Back to Frameworks
MDSAP Audit Approach (MDSAP AU P0002)
International (Australia, Brazil, Canada, Japan, United States)
vMDSAP AU P0002.011 Audit Approach, revision date 3 August 2026; with MDSAP AU P0038.002 (MDO eligibility pilot, effective 1 August 2026)
8 domains
79 controls
The MDSAP Audit Approach (MDSAP AU P0002.011) as the requirements a medical device organisation is audited against for Australia, Brazil, Canada, Japan and the United States: QMS planning and management, registration and change notification, CAPA and complaints, adverse event and recall reporting per jurisdiction, design control and cybersecurity, production, sterilisation, UDI, traceability and labelling, purchasing, and technical documentation.
Verified
MDSAP Audit Approach (MDSAP AU P0002) is a compliance framework from International (Australia, Brazil, Canada, Japan, United States) with 8 domains and 79 controls. The largest domains are Chapter 6: Production and service controls – MDSAP Audit Approach (MDSAP AU P0002) (21 controls), Chapter 3: Measurement, analysis and improvement – MDSAP Audit Approach (MDSAP AU P0002) (14 controls), Chapter 1: Management – MDSAP Audit Approach (MDSAP AU P0002) (11 controls). Every control below carries what it requires and what an assessor expects to see.
Maintained by Gerard Blokdyk
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
Annexes: technical documentation, sterile devices, exclusions and reference tables – MDSAP Audit Approach (MDSAP AU P0002)
2 controls
| Code | Title |
|---|---|
| mdsap-audit-approach-mdsap-au-p0002::A1-techdoc | Maintain technical documentation (medical device file and design files) that evidences regulatory compliance, keep it current, and for Australia meet the minimum Essential Principles evidence set |
| mdsap-audit-approach-mdsap-au-p0002::A2-sterile | Control every process contributing to sterility through the QMS, with validated and revalidated processes, routine monitoring, batch records, designated lot release and controlled sterilisation and laboratory suppliers |
Chapter 1: Management – MDSAP Audit Approach (MDSAP AU P0002)
11 controls
| Code | Title |
|---|---|
| mdsap-audit-approach-mdsap-au-p0002::C1-T1 | Plan, document and maintain the QMS with a risk-based approach to process control, manage QMS changes and keep a quality manual |
| mdsap-audit-approach-mdsap-au-p0002::C1-T10 | Distribute or offer devices only into markets where they hold the required marketing authorization, and license and label private-label devices for Canada correctly |
| mdsap-audit-approach-mdsap-au-p0002::C1-T11 | Top management demonstrates commitment to an effective QMS and communicates its effectiveness, as judged across management, measurement and improvement, design, production and purchasing |
| mdsap-audit-approach-mdsap-au-p0002::C1-T2 | Appoint and document a management representative responsible for QMS effectiveness, reporting to top management and promoting regulatory awareness |
| mdsap-audit-approach-mdsap-au-p0002::C1-T3 | Set a quality policy and measurable quality objectives at relevant functions and levels, consistent with the policy, and act to achieve them |
| mdsap-audit-approach-mdsap-au-p0002::C1-T4 | Define the organisational structure, responsibilities and authorities, and provide the people, infrastructure, competence and training needed to design and make devices as planned |
| mdsap-audit-approach-mdsap-au-p0002::C1-T5 | Document the extent of outsourcing and the controls over outsourced processes, keep the supplier list current, and divide regulatory duties correctly with sponsors, importers and correspondents |
| mdsap-audit-approach-mdsap-au-p0002::C1-T6 | Determine competence needs for work affecting quality, close gaps, check effectiveness in proportion to risk, keep competence records and qualify consultants |
| mdsap-audit-approach-mdsap-au-p0002::C1-T7 | Top management commits to and owns risk management planning across the product life cycle, with documented methods, acceptability criteria and post-market updating of risk files |
| mdsap-audit-approach-mdsap-au-p0002::C1-T8 | Control documents and records of internal and external origin, and keep records and an obsolete copy of documents for at least the device lifetime (minimum two years) or the longer jurisdiction periods |
| mdsap-audit-approach-mdsap-au-p0002::C1-T9 | Conduct documented management reviews at planned intervals covering the suitability and effectiveness of the policy, objectives and QMS against all regulatory requirements |
Chapter 2: Device marketing authorization and facility registration – MDSAP Audit Approach (MDSAP AU P0002)
5 controls
| Code | Title |
|---|---|
| mdsap-audit-approach-mdsap-au-p0002::C2-T1 | Register facilities and list or license devices as each jurisdiction requires, and (for Australia) compile and maintain the manufacturer's Declaration of Conformity |
| mdsap-audit-approach-mdsap-au-p0002::C2-T2 | Hold the marketing clearance or approval each jurisdiction requires before commercial distribution (ANVISA registration or notification, Canadian licence, Japanese approval, FDA 510(k) or PMA) |
| mdsap-audit-approach-mdsap-au-p0002::C2-T3-AU | Identify changes needing regulatory notification and, for Australia, notify the MDSAP auditing organisation (and the TGA for conformity assessment certificate holders) before substantial QMS, supplier, process, scope or Class III design changes |
| mdsap-audit-approach-mdsap-au-p0002::C2-T3-BR-CA-JP | Submit significant changes to ANVISA, Health Canada licence amendments and annual statements, and Japanese change applications through the marketing authorization holder |
| mdsap-audit-approach-mdsap-au-p0002::C2-T3-US | For the United States, update registration and listing, file new 510(k)s or PMA supplements for significant changes, and keep changes within any agreed predetermined change control plan |
Chapter 3: Measurement, analysis and improvement – MDSAP Audit Approach (MDSAP AU P0002)
14 controls
| Code | Title |
|---|---|
| mdsap-audit-approach-mdsap-au-p0002::C3-T1 | Establish documented measurement, analysis and improvement procedures covering monitoring of product conformity, early-warning feedback, CAPA and dissemination of quality problem information |
| mdsap-audit-approach-mdsap-au-p0002::C3-T10 | Run planned internal audits under a documented procedure with trained, independent auditors, and follow up findings with corrections, corrective actions and verification |
| mdsap-audit-approach-mdsap-au-p0002::C3-T11 | Feed nonconforming product, QMS nonconformity, correction, corrective and preventive action information into management review |
| mdsap-audit-approach-mdsap-au-p0002::C3-T12 | Gather and evaluate post-production experience, including complaints and post-market surveillance, feed it into improvement and risk management, and (for Australia) pass serious problem and proposed recall information to the TGA or sponsor as soon as practicable |
| mdsap-audit-approach-mdsap-au-p0002::C3-T12-BR-US | Keep complaint handling procedures and records that meet ANVISA and FDA rules: a designated unit, documented decisions not to investigate, mandatory investigation of failures and reportable events, and complete investigation records |
| mdsap-audit-approach-mdsap-au-p0002::C3-T12-CA | For Canada, keep problem and complaint records, run effective investigation and recall procedures, prepare periodic summary reports with critical benefit-risk analysis and notify the Minister within 72 hours of a changed benefit-risk conclusion |
| mdsap-audit-approach-mdsap-au-p0002::C3-T12-CYBER | For devices with software or programmable logic, collect cybersecurity feedback (vulnerability reports, incidents, threat intelligence) after release and feed it into risk management, improvement and design change |
| mdsap-audit-approach-mdsap-au-p0002::C3-T13 | Exchange relevant information with external organisations whose activities contributed to a complaint, and keep records of it |
| mdsap-audit-approach-mdsap-au-p0002::C3-T14-T15 | Evaluate every complaint for adverse event reportability and every quality problem in distributed product for an advisory notice, under documented procedures with recorded rationale for decisions not to report or not to act |
| mdsap-audit-approach-mdsap-au-p0002::C3-T2 | Identify and analyse all relevant quality data sources under a documented procedure, using valid statistical methods where appropriate |
| mdsap-audit-approach-mdsap-au-p0002::C3-T3-T4 | Investigate the root causes of nonconformities and potential nonconformities where possible, with depth proportionate to the risk |
| mdsap-audit-approach-mdsap-au-p0002::C3-T5 | Determine, implement, document and verify corrections, corrective actions and preventive actions in proportion to risk, without adverse effect on finished devices |
| mdsap-audit-approach-mdsap-au-p0002::C3-T6-T7 | Evaluate new hazards and risks from CAPA-driven design or process changes, revalidate processes where needed, and notify regulators, auditing organisations or MAHs of significant or critical changes |
| mdsap-audit-approach-mdsap-au-p0002::C3-T8-T9 | Identify and control nonconforming product to prevent use or delivery, justify and record dispositions, notify responsible external parties, and act in proportion to risk when nonconforming product is found after delivery |
Chapter 4: Medical device adverse events and advisory notices reporting – MDSAP Audit Approach (MDSAP AU P0002)
10 controls
| Code | Title |
|---|---|
| mdsap-audit-approach-mdsap-au-p0002::C4-T1-AU | Australia: report adverse events and near adverse events to the TGA or the Australian sponsor as soon as practicable through the post-marketing system |
| mdsap-audit-approach-mdsap-au-p0002::C4-T1-BR | Brazil: run an integrated post-market surveillance system with a designated responsible professional, record and investigate complaints, and notify ANVISA of adverse events, technical defects, serious public health hazards and counterfeits |
| mdsap-audit-approach-mdsap-au-p0002::C4-T1-CA | Canada: make preliminary incident reports within 10 days (death or serious deterioration) or 30 days (could recur and cause it), follow with final reports, and report foreign serious risks within 72 hours |
| mdsap-audit-approach-mdsap-au-p0002::C4-T1-JP | Japan: as a Registered Manufacturing Site, pass serious and specified events, foreign safety actions and study findings to the marketing authorization holder promptly |
| mdsap-audit-approach-mdsap-au-p0002::C4-T1-US | United States: maintain written MDR procedures and event files, report deaths, serious injuries and reportable malfunctions within 30 calendar days, 5-day reports where remedial action is needed, supplements within a month, with UDI and electronic submission |
| mdsap-audit-approach-mdsap-au-p0002::C4-T2-AU | Australia: tell the TGA or the sponsor as soon as practicable when the manufacturer proposes to recall devices distributed in Australia, with the technical or medical reasons |
| mdsap-audit-approach-mdsap-au-p0002::C4-T2-BR | Brazil: define when field actions are needed, keep records of all field actions, carry them out on evidence of non-compliance or on ANVISA's demand, and notify ANVISA within the set deadlines |
| mdsap-audit-approach-mdsap-au-p0002::C4-T2-CA | Canada: give Health Canada recall information within 24 hours of the decision, a full written section 64 report within three business days, and a results report after completion |
| mdsap-audit-approach-mdsap-au-p0002::C4-T2-JP | Japan: as a Registered Manufacturing Site, maintain effective communication with the marketing authorization holder on advisory notices so the holder can report them |
| mdsap-audit-approach-mdsap-au-p0002::C4-T2-US | United States: report corrections and removals made to reduce a risk to health or remedy a violation within 10 working days, with device identifiers, and keep records of unreported ones |
Chapter 5: Design and development – MDSAP Audit Approach (MDSAP AU P0002)
11 controls
| Code | Title |
|---|---|
| mdsap-audit-approach-mdsap-au-p0002::C5-T1 | Identify which devices are subject to design and development controls in each jurisdiction and maintain the technical documentation evidence they require |
| mdsap-audit-approach-mdsap-au-p0002::C5-T10-T11 | Validate the design for the intended use with testing scaled to risk, and perform the clinical evaluation or safety and performance evaluation each jurisdiction requires |
| mdsap-audit-approach-mdsap-au-p0002::C5-T12 | Develop device software under design controls and risk management |
| mdsap-audit-approach-mdsap-au-p0002::C5-T12-US | United States: for cyber devices cleared or approved after 29 March 2023, maintain a postmarket vulnerability plan with coordinated disclosure, cybersecure design and update processes, and a software bill of materials |
| mdsap-audit-approach-mdsap-au-p0002::C5-T13 | Control design changes (verify or validate and approve before implementation, assess new risks), notify regulators or the MAH where required, and assign new UDI-DIs for new versions or packages |
| mdsap-audit-approach-mdsap-au-p0002::C5-T14-T15 | Hold design reviews at planned stages with the right functions and specialists, and review design changes for their effect on product already made and delivered |
| mdsap-audit-approach-mdsap-au-p0002::C5-T16 | Transfer the design correctly to production, releasing it only after authorised review of the complete design history |
| mdsap-audit-approach-mdsap-au-p0002::C5-T3-T4 | Plan and control each design and development project, with stages, reviews, verification, validation, transfer, responsibilities and interfaces, under established procedures |
| mdsap-audit-approach-mdsap-au-p0002::C5-T5-T6 | Establish, review and approve complete, unambiguous, non-conflicting design inputs covering function, performance, safety, intended use, regulations (including Essential Principles), human factors, risk controls and known security vulnerabilities |
| mdsap-audit-approach-mdsap-au-p0002::C5-T7 | Make design outputs traceable to and satisfy inputs, identify the outputs essential for proper functioning, and verify the design |
| mdsap-audit-approach-mdsap-au-p0002::C5-T8-T9 | Apply risk management throughout design with defined acceptability criteria, evaluate and communicate residual risk, and confirm through verification or validation that risk controls work |
Chapter 6: Production and service controls – MDSAP Audit Approach (MDSAP AU P0002)
21 controls
| Code | Title |
|---|---|
| mdsap-audit-approach-mdsap-au-p0002::C6-T1 | Plan product realization with the controls, controlled conditions and risk management needed to meet intended use and regulatory requirements, consistent with the rest of the QMS and the quality objectives |
| mdsap-audit-approach-mdsap-au-p0002::C6-T1-UDI | Determine UDI applicability and implement UDI allocation, carriers and data management for Australia (TGA-recognised issuing agency) and the United States (FDA-accredited agency and GUDID) |
| mdsap-audit-approach-mdsap-au-p0002::C6-T10-T11 | Monitor and measure product conformity to a risk-based extent, and operate production within specified limits with production risk controls implemented, monitored and evaluated |
| mdsap-audit-approach-mdsap-au-p0002::C6-T12 | Ensure production personnel are competent to carry out and maintain the processes as the organisation requires |
| mdsap-audit-approach-mdsap-au-p0002::C6-T13-T14 | Identify, calibrate, adjust and protect monitoring and measuring equipment, and assess and record the validity of earlier results and act on affected product when equipment is found out of specification |
| mdsap-audit-approach-mdsap-au-p0002::C6-T15 | Validate software used to control production and service processes, in production equipment or in the QMS for its intended use |
| mdsap-audit-approach-mdsap-au-p0002::C6-T16 | Keep a medical device file for each device type with specifications, process, QA, traceability, labelling and packaging and installation and servicing requirements, set traceability by risk, and meet jurisdiction labelling and distribution record rules |
| mdsap-audit-approach-mdsap-au-p0002::C6-T17 | Keep a verified, approved batch production record showing quantities made and released, manufacture to the device file and met release requirements, with inspected and controlled labelling |
| mdsap-audit-approach-mdsap-au-p0002::C6-T18 | For implantable, life-supporting or life-sustaining devices, keep traceability of components, materials and environment conditions and inspection personnel, require distributors to keep records, record consignees, and meet Canadian implant card and FDA tracking rules |
| mdsap-audit-approach-mdsap-au-p0002::C6-T19-T20 | Identify product status so only product that passed inspection is dispatched, used or installed, and identify, verify, protect and safeguard customer property including patient and confidential health information |
| mdsap-audit-approach-mdsap-au-p0002::C6-T21 | Carry out and document acceptance activities for every incoming item and service, to an extent matched to the device risk, with statistically valid sampling for Brazil |
| mdsap-audit-approach-mdsap-au-p0002::C6-T22-T23 | Identify, control and dispose of nonconforming product according to risk, and rework only under approved procedures that assess adverse effects, document results and re-verify the product |
| mdsap-audit-approach-mdsap-au-p0002::C6-T24 | Preserve product conformity through processing, storage and transport, including identification, handling, packaging, protection, limited shelf life and special storage conditions |
| mdsap-audit-approach-mdsap-au-p0002::C6-T25 | Review customer requirements before committing to supply, and keep the distribution records regulators require (consignee, product, quantity, date and control numbers; Canadian retention for device life or two years) |
| mdsap-audit-approach-mdsap-au-p0002::C6-T26-T27 | Record installation and its verification, perform and document servicing to defined procedures, analyse service records as quality data, and meet ANVISA and FDA service record content |
| mdsap-audit-approach-mdsap-au-p0002::C6-T28 | Apply risk control and mitigation measures to transport, installation and servicing in line with the risk management practice |
| mdsap-audit-approach-mdsap-au-p0002::C6-T3 | Run production and service under controlled conditions: product information, procedures and workmanship criteria, suitable equipment, monitoring devices, process and product monitoring, release activities, labelling and packaging operations and change requirements |
| mdsap-audit-approach-mdsap-au-p0002::C6-T4 | Set documented product cleanliness requirements (including before sterilisation and for non-sterile supply) and removal of process agents, with pest control and housekeeping for Brazil |
| mdsap-audit-approach-mdsap-au-p0002::C6-T5-T6 | Define and maintain the infrastructure and work environment needed for conformity, including equipment maintenance, personnel health and clothing, environmental monitoring, special-condition training and control of contaminated product |
| mdsap-audit-approach-mdsap-au-p0002::C6-T7-T8 | Identify the processes (including outsourced ones) that need validation and validate them under documented procedures, with revalidation after changes and methods reflecting the state of the art |
| mdsap-audit-approach-mdsap-au-p0002::C6-T9 | Validate and periodically revalidate sterilisation and sterile barrier processes, manufacture sterile devices under controlled conditions and keep batch-traceable sterilisation records |
Chapter 7: Purchasing – MDSAP Audit Approach (MDSAP AU P0002)
5 controls
| Code | Title |
|---|---|
| mdsap-audit-approach-mdsap-au-p0002::C7-T1-T3 | Plan purchasing (what to buy and outsource, requirements, records, resources, acceptance and risk management) and document procedures ensuring purchased product meets requirements |
| mdsap-audit-approach-mdsap-au-p0002::C7-T10-T11 | Verify purchased product to a risk-appropriate combination of supplier controls, purchase requirements and acceptance, keep verification records, hold material until verified (Brazil), and use purchasing data as quality data |
| mdsap-audit-approach-mdsap-au-p0002::C7-T4-T5 | Set documented, risk-based criteria for selecting, evaluating and re-evaluating suppliers, select suppliers on their ability to meet requirements, keep evaluation records and qualify Canadian regulatory correspondents |
| mdsap-audit-approach-mdsap-au-p0002::C7-T6-T7 | Monitor supplier performance, maintain effective controls so requirements continue to be met, and re-evaluate suppliers at intervals matched to the significance of their product |
| mdsap-audit-approach-mdsap-au-p0002::C7-T8-T9 | Ensure purchasing information is adequate and documented before release to the supplier, including product, process, personnel and QMS requirements, risk controls, traceability and a written agreement to notify changes |
What is MDSAP Audit Approach (MDSAP AU P0002) and who does it apply to?
MDSAP Audit Approach (MDSAP AU P0002) is a compliance framework from International (Australia, Brazil, Canada, Japan, United States) with 8 domains and 79 controls. The MDSAP Audit Approach (MDSAP AU P0002.011) as the requirements a medical device organisation is audited against for Australia, Brazil, Canada, Japan and the United States: QMS planning and management, registration and change notification, CAPA and complaints, adverse event and recall reporting per jurisdiction, design control and cybersecurity, production, sterilisation, UDI, traceability and labelling, purchasing, and technical documentation. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does MDSAP Audit Approach (MDSAP AU P0002) actually require?
MDSAP Audit Approach (MDSAP AU P0002) has 79 controls organised across 8 domains. The largest domains are Chapter 6: Production and service controls – MDSAP Audit Approach (MDSAP AU P0002) (21 controls), Chapter 3: Measurement, analysis and improvement – MDSAP Audit Approach (MDSAP AU P0002) (14 controls), Chapter 1: Management – MDSAP Audit Approach (MDSAP AU P0002) (11 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of MDSAP Audit Approach (MDSAP AU P0002) do I already cover?
MDSAP Audit Approach (MDSAP AU P0002) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement MDSAP Audit Approach (MDSAP AU P0002)?
Start your MDSAP Audit Approach (MDSAP AU P0002) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about MDSAP Audit Approach (MDSAP AU P0002) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 79 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,111 frameworks.
Get Started Free →Free forever, no credit card required