We prepare medical device and IVD manufacturers for MDSAP audits against ISO 13485:2016 and the requirements of the US, Canada, Brazil, Australia and Japan. Readiness depends on the markets you supply, because they set what the audit checks beyond the standard.
Overview
MDSAP audit preparation for medical devices and IVD · MDSAP audit approach (MDSAP AU P0002) · ISO 13485:2016 · requirements of FDA, Health Canada, ANVISA, TGA and MHLW/PMDA
Last updated: October 29, 2026
An MDSAP audit takes ISO 13485:2016 as its base and adds the requirements of every participating market the company supplies, from registration to adverse event reporting. A system certified against the standard alone has not yet been audited against those additions.
Industries
Services
Which participating markets you supply, in which role (manufacturer, sponsor, marketing authorization holder), and which jurisdictions can be excluded with a justification. Deliverable: a scope statement per site that the auditing organization can use to plan the audit.
A review of your quality management system against the tasks of the seven MDSAP processes and the country-specific requirements of the markets in scope, with each gap linked to the clause or regulation it misses. Deliverable: a gap list per process and market, prioritized by the grade a finding would likely receive.
How we work together
MDSAP replaces several audits with one, and it widens that one audit. A recognized auditing organization audits your quality management system once against ISO 13485:2016 and the regulatory requirements of the participating markets you supply. The report then goes to the authorities, which use it in their own procedures.
The audit runs in a fixed order through seven processes: management; measurement, analysis and improvement; design and development; production and service controls, with purchasing audited alongside. Two further processes serve the specific requirements of the participating authorities: device marketing authorization and facility registration, and adverse event and advisory notice reporting.
The cycle runs for three years. The initial audit has two stages, a surveillance audit follows in each of the next two years, and a recertification audit closes the cycle. The authorities require unannounced audits where high grade nonconformities have been found; special audits follow, for example, an extension of scope or a significant complaint.
| Market | Authority | What the MDSAP audit is used for |
|---|---|---|
| United States | FDA | substitute for the routine inspection |
| Canada | Health Canada | QMS evidence for class II, III and IV licenses, only MDSAP certificates since January 1, 2019 |
| Brazil | ANVISA | input to ANVISA's assessment procedures; for class III and IV, which need a GMP certificate before registration, it can take the place of ANVISA's own inspection |
| Australia | TGA | auditing organizations assess the QMS on behalf of the TGA under the conformity assessment procedures |
| Japan | MHLW, PMDA | used in the QMS inspection; PMDA can still inspect on site or ask for documents |
For the FDA, the MDSAP report replaces the surveillance inspection, not every inspection: compliance follow-up, for-cause, specific product risk assignment and PMA inspections before and after approval remain. How the FDA itself inspects under the QMSR is set out in our article on compliance program 7382.850.
Every nonconformity is graded from 1 to 5, following GHTF/SG3/N19:2012 as applied in MDSAP. The grade does not fall when the finding is fixed. After the audit, a remediation plan is recommended within 15 calendar days and the evidence for grade 4 and 5 findings within 30; the auditing organization then submits the complete report package to the authorities.
Outside this page: the certification audit under ISO 13485:2016 alone, the notified body audit for the CE mark under MDR and IVDR, and the preparation for an FDA inspection under the QMSR.
Our approach
Step
Result
Set the scope
A list of the markets in scope with the role of the company in each and the justified exclusions.
Assess
A gap list against the MDSAP processes and the country-specific requirements, prioritized by likely grade.
Close the gaps
Revised procedures, records and a reporting matrix for the markets in scope.
Rehearse
A mock audit in MDSAP sequence with graded findings and time to act on them before the audit date.
Respond
A remediation plan within the recommended 15 days and, for grade 4 and 5 findings, evidence within 30.
Common pitfalls
The ISO 13485 certificate is taken as proof of MDSAP readiness.
The MDSAP audit criteria include the standard and the regulations of each participating market the company supplies; the certificate says nothing about the second part.
Markets are excluded to keep the audit short.
The audit approach allows an exclusion only for a jurisdiction the company does not intend to supply, and the exclusion has to be justified in the audit scope.
One reporting deadline is used for every market.
Annex 3 of the MDSAP audit approach lists the timeframes for adverse event reports and advisory notices per jurisdiction, and they are not the same.
The response to findings starts when the report arrives.
The recommended dates count from the last audit day: a remediation plan within 15 calendar days, the evidence for grade 4 and 5 findings within 30.
A finding is argued down to a lower grade with a quick fix.
Under the grading guideline, the grade does not change as a result of a correction or corrective action; only the auditing organization's appeals process can amend it.
Quality Management & Compliance
In a first call we assess your situation and say what needs clarifying first in your case. Without obligation, reply usually within one working day.
FAQ
Image notice: The images on this page were generated using artificial intelligence. They do not depict real people, places, or events.
Projects from this industry
Latest insights
All insights →Mock Audits →
Rehearsing certification and authority audits under real conditions
ISO 13485 Certification →
The certification path to ISO 13485:2016, the base of every MDSAP audit
ISO Audits at a Glance →
Which ISO audit fits your case: ISO 13485, ISO 9001 or a mock audit
Inspection Readiness →
Lasting readiness for inspections by FDA, EMA and national authorities
International Market Access →
Registrations in the markets the MDSAP audit report is used for
Medical Device Vigilance →
Reporting incidents and field safety corrective actions to the authorities
Briefly outline your situation. We'll respond with an initial assessment, usually within one business day.
Prefer direct? +39 02 8904 1000
info@theentourage.it
