MDSAP Mock Audits - Getting QA and RA on the Same Page

As companies grow larger, they often split the responsibilities of QMS management and regulatory compliance. Typically, QA will handle ISO 13485, FDA QSR, product quality, CAPA compliance, and so on. Regulatory tends to manage product registrations, clinical evaluation reports, risk management, and the like. As companies grow, the scope of responsibilities narrows and people in QA and RA don’t interact as much as they should.

That’s about to change and it’s being driven by one thing: MDSAP.

As you may know, the Medical Device Single Audit Program is a cooperative program between the US, Canada, Brazil, Japan, and Australia (but not Europe). The program was established so manufacturers could have their QMS audited once against the QMS requirements of all five markets. Overall, that’s beneficial for all parties involved, but it does bring new challenges.

The QMS audit will no longer focus solely on quality

To get the Medical Device Single Audit Program to satisfy the needs of all five Auditing Organizations, compromises had to be made. The end result is that MDSAP audits have a wider scope that pulls Regulatory into the fray. You will be asked questions related to regulatory compliance, not just QMS compliance. The MDSAP Audit Model requires review of your entire QMS as well as your device registration processes and regulatory notification (Adverse Event) notification systems. For example, a question that might come up is how your regulatory strategy impacts your product design. Other regulatory-related questions are sure to arise. During the audit you can expect a LOT more emphasis on risk, outsourced activities, validation, and change management.

Don’t be surprised if two or three auditors darken your door. In one recent audit attended by Oriel STAT A MATRIX consultants, two FDA auditors and one Heath Canada auditor were present. The number of auditors that show up for your audit “and the length of the audit” will now depend on the complexity of your organization and the number of applicable MDSAP tasks involved in the audit. Also, don’t be surprised if you get a notice of your audit date only 4-6 weeks prior to the auditors arriving at your company.

MDSAP preassessment and audit tips

1. Assess compliance now, then schedule

Recently, some Oriel STAT A MATRIX clients have found that certain Auditing Organizations are refusing to even schedule an audit until the client can show evidence that they have completed their own internal MDSAP pre-assessment and MDSAP/ISO 13485:2016 mock audit. Before you do that, thoroughly study this 231-page MDSAP audit approach guide most recently updated in April 2021. We can help you with the preassessment / baseline audit.

2. Have someone from QA and RA be part of the audit

Questions related to regulatory issues will come up during the audit. Don’t get caught slack-jawed; be prepared to have someone from Regulatory in the room at all times. Make sure you have “runners” assigned (QA and RA roles) to quickly retrieve documents and records. Ensure coverage during lunchtime as well.

3. Be prepared to shift gears quickly

MDSAP uses a true process-based approach. Auditors may begin reviewing one process and, while following the linkages between other processes, may continue the path of the new process to assure effective implementation across the organization. Don’t get flustered if the audit strays off topic. It’s the new reality of an MDSAP audit, so get used to it.

4. Double-check your approved suppliers list

Your European Authorized Representative and distributors should be treated as suppliers and included on your approved vendors list. Likewise, testing labs and calibration labs should be added as critical suppliers.

5. Double up on the morning coffee

These audits can be intense, so you need to be prepared for long days. It is not unusual for these audits to run from 8:00 a.m. to 6:00 p.m. or later.