What has changed?
A revised policy concerning the MDSAP audit approach has recently been published (MDSAP document AU P0002 on September 1st 2020). This document combines the formerly separate MDSAP Audit Model and Process Companion Documents into a single document and therefore replaces the current MDSAP Companion Document (MDSAP AU G0002.1.004) immediately, although a short transition period until September 30th 2020 is allowed. Any MDSAP audits during this transition timeframe, that have already planned by the auditing organization, will continue using the current companion document and audit model.
To understand the implications of this document, let’s have a look at the changes first.
Our analysis of changes
In comparison to the MDSAP Companion Document, this MDSAP Audit Approach document contains additional details regarding each audited process as well as guidance for assessing the conformity of each process. Furthermore, it reveals some interesting new features and changes. These include:
Clear and descriptive task titles and paragraphed task body text
As an example, let’s compare the Management process task 1 body task text in the two documents:
| MDSAP AU G0002.1.004 Companion Document | MDSAP AU P0002 Audit Approach |
- Confirm that quality management system planning is performed to ensure that all required processes are identified, documented, implemented, monitored and maintained in order to conform to the applicable requirements and meet quality objectives. Verify that changes to the quality management system are managed to maintain the conformity of the quality management system and of the devices produced. Verify that a quality manual has been documented.
| Task 1 – QMS Planning, Implementation, Changes and Quality Manual Confirm that quality management system planning is performed to ensure that all required processes are identified, documented, implemented, monitored and maintained in order to conform to the applicable requirements and meet quality objectives. Verify that changes to the quality management system are managed to maintain the conformity of the quality management system and of the devices produced. Verify that a quality manual has been documented. |
| Clause and Regulation:
[ISO 13485:2016: 4.1.1, 4.1.2, 4.1.3, 4.2.2, 4.1.4, 5.4.2; TG(MD)R Sch3 P1 1.4(4); RDC ANVISA 16/2013: 2.1, 5.6; MHLW MO169: 5, 7, 14; 21 CFR 820.20] Additional country-specific requirements: None | Clause and Regulation: ISO: ISO 13485:2016: 4.1.1, 4.1.2, 4.1.3, 4.2.2, 4.1.4, 5.4.2; TGA: TG(MD)R Sch3 P1 1.4(4); ANVISA: RDC ANVISA 16/2013: 2.1, 5.6; MHLW/PMDA: MHLW MO169: 5, 7, 14; FDA: 21 CFR 820.20 Additional country-specific requirements: None
|
Most notably, the audit tasks (body text) and criteria have not been changed.
A title paragraph has now been added on top of the task body text, i.e., to facilitate identification and referencing audit tasks. The task body text has been structured by using paragraphs for better readability. In addition, the country specific requirements are now clearly listed and grouped per jurisdiction.
Furthermore, links to related processes (e.g., link to Purchasing process from the Management process) are now formatted as internal hyperlinks and when the document is used in electronic form, the navigation bar facilitates quick access to all relevant tasks.New overview annexes have been added
The following annexes have been added:
Annex 3 – Medical Device Adverse Events and Advisory Notices Reporting Process Quick Reference.
This annex provides a quick reference guide concerning timeframes for submitting individual adverse events reports and advisory notices for all the jurisdictions in scope of MDSAP (Australia, Brazil, Canada, Japan and United Sates). Previously, these differences only became apparent by studying the underlying MDSAP jurisdictional regulations. Summarizing, this Annex not only simplifies (prepare) work for the auditor when performing the audit, it also supports the audited company when implementing jurisdictional requirements in their quality management system.
Annex 4 – Requirements for Written Agreements
This annex provides and overview of ISO 13485 clauses and jurisdictional specific requirements referring to information that needs to be defined in written agreements (e.g., contracts or service level agreements). This annex conveniently summarizes information earlier scattered throughout the companion document with respect to written agreements with legal representatives in the various jurisdictions, for example the Australian Sponsor, Brazil legal representative, Canadian Regulatory Correspondent, and the Japanese Marketing Authorization Holder.
Various corrections, clarifications and additions
Various corrections, clarifications and additions have been applied. The changes are summarized in the table below.
| Subject | Changes |
| Audit Sequence | - It is clarified that the order in which processes are to be audited is fixed, however the sequence of audit tasks within a process may be arranged to allow for an efficient audit.
- It is clarified that reasonable exceptions are allowed for following the audit sequence.
|
| Conducting the Audit | - Clarifying text is added as to the assessment of the medical device organization’s application of risk management principles.
|
| Terminology | - Explanatory text has been added for terms including “medical device organization”, “outsourced” process, product or service, “suppliers”, and “critical suppliers”.
|
| MDSAP Audit Cycle | - Statement regarding Stage 1 audits has been added for re-certification audits in certain circumstances.
- A paragraph has been added regarding sampling during audits.
|
| Surveillance Audits | - Reference has been added to Appendix 1 to MDSAP AU P0008.
|
| Management Process | Task 1: - Expectations have been added for the term “documented”.
Task 5: - Australia: reference has been added to EP13A for patient implant cards.
- Australia: clarification has been added of the inclusion of Sponsors activities in the medical device organization’s internal audit.
|
| Device Marketing Authorization and Facility Registration Process | Task 1: - Australia: matters that relate to Australian requirements for the written agreement moved to Annex 4.
- “Note” to “Assessing conformity”, text has been added regarding special attention should be paid to instances where devices are being marketed to jurisdictions where marketing authorization has not been granted.
- Brazil: corrected expiry dates for Brazil for Registration and Notification.
Task 2: - Australia: clarifying text has been added for Australia country-specific requirements.
- Brazil: expiry dates have been corrected for Brazil for Registration and Notification.
Task 3: - Emphasis has been added the link between design changes and the need to assess for market authorization.
- Australia: text added to the Australia country specific requirement regarding notifying TGA of changes in cases where the Manufacturer also holds a TGA Conformity Assessment Certificate.
- Japan: reference has been corrected for Japan to PMD Act 23-2-5.12.
|
| Device Marketing Authorization and Facility Registration process | - Australia: changed “manufacturer should” to “manufactures must” maintain a list of Australian Sponsors and the products.
- Australia: additional reminder added that sponsors are required to have a written agreement with manufacturers.
|
| Measurement, Analysis and Improvement Process | Task 2: - Statement added that information from the organization’s analysis of quality data should be used to inform the audit team’s decision as to specific products and processes to audit during Design and Development, Production and Service Controls, and Purchasing processes.
Task 7: - Australia: Corrected text for country-specific requirements for Australia, added text to the Australia country-specific requirement regarding notifying TGA of changes in cases where the Manufacturer also holds a TGA Conformity Assessment Certificate.
Task 12: - Criteria added for selection of complaints for review.
- Post-marketing systems added as experience to be gained from the post-production experience.
- Post-market surveillance activities added under the “Selecting records”.
- Risk management headings added to “Assessing conformity” for this task.
- Text added that information from reviewing post-production sources, including complaints and post-market surveillance reports, should guide the audit team in selecting designs to review and production processes to audit.
Task 14: - Task was rewritten to focus on the audit of the organization’s process for evaluating complaints for potential individual adverse event reports.
Task 15: - Task was rewritten to focus on audit of the organization’s processes for evaluating quality issues for potential advisory actions.
|
| Medical Device Adverse Events and Advisory Notices Process | Task 1: - Canada: Note added for Canada that requirement to report incidents meeting the requirements of section 59.(1) that occur outside of Canada does not apply unless the Manufacturer has indicated, to a regulatory agency of the country in which the incident occurred, the Manufacturer’s intention to take corrective action, or unless the regulatory agency has required the Manufacturer to take corrective action.
- United States: added allowance for quarterly summary reporting for malfunction MDRs.
|
| Design and Development Process | Task 5: - Post-production feedback is to be used for maintaining product requirements and improving product realization processes.
- Under “Assessing conformity”, “Design inputs” heading, added text relating design inputs to manufacturing processes.
Task 7: - Under “Assessing conformity”, “Design outputs” heading, added text that design outputs can include documents such as diagrams, drawings, specifications, and procedures for both products and processes.
Task 13: - 8.2.1 added as a relevant clause for design changes.
- Australia: text added to the Australia country-specific requirement regarding notifying TGA of changes in cases where the Manufacturer also holds a TGA Conformity Assessment Certificate.
|
| Production and Service Controls Process | Task 1: - Under “Assessing conformity”, “Unique Device Identifier” heading, removed the phase-in dates for device classes.
|
| Purchasing process | Task 5: - Australia: text added text for EP13A for patient implant cards.
|
| Annex 1 | - Change of title to reflect the general content of this section.
- General requirements for Assessing Technical Documentation.
- Added some clarifying text for the expected output from design control for technical documentation and the monitoring of the update of risk management documents.
- Australia: Australian minimum requirement for assessing technical documentation – Added the inclusion of information gathered in feedback processes and patient implant cards.
|
| Annex 2 | - Requirements clarified for grading nonconformities found during audit of sterilization processes.
|
Conclusion
Although the underlying ISO 13485:2016 and jurisdiction specific regulatory requirements have not been changed, the MDSAP audit approach as outlined in the MDSAP AU P0002 Audit Approach document has some structural and content changes that could impact the approach, process and content of your MDSAP (MOCK) audit.
In general, the overall readability of the document – compared to the MDSAP Companion Document – has been improved and supporting appendixes have been added to expedite the implementation and auditing of requirements.
It is highly recommended to familiarize yourself with this audit approach document as soon as possible to understand the changes and implications and be fully prepared for your next MDSAP (MOCK) audit!
In case of further questions or need for support, do not hesitate to contact us.
René Schings, Principle Consultant Quality & Auditing
Henk-Willem Mutsaers, Senior Consultant Quality & Auditing