MDSAP: what it is, who needs it, and how the audit works

What is MDSAP?

The Medical Device Single Audit Program is one audit of a medical device manufacturer's quality management system that five regulators accept: the US FDA, Health Canada, Australia's TGA, Brazil's ANVISA and Japan's MHLW and PMDA. An auditing organisation the regulators recognise audits against ISO 13485:2016 and each country's own requirements, then issues an MDSAP certificate.

The audit follows the MDSAP audit model, seven processes in place of the standard's clause order. Four are primary: management, measurement, analysis and improvement, design and development, and production and service controls. Three support them: purchasing, device marketing authorisation and facility registration, and adverse event and advisory notice reporting. Certification runs on a three-year cycle, with an initial audit in two stages, a surveillance audit in each of the next two years and a recertification audit before the certificate expires. The programme has run in full since January 2017.

Who needs MDSAP?

Manufacturers holding or applying for a Health Canada medical device licence for a Class II, III or IV device, where the MDSAP certificate has been required since 1 January 2019

Manufacturers selling in the United States who want the audit report accepted in place of a routine FDA inspection, and those registering in Australia, Brazil or Japan who want one audit to stand for each regulator's own

Companies already certified to ISO 13485 that are adding a second or third of the five markets, where one audit cycle takes the place of a separate audit for each regulator

The programme becomes urgent when a Canadian distributor asks for the device licence, when the auditing organisation sends the next audit dates, or when a second regulator asks to audit a system that has just been audited.

MDSAP IN QUALIO

Qualio maps MDSAP beside ISO 13485 in the same library, so one set of records answers the standard and each regulator's additions

Qualio breaks MDSAP down requirement by requirement, beside ISO 13485, and maps your procedures, training, design controls, complaints and CAPAs to both. Shared requirements are answered once, each regulator's additions show as their own gaps with a recommendation, and Qualio reassesses whenever a record changes. Copilot drafts the procedure update from the recommendation, and your team approves it. When the audit dates arrive, you export the audit pack by requirement.

Design controls for the design and development process, read from Jira as the work happens, with the ISO 14971 risk file beside them

Complaints for the adverse event and advisory notice process, with the reportability decision for each market kept on the event, dated and signed

Management review run as an event for the management process, with the actions it raises tracked as tasks on it

Supplier files and supplier corrective actions for the purchasing process, each held with the approvals behind it

Standards that apply alongside MDSAP

Medical devicesISO 13485: The standard the MDSAP audit is built on, so a certified system is the starting point and each regulator's additions are what is left to show
Medical devicesFDA QMSR: The US requirements inside the audit since 2 February 2026, when the FDA's rule incorporated ISO 13485
Medical devicesEU MDR: The EU is outside the programme, so CE marking takes its own notified body audit of the same quality management system
Medical devicesISO 14971: The risk management the audit looks for in every process, from hazard to residual risk
Medical devicesIEC 62304: The software lifecycle inside the design and development process when the device is, or contains, software

Tamer Mölnlycke

Discover how Tamer Mölnlycke Care achieved ISO 13485 compliance and audit success with Qualio, transforming their quality management in record time.

Read the Tamer Mölnlycke story

“We passed our MDSAP recertification audit with Qualio!”

John P.Quality Assurance Manager, KUBTEC Medical Imaging

Guides and checklists for MDSAP

Checklist

MDSAP audit checklist

Webinar

Qualio webinar recording: How to master the Medical Device Single Audit Program (MDSAP)

MDSAP process model: management, measurement, design, production, purchasing and reporting

Blog

Your complete guide to the Medical Device Single Audit Program (MDSAP)

Questions about MDSAP

What is MDSAP?

The Medical Device Single Audit Program lets one audit of a medical device manufacturer's quality management system serve five regulators: the US FDA, Health Canada, Australia's TGA, Brazil's ANVISA and Japan's MHLW and PMDA. A recognised auditing organisation audits against ISO 13485:2016 and each country's requirements, then issues an MDSAP certificate that each regulator uses in its own way.

Is MDSAP mandatory?

Only in Canada, where Health Canada has required an MDSAP certificate for Class II, III and IV device licences since January 2019. In the United States, Australia, Brazil and Japan it is voluntary, and each regulator accepts the report in place of some of its own inspections. The EU is outside the programme, so CE marking needs a notified body.

Does an MDSAP audit replace an FDA inspection?

A routine one. The FDA accepts an MDSAP audit report in place of its routine surveillance inspection of the quality management system, and keeps the right to inspect for cause, before a PMA decision or in a compliance follow-up. The report reaches the FDA from the auditing organisation, with the nonconformities and their grades.

How are MDSAP nonconformities graded?

On a scale of 1 to 5, in two steps. The clause's impact and whether the finding is a repeat set the starting grade, then escalation rules add a point for a missing procedure or product released without its controls. A single grade 5, or more than two grade 4s, reaches the five regulators within five working days.

Can we add MDSAP to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the records you already hold against every requirement, beside ISO 13485 if you run that too. Requirements the two share count once, and the first assessment lists each regulator's additions as their own gaps, with a recommendation on each.

When is the MDSAP audit?

Bring the dates and your ISO 13485 procedures. We will show you MDSAP assessed against them, each regulator's additions on their own list and the audit pack exported by requirement.

Book a demo Get the MDSAP audit checklist

Less time on audit prep. More time on quality.