Medical Device Single Audit Program (MDSAP)An Overview Canadian Experience

Linda ChatwinSr. Customer Solutions Consultant

: 360-817-5556

: linda.Chatwin@ul.com

LINDA M CHATWIN, Esq, RAC

Biography

Ms. Chatwin has been involved with regulated medical products for over 30 years. She understands the

global regulatory maze required to bring products to market, through years of watching regulations evolve

and change. She holds a Regulatory Affairs Certification and is an attorney in the U.S. She has obtained

product approvals for a wide range of products, and remains involved in changing requirements for

medical devices worldwide. She has navigated many FDA inspections, and has negotiated favorable

outcomes with FDA. Currently, she assists clients with regulatory issues and challenges, including

implementation of UDI processes, performing mock audits, in-depth training on regulatory requirements

and consulting on quality system development and improvement.

In an effort to address the growing burden on government agencies for resources necessary to ensure continued medical device manufacturer compliance with quality system regulations and standards, the IMDRF established a work group (in 2012) to establish a single, global audit program known as MDSAP as a substitute for Regulatory Authority (RA) inspections.

The idea being that qualified Auditing Organizations (AOs) could prepare audit reports accepted by the IMDRF participating RAs as evidence of compliance.

NOTE: The MDSAP adds no new standards or regulations. Includes ISO 13485:2016 requirements along with the ‘country specific regulations’.

Medical Device Single Audit Program (MDSAP)

In January 2014, a MDSAP Pilot process was initiated with a number of international regulatory partners. The intent was that:

• MDSAP-recognized Auditing Organizations (AOs) would conduct a single audit of a medical device manufacturer that would satisfy the relevant requirements of the medical device regulatory authorities (RAs) participating in the pilot program.

• These partners would accept the MDSAP audit reports as a substitute for routine regulatory inspections.

International partners that participated in the MDSAP Pilot included:• Therapeutic Goods Administration of Australia (TGA)

• Brazil’s Agência Nacional de Vigilância Sanitária (ANVISA)

• Health Canada (HC)

• US Food and Drug Administration (FDA)

Official Observers:• The World Health Organization (WHO) Prequalification of In Vitro Diagnostics (IVDs) Programme

• The European Union (EU)

• Japan’s Ministry of Health, Labour and Welfare (MHLW), and the Japanese Pharmaceuticals and Medical Devices Agency (PMDA)

History – MDSAP Pilot

In December 2015, Health Canada (HC) confirmed their transition plan for the MDSAP.

The MDSAP Pilot program was to conclude 31 Dec. 2016, when HC intended to implement MDSAP as the only vehicle for manufacturers to comply with the QMS requirements of the CMDR (MDSAP would thus replace the current CMDCAS program).

This implementation will span 2 years, during which HC will accept both CMDCAS and MDSAP certificates, but as of 01 Jan. 2019, only MDSAP certificates will be accepted

Note that HC’s transition to MDSAP is an attempt to align with the transition period for ISO 13485:2016.

History – Health Canada

HC also noted that all CMDCAS-recognized registrars have been given the opportunity to apply to be authorized MDSAP AOs during the Pilot and have stated their intentions to do so.

Manufacturers who have a contract with registrars not yet authorized under MDSAP should contact their registrar and inquire about their expected timeline for approval.

To facilitate transition, MDSAP audits may take the place of CMDCAS surveillance audits but certification documents will only be issued once all AO certification requirements have been met.

Manufacturers who plan to market their devices only in Canada are required to comply with the regulatory requirements set out in the CMDR, but compliance with foreign regulatory requirements will not be enforced.

• However, the CDMCAS QMS certificate will need to be replaced with an MDSAP certificate, which may require the services of another registrar / AO.

History – Health Canada (cont’d)

In December 2015, the US FDA announced that they were terminating the Pilot Program (effective 31 Mar. 2016) and participating in the operational phase of the MDSAP starting on 01 Jan. 2017.

• The report contained generally favorable conclusions, however it was noted that only 45 out of a hoped-for 330 MD manufacturers participated

According to the FDA, the MDSAP program provides them “better assurances than the Pilot because FDA's requirements under 21 CFR 820 or other FDA regulations typically covered during FDA inspections are encompassed within the MDSAP audit model.”

As a result of the implementation of the MDSAP program, FDA no longer accepted ISO 13485:2003 Voluntary Audit Report Submissions after 31 March 2016, to assist transitioning manufacturers over to MDSAP.

History - FDA

Global:• Reduce the overall number of audits or inspections and optimize the time and resources expended on audit

activities

• Enhance confidence in reliability of 3rd party audits, so that more RAs join MDSAP, and use MDSAP information to limit the need for additional audits.

• Some RAs will use audit outcomes as an alternative to their own inspections to process applications for MD marketing authorization.

• Like in any 3rd party auditing program, the MD manufacturer is free to choose among all authorized AOs. Routine audits are pre-announced and planned.

• Improve the predictability of audit outcomes through:

• enhanced auditing organization recognition criteria

• monitoring of AOs by the participating RAs

• the use of a standard MDSAP audit model

• grading of any nonconformity using objective criteria to characterize the finding

• reporting audit outcomes using a standard template.

Potential Benefits of MDSAP

• Canada

• Health Canada will operate the current Canadian Medical Devices Conformity Assessment System (CMDCAS) and MDSAP in parallel during the implementation.

• Health Canada would accept either an MDSAP certificate or a CMDCAScertificate for the purpose of obtaining a new (or maintaining an existing) Class II, III, or IV medical device license, pursuant to section 32 of the Canadian Medical Devices Regulations.

• Any Canada-specific benefits (compared with CMDCAS)? – none that are obvious…….

Potential Benefits of MDSAP

• US

• FDA plans to accept MDSAP reports as a substitute for FDA routine inspections (biennial by policy).

• MDSAP routine audits are announced, scheduled by the AO with the manufacturer, with a pre-established duration;

• The FDA will review MDSAP reports with a level of scrutiny commensurate to the significance of audit findings, taking into account the review and follow-up performed by the AO;

• Firms have 1 month to provide their full response to critical nonconformities (grade 4 and 5) to the AO (as opposed to 15 working days following a FDA inspection);

• Certification documents issued by the AO will state compliance with applicable US regulations, which may provide a marketing advantage.

Potential Benefits of MDSAP

International Medical Device Regulators Forum (IMDRF) main MDSAP documents (can link through FDA portal International Programs). Important documents for Manufacturers include:

• FAQ

• MDSAP Audit Models (ISO 13485:2016)

• MDSAP Companion Documents (ISO 13485:2016)

• Medical Device Regulatory Audit Report template

• Nonconformity Grading System for Regulatory Purposes and Information Exchange

• Links to MDSAP members’ regulations

Guidance

There are 3 categories

• Application received

• Authorized to Conduct MDSAP Audits

• Recognized

Auditing Organizations (AO)

• The Registrar applies to the MDSAP AO Assessment Body for Recognition

• The Registrar and its auditors get trained and are then capable of conducting audits, but cannot issue MDSAP certificates until they are Recognized.

• For Recognition:Assessment by Regulators (including off and on-site audits) of the

compliance of the prospective AO’s management system to all regulatory requirementsRegulators will witness audits of clients by the prospective AO to verify their

performance. They do not participate in the client audit itself

Once the Regulators are satisfied, they will grant recognition and the AO can issue certificates.

All 5 jurisdictions need to be covered and a variety of types and risk classes of devices / IVDs

Process for AOs

MDSAP Auditing Organizations (AOs)

Recognized Authorized to Conduct MDSAP Audits

BSI Group America Inc. DEKRA Certification B.V

Intertek Testing Services NA Inc. DQS Medzinprodukte GmBH

TŰV SŰD America Inc. LNE G-MED

National Standards Authority of Ireland (NSAI)

SAI Global Cert. Services PTY Ltd.

SGS United Kingdom Ltd.

TŰV Rheinland of North America Inc.

TŰV USA Inc.

UL Medical and Regulatory Services, UL LCC

Recognized Authorized to Conduct MDSAP Audits Application Received –

Under Authorization

Process

BSI Group America Inc. DEKRA Certification B.V

Intertek Testing Services NA Inc. DQS Medzinprodukte GmBH

TŰV SŰD America Inc. LNE G-MED

SAI Global Cert. Services PTY Ltd.

SGS United Kingdom Ltd. NSF Health Sciences Certification LLC

UL Medical and Regulatory Services, UL LCC

TŰV Rheinland of North America Inc.

TŰV USA Inc.

QMI-SAI Canada Limited

Lloyd’s Registry Quality Assurance Inc.

National Standards Authority of Ireland (NSAI)

The MDSAP Audit process is built on a risk-based approach and encompasses the QMS requirements for MD manufacturers according to (note that these are regulation-based QMS requirements only):

➢ISO 13485:2003/2016

➢Brazilian Good Manufacturing Practices (RDC ANVISA 16/2013)

➢FDA Quality System Regulation (21 CFR Part 820)

With 2 additional elements needed to fulfil specific requirements of the participating MDSAP RAs:

➢Medical Device Adverse Events and Advisory Notice Reporting

➢Device Marketing Authorization and Facility Registration

MDSAP Audit Model

The MDSAP Audit Process Companion document is provided as a reference and includes additional detail regarding each audited process as well as guidance for assessing the conformity of each process. Please refer to the companion document as needed to understand and anticipate the requirements and expectations of the AOs.

Remember, MDSAP adds no new regulations, however, most companies will need to implement / improve the following to be compliant:

• Ensure that all applicable regualtory requiements are well-documented, including new, country-specific procedures and country specific reporting and recall requirements, as appropriate;

• Ensure that risk management is thoroughly addressed throughout the QMS;

• Ensure that product changes are evalulated for risk as well as regulatory impact and regultory notificaiton, as applicable;

• Ensure that your product registrations / listing are current and match your commercialized product.

MDSAP Process: Summary

Status of MDSAP Transition:

• Transition well underway

• To date, approximately 1,000 facilities have started transition

• 575 have already undergone first audit

Per Health Canada

• Generally, broad support for singe audit concept

• Stakeholders are concerned about increase in audit time and costs

• Some Canadian distributors are concerned that foreign suppliers will abandon Canadian market because of MDSAP

• In December, 2017, HC surveyed holders of Class II, III and IV device license• 1,455 responded

HC Con’t

• Results show that 3 out of 4 intend to transition to MDSAP

• About 12 % undecided

• Most intend to complete transition in 2018

• Some indicated difficulty scheduling MDSAP audit

• Those not intending to transition was due to sales not justifying expense of MDSAP

Stakeholder Feedback

• HC is activity monitoring the impact of MDSAP transition

• Working with AOs to identify and mitigate impact of potential auditor shortages

• Working with MDSAP RA partners to find audit time reductions

• HC will soon launch a MDSAP website

• Exploring options to support smaller manufacturers to transition before deadline

Health Canada Response

• AOs are ready

• HC working with AOs to identify problems with audit scheduling

• According to HC, majority of AOs do not foresee significant difficulty in meeting transition deadline

• Most significant challenge is getting manufacturers to schedule MDSAP audit soon enough to complete before transition deadline

• Currently over 1400 auditors in MDSAP training program

• Of these, 700 fully qualified

AO Response

According to AOs we talk to and Emergo clients, many OCA companies (especially smaller) are considering pulling out due to the significant add’lcosts

Since most companies are waiting to the last minute, this is creating a significant pinch point at the end of 2018, esp. when combined with the concurrent ISO upgrade

Most AOs are not taking on new clients, so start-ups are being forced to delay market introduction in Canada (or elsewhere where ISO registration is a requirement)

Canadian Experience

• Major CA Industry Group sent letter January 9, 2018

• Concern about challenges of keeping up with requirements around unannounced audits, and release of new versions of ISO 9001:2015 and ISO 13485:2016

• Registrars are reporting major non-conformances during witness audits by RAs

• One large AO reports 25-30% of its client base with withdraw products from Canada, representing approx. 150 companies

MEDEC Response

• Consider extending the transition date to at least January 2020, allowing transition to ISO 13485:2016

• Extend CMDCAS viability so that certificates do not expire January 1, 2019

• Consider a two track or “lean” system for several years, which would use ISO 13485 plus CMDCAS for companies who only want MDSAP for Canada

MEDEC Recommendations

Question & Answers

Thank you for your attention

.