MDSAP Consultants for the Medical Device Single Audit Program
The Medical Device Single Audit Program (MDSAP) lets one recognized Auditing Organization carry out a single regulatory audit of a medical device manufacturer’s quality management system for the participating regulators of Australia, Brazil, Canada, Japan and the United States. I3CGLOBAL helps manufacturers prepare with gap analysis, QMS alignment, training and mock audits.
The basics
What Is MDSAP?
MDSAP is an international program in which a single audit of a medical device manufacturer can address the relevant requirements of several regulators. The audit is carried out by an MDSAP-recognized Auditing Organization, not by the regulators themselves.
The program was developed through the International Medical Device Regulators Forum (IMDRF). The audit assesses your quality management system against ISO 13485:2016 and the requirements of the jurisdictions in your audit scope.
The FDA lists five MDSAP members: TGA (Australia), ANVISA (Brazil), Health Canada, MHLW and PMDA (Japan), and the US FDA.
Who Needs MDSAP Certification?
The program is relevant to manufacturers that sell, or plan to sell, medical devices in one or more participating markets. It matters most for companies selling in Canada, where it is the accepted way to show compliance with the quality management system requirements.
You should consider MDSAP if:
- You hold or plan to apply for a Canadian medical device licence for a Class II, III or IV device.
- You sell in two or more of the five member markets and want to reduce separate audits.
- You want audit reports to be considered in place of routine FDA inspections.
- You already hold ISO 13485 certification and want to add country-specific requirements to your audit.
You do not have to sell in all five countries. According to the MDSAP FAQ, a manufacturer may exclude a jurisdiction where it does not intend to supply devices. The audit must still cover ISO 13485 and the regulations of each jurisdiction in which you supply devices.
Which Regulators Participate in MDSAP?
Each member decides how it uses audit results in its own regulatory process, so certification does not replace marketing authorization in any country. The table shows the main references to include when you plan your scope.
| Market | Regulator | Examples of requirements in scope |
|---|---|---|
| United States | US FDA | 21 CFR Part 820 (QMSR), Parts 803, 806, 807, 821 and 830 |
| Canada | Health Canada | Medical Devices Regulations (SOR/98-282) |
| Australia | TGA | Therapeutic Goods (Medical Devices) Regulations 2002 |
| Japan | MHLW and PMDA | MHLW Ministerial Ordinance No. 169 |
| Brazil | ANVISA | RDC 665/2022, RDC 751/2022 and RDC 830/2023 |
What about observers and affiliate members?
The FDA lists the European Union, Singapore HSA, UK MHRA and the WHO Prequalification of IVDs Programme as official observers. Affiliate members include regulators in Argentina, Israel, Kenya, Korea, Mexico, South Africa and Taiwan.
Observer or affiliate status does not mean that this certificate replaces that regulator’s requirements. For example, the program does not replace EU MDR or IVDR conformity assessment. Always check directly with the regulator in your target market.
How does the FDA use MDSAP reports?
The FDA states that it may accept MDSAP audit reports as a substitute for routine agency inspections. Electronic Product Radiation Control activities remain subject to FDA inspection. The MDSAP FAQ also explains that for-cause inspections, compliance follow-up inspections and PMA-related inspections are not replaced.
Is MDSAP Mandatory for Canada?
For Class II, III and IV devices, yes. The MDSAP FAQ states that certification is required to obtain, maintain or amend these Canadian licences, while Class I devices do not need a certified quality system. Health Canada’s transition notice states that only MDSAP certificates are accepted as of January 1, 2019. It describes MDSAP as the sole way for manufacturers to show compliance with the quality management system requirements of the Medical Devices Regulations, including manufacturers that sell only in Canada.
This is why many companies first consider the program when entering the Canadian market. Choose the rest of your scope carefully, since adding other jurisdictions adds requirements to your audit. A clear market plan helps you avoid both missed requirements and unnecessary scope.
How Is MDSAP Different From ISO 13485?
ISO 13485:2016 is the international standard for medical device quality management systems. The program uses it as a base, then adds the regulatory requirements of the jurisdictions in your audit scope. ISO 13485 certification alone is not the same as this certificate.
| Area | ISO 13485:2016 certification | MDSAP certification |
|---|---|---|
| Basis | ISO 13485:2016 requirements | ISO 13485:2016 plus requirements of jurisdictions in scope |
| Audit model | Audit plan of the certification body | Defined audit approach with seven processes |
| Who audits | Accredited certification body | Recognized Auditing Organization |
| Regulator visibility | Not part of the regulator reporting route | Audit outcomes are shared with participating regulators |
| Nonconformity grading | Commonly major or minor | Graded from 1 to 5 |
If you are starting from the beginning, see our ISO 13485 certification guidance and ISO 13485 consultants page.
What Are the Seven MDSAP Audit Processes?
The MDSAP Audit Approach (MDSAP AU P0002) organizes the audit around four primary processes and three supporting processes. Auditors follow a defined sequence, and any change to this sequence needs documented justification.
Management
Quality system planning, management review, resources and how leaders support regulatory compliance.
Measurement, Analysis and Improvement
CAPA, complaints, internal audit, nonconforming product and analysis of quality data.
Design and Development
Design planning, inputs, outputs, verification, validation, transfer and design changes.
Production and Service Controls
Production, process validation, identification, traceability, servicing and control of equipment.
Purchasing
Supplier evaluation, purchasing data and verification. It is audited together with other processes.
Marketing Authorization and Facility Registration
How the company obtains and maintains the authorizations, licences and registrations it needs.
Medical Device Adverse Events and Advisory Notices Reporting
How the company identifies, reports and documents reportable events and advisory notices.
Timeline
How Does the MDSAP Audit Cycle Work?
The program uses a three-year certification cycle with annual audits. The initial audit is a complete audit. Partial surveillance audits follow in the next two years, and a complete recertification audit takes place in the third year.
Routine audits are planned with the manufacturer. Special, regulator-conducted and unannounced audits can occur at any time in the cycle. After a successful initial or recertification audit, the Auditing Organization issues the certification documents.
Audit time is based on planned audit tasks, so it varies with your sites, activities, devices and scope. Ask your Auditing Organization for a written estimate for your scope.
How Are Audit Nonconformities Graded?
Each nonconformity is graded from 1 (least critical) to 5 (most critical), based on GHTF/SG3/N19:2012. Grades reflect both the significance of the requirement and whether the finding is repeated.
According to the MDSAP FAQ, the Auditing Organization must inform regulators within five working days when an audit finds:
- One or more grade 5 nonconformities
- More than two grade 4 nonconformities
- A public health threat
- Fraud or counterfeiting
According to the MDSAP FAQ, the manufacturer must submit a remediation plan within 15 calendar days of the nonconformity report. Evidence of implementing corrections for grade 4 or 5 findings is due within 30 calendar days of the audit end date.
What Records Should You Have Ready for the Audit?
Have records ready that show each process works in practice, not only that a procedure exists. The auditor follows the audit tasks and looks for evidence from your own activities. The exact list depends on your devices, sites and selected countries, but these areas are a useful starting point.
- Management: quality manual, quality objectives, organization charts, management review records and a process for keeping up with regulatory requirements.
- Measurement and improvement: CAPA records, complaint files, internal audit reports, nonconforming product records and trend analysis.
- Design and development: design plans, risk management files, verification and validation records, design transfer records and design change records.
- Production and service: device or batch records, process validation, calibration, environmental controls, identification, traceability and servicing records.
- Purchasing: supplier evaluations, purchasing data, quality agreements and incoming verification records.
- Marketing authorization and registration: current licences, listings and registrations for each country, plus your records for assessing changes.
- Adverse events and advisory notices: reporting procedures for each country, submitted reports, recall or advisory notice records and reporting decisions.
Keep country-specific information easy to find. For example, a reporting procedure should explain which regulator is notified, when, and how your team decides that an event is reportable.
Your ISO 13485 procedures can provide the base, but check that they also address each jurisdiction in your audit scope.
How Does the FDA QMSR Affect MDSAP?
The FDA Quality Management System Regulation (QMSR) took effect on February 2, 2026 and incorporates ISO 13485:2016 by reference. An updated Audit Approach was issued on the same date, with references to the former FDA Quality System Regulation removed, according to NSF.
Industry summaries also report updates to Australian recall references, Brazilian regulations and supplier audit wording. Check the current documents on the regulator-managed program website before you finalize your procedures.
A further revision, MDSAP AU P0002.011, was published on August 3, 2026, according to Complife. Reported changes cover risk management, personnel competence, cybersecurity, UDI, change control and supplier audits.
In practice, manufacturers in scope for the US should:
- Remove old QSR section references from procedures.
- Confirm FDA-specific record and labeling requirements under § 820.35 and § 820.45.
- Keep links to Medical Device Reporting, corrections and removals, tracking and UDI requirements.
- Train auditors and process owners on current wording.
See our FDA QMSR consultants page for the full guide.
What Are the Benefits and Limits of the Program?
The program can reduce repeated audits and bring several regulatory requirements into one audit. It also strengthens areas such as risk management, CAPA and post-market reporting. However, it needs a well-prepared quality system, because the audit covers more than ISO 13485.
Main benefits
- One audit program for selected markets
- Access to the required route for Canadian QMS compliance
- Fewer separate regulatory audits for many companies
- A defined audit model that teams can prepare against
- Stronger links between QMS and regulatory duties
Important limits
- Certification is not market authorization.
- It does not replace 510(k), PMA or other submissions.
- It does not replace EU MDR or IVDR conformity assessment.
- Regulators can still carry out their own inspections.
- Findings can be visible to participating regulators.
How Our MDSAP Consultants Can Help
I3CGLOBAL provides consulting support for manufacturers preparing for the audit. We are consultants, not an Auditing Organization, so certification decisions remain with your chosen Auditing Organization.
MDSAP gap analysis
We assess your QMS against ISO 13485:2016 and requirements of your selected countries, then define a remediation plan.
QMS development and alignment
We design or update your QMS and align it to the seven audit processes.
Regulatory strategy and market focus
We align your audit scope with your target markets among the USA, Canada, Australia, Japan and Brazil.
Training and implementation
We provide role-based training and hands-on implementation support for your team.
Internal and mock audits
We run internal audits and mock audits based on the official audit model.
CAPA and risk management
We support root cause analysis, CAPA development and closure, and links to risk management.
Audit support and coordination
We support your team during certification audits and help manage responses to findings.
Post-certification support
We provide support for surveillance audits, maintenance and continuous improvement.
Combined QMS approach
We can help you connect MDSAP with ISO 13485, FDA QMSR and other market requirements in one system.
How Do You Prepare for an MDSAP Audit?
Preparation works best when you decide the scope early and test your system against the audit model. These steps give you a practical route from planning to certification.
- Define your marketsList the countries where you supply devices, or plan to, and confirm the jurisdictions for your audit scope.
- Run a gap analysisCompare your QMS with ISO 13485:2016, the audit tasks and country-specific requirements.
- Plan remediationAssign owners, priorities and evidence for each gap, starting with the highest risk to product and compliance.
- Update the QMSUpdate procedures, records, reporting routes, registrations and supplier controls.
- Choose an Auditing OrganizationContact recognized Auditing Organizations and confirm scope, sites, schedule and cost.
- Train and audit internallyTrain process owners and carry out internal audits based on the seven audit processes.
- Hold a mock auditTest your team, records and responses, then close findings through CAPA before the audit.
What Do MDSAP Consulting Services Cost?
Our consulting fees depend on the service and whether the work is onsite or offsite. These prices cover I3CGLOBAL consulting only and do not include the fees of an Auditing Organization.
| Service | Fee (USD) |
|---|---|
| Onsite gap assessment | 1,000 per man-day, plus travel and accommodation |
| Offsite gap assessment | 500 per man-day |
| Guidance and support for fixing gaps (offsite) | 300 per man-day |
| Internal audit (offsite) | 600 per man-day |
| Internal audit (onsite) | 1,000 per man-day, plus travel and accommodation |
For a written estimate, contact our team with your devices, sites and target markets.
Work with I3CGLOBAL
Get Your Gaps Reviewed by Our MDSAP Consultants
Our regulatory team can review your quality system against ISO 13485:2016 and your selected markets, then help you close the gaps.
- Gap analysis and remediation plan
- QMS alignment to the seven audit processes
- Internal audits and mock audits
- Audit support and CAPA closure
Request your proposal
Share your devices, sites and target markets, and we will prepare a proposal for your scope.
FAQs
MDSAP: Frequently Asked Questions
What is MDSAP?
MDSAP is the Medical Device Single Audit Program. It allows one recognized Auditing Organization to carry out a single regulatory audit of a medical device manufacturer that addresses the relevant requirements of participating regulators.
Which countries participate in MDSAP?
The members are Australia, Brazil, Canada, Japan and the United States. Their regulators are the TGA, ANVISA, Health Canada, MHLW and PMDA, and the FDA.
Is MDSAP mandatory?
It is not mandatory in every market. Health Canada states that only MDSAP certificates have been accepted since January 1, 2019 to show compliance with its quality management system requirements. Elsewhere, it is generally a choice.
Do we need to sell in all five countries?
No. You can exclude a jurisdiction where you do not intend to supply devices. The audit must include ISO 13485 and the regulations of each jurisdiction where you supply devices.
Does MDSAP replace ISO 13485?
No. The program uses ISO 13485:2016 as a base and adds country-specific requirements. Ask your Auditing Organization how its certificates will reflect both.
Does MDSAP replace FDA inspections?
Audit reports may substitute for routine FDA inspections. They do not replace for-cause or compliance follow-up inspections, PMA-related inspections or Electronic Product Radiation Control inspections.
Is MDSAP the same as market approval?
No. It covers the quality system audit. You still need the marketing authorization, licence or registration required in each market, such as an FDA 510(k) where applicable.
Does MDSAP cover EU MDR or IVDR?
No. The European Union is an observer, and certification does not replace EU MDR or IVDR conformity assessment.
Who issues the MDSAP certificate?
The recognized Auditing Organization issues the certification documents after a successful initial or recertification audit. Consultants and regulators do not issue this certificate.
How long is an MDSAP certification cycle?
The cycle is three years. It has a complete initial audit, two partial surveillance audits and a complete recertification audit in the third year.
How many processes does MDSAP audit?
The audit model has seven processes: four primary processes, Purchasing, and two additional supporting processes for marketing authorization and registration, and for adverse events and advisory notices.
How are MDSAP nonconformities graded?
Nonconformities are graded from 1, the least critical, to 5, the most critical. Some high-grade findings must be reported to regulators within five working days.
Does the QMSR change MDSAP?
The Audit Approach was updated in February 2026 to remove references to the former FDA QSR. Manufacturers with the US in scope should update procedures to the QMSR and check the current program documents.
How long does MDSAP certification take?
There is no fixed period. It depends on your current QMS, devices, sites, selected markets and Auditing Organization availability. A gap analysis gives a realistic basis for your plan.
How do we choose an Auditing Organization?
Choose an organization recognized under the program that covers your device types and selected countries. Compare its availability, audit scope and written cost estimate before you decide.
What happens if the audit finds a nonconformity?
The Auditing Organization grades it from 1 to 5. According to the program FAQ, you must submit a remediation plan within 15 calendar days of the report, and evidence for grade 4 or 5 findings within 30 calendar days of the audit end date.
Can we move from ISO 13485 certification to MDSAP?
Yes. Many requirements overlap, because the program uses ISO 13485:2016 as its base. You still need to add the regulatory requirements of each country in your scope and prepare for the audit model. Ask your Auditing Organization how it handles the change from your current certificate.