Regulatory Open Forum

 View Only
Expand all | Collapse all

Neverending MDSAP Discussion

  • 1.  Neverending MDSAP Discussion

    Posted 14-Sep-2017 11:15
    ​I've been having a neverending discussion in an LI Group on the cost of a MDSAP audit.

    The original poster reported that the quotes his company received from 10 NBs for a MDSAP audit that included both Canadian and US requirements would be at least three times the cost previously CMDCAS.  As a result, the poster has advised:

    The one KEY POINT for the people who are following this blog is that "be prepared to pay AT LEAST 3 times more when you will switch to MDSAP vs. what you were spending for the CMDCAS."

    Apparently the quotes received from all 10 NBs were broken out the same way, which is not by jurisdiction, but by "stage." 

    Given that anyone who wants to secure MDSAP certification must be audited for all MDSAP jurisdictions in which they market their devices, I am interested in how the costs are impacted by the addition of more jurisdictions, not the cost of the different stages.  From this perspective, I have been unable to figure out how the original poster arrives at the conclusion that a MDSAP audit will cost at least 3 times as much as CMDCAS, because their MDSAP audit will include both Canada and the US, where some Canadian companies may market their devices only in Canada, and therefore the cost of their MDSAP audit would not include the cost of any other jurisdiction(s).

    Since the audits cover the different QMS requirements in each of the jurisdictions, I'm assuming (!) that, the more jurisdictions the MDSAP audit covers, the longer it will take, and the more it will cost.  So here's how I see the original poster's audit costs:


    Cost of Stage 1 (Offsite review of CA and US QMS documentation) +
    Cost of Stage 2 (Onsite audit to CA and US QMS requirements) +
    Annual registration fee >/=
    Cost of CMDCAS x 3

    To me, the idea that people switching to MDSAP from CMDCAS should be prepared to pay at least 3 times what they were spending for the CMDCAS holds true ONLY if you assume one of two things:

    1) They market in some jurisdiction in addition to Canada, and therefore are paying for the cost of onsite audits for at least two MDSAP jurisdictions. If they market only in Canada, and are audited only to CA requirements, based on the above, the cost is likely to be less than 3 times what they were spending for the CMDCAS.

    2) The only two MDSAP jurisdictions in which they market medical devices are Canada and the US, and the off-site review of US QMS documentation and the onsite audit to US requirements

    I'm starting to feel like I'm stalking the original poster, I've asked so many follow-up questions to try to sort this out, so far to no avail.  I must be missing something, but I can't figure out what it might be.  Can anyone help me out here???

    ------------------------------
    Julie Omohundro, ex-RAC (US, GS), still an MBA
    Principal Consultant
    Class Three, LLC
    Durham, North Carolina, USA
    919-544-3366 (T)
    434-964-1614 (C)
    julie@class3devices.com
    ------------------------------


  • 2.  RE: Neverending MDSAP Discussion

    Posted 14-Sep-2017 21:30
    Looks like I managed to delete the last part of assumption #2:

    ...are free.

    ------------------------------
    Julie Omohundro, ex-RAC (US, GS), still an MBA
    Principal Consultant
    Class Three, LLC
    Durham, North Carolina, USA
    919-544-3366 (T)
    434-964-1614 (C)
    julie@class3devices.com
    ------------------------------



  • 3.  RE: Neverending MDSAP Discussion

    Posted 15-Sep-2017 08:30
    Hi Julie,

    Since I'm not one of the 10 NB's, I can't give specifics -- I hope that one of them can step up and give their perspective -- but since there was some consistency, I will take a stab at the main contributors:
    • the manufacturer must have been fairly small -- ISO 13485 under CMDCAS audit duration depends on the number of employees (which as a former CB Technical Manager never really made much sense to me since it generally takes as long to audit a QMS whether the company has many or few employees) whereas MDSAP audit duration is based on the number of processes
    • they are making a comparison to an established QMS audit plan -- MDSAP is going to start at the beginning (hence having a Stage 1 audit) whereas they were probably having only Stage 2 and Surveillance audits
    • more is covered in an MDSAP audit vs. ISO 13485 under CMDCAS -- MDSAP is going to cover ISO 13485, US FDA 21 CFR 820 and Canada's CMDR; their ISO 13485 under CMDCAS audits won't be as comprehensive and cover US FDA.
    Last, the cost of audits may be rising in general, especially for MDSAP since the demand is great and the supply limited, but I really can't comment on how current AO's are going to price audits.  As I said, I hope that the AO's can weigh in, especially since this impression (and reality) is something that they are going to have to work through with their clients.

    It really is too bad that there is going to be sticker shock going to MDSAP for smaller companies, especially for the first pass. On the other hand, when one considers what is being audited under MDSAP, I also think that this is showing up the generally lighter audits that they were getting beforehand.

    ------------------------------
    Rem Siekmann, ASQ CBA
    Principal Engineer
    Mentor OH
    United States
    ------------------------------



  • 4.  RE: Neverending MDSAP Discussion

    Posted 15-Sep-2017 17:07
    ​Thanks, Rem.  I don't think this helps me when it comes to getting an idea of how much the addition of the US audit adds to the cost, but some of the information is useful in its own right.

    I didn't know that MDSAP was going to cover ISO 13485, Part 820, and the CMDR.  I thought it wouldn't cover any jurisdiction unless the company marketed its products in that jurisdiction.  I understood they were trying to include ISO 13485 somehow, but I didn't think it was going to be mandatory.

    ------------------------------
    Julie Omohundro, ex-RAC (US, GS), still an MBA
    Principal Consultant
    Class Three, LLC
    Durham, North Carolina, USA
    919-544-3366 (T)
    434-964-1614 (C)
    julie@class3devices.com
    ------------------------------



  • 5.  RE: Neverending MDSAP Discussion

    Posted 16-Sep-2017 09:14
    Under MDSAP audit durations are calculated using tools developed by the MDSAP Regulatory Authorities (RA) that are intended to drive more consistency in the audit's of the MDSAP Auditing Organizations (AO).

    I strongly recommend reviewing the MDSAP AU P0008 Audit Time Determination Procedure and MDSAP AU F0008 Audit Duration Calculation Form, both can be downloaded from the CDRH website here:  

    MDSAP Audit Procedures and Forms

    Unlike IAF guidance supporting the previous CMDCAS and ISO 13485 programs (which relied significantly on the size, number of employees, of the manufacturer) the MDSAP guidance considers the tasks, activities performed and the overall complexity of the manufacturers quality management system to calculate the audit duration. By completing the form (AU F0008) you can build an estimate of an audit duration, but, you really need to understand the manufacturers tasks and activities to develop an accurate estimation. The number of markets the manufacturer is supplying is less significant because it only adds time to consider specific country requirements (e.g. correct market clearance and registration). The audit calculation process is quite complex and needs practice to master.  

    Using these guidance's it is quite likely that audit duration's (initial, surveillance and re-certification) may increase for smaller manufacturers, the guidance was recently updated to allow some reductions for very small manufacturers (<45 employees - up to 10% reduction and <15 employees - up to 20% reduction). It should be noted that audit duration's can also increase when non-conformities are identified and need follow-up as well as other justifications listed in the guidance.

    The audit day rates charged by the AO's is market driven consideration, but, one should consider that AO's are investing significantly more time and expense in recruiting, training and qualifying MDSAP auditors which should lead to more valuable audits to add stakeholder confidence in MDSAP audit reports and certifications. As more AO's achieve designation under MDSAP maybe competition and market forces will impact fees, but, in the sort-term I anticipate that demand will outstrip supply.

    In my opinion overall the MDSAP audit duration calculation process is much more complex and difficult to work with, but, it is an attempt to more accurately consider the complexity and activity being audited which is a significant improvement over the previous IAF model. One of my concerns is the impact on smaller manufacturers, but, this seems likely to become a cost of doing business for medical device manufacturers in international markets and the success of the program will lead to a single audit to satisfy multiple market requirements (hopefully acceptance/consideration of MDSAP output, reports and certificates, by more markets outside the initial five MDSAP members).

    ------------------------------
    Paul Brooks
    Executive Director
    RAPS
    Rockville MD
    United States
    ------------------------------



  • 6.  RE: Neverending MDSAP Discussion

    Posted 16-Sep-2017 10:36
    ​I think everyone is concerned about the impact on everyone but the large multinationals, as well as the other way around.  For example, if the small mid-size companies pull out of Canada to avoid MDSAP, what's the impact on Canada?

    I agree that basing duration on headcount makes no sense for a medical device QMS audit.

    I'm still searching for some light on the cost associated with how many and which standards are included in the audit, since this addresses the question of the extent to which a MDSAP audit is cost effective relative to multiple individual audits.

    ------------------------------
    Julie Omohundro, ex-RAC (US, GS), still an MBA
    Principal Consultant
    Class Three, LLC
    Durham, North Carolina, USA
    919-544-3366 (T)
    434-964-1614 (C)
    julie@class3devices.com
    ------------------------------



  • 7.  RE: Neverending MDSAP Discussion

    Posted 16-Sep-2017 11:42
    HI Julie,

    Paul covered a lot of excellent ground in answering at least part of your question. Note that I also assumed that this company sold to both the US and Canada markets.

    To get at what I think is the rest of your concern, let me outline the scope of the 2003 MDSAP Model's total 211 questions (I don't have a model on-hand to easily give you the 2016 MDSAP Model numbers, but they are very similar). Note that depending on the section, the length of time allowed to audit each question can vary between 15 and 44 minutes:
    • 94 general questions (mostly ISO 13485:2003-based)
    • 19 Australia-specific questions (TGA-based)
    • 35 Brazil-specific questions (ANVISA-based)
    • 18 Canada-specific questions (CMDR-based)
    • 12 Japan-specific questions (MHLW-based)
    • 33 USA-specific questions (21 CFR-based)
    This will also be influenced by whether any questions can be excluded due to their not having an implantable product, or if service, installation or sterilization does not need to be audited.  Anyway, as you can see, adding Canada (and US) is a relatively minor impact to the equation (certainly not being the major factor in a 3X increase).

    I believe that the largest consideration is the difference in time spent in doing the audits in general.  Based on the reference Paul gave for determining MDSAP Audit Duration, a Stage 1 + Stage 2 MDSAP (Certification and Re-certification) audit can take over 6 days to complete, with up to a 20% reduction for very small companies.  On the other hand, per IAF MD5:2009, a similar ISO 13485:2003 audit for a company with 10 or less full time people is only 2 days, with a re-certification audit of up to 25 full time people scheduled for the same 2 days length, and CB's adding maybe another 1/2 to 1 day for the CMDCAS portion.  Honestly, this was far too little time to do any kind of a realistic CMDCAS audit, but those were the rules which drove the market.

    Again, Paul touched on some of the other modifications that can adjust the cost, but I'm hoping that this gives a little more insight as to what may be causing the large difference, especially for smaller manufacturers in limited geographies.

    See you guys in Ottawa!

    ------------------------------
    Rem Siekmann, ASQ CBA
    Principal Engineer
    Mentor OH
    United States
    ------------------------------



  • 8.  RE: Neverending MDSAP Discussion

    Posted 16-Sep-2017 11:59
    The audit is based the MDSAP Audit Model and I find the MDSAP Companion Document invaluable.

    In the words of the MDSAP Audit Model: The Medical Device Single Audit Program (MDSAP) audit process was designed and developed
    to ensure a single audit will provide efficient yet thorough coverage of the requirements of Medical devices – Quality management systems – Requirements for regulatory purposes (ISO 13485:2016), the Quality Management System requirements of the Conformity Assessment Procedures of the Australian Therapeutic Goods (Medical Devices) Regulations (TG(MD)R Sch3), Brazilian Good Manufacturing Practices (RDC ANVISA 16/2013), Japan Ordinance on Standards for Manufacturing Control and Quality Control of Medical Devices and In Vitro Diagnostic Reagents (MHLW Ministerial Ordinance No. 169), the Quality System Regulation (21 CFR Part 820), and specific requirements of medical device regulatory authorities participating in the MDSAP program.

    The Companion Document is invaluable in identifying the specific requirements of the RA's. The audit must include the specific requirements of the countries where the manufacturer is placing product on the market.

    Costs and audit time are specific for each manufacturer based on the audit duration calculation guidance and the fees that their AO charges. For small manufacturers there is likely to be a significant increase in audit duration and fees (for example a small manufacture typically on 1-2 day annual audits could increase to 3-5  annual audits). 

    MDSAP Audit Model P0002 and MDSAP Companion Document G0002 can be downloaded from: MDSAP Audit Procedures and Forms

    ------------------------------
    Paul Brooks
    Executive Director
    RAPS
    Rockville MD
    United States
    ------------------------------



  • 9.  RE: Neverending MDSAP Discussion

    Posted 16-Sep-2017 12:02
    Costs and audit time are specific for each manufacturer based on the audit duration calculation guidance and the fees that their AO charges. For small manufacturers there is likely to be a significant increase in audit duration and fees (for example a small manufacture typically on 1-2 day annual audits could increase to 3-5 day annual audits).

    ------------------------------
    Paul Brooks
    Executive Director
    RAPS
    Rockville MD
    United States
    ------------------------------



  • 10.  RE: Neverending MDSAP Discussion

    Posted 16-Sep-2017 12:27
      |   view attached
    Hi Paul,

    The link points to the version (MDSAP AU P0002.003 2015-10-06) - 57 page document.

    I've attached what I was reading from FDA as 2017-01-06 MDSAP AU P0002.004 - 81 page document.

    The 2017 version includes the following.

    Annex 1 - Audit of Technical Documentation
    Annex 2 - Audit of Requirements for Sterile Medical Devices
    Summary of Changes from Prior Revision

    Happy Meeting in Ottawa! 

    Thank you.

    s/ David
    ______________________________________________
    Dr. David Lim, Ph.D., RAC, ASQ-CQA 
    REGULATORY DOCTOR
    Phone (Toll-Free): 1-(800) 321-8567

    NOTICE: This communication (including any attachments) may contain privileged or confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this communication and/or shred the materials and any attachments and are hereby notified that any disclosure, copying or distribution of this communication, or the taking of any action based on it, is strictly prohibited.







  • 11.  RE: Neverending MDSAP Discussion

    Posted 16-Sep-2017 13:56
    This is great information!  Thanks everyone.

    Now...can anyone tell me on what date and in what country the first post-pilot MDSAP audit was conducted?


    ------------------------------
    Julie Omohundro, ex-RAC (US, GS), still an MBA
    Principal Consultant
    Class Three, LLC
    Durham, North Carolina, USA
    919-544-3366 (T)
    434-964-1614 (C)
    julie@class3devices.com
    ------------------------------



  • 12.  RE: Neverending MDSAP Discussion

    Posted 16-Sep-2017 13:57
    This is great information!  Thanks everyone.

    Now...can anyone tell me on what date and in what country the first post-pilot MDSAP audit was conducted?


    ------------------------------
    Julie Omohundro, ex-RAC (US, GS), still an MBA
    Principal Consultant
    Class Three, LLC
    Durham, North Carolina, USA
    919-544-3366 (T)
    434-964-1614 (C)
    julie@class3devices.com
    ------------------------------



  • 13.  RE: Neverending MDSAP Discussion

    Posted 16-Sep-2017 14:19
    This is great information!  Thanks everyone.

    Now...can anyone tell me on what date(s) and in what country the first post-pilot MDSAP audit was conducted?

    ------------------------------
    Julie Omohundro, ex-RAC (US, GS), still an MBA
    Principal Consultant
    Class Three, LLC
    Durham, North Carolina, USA
    919-544-3366 (T)
    434-964-1614 (C)
    julie@class3devices.com
    ------------------------------



  • 14.  RE: Neverending MDSAP Discussion

    Posted 16-Sep-2017 14:20
    Sorry for the triple posts.  Just one answer would be fine. :)

    ------------------------------
    Julie Omohundro, ex-RAC (US, GS), still an MBA
    Principal Consultant
    Class Three, LLC
    Durham, North Carolina, USA
    919-544-3366 (T)
    434-964-1614 (C)
    julie@class3devices.com
    ------------------------------