OPENREGULATORY
Sign in Get started
FREE Ungated HTML checklist · mapped to free QMS templates

MDSAP audit checklist

One audit, five countries. This checklist follows the seven processes of the official MDSAP audit approach and lists the evidence to have ready for each — so the audit confirms what you already know.

Start the checklist Prepare evidence in Formwork

Based on MDSAP AU P0002 and current official forms · sources checked 19 August 2026 · change log below

What MDSAP is, and which countries accept it

The Medical Device Single Audit Program lets one audit by an authorized auditing organization satisfy the QMS oversight of five regulators: the US FDA, Health Canada, Brazil's ANVISA, Japan's MHLW/PMDA, and Australia's TGA. For Canada it's mandatory — Health Canada requires MDSAP certification for Class II–IV devices. For the other four countries it's voluntary but valuable: the FDA accepts MDSAP audit reports in place of routine inspections.

The audit is built on ISO 13485 plus each country's specific requirements, and it follows a fixed sequence of seven processes. That structure is good news for preparation: you know exactly what will be examined, in which order, and can prepare evidence per process — which is how this checklist is organized. The European Union is not part of MDSAP; notified body audits under the MDR continue separately.

The checklist, process by process

Work through each process and tick what you can already evidence. Anything unticked is your preparation plan. The full official audit approach and forms are on the FDA's MDSAP procedures page — this checklist prepares you for it; it doesn't replace it.

PROCESS 1 OF 7

Management

The heart of the audit: leadership, planning, and review of the whole QMS.

  • Quality manual, quality policy, and measurable quality objectives are current and approved
  • Management reviews held at planned intervals, with records covering all required inputs
  • Roles, responsibilities, and a management representative are documented
  • Internal audits cover the full QMS on a schedule, with findings and follow-up recorded
  • Risk management is integrated into QMS processes, not just product design

Free templates for this process: Internal Audit Plan, SOP Internal Audit.

PROCESS 2 OF 7

Device marketing authorization and facility registration

Each participating country's registration and licensing requirements, checked in one place.

  • Registrations and licenses are current for every MDSAP country you sell in
  • Authorization records match the devices actually marketed (variants, classifications)
  • Regulatory correspondence and commitments are tracked to closure
  • A process exists for assessing regulatory impact of changes before implementation

PROCESS 3 OF 7

Measurement, analysis and improvement

How you detect, analyze, and fix problems — including CAPA and nonconformance handling.

  • Nonconforming product is identified, segregated, and dispositioned with records
  • CAPA procedure runs from trigger to documented effectiveness check
  • Complaint data, audit findings, and process metrics feed analysis of quality data
  • Statistical techniques and sampling rationales are documented where used

Free templates for this process: SOP Corrective and Preventive Action (CAPA), CAPA List.

PROCESS 4 OF 7

Medical device adverse events and advisory notices

Reporting obligations differ per country — auditors check you know each one.

  • Procedures define adverse-event reportability criteria and deadlines per MDSAP country
  • Complaint handling distinguishes complaints from reportable events, with records of the decision
  • Advisory notice / recall procedure exists and has been exercised or tested
  • Links from events back into CAPA and risk management are documented

Free templates for this process: SOP Feedback Management and Customer Complaints.

PROCESS 5 OF 7

Design and development

Design controls from planning through transfer, with the design file as evidence.

  • Design plans, inputs, outputs, reviews, verification, and validation are recorded per project
  • Design changes are controlled with regulatory and risk impact assessed
  • Risk management file is complete and consistent with current design
  • Design transfer to production is documented

Free templates for this process: Risk Management Plan & Acceptance Matrix, Risk Management Report.

PROCESS 6 OF 7

Production and service controls

Making the device the way the file says you make it.

  • Production processes are documented, controlled, and monitored; process validations are current
  • Identification and traceability run through production records
  • Equipment maintenance, calibration, and environment controls have records
  • Servicing activities, where applicable, produce analyzed records

PROCESS 7 OF 7

Purchasing

Supplier control proportionate to risk — a frequent source of findings.

  • Suppliers are evaluated, approved, and monitored based on risk
  • Purchasing data specifies requirements, including quality requirements
  • Incoming verification activities match the criticality of what's purchased
  • Supplier-related problems feed nonconformance and CAPA processes

A necessary caveat: completing a checklist does not assure certification. MDSAP auditors assess whether your QMS is genuinely implemented — real records, real reviews, real closed CAPAs. Use the gaps this checklist surfaces to fix the system, not the paperwork.

Turning gaps into audit-ready evidence

Most unticked boxes above resolve to the same three moves: write or adapt the missing procedure, generate honest records under it, and keep both retrievable. The free OpenRegulatory template library covers the procedures; Formwork keeps the records — versioned documents with approvals, training tied to revisions, CAPAs with effectiveness checks, and audit-ready exports for the auditor's evidence requests.

Prepare your evidence in Formwork Browse the free templates

Frequently asked questions

What is MDSAP?
The Medical Device Single Audit Program: one regulatory audit, conducted by an authorized auditing organization, accepted by five countries — the United States, Canada, Brazil, Japan, and Australia. Instead of separate inspections per market, one MDSAP audit covers the QMS requirements of all participating regulators.
Is MDSAP mandatory?
Only for Canada: Health Canada requires MDSAP certification for Class II–IV devices sold there. For the US, Brazil, Japan, and Australia it's voluntary — the FDA, for example, accepts MDSAP audit reports in place of routine inspections but doesn't require them.
Does MDSAP cover Europe?
No. The EU is an observer, not a participant — MDSAP does not replace notified body audits under the MDR or IVDR. Manufacturers selling in both markets still need their notified body certification alongside MDSAP.
How long does an MDSAP audit take?
Audit duration is calculated from the official MDSAP audit-time rules, driven mainly by employee count and the applicable regulatory requirements — several days on site is typical for a small manufacturer. Surveillance audits follow annually, with a recertification audit in year three.
Does completing this checklist guarantee passing the audit?
No — and be wary of anything that promises otherwise. This checklist helps you prepare evidence against the official audit approach, but the audit assesses whether your QMS is genuinely implemented and lived. Use the checklist to find gaps, then fix the gaps in the QMS itself.

Keep reading

Internal Audit Report template
The internal-audit evidence MDSAP auditors ask for first.

SOP Internal Audit
The procedure behind the audit program.

ISO 13485 certification cost
Budgeting the audits and the system behind them.

Medical device document control software
The document lifecycle every MDSAP process leans on.

Sources: FDA MDSAP audit procedures and forms · official MDSAP audit approach · Health Canada inspection guidance · ISO 13485:2016 (official ISO page, no reproduced text).
Change log: 2026-08 — initial version checked against MDSAP AU P0002, the current audit-time procedure and report forms.
Written and reviewed by Dr. Oliver Eidel · Last reviewed August 19, 2026 · Next review August 2027. Update owner: Dr. Oliver Eidel — check official sources when they change and at least annually.