Why is everyone talking about MDSAP and Health Canada? Read our second blog

Why is everyone talking about MDSAP and Health Canada? Read our second blog

As we have seen in the first of our blogs submitted by John Lafferty, MDSAP is the Medical Device Single Audit Programme which consists of a single Quality Management System (QMS) audit for the following five countries; Australia, Brazil, Canada, Japan and the USA. The programme is voluntary for four of these countries but will be mandatory for Canada (for Class 2 or higher devices).

John Lafferty our tutor from Northridge answers the following  MDSAP Questions in this blog,

– Will I still be able to sell my Medical Devices in Canada after 1st January 2019? UPDATE

– What is involved in the MDSAP Audit Process? 

– What are the specific steps in an MDSAP Audit? 

– What are the benefits of the MDSAP programme for manufacturers?  

– What are the challenges of the MDSAP programme for manufacturers? 

– What happens if there are Findings during my MDSAP audit?  

– What has been the Experience of Manufacturers with the MDSAP programme to date? 

Will I still be able to sell my Medical Devices in Canada after 1st January 2019?

Grandfather Period*

UPDATE  *Health Canada had originally stated that participation in MDSAP would be mandatory from 1st January 2019 onwards; however, due to practical difficulties involved with achieving this deadline, Health Canada issued a notice on 13th April 2018 stating that manufacturers will be able to continue selling their product in Canada after 1st January 2019 provided they have an existing CMDCAS ISO 13485: 2016 certificate and have an MDSAP audit scheduled (or completed) in 2018. The exact criteria for such manufacturers are: 1. They have undergone an initial or recertification audit to ISO 13485 under CMDCAS on or after January 1st 2016 2. They hold a valid ISO 13485 certificate issued under CMDCAS that has a validity period to at least December 31st 2018 3. As of January 1st 2019, they continue to hold a valid ISO 13485 certificate (non-CMDCAS) issued by an MDSAP Auditing Organisation and 4. They have undergone an MDSAP surveillance audit or have made arrangements to undergo an MDSAP audit. The Health Canada notice can be found at: https://bit.ly/HealthCanadaNotice

What is involved in the MDSAP Audit Process? 

A MDSAP Certificate (obtained upon successfully completing a MDSAP audit) can be used to demonstrate compliance with Quality Management System (QMS) requirements for Medical Device registration in each of the five participating countries. The MDSAP process involves an audit by an Auditing Organization (AO) engaged by the Medical Device Manufacturer on every site involved in the MDSAP application.

Each site must obtain a Duns Number.
For this reason, each site must obtain a Duns Number (available from Dun & Bradstreet) which allows the AO to track each site. The AO may also audit significant suppliers or outsourced processes such as sterilization. The audit involves a check of the QMS against the requirements of ISO 13485: 2016 and additional QMS requirements from any of the five countries covered by the MDSAP application. The additional QMS requirements from the five different countries (Australia, Brazil, Canada, Japan and the US) are relatively few but are quite disparate in nature and some are considered key requirements by the relevant country authorities.

Key Staff Must be Trained in the additional QMS requirements for MDSAP.
In order to have a successful MDSAP audit, it is essential that the Medical Device Manufacturer’s staff including Top Management, Quality, Regulatory & Operations Staff and Internal Auditors are familiar with these additional QMS requirements and that the requirements are correctly implemented and adhered to within the QMS. For this reason it is essential that the foregoing groups are properly trained well in advance of any proposed MDSAP audit.

Basic Regulatory Requirements from Each of the Five MDSAP Jurisdictions.
In addition to checking QMS compliance; the audit will focus on ensuring that certain basic regulatory requirements from each of the five jurisdictions are being met. These regulatory requirements relate to; – applicable product and site registrations, – the presence of technical documentation, – and compliance with vigilance and incident reporting regulations.

Matters Precluded from MDSAP Audit.
The AO will check these on behalf of the relevant country authority; however, any auditing of product, safety or compliance matters are strictly precluded from the MDSAP audit process. Responsibility for the latter rests solely with the authorities from the relevant countries.

What are the specific steps in an MDSAP Audit? 
The MDSAP audit involves three steps all of which involve the AO.
1. Application Review
2. Phase 1 Audit (offsite documentation audit)
3. Phase 2 Audit (on site audit)

This means that when the auditors arrive on site they will be familiar with company procedures and may have already identified potential gaps around which they may have prepared questions.

MDSAP Companion Document 

During the audit, the auditors will work from a document known as the Companion Document; this is a 123 page document which outlines;
1. the audit task to be carried out by the auditor,
2. linkages between the various QMS processes and
3. the country-specific QMS requirements to be checked.

It is essential that manufacturers obtain a copy of the Companion Document prior to the MDSAP audit and make sure that all of the requirements referred to in the Companion Document are adequately addressed within their QMS. The Companion Document is available for free on the FDA website. In order to achieve compliance with the MDSAP requirements from the five participating countries, it will first be necessary to carry out a MDSAP Gap Analysis against the requirements referred to in the Companion Document.

MDSAP Gap Analysis
This Gap Analysis should also be applied to the system’s third parties such as Suppliers of key outsourced products or services and the company’s regulatory authorisation holders based in the 5 MDSAP countries e.g. The Australian Sponsor. If necessary to achieve MDSAP timelines, external assistance should be used to conduct the MDSAP Gap Analysis.

Next, manufacturers should ensure that their Internal Audit programmes cover all of the requirements of the five MDSAP countries and that the company’s auditors have checked compliance with these requirements prior to the arrival of the AO for the official MDSAP audit.

It is worth noting three things about the Audit Companion Document:

1. It does not contain the actual requirements from the various regulations. The company’s auditors must have access to the applicable regulations from each of the five MDSAP countries in order to make compliance determinations.
2. It does not necessarily refer to all of the requirements that apply from the individual participating countries e.g. the Companion Document does not make a direct reference to the need to validate spreadsheets that contain Quality Records.
3. There are no references (within the body of the text) to additional regulations, from individual countries, that may apply e.g. 21 CFR Part 11 for Electronic Records and Electronic Signatures, or 21 CFR Part 4 for Combination Products.

What are the benefits of the MDSAP programme for manufacturers? 

For the medical device industry, the MDSAP programme is expected to significantly ease the audit compliance burden on medical device manufacturers. Harmonization of auditing requirements from the five participating countries has many benefits for the manufacturer as follows;
• Ability to sell into the 5 MDSAP countries. By far the biggest benefit of joining the MDSAP programme is the ability to sell in five countries on the basis of one QMS audit. Not least of these is the ability to sell into Canada which will not be possible without MDSAP compliance from 2019* onwards (*unless certain criteria are met – see UPDATE above).

• Reduced overall auditing time and expense; this may not be apparent from the outset as MDSAP audits are lengthy and expensive; however as there will be just one audit per year, the cost associated with audits and replying to any audit findings will ultimately be reduced.

• More transparent and consistent oversight by regulators. As audits on behalf of the five MDSAP countries (and Europe if your AO is also your Notified Body (NB)) will all be conducted by one organization, varying of approaches from the FDA vs NB vs ANVISA will no longer be an issue.

• Better Scheduling of Audits. MDSAP audits are held annually on the anniversary of registration which will allow manufacturer’s to plan for audits more easily. Unannounced audits from the Notified Body will still exist of course but these only occur once in a three yearly cycle.

• Broader acceptance of audit reports. It is also expected that MDSAP audit reports will be increasingly readily accepted by third countries (non MDSAP, non-European countries).

What are the challenges of the MDSAP programme for manufacturers? 

There are number of challenges to be overcome when implementing a MDSAP programme. Some of these challenges are outlined below.

• The effort and cost of preparing for and hosting the MDSAP Audit; The AO fees for the MDSAP audit are significant given the extended audit duration of 5 to 9 days and the need for multiple auditors on site. In the early days of the MDSAP programme, there is a high possibility that the Audit will be a witnessed audit resulting in an additional person(s) present during the audit. Allied to these, a greater number of personnel will be required to host the MDSAP audits due to the numbers of auditors and the multiple regulations involved.

• Preparation of the QMS within the required Timeframe. Review of the QMS via a Gap Analysis, revision of the QMS, training of personnel and auditing of the system will place a considerable amount of strain on the manufacturer’s resources. In addition to this, the manufacturer will need to ensure that the QMS is fully in compliance with ISO 13485: 2016 which is the base standard for MDSAP.

• Staying in touch with the approach of the regulatory bodies. On an ongoing basis the manufacturer will not be subject to audits directly from regulatory bodies such as the FDA or ANVISA; however, they may still receive audits from these bodies due to product registrations or ‘For Cause’ audits. When this arises, the manufacturer will still need to be in touch with the approach of these regulatory bodies (such as the FDA or ANVISA) which may be quite different to the approach of their AO.

What happens if there are findings during my MDSAP audit? 

The MDSAP grading of audit non-conformities is different from that used by European Notified Bodies (Major and Minor non-conformities). MDSAP audit non-conformities are graded 1 to 5 as shown below (a Grade 5 results from the escalation of a Grade 4 non-conformity).

Two escalation rules apply to MDSAP non-conformities: Rule 1 – Absence of a documented process or procedure of any requirement, the grade increases by 1. Rule 2 – Release of a Nonconforming Medical Device outside of the controls of the manufacturer’s QMS, the grade increases by 1. Note: Repeat means the same non-conformity is repeated during the three year audit cycle. Non-conformities of Grade 1, 2, or 3 are considered minor non-conformities. Grade 4 and 5 non-conformities are considered far more serious. Receipt of one Grade 5 non-conformity or two or more Grade 4 non-conformities will result in failure to receive MDSAP certification. In a MDSAP surveillance audit, a similar performance will result in an un-announced follow-up audit by the AO in a period 6 to 9 months following the surveillance audit. An unsuccessful performance in the follow-up audit may result in withdrawal of the MDSAP certificate.

What has been the experience of Manufacturers with the MDSAP programme to date? 

The experience of manufacturers with the MDSAP programme appears on the whole to have been a positive one, if a little varied, with most audits having a successful outcome. Definitive information is not readily available with little published data on the performance of medical device manufacturers within the programme. The report on the initial MDSAP Pilot Programme focused mainly on the performance of the MDSAP system itself rather than on the success rate of the manufacturers within that programme.

Anecdotal Feedback from Manufacturers 

Through my work in the area of MDSAP training and preparation, I have gained the following understanding from anecdotal sources within Europe:
• Hosting of the audit was challenging – ‘like hosting three audits at once’ according to a number of sources.

• The vast majority of MDSAP auditors and regulatory authority witnesses were European which the auditees felt was helpful.

• The nature of the audit varied considerably with some companies stating that even the Stage 2 audit was quite high level and light touch while other companies experienced a significant drilling down into records, with the phrase ‘show me’ being frequently repeated.

• The nature of the audit appears to be driven by three factors;
1. The approach of the Auditing Organisation with some AOs focussing on the documentation and others being very much focussed on records.
2. The amount of time available to the auditor. Auditors who had less time naturally focused more on documents rather than records. Where an auditor had more time due to, for instance, the small size of the operation or the lack of complexity of the system, then a very thorough review of selected records and practices took place.
3. Whether the application was made by a corporation or by an individual site. In the case of a corporate application, auditors appeared to have less time during (Stage 2) site audits to review large volumes of records in detail. Conversely, where the application consisted of just one site the auditor was already familiar with the site QMS by the time of the Stage 2 audit and was able to review records and practices in detail.

• Although most manufacturers were happy to report a successful conclusion to the MDSAP audit, a small number reported receiving numerous Grade 4 non-conformities.

• A large number of manufacturers reported significant difficulties in getting their AO to schedule audits; however, those that did receive audits did not experience significant delays in receiving the audit reports or MDSAP certificates. In summary, the MDSAP programme is progressing slowly but largely satisfactorily for manufacturers who have been through the programme. The relaxation of the compliance deadline by Health Canada has been a most welcome development; however, further movement from Health Canada may become necessary before the end of 2018 if all manufacturers are to remain in a position to continue supplying the Canadian market on January 1st 2019.

Submitted by our tutor John Lafferty from Northridge