MDSAP is a single regulatory audit of a medical device manufacturer's quality management system that satisfies the requirements of five participating regulators: Australia (TGA), Brazil (ANVISA), Canada (Health Canada), Japan (MHLW/PMDA), and the United States (FDA). Rather than hosting multiple separate inspections, one audit conducted by an MDSAP-recognized Auditing Organization (AO) is accepted by all five jurisdictions. MDSAP is mandatory in Canada for Class II, III, and IV device licensing, substitutes for routine FDA inspections in the United States, and streamlines market access in Australia, Brazil, and Japan. For most manufacturers selling in two or more of these markets, MDSAP delivers significant audit-cost savings and a single, defensible compliance record.

Although MDSAP is built on ISO 13485:2016, the audit is structured around seven defined processes rather than a clause-by-clause walkthrough. Auditors trace records across linked processes — for example, a customer complaint may be followed through CAPA, design change, supplier evaluation, and regulatory reporting — to verify the QMS operates as a connected system. MDSAP also uses a numerical nonconformity grading scale from 1 to 5 instead of major/minor classifications. Grades 4 and 5 trigger immediate notification to the relevant regulators, with potential consequences including license suspension and import holds. The audit also incorporates country-specific regulatory requirements that go beyond ISO 13485, such as FDA 21 CFR Part 820, Health Canada SOR/98-282, and Japan MHLW MO 169.

 MDSAP follows a three-year certification cycle. Year 0 is the initial certification audit, consisting of a Stage 1 documentation review followed by a Stage 2 on-site audit. Years 1 and 2 are shorter annual surveillance audits with a rotating focus on specific processes. Year 3 is a full recertification audit covering all seven processes again. Unannounced audits may also occur, particularly for cause. Audit duration is calculated by a formula based on employee count, site complexity, and device risk, and typically runs longer than a standalone ISO 13485 audit. From the decision to pursue certification through Stage 2 completion, most manufacturers should plan on six to twelve months of preparation. 

The most frequent issues seen during MDSAP audits include weak process linkages where procedures are written in silos and cannot demonstrate how outputs of one process feed inputs of another; incomplete CAPA records that lack genuine root cause analysis or effectiveness verification; gaps in country-specific vigilance reporting timelines and procedures; insufficient supplier controls, particularly for critical and sterilization suppliers; and unclear management review records that fail to capture all required inputs. Many manufacturers also underestimate the documentation rigor expected for design changes, process validation (IQ/OQ/PQ), and software validation. Grade 4 and 5 findings most often arise when these gaps intersect with patient-safety-relevant processes. 

JJCC Group Services delivers a structured MDSAP readiness program led by former MDSAP-qualified lead auditors. The engagement begins with a gap analysis against ISO 13485:2016 and the official MDSAP Audit Approach (AU P0002), mapping current procedures to each of the seven processes. We then provide remediation support including procedure rewriting, process-linkage mapping, CAPA coaching, supplier control upgrades, and country-specific procedure development for each jurisdiction the client targets. Training is delivered to internal auditors, process owners, and front-line staff on the MDSAP audit approach, the 1–5 grading scale, and country-specific obligations. The goal is a QMS that demonstrably operates as a connected system on audit day, not just on paper.  

Our mock audit is designed to replicate the certification audit experience as closely as possible. The four-to-eight-week engagement includes:

• Pre-audit readiness assessment: documentation review and tailored audit plan covering all seven processes.
• On-site mock audit: three to five days replicating the Stage 2 audit, including opening meeting, process tracing, record sampling, employee interviews, and closing meeting.
• Graded findings report: each observation graded on the official 1–5 MDSAP scale with full rationale, including any Grade 4 or 5 issues that would trigger regulatory notification in a live audit.
• Remediation roadmap & CAPA coaching: prioritized corrective action plan with root cause support and verification of effectiveness.
• Final readiness verification: a condensed follow-up audit and audit-day playbook including front-room/back-room logistics and interview coaching.

Because our auditors apply the same MDSAP Companion Document criteria used by recognized AOs, the findings are directly comparable to what a real audit would surface.

Yes. Our regulatory specialists provide jurisdiction-specific support for all five MDSAP countries. For Canada, we help manufacturers establish and maintain the Medical Device License (MDL), implement Mandatory Problem Reporting procedures, and align with SOR/98-282 requirements. For Brazil, we support Brazilian Registration Holder (BRH) coordination, RDC 665/2022 GMP compliance, and Technovigilance Reporting under RDC 67/2009. For Australia, we assist with Australian Sponsor arrangements and ARTG inclusion. For Japan, we coordinate with Marketing Authorization Holders (MAH/D-MAH) and align procedures with MHLW Ministerial Ordinance No. 169 and the PMD Act. For the United States, we help manufacturers transition to the FDA Quality Management System Regulation (QMSR), which aligns 21 CFR Part 820 with ISO 13485 effective February 2026.

Certification is the beginning, not the end. JJCC Group offers post-certification support including annual internal audits aligned to the MDSAP process model, surveillance audit preparation for Years 1 and 2, CAPA effectiveness reviews, supplier audit programs, vigilance reporting oversight, and management review facilitation. We also provide regulatory intelligence updates as participating regulators revise their requirements — for example, the FDA's transition to QMSR, evolving Brazilian technovigilance expectations, and Canadian licensing changes. For manufacturers expanding into additional MDSAP jurisdictions after initial certification, we manage the scope expansion process with the Auditing Organization and ensure country-specific procedures are in place before the next surveillance visit. The objective is a compliance program that strengthens with each audit cycle rather than scrambling to recover from one.