MDSAP Consultants: Preparing Your Quality System for an MDSAP Audit

Compliance Management Solutions helps medical device manufacturers prepare for the Medical Device Single Audit Program (MDSAP). We assess your quality management system against the MDSAP audit model, close the gaps, audit the system independently before the auditing organisation arrives, and help you plan the audit scope so the certificate can be used in your Australian ARTG applications.

Talk to us about MDSAP Call +61 4 33 124 266

What MDSAP is

MDSAP allows a recognised auditing organisation to carry out a single regulatory audit of a medical device manufacturer that satisfies the requirements of the participating regulatory authorities. The program is based on ISO 13485:2016, with the specific regulatory requirements of each participating jurisdiction audited alongside it. For Australia, the MDSAP audit approach covers the quality management system parts of the Therapeutic Goods (Medical Devices) Regulations 2002: Schedule 3 Part 1, excluding clause 1.6 (design examination), and Schedule 3 Part 4.

MDSAP adds no requirements of its own beyond ISO 13485 and the national regulations. What it changes is how they are audited: one audit, one report format and one certificate, used by several regulators.

Who participates

As listed by the program in September 2026:

Role	Regulators
Members (the Regulatory Authority Council)	Australia's TGA, Brazil's ANVISA, Health Canada, Japan's MHLW and PMDA, and the US FDA
Official observers	The European Union (represented by the European Commission), Singapore's HSA, the UK's MHRA, and the WHO Prequalification of IVDs Programme
Affiliate members	Argentina (ANMAT), Israel's Ministry of Health, Kenya's Pharmacy and Poisons Board, Malaysia's Medical Device Authority, Mexico (COFEPRIS), the Republic of Korea's MFDS, South Africa (SAHPRA), Taiwan FDA, and the Tanzania Medicines and Medical Devices Authority

How each regulator uses MDSAP

Each regulator uses the program differently and remains the authority for market authorisation in its own jurisdiction:

Canada. MDSAP certification is required to obtain a Class II, III or IV medical device licence.
United States. The FDA accepts MDSAP audit reports as a substitute for routine inspections. For-cause and compliance follow-up inspections are not affected, and neither are pre-approval or post-approval inspections for premarket approval (PMA) applications.
Japan. MHLW and PMDA can use an MDSAP report to exempt a manufacturing site from on-site inspection, or to replace much of the documentation an inspection would require, with some exceptions.
Brazil. ANVISA may use an MDSAP audit in place of its own premarket inspection when granting GMP certification for Class III and IV devices.
Australia. Covered in detail below.

How the TGA uses MDSAP

The TGA assesses MDSAP audit reports and certificates as part of the evidence sponsors and manufacturers need to meet the medical device requirements, and MDSAP auditing organisations are among the comparable overseas assessment bodies it recognises. In practice:

Australia must be in the audit. The certificates and audit reports have to state that the manufacturer was assessed and found to comply with the relevant aspects of the Therapeutic Goods (Medical Devices) Regulations 2002. A certificate that does not cover Australia does not help an ARTG application, and because manufacturers can leave out jurisdictions they do not supply, the scope is worth checking before the audit is booked.
It must be the right manufacturer. According to the TGA's evidence guidance, the certificate must be issued to the manufacturer named on the labelling and instructions for use, and the TGA can only use certificates and reports that relate to manufacturers.
For higher classes it is paired with product evidence. The same guidance gives the example of a Class IIb device, where the MDSAP certificate is submitted as manufacturer evidence together with the product approval from the FDA or Health Canada.
It can shorten a TGA assessment. A sufficiently detailed MDSAP report can support an abridged assessment of a TGA conformity assessment application, for example a desk assessment of the quality system instead of an on-site audit.
It usually avoids a separate TGA audit. The TGA states it usually will not audit manufacturers that have been audited under MDSAP, although it reserves the right to audit any manufacturer supplying devices to Australia.

Eligibility matters too. MDSAP is open to legal manufacturers that market devices under their own name, and contract manufacturers are not eligible under Australian or Canadian regulations. How the evidence fits the rest of your application is covered on our ARTG inclusion and TGA conformity assessment pages.

The MDSAP audit cycle

The program's Audit Approach sets a three-year cycle:

Audit	When	What it does
Initial audit, Stage 1	Year 1	Reviews the quality system documentation and assesses whether you are ready for Stage 2
Initial audit, Stage 2	Year 1	Evaluates whether ISO 13485 and the relevant regulatory requirements are implemented and effective
Surveillance audits	Years 2 and 3	Partial audits of reduced scope, once a year
Recertification audit	Year 3	A complete re-audit ahead of the next cycle

Special audits, audits by regulatory authorities and unannounced audits can take place at any point. The certificate is issued after a successful initial or recertification audit, not normally after surveillance audits. Audits can be on site, off site as a documentation review, remote, or a combination, and the auditing organisation sets the audit duration. You choose and contract a recognised auditing organisation directly; the regulators are not part of that agreement.

What the audit looks at

MDSAP is a process-based audit. Auditors follow a set sequence of four primary processes, each linked to purchasing, with two further processes that carry the jurisdiction specific requirements:

Management, including quality system planning, quality policy and objectives, and organisational structure
Measurement, analysis and improvement, including sources of quality data, investigation of nonconformities, CAPA and internal audits
Design and development, from inputs through verification, validation and design changes
Production and service controls, including process validation and control of monitoring and measuring equipment
Purchasing: supplier selection, control and verification of purchased product
Device marketing authorisation and facility registration, including notifying regulators of changes
Medical device adverse events and advisory notice reporting

Because the audit traces how processes link together, a well-written procedure is not enough on its own. The auditor will look for records that show the process is running.

Nonconformity grading and response times

Nonconformities are graded from 1, the least critical, to 5, the most critical, following GHTF/SG3/N19:2012, and audit outcomes are shared with the participating regulators. The response periods are short:

15 calendar days to provide your investigation of each nonconformity and the actions you propose.
30 calendar days to provide evidence of implementation for any nonconformity graded 4 or 5.

That timetable is why CAPA and complaint handling need to be working well before the audit, not rebuilt after it.

How we help

Gap assessments against the MDSAP audit model and the regulations of the markets you supply, with structured reporting and a practical recommendation for each nonconformity.
ISO 13485 quality systems built for MDSAP, including for companies transitioning to MDSAP: design and development, supplier and purchasing controls, CAPA, complaint handling and post-market surveillance processes, internal audit and management review. See our ISO 13485 consulting page.
Independent internal audits in accordance with ISO 19011, covering MDSAP, ISO 13485, MDR and IVDR, so the system has been tested from the outside before the auditing organisation arrives.
MDSAP training for your team, as part of our medical device training.
Coordinated MDSAP quotations and liaison with our notified body partners.
Using the certificate in Australia: ARTG inclusion support, including the manufacturer evidence your application depends on, and market entry strategy for the other MDSAP markets.

Our director, George Loizou, has worked as an MDSAP auditing organisation lead auditor and as a notified body lead auditor, so we prepare systems with the auditor's questions in mind. We are not an MDSAP auditing organisation: we do not conduct certification audits or issue MDSAP certificates.

Is MDSAP the right route?

If Canada is on your plan, MDSAP is a requirement for Class II, III and IV device licences. If the United States, Japan or Brazil are near-term markets, one audit that serves several regulators can reduce duplicated audit work. A manufacturer that supplies only Australia may find another conformity assessment route more proportionate. We help you weigh that against your market roadmap before you commit to an auditing organisation.

Start with an MDSAP gap assessment

Frequently asked questions

What is an MDSAP audit?

A single regulatory audit of a medical device manufacturer's quality management system, carried out by a recognised MDSAP auditing organisation, that satisfies the requirements of the participating regulators: the TGA, Brazil's ANVISA, Health Canada, Japan's MHLW and PMDA, and the US FDA. It covers ISO 13485:2016 plus the specific regulatory requirements of the jurisdictions where the manufacturer supplies devices.

Is MDSAP mandatory?

For Canada, effectively yes: MDSAP certification is required to obtain a Class II, III or IV medical device licence. For the other participating jurisdictions, including Australia, it is one way of providing evidence rather than a requirement, and each regulator uses it differently.

Does the TGA accept an MDSAP certificate for ARTG inclusion?

The TGA assesses MDSAP certificates and audit reports as part of the evidence for ARTG applications and conformity assessment. The certificate must be issued to the manufacturer named on the labelling, and it must show that the manufacturer was assessed and found to comply with the relevant aspects of the Therapeutic Goods (Medical Devices) Regulations 2002. For higher-class devices, the TGA's guidance pairs the MDSAP certificate with evidence of product assessment, such as an FDA or Health Canada approval.

Can Compliance Management Solutions carry out our MDSAP certification audit?

No. Only a recognised MDSAP auditing organisation can conduct the audit and issue an MDSAP certificate, and manufacturers contract with the auditing organisation directly. We prepare you for that audit: gap assessments, quality system implementation, independent internal audits and training.

How often are MDSAP audits held?

MDSAP runs on a three-year cycle: an initial audit in two stages, a surveillance audit in each of the following two years, and a recertification audit in the third year. Special audits, audits by regulatory authorities and unannounced audits can happen at any time in the cycle.

How are MDSAP nonconformities graded?

On a scale from 1, the least critical, to 5, the most critical, following GHTF/SG3/N19:2012. The manufacturer has 15 calendar days to respond with its investigation and proposed actions, and 30 calendar days to provide evidence of implementation for any nonconformity graded 4 or 5.

Does MDSAP replace FDA inspections?

It replaces routine ones. The FDA accepts MDSAP audit reports as a substitute for routine inspections, but for-cause and compliance follow-up inspections are not affected, and MDSAP does not apply to pre-approval or post-approval inspections for premarket approval (PMA) applications.

Can we leave a market out of the MDSAP audit?

A manufacturer may exclude the requirements of a jurisdiction where it does not intend to supply devices. The audit must still cover ISO 13485 and the regulations of every participating jurisdiction where it does supply, and all products supplied to those jurisdictions. If you intend to use the certificate in Australia, the Australian requirements have to be in scope.