U.S. flag An official website of the United States government
  1. Home
  2. Medical Devices
  3. CDRH International Affairs
  4. Medical Device Single Audit Program (MDSAP)
  5. MDSAP AU P0029: Communication by AOs with RA on Organizations Participating in MDSAP
  1. Medical Device Single Audit Program (MDSAP)

MDSAP AU P0029: Communication by AOs with RA on Organizations Participating in MDSAP

  • Title: Communication by AOs with RA on organizations participating in MDSAP
  • Document No: MDSAP AU P0029.007
  • Version Date: 2024-03-07
  • Effective Date: 2024-04-05
  • Project Manager: Marc-Henri Winter, US FDA

Table of Contents

  1. Purpose / Policy
  2. Scope
  3. Definitions / Acronyms
  4. Authorities / Responsibilities
  5. Procedures
  6. Forms
  7. Reference Documents
  8. Document History

1. Purpose / Policy

The purpose of this document is to describe the regulatory Authorities' expectations regarding the information on organizations participating in MDSAP.

This document covers:

  • The initial notification by the Auditing Organization to the regulatory authorities of the participation of an organization in MDSAP;
  • Maintaining the currency of the information shared with Regulatory Authorities on participating organizations
  • The notification of decisions to refuse, suspend or withdraw certification, or reduce the scope of certification of a participating organization.

This document provides instructions for creating, updating and maintaining facility entries in the MDSAP Master List in the MDSAP Regulatory Exchange Platform – secure (MDSAP REPs).

2. Scope

This process applies to all RAs participating in the MDSAP and all formally recognized AOs, or AOs that have been authorized to conduct MDSAP audits.

3. Definitions / Acronyms

AO – Auditing Organization

RA – Regulatory Authority

MDSAP REPs – Regulatory Exchange Platform – secure

Master List – A module of MDSAP REPs that is a database of all facilities that are participating or have participated in MDSAP.

Campus

Either:

  1. A group of facilities within a maximum range of one kilometer, OR
  2. A group of geographically close facilities (within 60-minute drive), if not more than one of these facilities would require a facility-specific Regulatory Authority-issued certificate (such as the issuance of a GMP Certificate (ANVISA) or a Registration Certificate (PMDA))

In either case, the facilities in the group shall be operated by the medical device organization under a single QMS. The management for, and the activities within, the group of facilities must correlate to the realization of the finished medical devices included in the scope of certification.

Notes:

  • A group of buildings sharing the same street address (same street and number) is seen as a single facility and not as a campus.
  • A campus may include multiple facilities with Regulatory Authority-issued facility identifier (e.g. FEI issued by the FDA).

4. Authorities / Responsibilities

Auditing Organization:

  • Designates a person(s) to serve as the AO Client Manager role

AO Client Manager Role:

  • Creates new facility requests in the Master List
  • Updates and maintains accuracy of facility data in the Master List
  • Submits withdrawal requests of facilities from the Master List
  • Point of contact for Master List inquiries from the RAs

Regulatory Authority:

  • Designates the persons to serve in the RA Master List Manager role in MDSAP REPs

RA Master List Manager Role:

  • Reviews and approves new facility submissions from AOs
  • Reviews and approves facility update requests from AOs
  • Modifies facility data entries
  • Updates and maintains RA specific facility identifiers

5. Procedures

5.1 Initial Audit Notification and New Facility Request Submission

Auditing Organizations (AOs) must submit an initial MDSAP audit notification to the Regulatory Authorities (RA) by submitting a new facility request using the Master List Update Form for each facility that participates in MDSAP.

New facility submissions and updates to existing facilities in the Master List are routed to the RA Master List Manager group for review and approval. Detailed instructions for creating, modifying, and submitting facilities to the MDSAP REPs Master List can be found in the MDSAP REPs User Guide.

After the AO has entered into a contract with the facility to be audited under MDSAP, the AO Client Manager shall create a new facility request in MDSAP REPs.  This entry should be created without undue delay from the date of agreeing on the terms of the certification contract, if possible, at least sixty (60) days prior to the audit, and no later than the audit start date. In other words, an audit team shall not start auditing an organization without knowing the MDSAP REPs-generated Facility ID. A delayed notification of a facility's participation may impact the ability of a Regulatory Authority to re-schedule or cancel an inspection. 

Each audited location that is listed under the MDSAP certificate is to be entered as a separate facility in the Master List unless the location meets the definition of a campus as defined above.

5.2 Campuses

If a group of facilities meet the definition of a campus, each location of the campus is to be entered under the "Address(es)" section of the new facility request form. One of these locations is required to be identified as the primary address of the campus.

5.3 Facilities Audited by More Than One AO

For facilities that are audited by more than one AO, each AO is responsible for creating and maintaining their own separate facility entry in the Master List.

5.4 Updating and Maintaining Facility Data in the Master List

The AO Client Manager is responsible for maintaining the accuracy of all facility data in the Master List. 

In particular, changes affecting the following information must be updated using the Master List Update Form without undue delay:

  • Initial audit start and end dates (by more than a month)
  • Facility Name
  • Other Trade Name(s)
  • Address changes (including additions or deletions to a previously defined campus)
  • Jurisdictions
  • MDSAP Scope of Certification
  • Certificate holder information
  • Facility Contact Person

The facility profile should for example be reviewed when:

  • Planning / reviewing a site's audit program
  • When scheduling a specific audit for a site
  • Prior to submitting a 5-day notice or an audit report
  • Prior to notifying Regulatory authorities of their decision to refuse to certify, to suspend, reinstate or withdraw certification or to restrict the scope of certification

5.5 Voluntary Withdrawal of Participation in MDSAP

When a participating facility elects to voluntarily withdraw their participation in MDSAP, with no intention to transfer to another AO, the AO Client Manager shall submit a deactivation request using the Master List Update Form for the facility within seven (7) business days of the AO receiving the withdrawal notification from the organization.

If the organization was already certified against the Canadian regulation, the AO shall also directly inform Health Canada, using the form F201.

The deactivation request shall explain the reason for the withdrawal in the field "Additional Information", using the following template language:

  •  "Voluntary withdrawal requested by the organization: on <YYYY-MM-DD>, <Organization's name>'s <organization representative's function> < organization representative's name> communicated to <AO> their intent to discontinue their certification <process (if the request comes before the organization was certified, add the word)>. <Additional context of the withdrawal>. At the time of the withdrawal, there were <no or number> outstanding nonconformities from past assessment. <if any outstanding NC, specify>. The organization <confirmed / did not answer requests for confirmation> that they do not intend to pursue certification with another AO."

Important: this implies that the AO must seek the confirmation from the organization that they do not intend to pursue certification with another AO.

Upon deactivation of a facility from the Master List, the RA Master List Manager must set the facility status to INACTIVE.

5.5.1 Facility Withdrawals During an Audit

If an organization decides to voluntarily withdraw their participation from MDSAP while the MDSAP audit is taking place, due to the findings of the audit, the Auditing Organization must submit the Nonconformity Grading and Exchange (NGE) form as a 5-Day Notice per procedure MDSAP AU P0027 and the full audit report package within 45 days after the end of the audit.

Reminder: an Auditing Organization cannot downgrade an unsuccessful MDSAP audit into a mock audit

5.6 Transfers of Facilities Between Auditing Organizations

In situations where a facility elects to transfer their certification from their original AO to a new AO, the following actions shall take place in a coordinated way between the two AOs and the RA Master List Manager, based on the date the certification by the new AO becomes effective.

  1. The new AO shall create the facility profile before the effective date of transfer. The new AO Client Manager must specify the transfer of certification in the "Additional Information" field using the following template language:
    • "Transferred from <Original AO's name>."
  2. Inactivation of the facility profile in the original AO portfolio. The original AO Client Manager shall submit a facility modification request in MDSAP REPs within 5 working days from the effective date of transfer. The original AO Client Manager must specify the reason for the inactivation of the facility profile in the "Additional Information" field, using the following template language:
    • "Transferred to <New AO's name>. on <YYYY-MM-DD>, <Organization's name>'s <organization representative's function> < organization representative's name> communicated to <original AO> their intent to transfer their certification. <Additional context of the withdrawal>. At the time of the request, there were <no or number> outstanding nonconformities from past assessment. <if any outstanding NC, specify>. <original AO's name> communicated with <new AO's name> to enable the effective transfer of certification, which became effective on <YYYY-MM-DD>. The reference of the affected (i.e. withdrawn) certificate is: <withdrawn certificate reference>"
    Prior to requesting the inactivation of the facility profile, the original AO shall ensure that all past MDSAP audit report packages have been submitted in MDSAP REPs.
     
    If the organization was certified against the Canadian regulation, the AO shall also directly inform Health Canada, using the form F201.
  3. The RA Master List Manager accepting the withdrawal request from the original AO or the new facility request from the new AO shall add to both facility profiles the MDSAP Facility ID under the other AO to ensure the reciprocal traceability between the 2 facility profiles. The RA Master List Manager shall add this information into the field "Additional Information".

5.7 AO's Decision to refuse to certify, to suspend, reinstate or withdraw certification or to restrict the scope of certification

When an Auditing Organization makes the decision refuse to certify, to suspend or withdraw certification or to restrict the scope of certification of an organization, they must, according to IMDRF document N3 – 8.6.4, notify within 5 working days from the date of the decision. Additionally, where a facility holding marketing authorizations or facility registrations in at least one of the participating jurisdictions undergoes a Stage 1 audit whose results do not support proceeding with a Stage 2 audit, the Auditing Organization shall notify the participating Regulatory Authorities.

The AO shall:

  1. AO Client Manager: Update the facility profile by submitting the Master List Update Form and adding information on the decision in the field "Additional Information." The request shall specify the decision and its rationale, using the following template language, depending on the context:
    • Refusal to certify or withdrawal of certification (deactivation request):
      "AO's decision to <refuse/withdraw> certification: on <YYYY-MM-DD>, <AO's name> made the decision to <refuse to certify /  withdraw the certification from> <Organization name> for the following reason: <rationale, including – if applicable – the reference of the audit reports that triggered that decision>. The effective date of the decision is <YYYY-MM-DD>. The reference of the MDSAP certificate affected by the decision is: <certificate reference>. As a result, the facility's status in the Master List must be changed to INACTIVE."
    • Suspension of certification (modification request):
      "AO's decision to suspend certification: on <YYYY-MM-DD>, <AO's name> made the decision to suspend the certification from <Organization name> for the following reason: <rationale, including – if applicable – the reference of the audit reports that triggered that decision>. The effective date of the decision is <YYYY-MM-DD>. The reference of the MDSAP certificate affected by the decision is: <certificate reference>. The facility's status in the Master List remains ACTIVE, until a new decision is made before <YYYY-MM-DD> to either reinstate or permanently withdraw the certification."
    • Reinstatement of certification (modification request):
      "AO's decision to reinstate certification: on <YYYY-MM-DD>, <AO's name> made the decision to reinstate the certification to <Organization name> for the following reason: <rationale, including – if applicable – the reference of the audit reports or new information that triggered that decision>. The effective date of the decision is <YYYY-MM-DD>. The reference of the MDSAP certificate affected by the decision is: <certificate reference>. The facility's status in the Master List remains ACTIVE."
    • Reduction of scope of certification (modification request):
      "AO's decision to restrict certification: on <YYYY-MM-DD>, <AO's name> made the decision to restrict the scope of certification of <Organization name> for the following reason: <rationale, including – if applicable – the reference of the audit reports that triggered that decision>. The effective date of the decision is <YYYY-MM-DD>. The reference of the MDSAP certificate affected by the decision is: <certificate reference>. The facility's status in the Master List remains ACTIVE."
    • Unsuccessful Stage 1 (modification request):
      "AO's decision to refuse to proceed with Stage 2 audit of initial certification: on <YYYY-MM-DD>, <AO's name> made the decision to refuse to proceed with a Stage 2 audit following the unsuccessful Stage 1 audit of <Organization name> whose devices are currently placed on the <Australian, Brazilian, Canadian, Japanese, US> markets, due to the following deficiencies. <list the most relevant deficiencies, i.e. those that are indicative of a lack of device quality (i.e. safety or performance), or of effective control of quality, or of significant violations of applicable regulatory requirements>. The effective date of the decision is <YYYY-MM-DD>. The facility's status in the Master List remains ACTIVE, until a new decision is made before <YYYY-MM-DD> to either perform a new Stage 1 audit, confirm the resolution of the identified deficiencies allowing to resume the certification process with a scheduled Stage 2, or deactivate the organization's participation."
  2. Send a single1 email to all the Regulatory Authorities whose jurisdiction is included in the facility profile, notifying of the decision. The email addresses to notify the RAs of such a decision are: If the decision is the suspension, withdrawal of certification or restriction of the scope of certification and the affected jurisdictions include Canada, the AO shall attach the completed form F201 from Health Canada to their email.  

Each RA reviews the information according to their own regulatory processes.

5.8 Re-activation of a facility

If an organization whose facility profile was deactivated decides to resume their participation in MDSAP with the same AO, the Client Manager shall request the reactivation of the facility profile (i.e. do not create a new facility). The request should include the dates of the new initial audit dates.

1 One email addressed to all concerned RAs as opposed to separate emails to each RA.

6. Forms

N/A

7. Reference Documents

  • MDSAP REPs User Guide

8. Document History

Version
No.
Version
date
Description of Change Author Name / Project Manager
001 2014-11-20
  • Initial Release
LCDR Neil Mafnas, FDA
002 2015-09-22
  • On page 4; Japan's e-mail address was added due to its participation to MDSAP Pilot.
Liliane Brown, FDA
003 2018-10-15
  • Fully revised due to REPs launch
Michael Chan, FDA Hiromi Kumada, PMDA
004 2020-03-30
  • The scope of the document was extended to more generally cover "Communication by AOs with RA on organizations participating in MDSAP". It includes specific details covering the creation, update and inactivation of a facility profile in REPs, including in the context of a transfer from an AO to another, and the communication to the regulatory Authorities about certification decisions by the Auditing Organizations to refuse to certify, to suspend, reinstate or withdraw certification, or to reduce the scope of certification.
Marc-Henri Winter
005 2021-12-30
  • Revised section 5 to replace the use of REPs with the interim use of MDSAP AU G0029.2 Using the MDSAP Master List Update PDF Form and the MDSAP AU F0029.1 – MDSAP – Master List Update Form during the downtime of REPs.
  • Updated section 5.8 to add email address for facility reactivations.
Michael Chan, FDA
006 2022-11-21
  • Due to the re-launch of REPs, section 5 was revised to restore the use of REPs for all facility notifications and requests.
  • The interim use of MDSAP AU G0029.2 Using the MDSAP Master List Update PDF Form and the MDSAP AU F0029.1 – MDSAP – Master List Update form has been discontinued.
  • Updated e-mail address for Health Canada
  • Updated web links
Michael Chan, FDA
007 2024-03-07
  • Added the requirement for AOs to notify RAs following failed Stage 1 audits where the facility holds marketing authorizations or facility registrations in at least one of the participating jurisdictions.
Frédéric HAMELIN, Health Canada

Version Approval: 007

Approved: Signature on File, CHAIR, MDSAP RAC

Date: 2024-04-05


Uncontrolled when printed.

For the most current copy, contact MDSAP@fda.hhs.gov

 
Back to Top