What happens during a Stage 1 MDSAP audit?

[racglobal]

Hello,

Can somebody shed some light on what happens during a Stage 1 MDSAP audit? Suppose the company is manufacturing a pilot device for the first time, does this mean by Stage 1, we should have manufactured a device and have at our disposal all the documentation associated with the manufacturing of the device? Or is this material for Stage 2 audit?

Can somebody clarify what documentation is reviewed at Stage 1 and what does Stage 2 involve?

Because I am new to this , I'd be interested in knowing what happens at each Stage of the MDSAP audit. I'd appreciate any input.

Thanks

 

[LUFAN]

My previous company's stage 1 was two man days. One off-site day where we sent every document we thought she needed to perform a Doc review, and then about a month later she came on-site and did a 1-Day audit where she selectively looked at processes. At the end of stage 1, she recommended us for a stage 2. We then had to do corrective actions, and have them complete by the Stage 2.

Stage 2 is a full QMS audit where they will look at absolutely everything, some way more in depth than others. On FDA's website there is a audit duration calculator that will tell you based on what you can exclude in your QMS, how long a Stage 2 audit will be. In my experience, count on 4-6 man days depending on the risk of your device.

The tricky part of MDSAP in general is you have to have some documentation and records to support whatever it is you are making. It is very much a "check-the-box" kind of audit. At a minimum you need your procedures, and certainly would make your life easier if you had some records to support it. However, if the standard directly calls something out, you MUST have it. For example, not have having a Preventive Action for review by an auditor is an NC where-as not having some production records because you haven't manufactured may or may not be.

In any case, I would highly highly highly recommend bringing in a contract internal auditor with plenty of MDSAP/ISO experience to cover all your basis. Most importantly hire your Auditing Organization (BSI, Intertek, etc) for a pre-assessment. This allows you to meet your auditors, get an idea of what they are looking for and allow you time to make corrective actions you might have otherwise missed.

 

[Jean_B]

The outline given to us by our Auditing Organization stated Stage 1 to be Documentation review and preparedness assessment for Stage 2. It occurred off-site and focused on our documentation (ISO 13485 and region specific) and scope and focus for audits. We did not have a Stage 1 on-site, possibly due to satisfactory hand-in and us complying to some of those regions separately through the same auditing organization before MDSAP.

The documents requested by our auditing organization were :
o Device Marketing Authorization and Facility Registration Procedures, addressing the requirements for the applicable regulatory jurisdictions (facility and device licensing);
o Facility registration identification numbers for the applicable regulatory jurisdictions;
o Marketed device listing, classification and licensing or authorizations for the applicable regulatory jurisdictions;
o Regulatory correspondents or legal representatives and agreements for the applicable regulatory jurisdictions as required (Australia –Sponsor, Brazil – Legal Representative, Canada – Regulatory Correspondent , US – Official Correspondent, Japan – Marketing Authorization Holder (MAH));
o Procedures for Change Notification to applicable regulatory jurisdictions;
o Procedures addressing Medical Device Adverse Event and Advisory Notices reporting requirements for the applicable regulatory jurisdictions;
o Requirements for Labeling demonstrating compliance to labeling requirements of the applicable regulatory jurisdictions (Note: FDA requires UDI labeling for all Class II and III devices).

The stage 2 we underwent was concurrent with ISO 13485 maintenance audit and CE certificate, which gave them more leeway. The purely MDSAP parts were 'check-the-box' as LUFAN stated. We had 14 man-days and there were indeed in-depth checks at points.

For your pilot device case I would say that actual product(ion) records are only of interest in Stage 2, except for the labeling and already marketed device listing. Perhaps draft labeling would suffice but best to check that beforehand.