MDSAP AU P0029: Communication by AOs with RA on Organizations Participating in MDSAP
- Title: Communication by AOs with RA on organizations participating in MDSAP
- Document No: MDSAP AU P0029.007
- Version Date: 2024-03-07
- Effective Date: 2024-04-05
- Project Manager: Marc-Henri Winter, US FDA
Table of Contents
- Purpose / Policy
- Scope
- Definitions / Acronyms
- Authorities / Responsibilities
- Procedures
- Forms
- Reference Documents
- Document History
1. Purpose / Policy
The purpose of this document is to describe the regulatory Authorities' expectations regarding the information on organizations participating in MDSAP.
This document covers:
- The initial notification by the Auditing Organization to the regulatory authorities of the participation of an organization in MDSAP;
- Maintaining the currency of the information shared with Regulatory Authorities on participating organizations
- The notification of decisions to refuse, suspend or withdraw certification, or reduce the scope of certification of a participating organization.
This document provides instructions for creating, updating and maintaining facility entries in the MDSAP Master List in the MDSAP Regulatory Exchange Platform – secure (MDSAP REPs).
2. Scope
This process applies to all RAs participating in the MDSAP and all formally recognized AOs, or AOs that have been authorized to conduct MDSAP audits.
3. Definitions / Acronyms
AO – Auditing Organization
RA – Regulatory Authority
MDSAP REPs – Regulatory Exchange Platform – secure
Master List – A module of MDSAP REPs that is a database of all facilities that are participating or have participated in MDSAP.
Campus –
Either:
- A group of facilities within a maximum range of one kilometer, OR
- A group of geographically close facilities (within 60-minute drive), if not more than one of these facilities would require a facility-specific Regulatory Authority-issued certificate (such as the issuance of a GMP Certificate (ANVISA) or a Registration Certificate (PMDA))
In either case, the facilities in the group shall be operated by the medical device organization under a single QMS. The management for, and the activities within, the group of facilities must correlate to the realization of the finished medical devices included in the scope of certification.
Notes:
- A group of buildings sharing the same street address (same street and number) is seen as a single facility and not as a campus.
- A campus may include multiple facilities with Regulatory Authority-issued facility identifier (e.g. FEI issued by the FDA).
4. Authorities / Responsibilities
Auditing Organization:
- Designates a person(s) to serve as the AO Client Manager role
AO Client Manager Role:
- Creates new facility requests in the Master List
- Updates and maintains accuracy of facility data in the Master List
- Submits withdrawal requests of facilities from the Master List
- Point of contact for Master List inquiries from the RAs
Regulatory Authority:
- Designates the persons to serve in the RA Master List Manager role in MDSAP REPs
RA Master List Manager Role:
- Reviews and approves new facility submissions from AOs
- Reviews and approves facility update requests from AOs
- Modifies facility data entries
- Updates and maintains RA specific facility identifiers
5. Procedures
5.1 Initial Audit Notification and New Facility Request Submission
Auditing Organizations (AOs) must submit an initial MDSAP audit notification to the Regulatory Authorities (RA) by submitting a new facility request using the Master List Update Form for each facility that participates in MDSAP.
New facility submissions and updates to existing facilities in the Master List are routed to the RA Master List Manager group for review and approval. Detailed instructions for creating, modifying, and submitting facilities to the MDSAP REPs Master List can be found in the MDSAP REPs User Guide.
After the AO has entered into a contract with the facility to be audited under MDSAP, the AO Client Manager shall create a new facility request in MDSAP REPs. This entry should be created without undue delay from the date of agreeing on the terms of the certification contract, if possible, at least sixty (60) days prior to the audit, and no later than the audit start date. In other words, an audit team shall not start auditing an organization without knowing the MDSAP REPs-generated Facility ID. A delayed notification of a facility's participation may impact the ability of a Regulatory Authority to re-schedule or cancel an inspection.
Each audited location that is listed under the MDSAP certificate is to be entered as a separate facility in the Master List unless the location meets the definition of a campus as defined above.
5.2 Campuses
If a group of facilities meet the definition of a campus, each location of the campus is to be entered under the "Address(es)" section of the new facility request form. One of these locations is required to be identified as the primary address of the campus.
5.3 Facilities Audited by More Than One AO
For facilities that are audited by more than one AO, each AO is responsible for creating and maintaining their own separate facility entry in the Master List.
5.4 Updating and Maintaining Facility Data in the Master List
The AO Client Manager is responsible for maintaining the accuracy of all facility data in the Master List.
In particular, changes affecting the following information must be updated using the Master List Update Form without undue delay:
- Initial audit start and end dates (by more than a month)
- Facility Name
- Other Trade Name(s)
- Address changes (including additions or deletions to a previously defined campus)
- Jurisdictions
- MDSAP Scope of Certification
- Certificate holder information
- Facility Contact Person
The facility profile should for example be reviewed when:
- Planning / reviewing a site's audit program
- When scheduling a specific audit for a site
- Prior to submitting a 5-day notice or an audit report
- Prior to notifying Regulatory authorities of their decision to refuse to certify, to suspend, reinstate or withdraw certification or to restrict the scope of certification
5.5 Voluntary Withdrawal of Participation in MDSAP
When a participating facility elects to voluntarily withdraw their participation in MDSAP, with no intention to transfer to another AO, the AO Client Manager shall submit a deactivation request using the Master List Update Form for the facility within seven (7) business days of the AO receiving the withdrawal notification from the organization.
If the organization was already certified against the Canadian regulation, the AO shall also directly inform Health Canada, using the form F201.
The deactivation request shall explain the reason for the withdrawal in the field "Additional Information", using the following template language:
- "Voluntary withdrawal requested by the organization: on <YYYY-MM-DD>, <Organization's name>'s <organization representative's function> < organization representative's name> communicated to <AO> their intent to discontinue their certification <process (if the request comes before the organization was certified, add the word)>. <Additional context of the withdrawal>. At the time of the withdrawal, there were <no or number> outstanding nonconformities from past assessment. <if any outstanding NC, specify>. The organization <confirmed / did not answer requests for confirmation> that they do not intend to pursue certification with another AO."
Important: this implies that the AO must seek the confirmation from the organization that they do not intend to pursue certification with another AO.
Upon deactivation of a facility from the Master List, the RA Master List Manager must set the facility status to INACTIVE.
5.5.1 Facility Withdrawals During an Audit
If an organization decides to voluntarily withdraw their participation from MDSAP while the MDSAP audit is taking place, due to the findings of the audit, the Auditing Organization must submit the Nonconformity Grading and Exchange (NGE) form as a 5-Day Notice per procedure MDSAP AU P0027 and the full audit report package within 45 days after the end of the audit.
Reminder: an Auditing Organization cannot downgrade an unsuccessful MDSAP audit into a mock audit
5.6 Transfers of Facilities Between Auditing Organizations
In situations where a facility elects to transfer their certification from their original AO to a new AO, the following actions shall take place in a coordinated way between the two AOs and the RA Master List Manager, based on the date the certification by the new AO becomes effective.
- The new AO shall create the facility profile before the effective date of transfer. The new AO Client Manager must specify the transfer of certification in the "Additional Information" field using the following template language:
- "Transferred from <Original AO's name>."
- Inactivation of the facility profile in the original AO portfolio. The original AO Client Manager shall submit a facility modification request in MDSAP REPs within 5 working days from the effective date of transfer. The original AO Client Manager must specify the reason for the inactivation of the facility profile in the "Additional Information" field, using the following template language:
- "Transferred to <New AO's name>. on <YYYY-MM-DD>, <Organization's name>'s <organization representative's function> < organization representative's name> communicated to <original AO> their intent to transfer their certification. <Additional context of the withdrawal>. At the time of the request, there were <no or number> outstanding nonconformities from past assessment. <if any outstanding NC, specify>. <original AO's name> communicated with <new AO's name> to enable the effective transfer of certification, which became effective on <YYYY-MM-DD>. The reference of the affected (i.e. withdrawn) certificate is: <withdrawn certificate reference>"
If the organization was certified against the Canadian regulation, the AO shall also directly inform Health Canada, using the form F201. - The RA Master List Manager accepting the withdrawal request from the original AO or the new facility request from the new AO shall add to both facility profiles the MDSAP Facility ID under the other AO to ensure the reciprocal traceability between the 2 facility profiles. The RA Master List Manager shall add this information into the field "Additional Information".
5.7 AO's Decision to refuse to certify, to suspend, reinstate or withdraw certification or to restrict the scope of certification
When an Auditing Organization makes the decision refuse to certify, to suspend or withdraw certification or to restrict the scope of certification of an organization, they must, according to IMDRF document N3 – 8.6.4, notify within 5 working days from the date of the decision. Additionally, where a facility holding marketing authorizations or facility registrations in at least one of the participating jurisdictions undergoes a Stage 1 audit whose results do not support proceeding with a Stage 2 audit, the Auditing Organization shall notify the participating Regulatory Authorities.
The AO shall:
- AO Client Manager: Update the facility profile by submitting the Master List Update Form and adding information on the decision in the field "Additional Information." The request shall specify the decision and its rationale, using the following template language, depending on the context:
- Refusal to certify or withdrawal of certification (deactivation request):
"AO's decision to <refuse/withdraw> certification: on <YYYY-MM-DD>, <AO's name> made the decision to <refuse to certify / withdraw the certification from> <Organization name> for the following reason: <rationale, including – if applicable – the reference of the audit reports that triggered that decision>. The effective date of the decision is <YYYY-MM-DD>. The reference of the MDSAP certificate affected by the decision is: <certificate reference>. As a result, the facility's status in the Master List must be changed to INACTIVE." - Suspension of certification (modification request):
"AO's decision to suspend certification: on <YYYY-MM-DD>, <AO's name> made the decision to suspend the certification from <Organization name> for the following reason: <rationale, including – if applicable – the reference of the audit reports that triggered that decision>. The effective date of the decision is <YYYY-MM-DD>. The reference of the MDSAP certificate affected by the decision is: <certificate reference>. The facility's status in the Master List remains ACTIVE, until a new decision is made before <YYYY-MM-DD> to either reinstate or permanently withdraw the certification." - Reinstatement of certification (modification request):
"AO's decision to reinstate certification: on <YYYY-MM-DD>, <AO's name> made the decision to reinstate the certification to <Organization name> for the following reason: <rationale, including – if applicable – the reference of the audit reports or new information that triggered that decision>. The effective date of the decision is <YYYY-MM-DD>. The reference of the MDSAP certificate affected by the decision is: <certificate reference>. The facility's status in the Master List remains ACTIVE." - Reduction of scope of certification (modification request):
"AO's decision to restrict certification: on <YYYY-MM-DD>, <AO's name> made the decision to restrict the scope of certification of <Organization name> for the following reason: <rationale, including – if applicable – the reference of the audit reports that triggered that decision>. The effective date of the decision is <YYYY-MM-DD>. The reference of the MDSAP certificate affected by the decision is: <certificate reference>. The facility's status in the Master List remains ACTIVE." - Unsuccessful Stage 1 (modification request):
"AO's decision to refuse to proceed with Stage 2 audit of initial certification: on <YYYY-MM-DD>, <AO's name> made the decision to refuse to proceed with a Stage 2 audit following the unsuccessful Stage 1 audit of <Organization name> whose devices are currently placed on the <Australian, Brazilian, Canadian, Japanese, US> markets, due to the following deficiencies. <list the most relevant deficiencies, i.e. those that are indicative of a lack of device quality (i.e. safety or performance), or of effective control of quality, or of significant violations of applicable regulatory requirements>. The effective date of the decision is <YYYY-MM-DD>. The facility's status in the Master List remains ACTIVE, until a new decision is made before <YYYY-MM-DD> to either perform a new Stage 1 audit, confirm the resolution of the identified deficiencies allowing to resume the certification process with a scheduled Stage 2, or deactivate the organization's participation."
- Refusal to certify or withdrawal of certification (deactivation request):
- Send a single1 email to all the Regulatory Authorities whose jurisdiction is included in the facility profile, notifying of the decision. The email addresses to notify the RAs of such a decision are:
- Australia: MDSAP@health.gov.au
- Brazil: MDSAP@anvisa.gov.br
- Canada: qs.mdb@hc-sc.gc.ca
- Japan: MDSAP@pmda.go.jp
- USA: MDSAP@fda.hhs.gov
Each RA reviews the information according to their own regulatory processes.
5.8 Re-activation of a facility
If an organization whose facility profile was deactivated decides to resume their participation in MDSAP with the same AO, the Client Manager shall request the reactivation of the facility profile (i.e. do not create a new facility). The request should include the dates of the new initial audit dates.
1 One email addressed to all concerned RAs as opposed to separate emails to each RA.
6. Forms
N/A
7. Reference Documents
- MDSAP REPs User Guide
8. Document History
| Version No. |
Version date |
Description of Change | Author Name / Project Manager |
|---|---|---|---|
| 001 | 2014-11-20 |
|
LCDR Neil Mafnas, FDA |
| 002 | 2015-09-22 |
|
Liliane Brown, FDA |
| 003 | 2018-10-15 |
|
Michael Chan, FDA Hiromi Kumada, PMDA |
| 004 | 2020-03-30 |
|
Marc-Henri Winter |
| 005 | 2021-12-30 |
|
Michael Chan, FDA |
| 006 | 2022-11-21 |
|
Michael Chan, FDA |
| 007 | 2024-03-07 |
|
Frédéric HAMELIN, Health Canada |
Approved: Signature on File, CHAIR, MDSAP RAC
Date: 2024-04-05
Uncontrolled when printed.
For the most current copy, contact MDSAP@fda.hhs.gov