MDSAP Audit Approach Updated From Rev. 6 To 7

On April 15, 2022, MDSAP Audit Approach AU P0002.007 was updated. This article summarizes the changes from version 006 to 007. Please note that only the changed requirements are included in this summary.

MDSAP AU P0037 Guidelines on the use of Quality management system – Medical devices – Nonconformity Grading System for Regulatory Purposes and Information Exchange (GHTF/SG3/N19:2012) for MDSAP purposes was added as a reference. MDSAP AU P0037 is used by regulatory authorities, auditing organizations, and medical device manufacturers participating in or utilizing the results of the MDSAP. MDSAP AU P0037 provides guidelines for the use of the document GHTF/SG3/N19:2012: Quality management system - Medical devices – Nonconformity Grading System for Regulatory Purposes and Information Exchange for grading nonconformities resulting from MDSAP audits.

Chapter 1: Management

General: Australian, Brazilian, and Japanese regulatory clauses references were updated as appropriate.

Chapter 2: Device Marketing Authorization and Facility Registration

General: Australian, Brazilian, and Japanese regulatory clauses references were updated as appropriate.

Task 3 – Notification of Changes to Marketed Devices or to the QMS

Ensure your organization has identified changes to marketed devices or the quality management system that require notification to regulatory authorities. The audit team should pay special attention to situations observed in the audit of the design and development processes (specifically design changes) that may require notification to the jurisdictions to which the changed devices are marketed. Clarified FDA premarket notification requirements for changes:

• 21 CFR 807.81 - Premarket Notification

A new complete 510(k) application is usually required for changes or modifications to an existing device, where the modifications could significantly affect the safety or effectiveness of the device, or the device is to be marketed for a new or different indication. Most changes in indications for use require the submission of a 510(k).

• 21 CFR 814.39 – PMA Supplements

After FDA’s approval of a PMA, an applicant must submit a PMA supplement for review and approval by FDA before making a change affecting the safety or effectiveness of the device for which the applicant has an approved PMA.

Chapter 3: Measurement, Analysis, and Improvement

General: Australian, Brazilian, and Japanese regulatory clauses references were updated as appropriate.

Task 12 – Evaluation of Information from Post-Production Phase, Including Complaints

Ensure your organization has made effective arrangements for gaining experience from the post-production phase, including post-market surveillance, handling complaints, and investigating the cause of nonconformities related to advisory notices with provision for feedback into the measurement, analysis, and improvement processes. Updated requirements for Health Canada:

• Ensure your organization has established and implemented documented procedures for preparing summary reports with respect to information received or of which they became aware during the previous 24 months for Class II medical devices and during the previous 12 months for Class III and IV medical devices. [CMDR 61.4(1)]
• Verify that summary reports cover adverse effects, reported problems and complaints, reportable incidents in accordance with section 59(1), and serious risks of injury to human health that are relevant to the safety of the medical device in accordance with section 61.2(2). [CMDR 61.4(2)]
• Verify that the summary report includes a concise critical analysis of the information required in section 61.4(2). [CMDR 61.4(3)]
• Ensure your organization has determined, based on the analysis of data, whether what is known about the benefits and risks associated with the medical device has changed, as follows: any of the benefits that may be obtained by patients through the use of the medical device could be less; with respect to any of the risks, the risk is more likely to occur or, if the risk occurs, the consequences for the health and safety of patients, users, or other persons could be more serious; and a new risk has been identified.
• Ensure your organization has included the conclusions drawn from the above-mentioned analysis in the summary report. [CMDR 61.4(4) & (5)]
• Ensure your organization has notified the Minister in writing within 72 hours after concluding that what is known about the benefits and risks associated with the medical device has changed. [CMDR 61.4(6)]
• Ensure your organization retains records of the summary reports, the information used in the preparation of the reports, and any associated notification to the Minister for seven years after the day on which they are created. [CMDR 61.6]

Task 15 – Evaluation of Quality Problems for Advisory Notices

Ensure your organization r has made effective arrangements for the timely evaluation of quality problems involving distributed product for potential issuance and implementation of advisory notices. Updated regulation reference for Brazil RDC ANVISA 665/2022: Art. 120 section VIII, RDC ANVISA 551/2021.

Chapter 4: Medical Device Adverse Events and Advisory Notices Reporting

General: Australian, Brazilian, and Japanese regulatory clauses references were updated as appropriate.

Task 1 – Notification of Adverse Events

Ensure your organization has a process in place for identifying device-related events that may meet reporting criteria as defined by participating regulatory authorities. Verify that the complaint process has a mechanism for reviewing each complaint to determine if a report to a regulatory authority is required. Confirm that the medical device organization’s processes meet the timeframes required by each regulatory authority where the product is marketed. Updated requirements for Health Canada:

• Manufacturers and importers can use the “Mandatory Medical Device Problem Reporting Form for Industry” to submit preliminary and final incident report.
• If the reports required by section 60 and 61 are submitted to the Minister just by the importer, ensure your organization has advised the Minister in writing that the reports the manufacturer and importer would have submitted were identical and that the manufacturer has permitted the importer to prepare and submit reports to the Minister on the manufacturer’s behalf [CMDR 61.1]. This notification is to be done using Health Canada form “FRM-0090.”
• Ensure your organization submits to the Minister information regarding serious risk of injury to human health related to the safety of the device that it becomes aware of or receives, regarding:

(a) risks that have been communicated by any Regulatory Agency that is set out in the List of Regulatory Agencies for the Purposes of Section 61.2 of the Medical Devices Regulations, or by any person who is authorized to manufacture or sell a medical device within the jurisdiction of such a Regulatory Agency, and the manner of the communication;

(b) changes that have been made to the labelling of any medical device and that have been communicated to or requested by any Regulatory Agency that is set out in the list referred to in paragraph (a); and

(c) recalls, reassessments and suspensions or revocations of authorizations, including licenses, in respect of any medical device, that have taken place within the jurisdiction of any Regulatory Agency that is set out in the list referred to in paragraph (a). [CMDR 61.2(2)]

• For greater clarity, serious risk of injury to human health is defined as a hazard associated with the medical device that is relevant to the safety of the medical device and that, without risk mitigation, would likely:
  • be life-threatening
  • result in persistent or significant disability or incapacity
  • require inpatient hospitalization or prolonged hospitalization
  • result in a serious health consequence such as loss of function or debilitating chronic pain
  • result in death

Verify that your organization has submitted notifications of foreign risks within 72 hours after receiving or becoming aware that a notifiable action has been taken in response to a serious risk, whichever comes first. [CMDR 61.2(3)]

• Foreign Risk Notifications can be submitted using the “Medical Device Foreign Risk Notification Form for Industry.”
• If the notification required by section 61.2 is submitted to the Minister just by the importer, ensure your organization has advised the Minister in writing that the report the manufacturer and importer would have submitted were identical and that the manufacturer has permitted the importer to prepare and submit reports to the Minister on the manufacturer’s behalf. [CMDR 61.3(2)] This notification is to be done using Health Canada form “FRM-0090.”
• Additional information and guidance on Foreign Risk Notification can be found in the associated Guidance Document.

Task 2 – Notification of Advisory Notices

Verify that advisory notices are reported to regulatory authorities when necessary and comply with the timeframes and recordkeeping requirements established by participating regulatory authorities.

Clarified Australian recall reporting requirements:

• Manufacturers are required to implement a post-marketing system that includes provisions for the recall of devices – e.g., Therapeutic Goods (Medical Devices) Regulations 2002 Schedule 3 Part 1 Clause 1.4 (3A). Under the MDSAP, and in view of the written agreement between Manufacturers and the Australian sponsor [TG Act 41FD] (see Annex 4), proposed recalls must be reported by the manufacturer to the MDSAP AO, and to the TGA or sponsor in a timely manner to ensure that a sponsor can meet their reporting obligations. [Therapeutic Goods (Medical Devices) Regulation 5.7 and 5.8, Therapeutic Goods Act Part 4-9, and the Uniform Recall Procedure for Therapeutic Goods (URPTG)]

Updated regulation references for Brazil:

• Verify that procedures and workflows were established in order to identify when field actions (recalls and corrections) are necessary, in accordance with the medical device organization’s post-market surveillance system and quality system. [RDC ANVISA 67/2009 - Art. 6º, RDC ANVISA 551/2021 – Art. 1º, Art. 5º]
• Ensure your organization keeps records regarding field actions performed, including those that do not need to be reported to regulatory authorities. [RDC ANVISA 551/2021 – Art. 4º; Art. 6º, Art. 10, Art. 11, Art. 16]
• For domestic manufacturers (also applies to legal representatives in Brazil) – ensure your organization has sent to the regulatory authority the reports requested, according to Brazilian regulation. [RDC ANVISA 551/2021– Art. 10, Art. 11]
• Ensure your organization has performed field actions based on potential or concrete evidence that your product does not comply with essential requirements of safety and effectiveness. [RDC ANVISA 551/2021 – Art. 4º, Art. 6º, Art. 7º, Art. 13, Art. 14, Art. 15]
• For domestic manufacturers (also applies to legal representatives in Brazil) - ensure your organization has performed field actions when required by the regulatory authority. [RDC ANVISA 551/2021 – Art. 6º]
• For domestic manufacturers (also applies to legal representatives in Brazil) - ensure your organization notified the regulatory authority regarding field actions, in accordance with requirements and deadlines established per Brazilian regulation. [RDC ANVISA 551/2021 – Art. 7º, Art. 8º]

Updated requirements for Health Canada:

• For greater clarity and consistency with section 4.1.1 of Health Canada’s Recall Policy for Health Products (POL-0016), AOs and auditors are advised of the following interpretations of the timelines in sections 64 and 65 of the Medical Devices Regulations: Section 64 of the Medical Devices Regulations requires the manufacturer and importer of a medical device to provide Health Canada with information concerning a recall "on or before undertaking a recall." This is interpreted to mean that the manufacturer and importer must submit to Health Canada as much recall information as is known within 24 hours of having made the decision to recall. This initial notification may be made verbally or in writing. This must be followed by a written report containing full information, as required by section 64, within three business days of starting the recall. As per section 65 of the Medical Devices Regulations, a report on the results of the recall and the action taken to prevent a recurrence of the problem must be submitted as soon as possible after the completion of a recall.

Chapter 5: Design and Development

General: Australian, Brazilian, and Japanese regulatory clauses references were updated as appropriate.

Chapter 6: Production and Service Controls

General: Australian, Brazilian, and Japanese regulatory clauses references were updated as appropriate.

Task 9 – Validation of Sterilization Process

If product is supplied sterile (see Annex 2): Verify the sterilization process is validated, periodically revalidated, and records of the validation are available. Verify that devices sold in a sterile state are manufactured and sterilized under appropriately controlled conditions. Determine if the sterilization process and results are documented and traceable to each batch of product. Amendment to the Australian country specific requirements and legislative links:

• Verify that methods of sterilization validation have regard to the generally acknowledged state of the art (e.g., Australian Medical Device Standard Orders – MDSO e.g., Medical Device Standards Order (Endotoxin Requirements for Medical Devices) 2018) or Australian Conformity Assessment Standard Orders - Conformity Assessment Standards Order (Quality Management Systems) 2019 that refer to the use of ISO 11135, ISO 11137 and other standards). [TG(MD)R Sch1 P1 2(1)]

Chapter 7: Purchasing

General: Australian, Brazilian, and Japanese regulatory clauses references were updated as appropriate.

Annex 1: Audit of Product/Process related Technologies and Technical Documentation

The reference of GHTF/SG3/N19:2012 Quality management system – Medical devices - Nonconformity Grading System for Regulatory Purposes and Information Exchange was changed to MDSAP AU P0037 Guidelines on the use of Quality management system - Medical devices - Nonconformity Grading System for Regulatory Purposes and Information Exchange (GHTF/SG3/N19:2012) for MDSAP purposes.

Amendment to the Australian country specific requirements to include updated regulatory references:

• a selected clinical evaluation report to confirm that it is current and was prepared by an appropriately qualified expert (see TG(MD)Regs Sch 3 Part 8).
• the declaration of conformity, for example, to comply with TG(MD)Reg Sch 3 Part 1 Clause 1.8 (this may be in a draft form for development devices that do not yet have marketing authorization).

Annex 2: Audit of Requirements for Sterile Medical Devices

No updates.

Annex 3: Medical Device Adverse Events and Advisory Notices Reporting Process Quick Reference

No updates.

Annex 4

Updated to Australian regulatory references relating to the maintenance of distribution records:

• Ensure that the responsibility to retain, maintain, and make available distribution records, and other records identified in r5.10, is in accordance with r5.10 and 8.1A, using arrangements that have been agreed and verified.
• Create and maintain contemporaneous records of complaints, adverse events, recalls, and product distribution and retain the records for the periods prescribed in regulations (r5.10).
• Ensure that manufacturing records and distribution records are available for the periods defined in Reg 8.1.

Updated the clarification on the use of MDSAP in Australia section to remove requirements related to Regulation 4.1 (which has been repealed) and to reference TGA guidance on use of comparable overseas evidence and related legislative instruments.

Annex 5: Japan’s QMS Ordinance Revision – Tables

No updates.

Annex 6: Acceptable exclusions from an organization’s scope of certification

Explains the acceptable exclusions of medical devices or regulations from the scope of certification:

• Australia - Class I medical devices (non-sterile, no measuring function) are not required to have a certified quality management system.
• Brazil - Class I and Class II medical devices are not subject to GMP certification. However, ANVISA Resolution RDC 15/2014 still requires that the manufacturer of the finished device have an effective QMS in place.
• Canada - Class I medical devices are not required to have a certified quality management system.
• Japan - Class I medical devices are not required to have a certified quality management system.
• United States - Some Class 1 medical devices are not subject to the U.S. quality system regulation.

About The Author:

Mark Allen Durivage has worked as a practitioner, educator, consultant, and author. He is managing principal consultant at Quality Systems Compliance LLC, an ASQ Fellow and SRE Fellow. Durivage primarily works with companies in the FDA regulated industries (medical devices, human tissue, animal tissue, and pharmaceuticals) focusing on quality management system implementation, integration, updates, and training. Additionally, he assists companies by providing internal and external audit support as well as FDA 483 and warning letter response and remediation services. He earned a BAS in computer aided machining from Siena Heights University and an MS in quality management from Eastern Michigan University. He holds several certifications, including CRE, CQE, CQA, CSSBB, RAC (Global), and CTBS. He has written several books available through ASQ Quality Press, published articles in Quality Progress, and is a frequent contributor to Life Science Connect. You can reach him at mark.durivage@qscompliance.com with any questions or comments.