MDSAP – One audit for the world? Opportunities, limitations and practical application
Anyone operating internationally in the medical device sector is probably familiar with the problem: five markets often mean five different audits – with largely identical requirements, but differing interpretations. This is precisely where the Medical Device Single Audit Programme (MDSAP) comes in – and is noticeably changing the rules of the game in global quality management.
What is MDSAP – and why does it exist in the first place?
The MDSAP is a programme developed by the International Medical Device Regulators Forum (IMDRF) that is based on a central principle: a single audit should cover several regulatory requirements at the same time.
In concrete terms, this means that an audit conducted by an authorised ‘Auditing Organisation’ covers the QMS requirements of five major markets.
The idea behind it is simple, but effective:
- Reduction of redundant audits
- Harmonisation of regulatory requirements
- More efficient use of resources by manufacturers and regulatory authorities
In other words: less audit-related stress, more focus on genuine quality work.
In which countries is MDSAP relevant?
The five ‘core’ countries are:
- USA (FDA)
- Canada (Health Canada)
- Brazil (ANVISA)
- Japan (MHLW/PMDA)
- Australia (TGA)
A key point for the strategy:
- Canada: MDSAP is mandatory for Class II–IV medical devices.
- Other countries: MDSAP is voluntary, but offers clear benefits – e.g. fewer inspections or faster approval.
In addition, other jurisdictions, such as Singapore and South Korea, may recognise MDSAP audit reports indirectly or use them as input for their quality management system assessments, thereby further reducing the assessment burden.
How does MDSAP fit into the existing certification landscape?
MDSAP does not replace existing certifications, but complements them:
- Basis: ISO 13485:2016
- Additional element: Country-specific regulatory requirements (e.g. FDA QMSR and Japanese QMS requirements)
In practice, this means:
- MDSAP runs in parallel with MDR certifications
- An MDSAP certificate does not replace an MDR Annex IX audit
- Synergies arise primarily in audit preparation and system structure
Of interest for Europe: MDSAP reports may, in certain cases, be considered during MDR surveillance audits; however they do not replace such audits in full.
How does the MDSAP audit approach work?
This is one of the key differences compared with traditional audits – and, at the same time, one of its greatest added value.
MDSAP follows a structured process model with clearly defined audit pathways:
Core processes:
- Management
- Measurement, Analysis & Improvement
- Design & Development
- Production & Service Controls
Supporting processes:
- Purchasing / Supplier Control
- Regulatory Reporting & Registration
What makes this approach distinctive:
- The audit sequence is predefined and therefore leaves little room for interpretation
- There is a strong focus on process interdependencies and risks
- A standardised system is used to assess non-conformities
Compared with an MDR audit conducted by a notified body, this means:
- MDSAP = structured, process-driven and highly systematic
- MDR = more document- and product-oriented, with a stronger focus on EU-specific requirements
What happens in the event of non-conformities?
Non-conformities identified during an MDSAP audit have particular significance:
- A standardised grading system is used resulting in a centralised assessment
- The results are made available simultaneously to the participating regulatory authorities, taking into account the manufacturer’s target jurisdictions
Regulatory authorities may initiate measures on the basis of the report In practical terms, this means the following for manufacturers undergoing MDSAP audits:
- A critical non-conformity is not ‘locally limited’, but may trigger action by up to five regulatory authorities
- The impact may affect several markets at the same time
- The pressure to implement effective corrective and preventive actions (CAPA) is correspondingly high
When is MDSAP worthwhile – including from a financial perspective?
The straightforward answer here is: not always immediately .
MDSAP is particularly worthwhile when:
- Several MDSAP markets are being targeted simultaneously
- The USA and Canada are specific target markets
- Growth in international markets is generally planned
A tried-and-tested rule of thumb from practical experience is:
- MDSAP makes sense where two or more relevant markets are to be addressed within a short time horizon
- If the focus is solely on the EU, an MDSAP audit mainly creates additional overhead
In addition, manufacturers incur extra costs due to:
- A longer audit duration
- Additional preparation for the MDSAP audit
- More complex system requirements
Potential ROI, on the other hand, may arise from:
- Fewer individual inspections by individual regulatory authorities
- A lower overall audit frequency
- Faster market access for certain international target markets
How can the MDSAP Guidance be used effectively?
This is where MDSAP offers a hidden value for QM/RA:
The MDSAP documents are far more than just audit specifications – they are also an excellent tool for internal quality management and for implementing the required requirements and processes.
In practice, they can be used in various areas, for example:
- Internal audits:
→ Use of the Audit Approach as a structured checklist - Training colleagues outside QM:
→ The processes are clearly described and easy to follow - Gap analyses:
→ Ideally suited to international harmonisation - System design:
→ Process interdependencies provide valuable input for robust QMS structures
In short: anyone who understands MDSAP also improves their entire quality management system.
MDSAP is not a ‘nice-to-have’ certificate, but a strategic tool for medtech companies operating globally.
It offers clear benefits – primarily through standardisation, efficiency and international recognition. At the same time, however, it also raises the bar in terms of system maturity, audit preparation and CAPA excellence.
Put simply: MDSAP rewards robust systems – and rigorously exposes weak ones.
Please note that all details and listings do not claim to be complete, are without guarantee and are for information purposes only.
