MDSAP Reaches for a 2019 Deadline in Canada

The International Medical Device Regulators Forum (IMDRF) began a pilot phase for its new Medical Device Single Audit Program (MDSAP) in January 2014. This audit combines regulatory audits the manufacturer would typically face when they sell their products in certain IMDRF member countries: the United States, Canada, Brazil, Australia, or Japan. The intention was to establish one medical device certification that would be accepted by multiple countries, thus reducing the costs and headaches associated with entertaining multiple audits from each country.

Until recently, all participating countries had made MDSAP optional. But, in a move that may have unintended consequences, on Dec. 4, 2015, Health Canada announced that MDSAP will be required.

Understanding the problem

Since January 2014 the number of MDSAP audits has fallen well short of the 330 that IMDRF needed to validate MDSAP as a working program. As of August 2015, only 45 companies had signed up for MDSAP audits, and most of them had not been visited. There is, I believe, a reason why so few companies have chosen to participate in MDSAP. Ironically, it’s too much transparency.

To understand the problem, you have to understand the current situation with medical-device company inspections conducted by the U. S. Food and Drug Administration (FDA). For years the FDA has been unable to keep up with its backlog of scheduled audits, and has chosen instead to concentrate on “for-cause” audits, where a company’s products may pose a risk to public health. This means that most companies fly under the FDA’s radar.

With the yearly MDSAP audit, results are published in a Regulatory Audit Information Exchange Form, available to all participating regulators. The fear among many is that the FDA will review these forms and spot nonconformities without ever leaving the office. A company that has had no product safety issues and may have flown beneath the radar would now be a blip on the screen due to an issue that has nothing to do with product safety.

Canada requires MDSAP

Although the FDA has indicated its intention to formally accept MDSAP certificates beginning in January 2017, its use of MDSAP remains strictly voluntary. Health Canada, however, announced that it intends to replace their current use of Canada’s CMDCAS certification with MDSAP. The announcement by Health Canada indicates it will follow the transition dates for the new ISO 13485:2016 standard, which should conclude early in 2019. To date, it seems that only Health Canada has announced a commitment to require MDSAP certification.

CMDCAS audits are less burdensome than a MDSAP audit since they are limited to ISO 13485 for the quality management system (QMS) criteria. Because most medical device companies that sell into Canada also sell in the United States, requiring MDSAP will mean replacing a single, simpler audit for Canada with one that is intended to combine the FDA’s Quality System Regulation 21 CFR Part 820 and will be a substantial add on to the Canada-only audit. In addition, as mentioned, this may now bring some of those companies to the attention of the FDA.

Trying to accommodate multiple regulatory requirements under conditions where any nonconformity will be shared with other countries’ regulatory agencies has created much unease among medical device manufacturers. Violating any part of a Quality System Regulation is a serious concern to regulators, and enough of them could burn down the proverbial house. Those concerns were elevated further when Kim Trautman of the FDA, who led development of the MDSAP program at IMDRF, explained to regulators of the Asian Harmonization Working Party that two or more nonconformities considered “Grade No. 4” or one nonconformity at “Grade No. 5” [during an MDSAP audit] “would justify further regulatory action against the manufacturer.” (Note: The IMDRF’s chosen nonconformity grading system is based on GHTF/SG3/N19:2012.)

To be fair, before Kim Trautman left her post at the FDA in January for the private sector, she had said that the FDA would not issue warning letters for minor nonconformities during the pilot period. I would assume that would be grade 1,2,3 nonconformities. And to be honest, currently the FDA never issues warning letters for minor things. But the question remains, what is the threshold, and will that remain the threshold once the pilot period is over?

An unintended consequence of Canada’s actions may be the loss of some of the 3,000-plus medical-device companies that currently sell into Canada and hold CMDCAS certificates. Even if some companies leave that market, many will likely remain. This will certainly provide the FDA with hundreds more audit reports than it has ever enjoyed under any other third-party program it has created. Even if half of those companies left Canada to avoid MDSAP audits, the FDA would still gain 40 times as many audit reports than it was able to obtain under the previous Pilot Multipurpose Audit Program. That’s good for the FDA since it will reduce the number of inspections it would have to do, but it might further damage Canada’s healthcare system by steering manufacturers away from that country to avoid the additional surveillance by the FDA and other IMDRF members.

The FDA should owe Canada a big “thank you” for making MDSAP audits mandatory, something the FDA has never been able to accomplish, since Congress would likely see enormous backlash for thrusting what’s normally a $15,000 to $25,000 fee on thousands of small U.S. medical device manufacturers, many of which continue to avoid Canada’s CMDCAS audit.

The question remains: Will MDSAP create an aversion to selling products in Canada to avoid a risk of regulatory actions by the FDA, especially since the United States is the largest medical device market in the world? There is no doubt this will have an impact on healthcare in Canada, but will it be for the better?

STATUS OF IMDRF COUNTRIES BRAZIL—Brazil will allow use of MDSAP in place of Brazilian Good Manufacturing Practice (RDC 16) audits from Anvisa, Brazil’s regulatory body. U.S. FDA—Will begin to accept MDSAP certificates beginning January 2017, under a voluntary program that allows MDSAP audits to count as equivalent to routine FDA (QSIT) inspections. These cannot replace “for cause” inspections (e.g., investigations resulting from MEDWATCH reports). CANADA—Will begin to accept MDSAP certificates beginning January 2017, and plans to make them mandatory by the end of the transition period for ISO 13485:2016, which is believed to be early to mid-2019. EUROPEAN UNION—Europe will not adopt MDSAP because CE certification is a “product certification.” JAPAN—The full extent of Japan’s adoption of MDSAP is not yet known. AUSTRALIA—Will accept CE certificates, MDSAP certificates, or an ISO 13485 certificate issued by an MLA signatory member of the International Accreditation Forum (IAF) or CMDCAS certificates. OTHER COUNTRIES—No other countries have indicated support or participation at this time.

About The Author