MDSAP: Medical Device Single Audit Program and FDA Inspections

The Medical Device Single Audit Program (MDSAP) lets a recognized auditing organization run one regulatory audit of a device manufacturer's quality management system. The audit is meant to satisfy the requirements of every participating regulator. Participation is voluntary for manufacturers regulated by FDA.

MDSAP is a program of regulators, not a standard. The auditing organizations are third parties, many of them bodies that also issue ISO 13485 certificates. The regulators set the audit method, assess the auditors and read the reports.

Who takes part

FDA's MDSAP page lists the participants. Its latest update is dated 18 December 2025, when FDA moved the MDSAP documents to a website managed by Australia's Therapeutic Goods Administration (mdsap.global).

• Members: the Therapeutic Goods Administration of Australia, Brazil's ANVISA, Health Canada, Japan's Ministry of Health, Labour and Welfare with the Pharmaceuticals and Medical Devices Agency, and the US FDA.
• Official observers: the European Union, Singapore's Health Sciences Authority, the UK's MHRA and the WHO Prequalification of In Vitro Diagnostics Programme.
• Affiliate members: Argentina's ANMAT, the Ministry of Health of Israel, Kenya's Pharmacy and Poisons Board, Korea's Ministry of Food and Drug Safety, Mexico's COFEPRIS, South Africa's SAHPRA and Taiwan's FDA.

A pilot ran from 1 January 2014 to 31 December 2016. FDA's compliance program says it joined the operational phase on 1 January 2017. All manufacturers of medical devices are eligible to be audited, according to the program's FAQ.

What an audit covers

The audit method is the MDSAP Audit Approach, document AU P0002. Its current revision, P0002.010, carries a date of 6 February 2026. The revision before it named 21 CFR Part 820 as the Quality System Regulation. This one names it the Quality Management System Regulation.

The audit criteria are ISO 13485:2016 and the quality system requirements of the five member jurisdictions: Australia's Therapeutic Goods (Medical Devices) Regulations, Schedule 3, Brazil's RDC 665/2022, the Canadian Medical Devices Regulations, Japan's Ministerial Ordinance 169 and 21 CFR Part 820. The Audit Approach organizes them into seven processes (chapters):

1. Management
2. Device marketing authorization and facility registration
3. Measurement, analysis and improvement
4. Medical device adverse events and advisory notices reporting
5. Design and development
6. Production and service controls
7. Purchasing

Chapters 1, 3, 5 and 6 are the primary processes, audited in the order management, measurement, design, production. Purchasing is audited together with the measurement, design and production chapters. Chapters 2 and 4 are supporting processes that carry requirements particular to the participating regulators, such as device listing in the US and reporting timelines for adverse events.

The three-year cycle

The Audit Approach describes a three-year cycle:

• Year 1: the initial certification audit, in two stages. Stage 1 reviews documentation and readiness. Stage 2 evaluates implementation and effectiveness. The auditing organization may combine them in one visit.
• Years 2 and 3: the Audit Approach describes a partial surveillance audit in each of the two years after the initial audit, followed by a full re-audit in the third year. MDSAP's own page describes it the same way.
• Any time: special audits, audits by regulators and unannounced audits can fall anywhere in the cycle.

The auditing organization issues the certification documents. The MDSAP FAQ says they state compliance with applicable US regulations.

Grading nonconformities

Each nonconformity is written on a standard form and graded from 1 to 5 under MDSAP's grading rules (AU P0037, which applies GHTF/SG3/N19:2012). The manufacturer answers every one.

• MDSAP recommends a remediation plan within 15 calendar days of the audit end date, covering cause, correction and corrective action.
• For grade 4 and 5 nonconformities it recommends evidence of implementation within 30 calendar days.
• One grade 5 nonconformity, or more than two of grade 4, triggers an early notice to the regulators within 5 working days of the audit end date. So does a perceived public health threat, fraudulent activity or counterfeit product (AU P0027).
• The complete audit report package goes to the regulators within 90 calendar days, or 45 days when the early notice applies. Nonconformities do not have to be closed when the package is submitted.

P0027 is the document that sets these dates. The copy we read is version 007, dated 21 November 2022. The current version is on mdsap.global, which we could not open directly.

How FDA uses MDSAP reports

Section 9 of Compliance Program 7382.850 states FDA's position:

• FDA uses MDSAP audit reports as a substitute for its surveillance inspections of manufacturers that volunteer to participate.
• Reports that include the United States as a jurisdiction are reviewed and classified by FDA.
• Surveillance inspections are not conducted at sites actively enrolled in MDSAP.
• Manufacturers with activities under the radiation-emitting electronic product provisions stay subject to FDA inspection for those activities.
• All manufacturers stay subject to non-surveillance inspections.

The QMSR preamble (89 FR 7496, comment 79) adds that FDA uses the audit reports, not the certificate. It also says FDA does not oversee auditing organizations outside MDSAP and does not evaluate the content of their reports.

An MDSAP audit can also lead to an FDA inspection. The compliance program lists "MDSAP Regulatory Audit Review" among the sources that can start a for-cause inspection. It lists MDSAP audit results among the quality data an investigator weighs when planning an inspection. MDSAP history also sorts sites into surveillance categories: non-baseline applies when the last FDA inspection or MDSAP audit closed NAI or VAI and the site is not currently enrolled. An investigator assigned a site that participates in MDSAP should discuss it with a supervisor before starting.

MDSAP and the QMSR

FDA's QMSR FAQ (question 13) says inspections under the QMSR will not follow the MDSAP audit plan or procedures. Third-party audits assess conformance to a standard and occur annually on a three-year plan. FDA inspections assess compliance with FDA regulations and are scheduled on risk. The FAQ calls MDSAP a voluntary program that remains available.

Passing an MDSAP audit therefore removes the routine FDA visit. It does not prepare a site for the other inspection types. There, the investigator picks elements by risk under FDA's own program instead of following the MDSAP audit sequence. The QMSR page lists the six QMS areas and the clauses behind them. Records FDA may now read include management review, internal audit and supplier audit reports.

The public documents do not say how FDA maps MDSAP nonconformity grades to its own NAI, VAI and OAI classes. We found no published count of FDA classifications of MDSAP reports.

What other regulators do with the report

The MDSAP FAQ (version 017, February 2022) describes the use in each jurisdiction:

• Canada: an MDSAP certificate is required to obtain, maintain or amend a class II, III or IV device licence. Health Canada stopped accepting the older CMDCAS certificates on 1 January 2019.
• Brazil: ANVISA may use an MDSAP audit instead of its own premarket inspection when it grants a GMP certificate for class III and IV devices, and to renew the certificate.
• Japan: the PMDA can use the report to waive an on-site inspection or to replace part of the documents for it, with exceptions.
• Australia: the TGA uses MDSAP reports and certificates as evidence in conformity assessment when the audit covered Australian requirements.

Not covered here

EU MDR certification by notified bodies is separate. MDSAP's observers include the EU, but the program does not replace notified body assessment. The wider standard is covered on the ISO 13485 page. Complaint and adverse event reporting, which MDSAP audits in chapter 4, is covered under post-market surveillance.