MDSAP AU P0026: Certificate Document Requirements

• Title: MDSAP Certification Document Requirements
• Document No: MDSAP AU P0026.005
• Implementation Date: 2014-07-18
• Revision Date: 2024-04-05

Table of Contents

• Foreword

1. Format
2. Language
3. Pagination
4. Unique Identification Code
5. Certification Document Dates and Period of Validity
6. Manufacturer's Name
7. Manufacturer's Address(es)
8. Statement of Conformity
9. Audit / Certification Criteria
10. Scope of Certification Document
11. Auditing Organization
12. Signing Authority
13. Statement of Recognition
14. Verification
15. References

• Appendix 1 - Examples of Certification Document Scope Statements

---

Foreword

An initial Medical Device Single Audit Program (MDSAP) certification document can only be issued by an Auditing Organization (AO) following the satisfactory completion of an Initial Certification Audit or a Recertification Audit of a device manufacturer. 

An MDSAP audit conducted at a "Surveillance" phase (Surveillance 1 or 2) of the certification cycle cannot support the issuance of an initial MDSAP certification document because the manufacturer's complete quality management system was not audited.

An MDSAP "Surveillance Audit Confirmation" notification will be issued following the satisfactory completion of an initial MDSAP audit conducted at a surveillance phase of the certification cycle.  Further guidance regarding the MDSAP Surveillance Audit Confirmation Notification process is included within MDSAP AU G0026.1.  

1. Format

The certification documents shall be formatted to fit on US Letter (8.5 X 11 in.) or ISO A4 sized paper. Orientation may be either portrait or landscape unless otherwise specified by a participating Regulatory Authority.

2. Language

All MDSAP certification documents shall be issued in English. Certification documents may be issued in other languages, but only the English version shall be taken as official unless otherwise specified by a participating Regulatory Authority.

3. Pagination

All certification documents shall include pagination information on every page. This should be conveyed as "page x of y".

4. Unique Identification Code

Every certification document shall contain a unique identification code specific to the document. The unique identification code must only be used to identify the specific certification document, not the client, registration, or facility. Auditing organizations are free to use any combination of letters and numbers as a unique identification code – however it is not permitted to require the user of a certification document to combine multiple fields to positively identify the document (e.g. registration number + issue date). The field shall preferably be labelled "certification document number" or "certificate number". This identification code shall inherently provide for version control between certification documents. It shall be included on every page of a certification document.

5. Certification Document Dates and Period of Validity

All certification document dates shall be in international year-month-day format as per clause 4.1.2.2 of ISO 8601 (YYYY-MM-DD).

Each certification document shall contain a field labelled "Effective date".  The effective date shall signal the commencement of the certification document's period of validity and shall not precede the date of a certification decision by the AO.  Each certification document shall contain a field labelled "Expiry date".  The expiry date shall specify the end of the certification document's period of validity.

The maximum period of validity for all certification documents is 3 years.

6. Manufacturer's Name

The certification document shall contain the complete legal name of the manufacturer to which it is issued.  Certification documents may also contain trading or commercial names in addition to the legal name of the manufacturer.  The name of the manufacturer on the certification document shall be consistent with the name used on the labelling of the manufacturer's devices.

The name of the manufacturer that is to appear on the certification document shall be determined by the manufacturer based on the jurisdiction in which they market, or plan to market, their products and their legal obligations in relation to registration, listing, or licensing in those jurisdictions.

The certification document shall include the facility's identification number generated by the Regulatory Exchange Platform – secure (REPs) of the manufacturer.

7. Manufacturer's Address(es)

The certification documents shall include the complete civic (physical) address of all audited locations within the scope of the certification.  Postal addresses may be separately included in addition to the physical addresses, if required by the manufacturer.  The primary physical address stated on the certification document shall be consistent with the one used on the labelling of the manufacturer's devices and shall be consistent with the manufacturer's obligations in relation to registration, listing or licensing in the jurisdictions in which it markets, or plans to market, its devices.

The certification document shall record all sites of the manufacturer's quality management system that have been audited on-site.  Each site included in the certification document shall be identified by its legal name, its address and the facility's identification number generated by the Regulatory Exchange Platform – secure (REPs).   

Although suppliers may be audited in some circumstances, these shall not be listed on certification documents.

8. Statement of Conformity

The certification document shall contain a statement of conformity attesting that the quality management system of the manufacturer listed on the certification document has been audited against stated criteria and found to conform to those criteria for the scope contained in the certification document.

9. Audit / Certification Criteria

The certification document shall state the criteria that were used in the audit of the manufacturer.  This shall include:

• ISO 13485:2016: Only the international version will be accepted. National or regional adoptions of the standard may not appear on MDSAP certification documents; and
• the following regulatory requirements as audited and applicable to the manufacturer:
  • Australia:
    • Therapeutic Goods (Medical Devices) Regulations, 2002, Schedule 3 Part 1 (excluding Part 1.6) – Full Quality Assurance Procedure [if design controls are part of the certification]; OR
    • Therapeutic Goods (Medical Devices) Regulations,2002, Schedule 3 Part 4 – Production Quality Assurance Procedure [if design controls are excluded from the certification]
  • Brazil:
    • RDC ANVISA n. 665/2022
    • RDC ANVISA n. 551/2021
    • RDC ANVISA n. 67/2009
  • Canada:
    • Medical Devices Regulations – Part 1- SOR 98/282
    • Medical Devices Regulations – Part 1.1 – SOR 98/282 (as applicable)
  • Japan:
    • MHLW Ministerial Ordinance 169, Article 4 to Article 68
    • PMD Act (as applicable)
  • United States:
    • 21 CFR 820*
    • 21 CFR 803
    • 21 CFR 806
    • 21 CFR 807 – Subparts A to D
    • 21 CFR 821 (where applicable)

* When United States requirements are audited, 21 CFR 820 should appear on the certification document unless the Auditing Organization has confirmed the audited organization is exempt (by FDA regulation) from all Quality System Regulation requirements other than 21 CFR 820.180 and 198.

10. Scope of Certification Document

All MDSAP certification documents shall contain a scope of certification statement detailing the activities and devices covered by the certification document.  Where there are multiple facilities or locations covered by the certification document, the certification document will contain, in addition to an overall scope of certification statement, relevant sub-scope statements for each location or facility that detail the devices manufactured and activities audited in each facility.  The activities and devices in the sub-scope statements must be covered by the overall scope of certification statement.

The scope of a certification document shall be clear and unambiguous as to the devices manufactured and the activities that were audited, and the requirements against which they were audited.  The scope shall include any limitations or conditions that may apply.  Therefore, the scope of a certification document shall clearly identify the applicability of the criteria where it is not universal, such as when certain devices are not marketed in certain jurisdictions, or where design controls are not applied to certain devices.

Activities

All the activities covered by the scope of certification statement should be relevant to the devices covered.  In wording the scope statement of the certification document, only the following terms may be used:

• Design, development, manufacture, production, servicing, installation, or distribution

More specific terms may be included in the sub-scope statements for individual locations. (e.g., assembly, packaging, sterilization, quality control, warehousing, etc.)

All certification documents must include the terms "manufacture" or "production" in the overall scope statement.  If design controls are included, the terms "design" or "design and development" must be included in the scope statement.

Devices

The scope statement shall list all devices covered by the certification document. In doing so, generic device group descriptors may be used.  The listing shall be specific enough to determine whether a given device (e.g. paediatric bone biopsy needle, PFO closure device, gamma camera, etc.) is covered without resorting to the inclusion of trade-names, models, or device identifiers.  Generic terms such as "medical device", "components", "accessories", or "parts" shall not be used.   Specific descriptions shall be used for such items that are provided by the manufacturer of a medical device.

See Appendix 1 for examples of generic device group descriptors.

11. Auditing Organization

The certification document shall contain the full legal name and address of the MDSAP recognised Auditing Organization that issued the document. This shall match the information submitted in the MDSAP AO application form or any subsequent amendment.

12. Signing Authority

The certification document shall contain the name, position, and signature (or facsimile) of the person issuing or authorising the issuance of the certification document. This individual shall be a duly authorised officer employed by the AO.

13. Statement of Recognition

Upon full implementation of the Medical Device Single Audit Program on 01 January 2017, an Auditing Organization that has successfully satisfied applicable recognition criteria will be "recognised" to conduct MDSAP audits. The certification document shall contain a statement of recognition under MDSAP of the form "[AO] is recognised under the Medical Devices Single Audit Program" or, "[AO] is an MDSAP recognised auditing organization".

Recognised Auditing Organizations are entitled to use the MDSAP logo.

MDSAP certification documents shall not include marks or logos related to accreditation or recognition by any other entity, scheme, or commercial or trade group, or membership in any such group.

An Auditing Organization who underwent a successful Stage 1 and Stage 2 assessment and provided an appropriate response to any identified nonconformities is "authorized" to perform MDSAP audits, until after 3 witnessed audits are completed and any new nonconformity resolved. During that time, the Auditing Organization may grant certification to medical device organizations. The certification document shall contain a statement of the form "[AO] is authorized to audit under the Medical Devices Single Audit Program" or, "[AO] is an MDSAP authorized auditing organization". 

Auditing Organizations authorized to perform MDSAP audits cannot use the MDSAP logo.

14. Verification

The certification document shall include a statement specifying how the user can obtain information about the validity of the certification document.

15. References

• MDSAP AU G0026.1 Surveillance Audit Confirmation Notification Process

Appendix 1 – Examples of Certification Document Scope Statements

1. Determine if the product is an in-vitro diagnostic medical device or not, as this will dictate which of the two "generic device group" templates to use.  If a manufacturer produces both types of devices, then they may use either template and formulate a hybrid scope statement.
2. Delete the QMS processes, generic device groups, and medical areas that do not apply.
3. The list of generic device group descriptions provided in each template is not comprehensive.  Other generic device group descriptions can be added if the ones provided are not adequate.

1. Template for in-vitro diagnostic medical devices

The (design and development,) manufacture, (installation, and servicing) of (in-vitro diagnostic analyzers/software, in-vitro diagnostic medical devices, in-vitro diagnostic reagents, in-vitro diagnostic test kits) used in the (diagnosis, management, detection) of (autoimmune status, blood analytes, blood components, blood gases, blood grouping, cancer, cardiac markers, coagulation, compatibility testing, disease status, donor screening, drugs of abuse, endocrine disorders, fertility testing, genetic testing, immune status, pregnancy testing, prenatal screening, protein metabolism, sexually transmissible agents, tissue typing, transmissible agents, immunological typing, therapeutic drug monitoring, other... ) including (home use, near patient/point of care) in-vitro diagnostic medical devices.

2. Template for devices other than in-vitro diagnostic medical devices

The (design and development,) manufacture, (installation, and servicing) of (anaesthesia systems, anaesthetic and/or breathing adaptors, biliary stents, bone prostheses, breathing circuits, cardiovascular stents, catheters, cochlear implants, computed tomography scanners, condoms, contact lenses, cryosurgical instruments, defibrillators, dental amalgams, dental implants, dental etchants, dermatological lasers, diagnostic ultrasound systems, dilatation catheters, disposable surgical instruments, ECG monitors, ECG leads, EEG recorder, elastomeric pumps ,electrosurgical instruments and generators, endoscopes, examination gloves, guide wires, hearing aids, haemodialysis water purification systems, imaging and monitoring workstations, infusion pumps, intraocular lenses, intravenous infusion sets, irrigation/drainage sets, mechanical and tissue heart valves, nebulizers, needles, ophthalmic lasers, total knee implants, pacemakers, patient monitors, Picture Archiving Computer Systems (PACS), powered dental instruments, pulse generators, resorbable material implants, slit lamps, software, surgical gloves, surgical sponges, surgical lasers, surgical trays, sutures, syringes, therapeutic ultrasound devices, tonometers, vascular introducers, ventilators, wound dressings, x-ray equipment, other......) for the area(s) of (anaesthesiology, cardiovascular, dentistry, electrosurgical applications, ENT, gastroenterology, neurology, obstetrics & gynaecology, ophthalmology, orthopaedics, plastic surgery, radiology, urology).

Version No.	Version date	Description of Change	Author Name / Project Manager
001	2014-07-18	Initial Release	Robert G. Ruff, FDA
002	2015-09-22	On page 5; Japan's requirements are added to the Audit/ Certification Criteria.	Liliane Brown, FDA
003	2021-02-08	On Page 4; Replaced DUNS # with Facility ID generated by the REPs On page 5; updated for ISO13485:2016 Modified Section 13 Statement of recognition	Hiromi Kumada, PMDA
004	2022-04-29	Updated references to ANVISA regulations	Frédéric HAMELIN, HC
005	2024-03-07	Added MDR Part 1.1	Frédéric HAMELIN

Version Approval: 005

Approved: Signature on File, CHAIR, MDSAP RAC

Date: 2024-04-05

---

Uncontrolled when printed.

For the most current copy, contact MDSAP@fda.hhs.gov