MDSAP: How It Differs from Traditional Audits

How is the Medical Device Single Audit Process (MDSAP) different from traditional medical device audits?

MDSAP allows a single audit to satisfy regulatory requirements across multiple Regulatory Authorities or jurisdictions, including Australia, Brazil, Canada, the United States, and Japan. It is not simply an expanded ISO 13485 audit. Rather, the Medical Device Single Audit Process (MDSAP) enables a recognized Auditing Organization, such as SGS, to conduct one regulatory audit of a medical device manufacturer that also satisfies the relevant requirements of participating Regulatory Authorities.

The Medical Device Single Audit Process (MDSAP) follows a process-based audit model that links:

1. ISO 13485 requirements
2. Regulatory requirements from participating countries
3. Interactions between processes

Auditors assess how effectively these processes function together, rather than evaluating them in isolation. This increases both the depth of the audit and the expectations placed on the organization.

Where can I find information on the MDSAP process?

MDSAP now has its own website:

https://www.mdsap.global/

Where can I find the MDSAP audit manual?

The current version of the Audit Approach, MDSAP AU P0001, can be found here:

https://www.mdsap.global/documents/audit-procedures-and-forms

Does MDSAP reduce regulatory inspection risk?

Yes, but only one jurisdiction, Health Canada (HC), actually requires the issuance of a certificate through the MDSAP audit process. The U.S. FDA continues to accept MDSAP audit reports as a substitute for routine agency surveillance inspections. Australia uses these reports as evidence to assess compliance with its medical device market authorization requirements. Brazil uses them as input for its pre-market and post-market assessment procedures. Japan uses them for desktop reviews of Class II, III, and IV medical devices instead of conducting a pre-market inspection.

Canada requires an MDSAP certificate for market acceptance. However, organizations should not assume that passing an MDSAP audit eliminates the need for ongoing regulatory readiness.

What are the most common mistakes in MDSAP audits?

Common issues include:

1. Treating MDSAP like a standard ISO audit
2. Failing to address country-specific requirements
3. Weak connections between processes

For example, complaint handling must now be evaluated through the lens of reportability requirements across all five participating jurisdictions.

MDSAP is designed to evaluate both system effectiveness and regulatory alignment, which increases scrutiny and highlights weaknesses that may not be visible in traditional audits.

If you want to go deeper, SGS offers MDSAP training programs focused on the audit approach, regulatory expectations, grading of nonconformities, and implementation strategies.