MDSAP Audit Approach (MDSAP AU P0002) C1-T5: Document the extent of outsourcing and the controls over outsourced processes, keep the supplier list current, and divide regulatory duties correctly with sponsors, importers and correspondents

What does C1-T5 require?

The organisation must work out which outsourced processes can affect product conformity, document how it controls them (it remains responsible for them) and keep an accurate, current supplier list. Requirements the regulator places specifically on another party are not the manufacturer's to meet, but requirements a customer specifies in an agreement are. Australia: the Australian sponsor holds the ARTG inclusion and sponsor-specific duties (including Australian UDI Database submissions) are outside the audit, while the manufacturer must run its own UDI processes (assigning UDI-DIs and UDI-PIs, building UDI into design, labelling and packaging, keeping UDI data accurate and giving it to the sponsor, and controlling outsourced UDI work); where the sponsor installs, services, supplies labelling under Essential Principle 13 or implant cards under 13A for the manufacturer, it is a supplier, unless it sits inside the manufacturer's QMS, in which case oversight of its activities is documented and internally audited. Canada: roles of regulatory correspondents, importers, distributors and service providers must be documented, and they must be qualified and controlled as suppliers. Clauses: ISO 13485:2016 4.1.5, 4.2.1; TG Act s 3, TG(MD)R Sch 3 Pt 1 cl 1.4(5)(b)(iii) and (d)(ii); RDC 665/2022 Arts 21 to 24; MO169 Arts 5-5 and 6.