ISO 13485 and MDSAP Audit Readiness for Medical Device Companies

ISO 13485:2016 is the international quality management system standard for medical devices, and the Medical Device Single Audit Program (MDSAP) lets one audit satisfy the requirements of several regulators. With FDA’s QMSR now aligned to ISO 13485, a well-run system serves your EU, US and other markets at once. This guide explains how the two fit together and how to prepare for an audit without last-minute panic.

ISO 13485 in a nutshell

ISO 13485:2016 follows a process structure with eight main clauses. Clauses 4 to 8 contain the requirements:

Clause	Topic	What auditors look for
4	Quality management system	Scope, risk-based process approach, document and record control, software validation
5	Management responsibility	Quality policy and objectives, regulatory awareness, management review
6	Resource management	Competence and training, infrastructure, work environment and contamination control
7	Product realization	Planning, design and development, purchasing, production, validation, traceability, calibration
8	Measurement, analysis and improvement	Feedback, complaints, regulatory reporting, internal audit, nonconforming product, CAPA

The standard repeatedly requires a risk-based approach, so connect your QMS to ISO 14971 risk management. If you want structured learning, see our Advanced QMS Course and Quality Systems pages.

What MDSAP is and who accepts it

MDSAP is run under the International Medical Device Regulators Forum. A single audit by a recognised auditing organisation is accepted by the participating regulatory authorities: the Therapeutic Goods Administration in Australia, ANVISA in Brazil, Health Canada, the US FDA and Japan’s MHLW and PMDA. Health Canada requires an MDSAP certificate for Class II, III and IV devices. FDA accepts MDSAP audit reports in place of routine inspections in some circumstances. Other regulators have observer or recognition roles, so check each market before relying on a certificate.

MDSAP audits go beyond ISO 13485 because they also check jurisdiction-specific regulatory requirements. They follow a defined audit model with seven linked processes: management; device marketing authorization and facility registration; measurement, analysis and improvement; medical device adverse events and advisory notices reporting; design and development; production and service controls; and purchasing. Nonconformities are graded, and higher grades trigger shorter response times and extra regulator notification, so understand the grading before your first audit.

ISO 13485 certification versus MDSAP versus FDA inspection

	ISO 13485 certification	MDSAP	FDA inspection
Basis	ISO 13485:2016	ISO 13485 plus five regulators’ requirements	FDA regulations including QMSR
Performed by	Certification body	Recognised auditing organisation	FDA investigators
Outcome	Certificate	MDSAP certificate and report shared with participating regulators	Form 483 observations, possible classification of inspection outcome

Audit readiness: a practical programme

1. Scope and gap check. Map your processes to the standard and to each market’s requirements. Close gaps in a tracked plan.
2. Run real internal audits. Audit each process on a risk-based schedule using trained, independent auditors. A clean audit with no findings is a warning sign.
3. Hold a meaningful management review. Include audit results, complaints, CAPA status, supplier performance, regulatory changes and resource needs, with recorded decisions.
4. Check CAPA and complaints. Records should show root cause, effectiveness checks and trend analysis. See CAPA and complaint handling.
5. Review supplier controls. Approved supplier lists, evaluations, agreements and incoming inspection records must exist and match your risk.
6. Verify validation records. Production processes (process validation) and software (CSV/CSA) are common audit topics.
7. Prepare people. Brief staff on how audits work, but never script answers. Staff should explain what they actually do and show the record.
8. Organise logistics. Agree an audit plan, schedule a back-room team for records requests, and nominate a scribe and escort.

During and after the audit

• Answer the question asked, show the record and do not speculate.
• Take notes on observations as they are raised, and clarify anything unclear immediately.
• Respond to nonconformities within the stated deadline with root cause, correction and corrective action, and verify effectiveness later.
• Use audit results as inputs to management review and continual improvement.

For the US-specific view, read our FDA inspection guide and overview of US regulations. For Europe, see the MDR and IVDR overview.

Frequently asked questions

Is ISO 13485 certification the same as MDSAP?

No. ISO 13485 certification confirms conformity with the standard. MDSAP audits also assess the regulatory requirements of the participating authorities and can replace some separate audits and inspections.

Does the QMSR mean I need an ISO 13485 certificate for FDA?

No. FDA incorporates ISO 13485 by reference but does not require a certificate for compliance. Your system must meet the requirements, and FDA inspects against its regulation.

How often are surveillance audits held?

Certification and MDSAP programmes follow a multi-year cycle of an initial audit, regular surveillance audits and recertification. Check the schedule with your auditing organisation.

What is the most common reason for audit nonconformities?

Findings often cluster around CAPA, supplier controls, management review, design controls and training records, because these areas depend on consistent follow-through rather than a one-off effort.

Confirm current MDSAP participation and market requirements with each regulator and your auditing organisation.

Talk to the AptSkill team

Preparing for ISO 13485 certification, an MDSAP audit or an FDA inspection? Contact us.