MDSAP replaces routine. Not for-cause.

A device manufacturer selling into several countries used to face a separate quality-system audit from each regulator it sold into. The Medical Device Single Audit Program (MDSAP) lets one audit, by one FDA-recognized Auditing Organization, satisfy the standard and regulatory requirements of up to five regulators at once. What that audit replaces is narrower than “FDA won’t inspect you,” and the narrowing is worth knowing before a QA calendar leans on it.

One audit, five regulatory authorities

MDSAP grew out of a 2012 IMDRF work group and a Statement of Cooperation signed that November by FDA, Australia’s Therapeutic Goods Administration, Brazil’s ANVISA, and Health Canada; Japan’s Ministry of Health, Labour and Welfare and Pharmaceuticals and Medical Devices Agency joined the pilot in 2015. A manufacturer that opts in is audited once, against a common audit model built on ISO 13485, by an Auditing Organization the participating regulators recognize — and that single audit report is what each of the five reviews against its own requirements. Participation is voluntary: a manufacturer chooses MDSAP, or it doesn’t, per device markets it actually sells into.

What FDA accepts it for

FDA may accept an MDSAP audit report as a substitute for its own routine surveillance inspection — the inspection FDA schedules, by policy, on a roughly biennial cycle for an establishment with no open compliance issue. MDSAP audits run on a different rhythm than a traditional FDA inspection: they are announced and scheduled with the manufacturer in advance, with a pre-set duration, and a firm found with a critical (grade 4 or 5) nonconformity gets a month to respond to the Auditing Organization, rather than the fifteen working days FDA expects after one of its own inspections.

What it doesn’t touch

None of that reaches an inspection FDA opens for its own reasons. A for-cause inspection — triggered by a complaint, an adverse-event signal, or a recall — stays FDA’s own inspection, on FDA’s own schedule, regardless of a current MDSAP audit. A pre-approval inspection ahead of a PMA decision is unaffected. A combination product is excluded from the substitution entirely, and so is anything a manufacturer does under the Electronic Product Radiation Control provisions — an X-ray or laser component keeps its own FDA inspection even at a facility whose device quality system MDSAP already covered that year.

An MDSAP audit satisfies five regulators’ routine surveillance. It was never built to satisfy the reason FDA shows up once something has already gone wrong.

The practice

For a QA calendar, that split is the operational fact worth keeping straight: MDSAP participation is a real, legitimate way to compress the routine half of a multi-market inspection load into one scheduled event a year, and it changes nothing about the inspection that follows a complaint, an MDR pattern, or a recall already in progress. Treating an MDSAP audit as blanket cover invites exactly that inspection to arrive as a surprise it never needed to be. This is regulatory intelligence and method, never regulatory advice — whether MDSAP fits a specific facility’s inspection strategy is a decision for whoever owns that program. FDA Radar does not currently ingest inspection or audit-program data of any kind; the warning letters and recalls we do carry sit downstream of whichever inspection, MDSAP-covered or not, produced them.