5 countries. 1 unified audit. - maetrics.co.uk · ++an informative section, which focuses on an...

For more information, please contact:USA Office: + 1 877 623 8742 UK Office: +44 115 921 6200 [email protected] [email protected] www.maetrics.com www.maetrics.co.uk

UNDERSTANDING THE MEDICAL DEVICE SINGLE AUDIT PROGRAM (MDSAP)Melodie Kahl, Mike Wolf, and Scott EdwardsJuly 2017

5 Countries. 1 Unified Audit.

©2017 Maetrics. All Rights Reserved. ® Trademark of Theoris Group, Inc. 2

IntroductionWithin the evolving regulatory environment of the Medical Devices industry, prioritizing which changes to respond to first can be challenging. Among the various recent changes, the Medical Device Single Audit Program (MDSAP) impacts multiple industry stakeholders. In addition to this, the most important word of the MDSAP acronym is “Single,” because the program is offering an “all-in-one” audit to accommodate multiple legislations. The industry would, therefore, be well advised to treat this as a positive change as the collaboration and support amongst the stakeholders will be the most effective and efficient way to implement the MDSAP.

This whitepaper provides guidance for the industry to prepare for MDSAP and emphasizes the business advantages that can be drawn out of the program. Specifically, this whitepaper is comprised of:

++ an informative section, which focuses on an easy-to-understand analysis of the MDSAP including a stakeholder map, benefits from each jurisdiction, as well as a review of the MDSAP structure; and

++ business analysis section, which provides the details needed to make the best strategic decisions based on internal and external factors.

Overview and scopePreparation for the MDSAP started ten years ago, and was initiated by the International Medical Device Regulators Forum (IMDRF). The IMDRF is a voluntary group of medical device regulators from around the globe who discuss acceleration and future directions in medical device regulatory harmonization and convergence. The IMDRF was built upon the foundations set by the Global Harmonization Task Force (GHTF) which was disbanded in 2012. Guidance documents for the IMDRF can be found here: http://www.imdrf.org/documents/documents.asp

The MDSAP is a global approach devised to audit and monitor the manufacturing of medical devices, with the objective of improving their safety and effectiveness. This program follows a “top-down” auditing approach, similar to the FDA Quality System Inspection Technique (QSIT). MDSAP promotes greater alignment of regulatory approaches and technical requirements and also promotes consistency, predictability and transparency of regulatory programs.

The Vision of MDSAP is to: “Develop, manage and oversee a single audit program that will allow a single regulatory audit to satisfy the needs of multiple jurisdictions”.1

The MDSAP Functional statement defines the policy of MDSAP thus: “To jointly leverage regulatory resources to manage an efficient, effective and sustainable single audit program focused on the oversight of medical device Manufacturers’ quality management systems.”1

The MDSAP will confirm and provide evidence of compliance with the ISO 13485 standard and the medical device regulations in Canada, Brazil, Japan, Australia and USA. Only Canada will enforce the MDSAP as mandatory, starting from January 1, 2019.

Exclusions can be made from ISO 13485 requirements, when specific requirements are irrelevant to the products in scope of the audit plan. However, the Brazilian regulatory authority, ANVISA, does not authorize an exclusion of the design and development process from the scope of the QMS.


ABBREVIATIONS

+ ANVISA: Agência Nacional de Vigilância Sanitária (Brazil)

+ AO: Auditing Organization

+ CMDCAS: Canadian Medical Devices Conformity Assessment System

+ CRO: Contract Research Organization

+ DUNS: Data Universal Numbering System

+ EU: European Union

+ FDA: Food and Drugs Administration (USA)

+ IMDRF: International Medical Device Regulators Forum

+ IVD: In Vitro Diagnostics

+ MAH: Marketing Authorization Holder (Japan)

+ MDSAP: Medical Device Single Audit Program

+ MHLW/PMDA: Ministry of Health, Labor and Welfare/Pharmaceuticals and Medical Devices Agency (Japan)

+ NC: Non-conformity

+ PMA: Pre-Market Approval

+ QMS: Quality Management System

+ RAC: Regulatory Authority Council

+ SME: Subject Matter Experts

+ TGA: Therapeutic Goods Administration (Australia)

+ UDI: Unique Device Identification

+ WHO: World Health Organization


Stakeholders Map Medical Device Manufacturers Medical Device Manufacturers involved in the MDSAP are not publicly listed, and any Manufacturer can participate in the MDSAP. To be MDSAP certified, the Manufacturer and the Auditing Organization (AO) shall launch their collaboration on a contractual basis, in which the costs to be paid to the AO for the MDSAP audit are defined. Feedback from Manufacturers to the Regulatory Authorities regarding the MDSAP process is encouraged. Contact emails, which are available for each of the five Regulatory Authority partners participating in the program, can be found here: https://www.fda.gov/downloads/MedicalDevices/InternationalPrograms/MDSAPPilot/UCM455187.pdf

SuppliersSuppliers of Medical Devices may follow the MDSAP if they abide by the participation criteria as defined by the Regulatory Authorities. For instance, when the Manufacturer is outsourcing activities such as software development, sterilization, or design and development activities, the supplier could be considered a critical supplier and would therefore be involved in the MDSAP audit.

Auditing Organizations (AOs)AOs (e.g. Notified Bodies, Registrars, CROs, and Independent Organizations) are recognized by the Regulatory Authorities to deliver MDSAP certifications. There are no application fees associated with MDSAP training. AOs shall participate in regulatory coordination groups in order to be informed of any changes in the MDSAP criteria or requirements.

A CRO can be an AO only if it shows impartiality in its management system. AOs will share audit outcomes with participating Regulatory Authorities. Upon successful certification audits, AOs will be accredited to issue MDSAP certification documents stating compliance to the ISO 13485 standard and applicable regulatory requirements.

The three-year MDSAP pilot ended on December 31st, 2016. During this pilot phase, only AOs recognized under the CMDCAS program were involved. Starting January 1st, 2017, the application of new AOs has been initiated to increase numbers beyond the original eleven, as detailed below.

Up to now, eleven AOs2 were authorized to conduct MDSAP audits. These AOs are:

++ BSI Group America Inc. ++ DEKRA Certification B.V. ++ DQS Medizinprodukte GmbH ++ Intertek Testing Services NA Inc. ++ Laboratoire National de métrologie et d’Essais (LNE) - Division certification G-MED ++ SAI Global Certification Services Pty Ltd. ++ SGS United Kingdom Ltd. ++ TÜV Rheinland of North America, Inc. ++ TÜV SÜD America Inc. (also operating as TÜV America Inc.) - Management Service Division ++ TÜV USA, Inc. ++ UL Medical and Regulatory Services UL, LLC

https://www.fda.gov/downloads/MedicalDevices/InternationalPrograms/MDSAPPilot/UCM429978.pdf


Among the AOs listed above, the following are recognized AOs as of 15th May 2017:

++ BSI Group America Inc. ++ Intertek Testing Services NA Inc. ++ TÜV SÜD America Inc. (also operating as TÜV America Inc.) - Management Service Division

Assessments of Auditing Organizations are performed in accordance with IMDRF document MDSAP WG N5, Regulatory Authority Assessment Method for the Recognition and Monitoring of Medical Device Auditing Organizations and related MDSAP procedures and guidance documents.

The FDA maintains an up-to-date list of Auditing Organizations (AOs) that are authorized to conduct MDSAP audits and each organization’s recognition status. The link to this information is below:https://www.fda.gov/downloads/MedicalDevices/InternationalPrograms/MDSAPPilot/UCM429978.pdf

CERTIFIED QUALITY AUDITORSCertified Quality Auditors are authorized by an AO when they demonstrate proven competencies with MDSAP requirements. These auditors can be employed by the AO, or work on a contract basis only if they demonstrate and maintain impartiality. Training on the MDSAP Audit Model and the requirements of the participating Regulatory Authorities is available on-line to Auditing Organizations’ candidate applicant auditors.

REGULATORY AUTHORITYRegulatory Authority participants (e.g. MDSAP, RAC and SME Working Groups) support, develop, implement, maintain and expand the MDSAP. Regulatory Authority Assessors conduct witnessed audits during a MDSAP audit performed by an AO.

CONSULTANCY ORGANIZATIONSConsultancy organizations can offer medical device consultancy for the deployment of MDSAP. The list of customers (Manufacturers or Suppliers) who received medical device consultancy services should be available to the AO and the Regulatory Authority Assessors. The independence of the AO from the Consultancy Organization shall be demonstrated and documented.

The AO cannot certify a QMS on which a customer received medical device regulatory consultancy services from another legal entity of the same group within three years following the end of the consultancy service or of the internal audit.3

PARTNERS AND OBSERVERSPartners participating in the MDSAP are the TGA (Australia), ANVISA (Brazil), Health Canada (Canada), MHLW/PMDA (Japan) and the FDA (United States of America). Observers are the WHO prequalification of IVD Programme and the EU.


Benefits specific to each jurisdictionCanadaStarting on January 1, 2019, the Class II, III and IV Medical Devices in Canada will follow MDSAP. The CMDCAS will be transferred to the MDSAP. In contrast to the other partners of the program where participation is voluntary, the MDSAP will be mandatory for the regulatory submission in Canada.

Australia Combination Products and other Medical Devices are accepted by the MDSAP. The TGA can accept MDSAP certificates as support of evidence for compliance with the ISO13485 standard, and may request additional documents.

BrazilThe resolution from August 2015 allows MDSAP reports as an alternative to an ANVISA inspection, only when the previous ANVISA inspection was deemed satisfactory.

USAThe MDSAP can be an alternative to a FDA inspection, excluding combination products and PMA inspections. Certification documents issued by the AO must comply with applicable US regulations.

JapanAn MDSAP audit report submitted at the time of pre- or post-market QMS inspection can be used as a trial to exempt some manufacturing sites from on-site inspection, and/or to allow the Manufacturer’s Marketing Authorization Holder (MAH) to substitute the MDSAP report for a considerable part of documents required for the inspection.

MDSAP audit structure Seven processesThe MDSAP is structured into seven interrelated processes4, as follows:

++ Goal

++ Expected results

++ Activities

++ Relation with other processes

++ Link with the ISO 13485 clauses

++ �Country�specific�requirements7

6

5

4

3

2

1 Management

Device Marketing Authorization and Facility Registration

Measurement,�Analysis�and�Improvement�

Medical Device Adverse Events and Advisory Notices Reporting

Design�and�Development

Production and Service Controls

Purchasing

These 7 processes are built on the following or similar structure:


The IMDRF document Audit Model MDSAP AU P0002 contains specific instructions for the planning and execution of the MDSAP audit process. It includes an audit sequence and instructions for auditing each specific process.

Note on “country specific requirements”: There are no EU requirements because the CE marking is excluded from the program, as the role of the EU is defined as that of an observer.

Audit cycleThe implementation of the MDSAP follows a three-year cycle, as for a standard ISO 13485 certification provided by a Notified Body. This cycle includes an initial certification audit, a surveillance audit, and a recertification audit.

INITIAL AUDITThe stage one audit is a documentation review, which determines the readiness of the audited company to undergo a stage two audit.

The stage two audit is an implementation review of the ISO 13485 standard and regulations applicable to the USA, Canada, Brazil, Japan, and Australia. Its purpose is to review the QMS in order to verify if the products are safe, effective, and meet performance specifications.

The audit report format is specifically defined for MDSAP. The current designation for this audit report format is MDSAP AU F0019.1.005. Upon successful completion of an initial audit or re-audit, an AO will issue certification documents including a reference to the MDSAP that will state compliance to ISO 13485 and any applicable medical device regulations from each jurisdiction that were used as audit criteria.

SURVEILLANCE AUDITUnless there were significant changes since the last audit, the surveillance audit does not require a stage one audit. The purpose of the surveillance audit is to maintain confidence in the compliance of the audited QMS with applicable standards and regulations.

RECERTIFICATION AUDITAs with the surveillance audit, a stage one audit is not mandatory. The purpose of this recertification audit is:

++ to evaluate a continuous effectiveness and suitability of the QMS satisfying all applicable standards and regulations; and

++ to confirm the relevance and applicability of the QMS with the scope of certification and MDSAP specific requirements.

Note on additional audits: In some cases, special audits, audits conducted by the regulatory authorities, and unannounced audits may be conducted.


Success MeasurementIn order to consider the MDSAP successful, eight key performance indicators (KPIs) will be measured, as described in the “proof of concept” document developed by the MDSAP Subject Matter Experts Working Group.

These KPIs focus on:

++ The content of the audit reports which conform to the requirements++ Consistency of the audit findings and supporting evidence++ Sufficient information in the audit report to provide to the regulatory authorities++ Any gaps between the audit model, the QMS and regulatory requirements++ The task sequence and assessment model which determines MDSAP requirements++ An appropriate audit duration++ The number of recognized AOs++ The number of Manufacturers participating in the MDSAP

Note on “audit duration”5: Audit duration should not exceed the accumulated time of ISO 13485 audits and regulatory inspections. The duration of the MDSAP audit is calculated on the basis of the number of applicable audit tasks, associated with the type of audit to be conducted, and the specific activities of the organization to be audited.

Non-conformities6 NCs identified during an on-site audit are graded on a scale from one (least critical) to five (most critical).

If the MDSAP audit identified one or more grade five NCs, or more than two grade four NCs, or a public health threat, or any fraudulent activity, the AO must inform the Regulatory Authorities within five (5) business days.

For Grade Four or Grade Five NCs, Manufacturers are expected to provide evidence to the AO of implementation of the remediation actions within thirty (30) days of the audit end date.

AOs are expected to provide the audit package, which includes the NC Grading, to the Regulatory Authority within forty-five (45) days of the end of audit.

The Manufacturer must provide a remediation plan for each NC within fifteen (15) calendar days from the date the NC report was issued.

Requirement for a DUNS numberIn order to participate in the MDSAP, medical device Manufacturers will have to submit a D-U-N-S number. A DUNS number, provided by Dun & Bradstreet, is required to uniquely identify each physical location of the business’s facility or site. The site-specific DUNS number is a recognized identification tool and serves as a resource for MDSAP in identifying and verifying business information. The DUNS number is specific for each site. Each distinct physical location of an entity (e.g., branch, division, and headquarter) would be assigned a different DUNS number.


MDSAP SWOT Analysis

StrengthsNO ADDITIONAL REQUIREMENTS FOR THE MEDICAL DEVICE MANUFACTURERS The MDSAP is not based on additional ISO standards or regulatory requirements, but covers the existing ISO 13485 standard and country specific requirements.

Therefore, the normative and regulatory framework remains unchanged, and Medical Device Manufacturers benefit from an effort of standardization and harmonization within the QMS, and also in the regulatory submissions.

HARMONIZED AUDITING REQUIREMENTSSince the MDSAP is built on multiple regulations from the 5 participating countries, a Manufacturer who complies with the MDSAP automatically complies with the regulations for the five participating countries. Spending time and effort on preparing for, and responding to, audits and inspections from various markets is a challenge that is significantly reduced by MDSAP.

Indeed, this regulatory surveillance activity will be eased by the implementation of the MDSAP. Even though the implementation phase may initially appear to be a constraint, the benefits that the MDSAP will provide supersedes its constraints.

++ Internal resource limitations

++ Lack of trained internal auditors

++ Cost of preparing the QMS for a MDSAP audit

OPPORTUNITIES++ Market access advantage

++ Cost advantage

++ Collaboration with external resources

THREATS

WEAKNESSES

++ Low Manufacturer participation/readiness of Manufacturers

++ Unclear coordination among regulators

++ Impact of major industry changes

++ No additional requirements for the Medical Device Manufacturers

++ Harmonized auditing requirements

++ Guidance facilitating MDSAP implementation

STRENGTHSIN

TERN

AL FA

CTO

RSEX

TERN

AL FA

CTO

RS


GUIDANCE FACILITATING THE MDSAP IMPLEMENTATIONThe FDA website provides guidance to stakeholders by making policies, procedures, templates and forms publicly available. On the websites of the FDA and of other regulatory authorities it is also possible to find links to descriptions of procedures, templates and forms. By following this guidance, Manufacturers can easily be guided through the MDSAP process.

The FDA website containing links to the MDSAP documents can be found here: https://www.fda.gov/MedicalDevices/InternationalPrograms/MDSAPPilot/ucm377578.htm

WeaknessesINTERNAL RESOURCE LIMITATIONSFor companies selling Medical Devices in Canada, the MDSAP is going to soon become mandatory. For the other four countries, it is strongly recommended. The transition from the current compliance procedures to the MDSAP procedures will have to be managed as a project including several phases (e.g. training, gap assessment, remediation).

LACK OF TRAINED INTERNAL AUDITORSManufacturers will need to train internal auditors and other professionals in the methods and criteria of an MDSAP audit. Once auditors are trained, a gap assessment between the current internal procedures and the MDSAP procedures will have to be made. At this stage remediation activities will have to be carried out in order to comply with the MDSAP procedures.

Training on the MDSAP requirements and auditing process will need to become a priority.

COST OF PREPARING THE QMS FOR A MDSAP AUDITDeployment or re-direction of resources will temporarily incur additional costs. However, this weakness should be interpreted as a mandatory constraint which will eventually lead the Manufacturer to new opportunities.

OpportunitiesMARKET ACCESS ADVANTAGELarger acceptance of audit reports through increased sharing and presence of various regulators. Some Manufacturers may choose to broaden market participation in the five markets currently covered by MDSAP. Also, participating in MDSAP may be seen as evidence of a medical device Manufacturer’s commitment to product quality and regulatory compliance. It may even be used as a promotional tool for marketing differentiation.

COST ADVANTAGEUnder MDSAP, a single audit is used in lieu of multiple separate audits or inspections by participating regulatory authorities or their representatives. Therefore, for many medical device Manufacturers, the MDSAP program reduces the overall number of audits or inspections and optimizes the time and resources expended on audit activities.

It is expected that MDSAP will eventually provide a broader choice of third party AOs, and subsequent market forces may tend to reduce the cost of AO services. Even though currently the number of AOs is not as large as expected, it’s possible that organizations other than the existing Notified Bodies will apply to be recognized as an AO.


COLLABORATION WITH EXTERNAL RESOURCESCollaboration with external resources, including MDSAP subject matter experts may add timely and valuable support for the MDSAP audit preparation. External resources, including some consultancy organizations, often collaborate with the best MDSAP experts who are appropriately trained to bring in the maximum results and benefits to Manufacturers, and to guide them towards the best path to success with the MDSAP process.

ThreatsLOW MANUFACTURER PARTICIPATION/READINESS OF MANUFACTURERSThe increasing regulatory burden coming from recent industry changes is not encouraging for Manufacturers to actively participate in the MDSAP. In addition, the benefits of supporting change to the MDSAP audits may not be obvious in the short-term.

UNCLEAR COORDINATION AMONG REGULATORSThere remains some residual lack of clarity in the methodology of recognition of MDSAP audit reports among the multiple regulators in the five participating countries. It’s imperative that the five RA partners ultimately take a very similar approach to accepting and recognizing the MDSAP, otherwise the goals and benefits of the program will not be achieved.

IMPACT OF MAJOR INDUSTRY CHANGES Only three AOs are currently recognized and eleven AOs are authorized to perform MDSAP audits. These AOs are already operating as Notified Bodies for the European market. The capacity of these Notified Bodies to support Manufacturers’ requests for MDSAP audits will be strained, particularly at a time when these NBs will be extremely busy supporting their clients’ transition to compliance with the new European Medical Device Regulation and IVD regulation over the next three to five years.

Conclusion The MDSAP involves various stakeholders, who all have different roles, responsibilities, and levels of influence. As such the MDSAP a “single audit program” that unifies stakeholders in a collaborative effort for the benefit of the Medical Device industry.

The work of Manufacturers, Auditing Organizations, and Regulatory Authorities will be greatly impacted. This impact involves a radical change in audit methodology, in order to harmonize regulatory requirements among multiple markets.

For Manufacturers, the change consists in updating the QMS and regulatory submission processes. Auditing Organizations, on their part, are applying for authorization and recognition to perform MDSAP audits, while Regulatory Authorities are collaborating with other regulatory authorities, and assessing AOs during witnessed audits, in order to determine if the AO’s auditing practices meet the requirements for recognition.

Although some stakeholders may be cautious about embracing this new MDSAP approach, the benefits of the program largely outweigh its constraints and risks, and are expected to have a positive impact on the medical device industry moving forward.


Sources1.+MDSAP Functional Statement MDSP P0001.002 Version Date 2015-07-242.+508_AO_Avaibility_To_Conduct_MDSAP_Audits 2017_04_04 Revised Web 2017-04-04 V0173.+MDSAP AU P0028.002 Threat to Impartiality Policy Version date: 2016-08-154.+P AU G0002.1.003 Companion Document Version date: 2015-10-065.+MDSAP AU P0008.004 Audit Time Determination Procedure Version date: 2017-02-156.+MDSAP AU P0027.004 Post Audit Activities and Timeline Policy Revision Date: 2016-08-15

5 countries. 1 unified audit. - maetrics.co.uk · ++an informative section, which focuses on an...

Documents