MDSAP grades findings; a Grade 5 notifies regulators

A quality team that reads an MDSAP audit report the way it reads an ordinary ISO 13485 surveillance audit — findings sorted into major and minor, each one closed out on its own CAPA timeline — has missed the mechanism that makes MDSAP different from a standard third-party audit. The Medical Device Single Audit Program lets a single audit, run by one recognized auditing organization, satisfy the quality system requirements of five participating regulatory authorities at once: the U.S. FDA, Health Canada, Brazil's ANVISA, Japan's MHLW/PMDA, and Australia's TGA. What makes that consolidation work isn't just a shared checklist. It's a shared, numeric grading system for nonconformities, and that system carries its own consequence: cross a defined threshold, and the auditing organization doesn't just tell the manufacturer — it tells the regulators.

Five regulators, one audit, one shared baseline

An MDSAP audit runs against ISO 13485:2016 as its common floor, with each participating authority layering its own additional regulatory requirements onto the same audit rather than requiring a separate one — the same logic this blog has already covered on the FDA side alone, extended here across five agencies working from one audit report instead of five. Health Canada was the first to make participation mandatory, requiring MDSAP certification since January 1, 2019 for Class II, III, and IV devices and retiring the Canadian Medical Devices Conformity Assessment System it replaced. The other four authorities accept an MDSAP certificate as a basis for reducing their own routine surveillance activity rather than requiring it outright, but the underlying audit and its grading system are the same regardless of which authority is relying on the result.

A nonconformity gets a number, not a label

MDSAP doesn't sort findings into major and minor the way an ordinary ISO 13485 audit does. Each nonconformity is scored against a defined point matrix tied to the specific requirement it violates, then run through a set of escalation rules that can raise that initial score — most notably where the finding reflects the complete absence of a documented process or procedure, or where a nonconforming device actually reached release. The result is a numeric grade, not a qualitative label, and the escalation rules mean two findings against the same clause can land at different grades depending on how deep the underlying gap actually runs.

Grade 4 and 5 leave the manufacturer's own CAPA log

Grades toward the low end of the scale stay inside the manufacturer's own quality system, closed out through ordinary corrective action on the manufacturer's own timeline, the same as any other audit finding. A single Grade 5 finding, or three or more Grade 4 findings arising from one audit, changes that: the auditing organization is obliged to notify the participating regulatory authorities directly, on a timeline the program sets rather than one the manufacturer negotiates, and a high enough grade can trigger a follow-up special audit or a for-cause inspection independent of whatever corrective action the manufacturer has already started. That's a materially different position than a CAPA closure letter the manufacturer drafts and controls the timing of.

What the certificate doesn't reach

The EU isn't among MDSAP's participating authorities, and an MDSAP certificate doesn't say anything about MDR or IVDR conformity — no notified body treats it as a substitute for its own Annex IX conformity assessment, or for the unannounced audit a notified body can still show up for on its own schedule. MDSAP's own audits, by contrast, are scheduled under the program's audit model rather than sprung on the manufacturer. Participation also doesn't retire FDA's own for-cause inspection authority; it reduces the frequency of routine surveillance inspections, not the agency's ability to act on a specific signal whenever one arises.

Where this meets the file

An audit-tracking file built for MDSAP needs a field for the grade of each finding, not just its open-or-closed status, plus a separate field noting whether that grade crossed the regulator-notification threshold and the date the auditing organization actually reported it — kept apart from the manufacturer's own internal CAPA due date, since the two run on different clocks controlled by different parties. An MDSAP finding-and-grading tracker built around the program's own point scale is previewed in the launch catalog. If your program grades findings differently, the shelf takes that correction directly.