 or 5 nonconformities, the manufacturer's evidence of implementation. Nonconformities do not need to be closed when the package is shared. P0027 also sets due dates, relative to D0, for the manufacturer to provide its investigation results, correction and corrective action plans and evidence of implementation; confirm these with your auditing organisation, as they drive your own post-audit plan.

In other words, a single grade 5 finding means the regulators hear about it within a week, and see your remediation plan within six. That is a good reason to understand the grading before the auditor arrives rather than at the closing meeting.

Example: a software release under audit

To show how these pieces interact, take a hypothetical case. The assumptions are deliberately simple.

A manufacturer of cloud-based clinical decision support software holds MDSAP certification and sells in the US and Canada. During the second surveillance audit, the auditor samples release 4.2, which added a new interface to hospital information systems. The design change record exists and was approved, but the cybersecurity risk assessment was not updated for the new interface, and the release was deployed to customers.

Design change control sits under ISO 13485:2016 clause 7.3.9, which has direct QMS impact: starting grade 3. The first surveillance audit had cited 7.3.9 for incomplete verification of another change, and the corrective action was never completed: repeat nonconformity, grade 4. If the auditor also concludes that the deployed release itself was nonconforming, the release criterion applies and the finding reaches grade 5. One grade 5 is enough for a 5-day Notice to the regulatory authorities, and the complete audit report package follows within 45 days.

The technical gap started the finding at grade 3; the clause it falls under, the stalled CAPA from the previous audit and the release of the software took it to grade 5. Version 011 makes this scenario more likely to surface, since Design and Development tasks 7 and 12 now explicitly include FDA device cybersecurity requirements, with a new link to Measurement, Analysis and Improvement.

Preparing for the audit

Because the audit approach is public, preparation is largely a matter of reading it the way the auditor will. In practice, that means:

• mapping each applicable audit task to the procedure that governs it, the records that show it is implemented and the person who can explain it, for the markets in your audit scope only;

• running an internal mock audit in the MDSAP process order, conducted by someone independent of the processes being audited;

• tracing at least one recent design change, for software manufacturers a recent release, through design control, cybersecurity review, verification, release and postmarket feedback;

• grading every internal finding against P0037: the clause, the starting grade, whether the same sub-clause was cited in the past three years, and whether nonconforming product was released;

• checking that every corrective action from previous MDSAP audits is on schedule, since a stalled CAPA is the shortest route to a repeat nonconformity.

The country-specific tasks deserve particular attention. Marketing authorisation, facility registration and adverse event reporting are where a QMS built purely on ISO 13485 tends to show gaps, as the Australian adverse event example in P0037 illustrates.

Conclusion

The MDSAP audit approach is one of the few audit methods where the auditor's route, tasks and grading rules are all on paper. That makes an MDSAP audit demanding, since one weak link can be examined against five regulators' requirements at once, but it also makes it predictable. The grading system and the 5-day Notice turn a handful of findings into direct regulator visibility, and version 011 has moved cybersecurity firmly into the Design and Development and Measurement, Analysis and Improvement tasks.

With three versions of the audit approach published in two years, the document is clearly still moving. Our advice is simple: treat AU P0002.011 as your internal audit checklist, grade your own findings with P0037 before anyone else does, and keep your CAPAs on schedule. Then the audit becomes a confirmation rather than a discovery exercise.

If you are preparing for an MDSAP audit, or want a mock audit run in the MDSAP process order, you can contact the MedQAIR team or read more about our audit services.

Frequently asked questions

Does an MDSAP audit replace an MDR notified body audit?

No. The European Union is an official MDSAP observer, not a participating authority. Conformity assessment under the MDR or IVDR still requires a notified body (FDA MDSAP page).

Is MDSAP mandatory?

It depends on the market. Health Canada requires an MDSAP certificate for Class II, III and IV device licences. In the US, participation is voluntary, but the FDA may accept MDSAP audit reports as a substitute for routine inspections.

When is a nonconformity a "repeat"?

When a similar nonconformity was cited against the same ISO 13485 sub-clause in any audit within the previous three years. Auditors should avoid citing a repeat if the manufacturer is implementing accepted corrective actions within the expected timeframes (MDSAP AU P0037.002, 5.2.2).

What triggers an MDSAP 5-day Notice?

One or more grade 5 nonconformities, more than two grade 4 nonconformities, or a perceived public health threat, fraudulent activity or counterfeit product identified during the audit. The auditing organisation must then inform the regulatory authorities within 5 working days of the audit end date (MDSAP AU P0027.007, 5.4).

Do surveillance audits include a Stage 1 audit?

No. Stage 1 is part of the initial audit only; surveillance audits do not require a Stage 1 audit (MDSAP AU P0002.011, Overview).

What does version 011 change for software manufacturers?

It adds US FDA device cybersecurity requirements to Design and Development tasks 7 and 12, cybersecurity and postmarket feedback provisions to Measurement, Analysis and Improvement task 12, and provisions for devices with software functions to Production and Service Controls task 26. It also removes the AI-specific wording around predetermined change control plans.