MDSAP audit checklist

• Quality manual or equivalent documentation showing QMS scope, applicable regulatory jurisdictions, product scope, and site coverage -- verify alignment with actual marketing authorizations held
• QMS process map or interaction diagram showing how management, realization, support, and measurement processes interconnect -- confirm process owners are current employees
• Master document list filtered to management system procedures -- verify at least 3 randomly selected procedures have current revision dates within the organization's defined review cycle
• QMS change management records from the past 12 months -- verify that changes were risk-assessed and validated before implementation
• Regulatory requirements matrix mapping each MDSAP jurisdiction's requirements to specific QMS procedures -- cross-check at least 2 entries against the referenced procedures

• Quality manual scope does not include all jurisdictions for which the organization holds marketing authorizations -- devices are sold in Brazil but QMS scope only references FDA and Health Canada (Grade 3 -- direct QMS impact).
• No documented QMS change management process exists -- recent organizational changes (new production line, site move) were implemented without assessing impact on the QMS (Grade 3).
• Process interaction diagram is a generic template that does not reflect the organization's actual process flow -- names and departments on the diagram do not match the current organizational chart (Grade 1).
• Quality manual has not been reviewed or updated within the organization's defined review cycle and references obsolete regulatory requirements (Grade 1).

Request the quality manual, process map, and regulatory requirements matrix. Cross-reference the scope against actual marketing authorizations. Pull 3 random procedures from the master list and verify they are current.

• When was the last structural change to your QMS, and what triggered it?
• How do you ensure your QMS addresses the regulatory requirements of all five MDSAP jurisdictions, not just the ones you audit against most frequently?
• If a new jurisdiction-specific requirement was published tomorrow, what is your process for incorporating it?

• Documented appointment letter or organizational chart showing the management representative with reporting line to top management
• Job description or role definition specifying QMS responsibilities, authority to stop production for quality reasons, and access to top management
• Meeting minutes or communication records showing the management representative reporting QMS status to top management within the past 12 months
• Evidence that the management representative has authority over resources needed to maintain the QMS

• Management representative role is assigned to a mid-level quality engineer who reports through two layers of management before reaching top management -- no direct access for escalation of quality issues (Grade 1).
• No formal appointment exists -- the quality manager performs the role by default but has no documented authority to halt production or escalate systemic issues (Grade 1).
• Management representative changed 6 months ago but the quality manual and regulatory submissions still reference the previous appointee (Grade 1).

Review the appointment letter or job description. Check the last 2 management review meeting attendee lists to confirm the management representative was present and actively participated.

• Can you describe a recent situation where you escalated a quality concern to top management? What was the outcome?
• If you needed to stop a production line due to a quality issue, do you have the authority to do that without additional approval?

• Documented quality policy signed by top management with a date within the organization's defined review cycle
• Evidence of communication to all levels -- posted in work areas, included in onboarding, referenced in training materials
• Interview 2--3 employees at different levels (floor operator, supervisor, engineer) to verify they can describe the quality policy in their own words
• Records showing the quality policy was reviewed during management review -- confirm review date and any resulting changes

• Quality policy is posted in the conference room but floor operators cannot articulate what it means or how it applies to their work -- communication is one-directional with no evidence of understanding (Grade 1).
• Policy does not reference regulatory compliance -- it focuses on customer satisfaction and continuous improvement but omits the organization's commitment to meeting applicable regulatory requirements (Grade 1).
• Quality policy was last reviewed more than 5 years ago and references an organizational mission statement that has since changed (Grade 1).

Read the quality policy. Interview 2 employees at different levels. Check that the most recent management review agenda included quality policy review.

• How do you verify that personnel understand the quality policy -- not just that they have been told about it?
• When was the quality policy last changed, and what drove the change?

• Risk management procedure referencing ISO 14971 and addressing all lifecycle phases -- verify it covers risk analysis, risk evaluation, risk control, and residual risk evaluation
• Risk management plan for at least one device showing scope, responsibilities, risk acceptability criteria, and planned verification activities
• Risk management file for the same device showing risk analysis records, risk control measures, and residual risk assessment -- verify it is current and includes post-market data
• Evidence that production and post-production information is fed back into the risk management process -- link to complaint data, CAPA records, or post-market surveillance reports

• Risk management file was completed at design transfer and has not been updated with post-market data -- no evidence that complaint trends, CAPA outcomes, or field performance data have been evaluated for risk impact (Grade 3 -- direct QMS impact).
• Risk acceptability criteria are not defined or are defined so broadly that no risk is ever deemed unacceptable -- the risk management process cannot demonstrate it would reject a design with unacceptable risk (Grade 3).
• Risk management process addresses only product risks and does not cover process risks (e.g., sterilization failure, packaging breach) as required by the MDSAP audit model (Grade 2).
• No linkage between risk management and design inputs -- design input requirements do not reference the risk analysis, and risk controls are not traced to design outputs (Grade 3).

Select the highest-risk device. Review the risk management plan and file. Verify the file includes post-market data updates within the past 12 months. Check linkage to at least one CAPA record.

• When was the risk management file for your highest-risk device last updated, and what triggered the update?
• How does post-market information -- complaints, CAPAs, literature reviews -- feed back into your risk management files?
• What criteria do you use to determine if a risk is acceptable, and can you show me an example where a risk was initially deemed unacceptable?

• List of outsourced processes with risk classification and rationale for outsourcing -- verify it includes all outsourced activities (sterilization, testing, calibration, design, manufacturing)
• Quality agreements or technical agreements for each critical outsourced process -- verify they define responsibilities, quality requirements, acceptance criteria, and right of audit
• Supplier audit or evaluation records for outsourced process providers -- verify frequency is risk-based and evaluations are current
• Monitoring data for outsourced processes -- incoming inspection results, performance metrics, or periodic review records

• Sterilization is outsourced but no quality agreement exists with the contract sterilizer -- the organization relies on the sterilizer's ISO certificate without defining specific requirements or monitoring performance (Grade 3).
• Outsourced processes are not included in the organization's process map or QMS scope -- they are managed as simple 'purchases' without the controls required for outsourced QMS processes (Grade 2).
• Quality agreements exist but have not been reviewed since initial execution -- the outsourced provider has changed processes, moved facilities, or been acquired without triggering a review of the agreement (Grade 1).

Review the outsourced process list. Select the most critical outsourced process and verify the quality agreement, most recent audit or evaluation, and monitoring data.

• How do you distinguish between an outsourced process and a purchased product or service?
• When was the last time you audited your contract sterilizer or other critical outsourced process provider?
• If your outsourced process provider changed a key process parameter, how would you know?

• Procedure or process description for regulatory authority communication covering all applicable jurisdictions
• Log or tracking system for regulatory correspondence -- submissions, notifications, queries, and responses
• Records of regulatory notifications submitted in the past 12 months (e.g., change notifications, annual reports, periodic safety reports)
• Evidence that regulatory authority communications are reviewed for QMS impact and routed to appropriate personnel

• Organization has no centralized tracking of regulatory authority correspondence -- communications are managed by individual regulatory affairs staff with no oversight or handoff process (Grade 1).
• Regulatory notifications required by Health Canada (Significant Change notifications) or ANVISA (post-registration changes) were not submitted or were submitted late (Grade 3 -- jurisdiction-specific requirement violation).
• No process exists to monitor regulatory authority communications for changes that may affect the QMS -- the organization is unaware of a published guidance document that impacts its device classification (Grade 2).

Review the regulatory correspondence log. Select one recent device change and verify that all required regulatory notifications were submitted to applicable jurisdictions within required timeframes.

• How do you track regulatory notification obligations across all five MDSAP jurisdictions?
• Can you show me the last regulatory notification you submitted? Which jurisdictions required it, and was it submitted within the required timeframe?

• Management review procedure defining required inputs, frequency, and participants -- verify it lists all inputs required by ISO 13485:2016 clause 5.6.2
• Most recent management review minutes or report showing each required input was addressed with data -- not just agenda items, but actual metrics, trends, and analysis
• Evidence that complaint trends, CAPA effectiveness data, audit findings, and post-market surveillance data were presented with quantitative analysis
• Records showing management review covered jurisdiction-specific regulatory performance -- adverse event reporting timeliness, regulatory submissions status, and authority communications

• Management review minutes show topics were discussed but no quantitative data was presented -- 'CAPA status was reviewed' with no trend data, closure rates, or effectiveness metrics (Grade 2).
• Required inputs were omitted -- no review of post-market surveillance data, no review of regulatory changes, or no review of risk management updates (Grade 2).
• Management review does not address multi-jurisdiction regulatory performance -- adverse event reporting compliance, regulatory submission status, and authority communications are not covered per MDSAP requirements (Grade 2).
• Management review frequency does not meet the defined schedule -- the most recent review was 18 months ago despite a documented annual requirement (Grade 1).

Review the last 2 management review records. Verify all required inputs per ISO 13485 clause 5.6.2 were addressed with data. Verify management review outputs include action items with assigned owners and completion dates.

• Can you show me the data package that was presented at the last management review -- not just the minutes, but the actual charts and metrics?
• How do you ensure management review covers regulatory performance for all five MDSAP jurisdictions?
• What specific actions resulted from the last management review, and can you show me evidence they were completed?

• Management review output records showing specific decisions, action items, responsible parties, and target dates
• Action item tracking log or system showing status of management review actions -- verify closure evidence for completed items
• Evidence that management review outputs addressed resource allocation decisions (personnel, equipment, infrastructure)
• Evidence that at least one improvement action from management review was implemented and its effectiveness verified

• Management review minutes conclude with vague action items ('improve CAPA process') with no specific owner, target date, or measurable success criteria (Grade 1).
• Action items from previous management reviews are carried forward indefinitely without escalation or re-prioritization -- the same items appear on 3 consecutive reviews without progress (Grade 2).
• No evidence that management review outputs led to actual resource allocation decisions -- the organization identifies resource needs but management does not approve or fund them (Grade 2).

Review action items from the last 2 management reviews. Track at least 3 items to closure with effectiveness evidence. Check for overdue or recurring items.

• Show me an action item from the last management review that has been completed. What evidence do you have that it was effective?
• Are there any management review action items that have been open for more than 6 months? Why?

• Resource planning records or budget allocations for quality system resources -- personnel, equipment, facilities, and training
• Infrastructure qualification records for critical production and testing equipment -- IQ/OQ/PQ or equivalent
• Preventive maintenance schedules and records for critical infrastructure -- verify maintenance is current
• Work environment monitoring records where environmental conditions affect product quality -- temperature, humidity, particulate counts, ESD controls

• Cleanroom environmental monitoring records show out-of-specification particulate counts on multiple occasions with no investigation or corrective action taken (Grade 3).
• No preventive maintenance program exists for production equipment -- maintenance is performed only when equipment fails (Grade 2).
• Organization has added a second production shift but has not assessed whether infrastructure (equipment capacity, environmental controls, utilities) is adequate for increased throughput (Grade 1).

Review infrastructure maintenance records for 3 critical production or testing assets. Check environmental monitoring data for one controlled area. Verify out-of-specification events were investigated.

• How do you determine what infrastructure and environmental controls are needed for your products?
• Can you show me environmental monitoring data for your most critical production area over the past 6 months?

• Document control procedure addressing approval, review, distribution, revision control, and obsolete document management -- verify it references jurisdiction-specific retention requirements
• Master document list or electronic document management system showing current revisions, effective dates, and approval status for all QMS documents
• Record retention schedule that addresses the retention requirements of all five MDSAP jurisdictions -- verify it identifies the longest applicable retention period for each record type
• Evidence of controlled document distribution -- verify that at least 3 work areas have current revision documents available (not obsolete versions)

• Record retention schedule only addresses FDA requirements (2 years or device lifetime) and does not account for longer retention periods required by other jurisdictions -- Health Canada requires retention for the life of the device plus one year, ANVISA requires specific periods per record type (Grade 2).
• Obsolete documents are still accessible in production areas without clear identification as superseded -- operators could inadvertently follow an outdated procedure (Grade 3).
• Electronic document management system does not enforce approval workflows -- documents can be posted without formal review and approval (Grade 2).

Check the record retention schedule against jurisdiction-specific requirements. Verify 3 random documents on the production floor are current revision. Confirm at least one obsolete document was properly retired.

• How do you determine the record retention period when multiple jurisdictions have different requirements?
• Can you show me how you prevent use of obsolete documents in production areas?

• List of all devices marketed by jurisdiction, showing the marketing authorization type, number, and status (active, pending, expired) for each device-jurisdiction combination
• Regulatory submission procedure covering submission types, review workflows, and tracking mechanisms for each jurisdiction
• Sample marketing authorizations -- at least one per jurisdiction -- verified as current and matching the device currently being manufactured
• Tracking system for regulatory submission status, approval conditions, and renewal dates

• Devices are being marketed in a jurisdiction without a valid marketing authorization -- the organization assumed mutual recognition where none exists (Grade 4 -- direct impact, regulatory violation).
• Marketing authorization references an older device specification that no longer matches the current manufactured device -- design changes were implemented without updating the submission (Grade 3).
• No systematic tracking of marketing authorization renewal dates -- an authorization expired without the organization being aware (Grade 3).

Select 3 devices. For each, verify the marketing authorization is current in every jurisdiction where the device is sold. Cross-reference the authorized device description against the current design output specifications.

• Can you show me a complete list of every device you sell, by jurisdiction, with the corresponding marketing authorization number?
• How do you determine whether a design change requires a new regulatory submission versus a change notification?

• Establishment registration records for each applicable jurisdiction -- FDA establishment registration, Health Canada establishment licence, ANVISA company registration, PMDA marketing authorization holder registration, TGA sponsor registration
• Device listing records showing all marketed devices are listed with the correct classification, product codes, and proprietor information per jurisdiction
• Evidence of annual registration renewals where required -- FDA annual registration, Health Canada annual licence fee
• Records showing device listing updates when devices are added, modified, or discontinued

• FDA establishment registration has lapsed because the annual renewal was missed -- the organization is technically operating without current registration (Grade 4).
• Device listing does not include all devices currently marketed -- recently launched devices were not added to the listing within the required timeframe (Grade 3).
• Device classification in the listing does not match the actual classification determination -- product codes or device class designations are incorrect (Grade 2).

Verify establishment registrations are current for each jurisdiction. Cross-reference device listings against the actual product catalog. Check that at least one recently launched device was added to listings within the required timeframe.

• When was your most recent establishment registration renewal for each jurisdiction?
• How do you ensure device listings are updated when you launch a new device or discontinue an existing one?

• Labeling control procedure covering label design, approval, storage, issuance, and reconciliation
• Labeling review records showing verification against jurisdiction-specific requirements -- FDA 21 CFR 801, Health Canada CMDR labeling requirements, ANVISA labeling rules, PMDA labeling standards, TGA labeling requirements
• Sample labels for at least one device -- verify they include all required elements per applicable jurisdiction (device name, manufacturer, UDI/GTIN, lot/serial, expiry, IFU reference, regulatory symbols)
• Translation management records for multi-language labeling -- verification that translations are accurate and cover all required jurisdictions

• Labels do not include Unique Device Identification (UDI) information as required by the applicable jurisdiction's UDI implementation timeline (Grade 3).
• Instructions for Use are only available in English and the primary market language but not in languages required by other jurisdictions where the device is sold (Grade 2).
• Labeling review checklist does not address jurisdiction-specific requirements -- it only covers ISO 15223 symbols without verifying country-specific text and content requirements (Grade 2).

Select one device sold in at least 3 jurisdictions. Verify the label includes all required elements per each jurisdiction. Check that IFU translations exist for required languages. Verify UDI status.

• How do you ensure labeling compliance when a device is sold in multiple jurisdictions with different language and content requirements?
• What is your current UDI compliance status for each applicable jurisdiction?

• Technical documentation or design dossier for at least one device -- verify it contains the elements required by each applicable jurisdiction's submission format
• Change management records showing technical documentation updates aligned with design changes
• Traceability matrix linking design outputs to technical documentation sections -- verify consistency
• Evidence that technical documentation supports currently marketed device versions, not obsolete configurations

• Technical documentation has not been updated to reflect design changes made after initial marketing authorization -- the dossier describes a configuration that no longer matches the manufactured device (Grade 3).
• No traceability between design history file and technical documentation -- engineers cannot demonstrate which technical documentation sections are affected by a given design change (Grade 2).
• Technical documentation exists only for the primary jurisdiction submission format (e.g., FDA 510(k)) with no equivalent documentation structured for other jurisdictions' requirements (Grade 1).

Select one device with a recent design change. Verify the technical documentation reflects the current design. Cross-reference at least 2 design outputs against the technical documentation content.

• If a regulatory authority requested your current technical documentation for a specific device, how quickly could you produce it?
• How do you ensure technical documentation stays synchronized with design changes?

• Regulatory requirements matrix mapping each jurisdiction's specific requirements to QMS procedures -- verify completeness for all five MDSAP jurisdictions
• Regulatory intelligence process -- documented method for monitoring regulatory changes, guidance updates, and enforcement actions in each jurisdiction
• Records showing regulatory change assessments performed in the past 12 months -- at least one change per jurisdiction identified, assessed, and actioned or dismissed with rationale
• Training records showing regulatory affairs personnel are trained on jurisdiction-specific requirements

• Regulatory requirements matrix only covers FDA and Health Canada -- no systematic identification of ANVISA, PMDA, or TGA-specific requirements despite marketing devices in those jurisdictions (Grade 2).
• No formal regulatory intelligence process exists -- the organization relies on trade publications and informal networks rather than systematic monitoring of regulatory authority publications (Grade 1).
• Regulatory change was published 6 months ago but the organization has not assessed its impact -- no evidence that new guidance or regulation was reviewed for QMS impact (Grade 2).

Review the regulatory requirements matrix for completeness. Verify the regulatory intelligence process has produced at least 2 change assessments in the past 12 months. Spot-check one jurisdiction-specific requirement against the organization's actual implementation.

• How do you monitor regulatory changes across all five MDSAP jurisdictions?
• Can you show me the last regulatory change you assessed and what action resulted?

• List of appointed representatives per jurisdiction -- authorized representative (EU/Health Canada), local agent (ANVISA), marketing authorization holder (PMDA), sponsor (TGA)
• Written agreements with each representative defining responsibilities, authority, and communication protocols -- verify agreements are current and signed
• Evidence of communication between the organization and its representatives in the past 12 months
• Verification that representative contact information provided to regulatory authorities is accurate and current

• Authorized representative agreement has expired or the representative has changed without notifying the regulatory authority (Grade 3).
• No formal agreement exists with the local agent in Brazil -- the organization uses a distributor as its ANVISA representative without a written agreement defining regulatory responsibilities (Grade 2).
• Representative contact information on file with the regulatory authority does not match the current representative -- the previous representative's details are still registered (Grade 2).

Review representative agreements for at least 2 jurisdictions. Verify the representative information registered with the regulatory authority matches the current agreement. Check for recent communication records.

• How do you verify that your authorized representatives are fulfilling their regulatory obligations?
• When was the last time you reviewed and updated your representative agreements?

• List of voluntary or consensus standards applied to devices (e.g., IEC 60601 for electrical safety, ISO 10993 for biocompatibility, IEC 62304 for software)
• Evidence that referenced standards are current editions -- verify the organization is aware of and planning for standard transitions
• Verification that standard requirements are incorporated into design inputs and testing protocols

• Organization references an obsolete edition of a consensus standard in its marketing authorization submission and has not assessed the impact of transitioning to the current edition (Grade 1).
• Voluntary standards are referenced in design documentation but the organization cannot demonstrate compliance testing against the referenced edition (Grade 1).

Review the standards reference list. Verify at least 2 referenced standards are current editions. Check one standard transition for QMS impact assessment.

• Which consensus standards do you reference in your marketing authorization submissions, and are they current editions?

• Complaint handling procedure covering intake, evaluation, investigation, trending, and closure -- verify it includes reportability assessment criteria for all five MDSAP jurisdictions
• Complaint log or database showing all complaints received in the past 12 months -- verify completeness by cross-referencing against customer communication records and returned product logs
• Sample of 5 complaint records -- verify each was evaluated for investigation need, reportability was assessed per jurisdiction, investigation (where required) was completed, and the record was closed with documented rationale
• Complaint trending reports showing analysis by product, complaint type, severity, and time -- verify trends are reviewed and actioned

• Complaint procedure does not include jurisdiction-specific reportability criteria -- the organization uses a single set of reporting criteria that does not address differences between FDA MDR, Health Canada Mandatory Problem Reporting, ANVISA Tecnovigilancia, PMDA adverse event reporting, and TGA reporting (Grade 3).
• Complaints received through non-standard channels (social media, distributor verbal reports, sales team feedback) are not captured in the complaint system (Grade 3).
• Complaint investigations do not address root cause -- records show the complaint was evaluated but the investigation consists only of reviewing the complaint description without product examination, process review, or causal analysis (Grade 2).
• Complaint trending is performed but trends are not linked to the CAPA system -- recurring complaint types are identified but no corrective action is initiated (Grade 3).

Pull 5 complaint records: 2 investigated, 1 reported to a regulatory authority, 1 determined not reportable, 1 closed without investigation (verify rationale). Verify trending data is current and linked to CAPA.

• How do you ensure complaints from all sources -- including distributors, social media, and sales teams -- are captured in your complaint system?
• Can you walk me through the reportability assessment for a specific complaint and show me how you determined it was or was not reportable?
• How do complaint trends feed into your CAPA system?

• CAPA procedure defining triggers, investigation methodology, root cause analysis tools, corrective action planning, implementation tracking, and effectiveness verification criteria
• Sample of 3 CAPA records -- at least one triggered by a complaint, one by an audit finding, and one by a process trend -- verify each includes root cause analysis, corrective action plan, implementation evidence, and effectiveness verification
• CAPA metrics showing timeliness of closure, effectiveness rates, and trending of CAPA sources -- verify metrics are reported in management review
• Evidence that preventive actions are also initiated -- not just corrective actions in response to problems

• Root cause analysis consists of a single 'why' statement without systematic methodology -- no evidence of 5-Why analysis, fishbone diagram, fault tree, or other structured root cause tool (Grade 2).
• CAPA effectiveness verification is performed immediately after corrective action implementation without allowing sufficient time for the action to demonstrate sustained effectiveness -- verification is a 'check-the-box' exercise (Grade 3).
• CAPA system is exclusively corrective -- no evidence of preventive actions based on trend analysis, risk assessment, or proactive identification of potential problems (Grade 2).
• CAPA records show the same root cause identified repeatedly across multiple CAPAs without recognizing the systemic nature of the problem -- each instance is treated as an isolated event (Grade 3).

Review 3 CAPA records end-to-end. Verify root cause analysis methodology, corrective action appropriateness, implementation evidence, and effectiveness verification. Check at least one preventive action record. Verify CAPA metrics are reported in management review.

• Can you show me a CAPA where the first corrective action did not work and you had to revise your approach? What did you learn?
• How long do you wait between implementing a corrective action and verifying its effectiveness?
• How do you distinguish between a corrective action and a preventive action in your system?

• Internal audit procedure defining audit planning, auditor qualification and independence, audit conduct, reporting, and follow-up requirements
• Internal audit schedule or program showing all QMS processes are covered within the defined cycle -- verify risk-based frequency and that no processes are excluded
• Completed internal audit reports from the past 12 months -- verify audits were conducted by qualified, independent auditors and findings were clearly documented
• Internal audit finding follow-up records -- verify findings were addressed with corrective actions and effectiveness was verified

• Internal audit program does not cover all QMS processes -- design controls, risk management, or regulatory affairs have not been audited within the defined audit cycle (Grade 2).
• Internal auditors audit their own areas of responsibility -- no evidence of independence between auditor and audited activity (Grade 2).
• Internal audit findings are documented but no corrective action follow-up is performed -- findings are recorded and then forgotten (Grade 2).
• Internal audit program does not address MDSAP jurisdiction-specific requirements -- audits cover ISO 13485 clauses but not FDA, Health Canada, ANVISA, PMDA, or TGA regulatory requirements (Grade 1).

Review the audit schedule for completeness. Read 2 internal audit reports. Verify at least 3 findings were followed up with corrective actions. Check auditor qualification records for at least 2 auditors.

• How do you determine the frequency and scope of internal audits?
• Can you show me an internal audit finding where the auditor identified a systemic process issue rather than a documentation gap?
• How do you qualify internal auditors and maintain their competency?

• List of monitored processes with defined metrics, targets, and monitoring frequency -- verify critical processes (production, sterilization, complaint handling, CAPA) have measurable objectives
• Process monitoring data for at least 2 critical processes -- verify data is current, targets are defined, and out-of-specification results trigger investigation
• Product monitoring records (inspection, testing) showing product conforms to acceptance criteria -- verify records include the identity of the inspector and the acceptance criteria used
• Trend analysis reports showing process and product monitoring data analyzed over time -- verify adverse trends trigger investigation or CAPA

• Process monitoring metrics are defined but not analyzed for trends -- data is collected but never reviewed in aggregate to identify deteriorating performance (Grade 2).
• Product acceptance records do not identify the acceptance criteria used -- inspectors record 'pass' or 'fail' without documenting against which specification or drawing revision the product was inspected (Grade 2).
• Out-of-specification results are addressed individually but not trended -- recurring out-of-specification events for the same parameter are not identified as a pattern requiring CAPA (Grade 3).

Review process monitoring data for 2 critical processes. Verify trend analysis is performed. Check one product inspection record for completeness (acceptance criteria, inspector identity, instrument used).

• Can you show me a trend chart for a key process parameter? What are your action limits versus specification limits?
• When was the last time monitoring data triggered a CAPA or process investigation?

• Nonconforming product control procedure covering identification, segregation, disposition, and documentation requirements for all product stages
• Nonconforming product records from the past 12 months -- sample at least 3, including at least one concession/use-as-is disposition
• For concession dispositions, verify approval authority is appropriate (not the same person who discovered the nonconformity) and rationale addresses impact on safety, performance, and regulatory compliance
• Records showing nonconforming product was segregated to prevent unintended use

• Nonconforming product is dispositioned as 'use-as-is' or 'accept with concession' without documented rationale assessing impact on device safety, performance, and regulatory compliance (Grade 3).
• No physical segregation of nonconforming product -- nonconforming material is stored alongside conforming material with only a label or tag to differentiate (Grade 2).
• Reworked product is released without re-inspection or re-testing against the original acceptance criteria (Grade 3).
• Concession dispositions are approved by quality staff without involvement of design engineering or regulatory affairs for devices with critical safety requirements (Grade 2).

Review 3 nonconforming product records. Verify at least one concession disposition has documented rationale and appropriate approval. Check segregation practices on the production floor. Verify reworked product was re-inspected.

• Show me a nonconforming product record where the disposition was 'use-as-is.' How was the safety and regulatory impact assessed?
• How do you track the cumulative effect of concessions on a product line over time?

• Data analysis procedure or practice defining sources, methods, frequency, and outputs
• Data analysis reports or dashboards covering at least complaints, CAPA, audit findings, process monitoring, and supplier performance -- verify reports are current (within past 6 months)
• Evidence that data analysis identified at least one trend or pattern that triggered a corrective or preventive action
• Management review records showing data analysis results were presented and discussed

• Data from different quality system sources is analyzed in isolation -- complaint trends, audit findings, and process monitoring data are never correlated to identify systemic issues (Grade 2).
• Data analysis consists of summary statistics (counts, averages) without trend analysis or statistical process control -- the organization cannot detect deteriorating performance before it becomes a nonconformity (Grade 1).
• Data analysis reports are produced but not reviewed by management or used as input to decision-making (Grade 1).

Review the most recent data analysis output. Verify it covers all required sources. Check that at least one trend or pattern was identified and actioned. Confirm the analysis was presented at management review.

• Can you show me an example where data analysis from multiple sources identified a systemic issue that would not have been visible from any single source alone?
• What statistical tools or methods do you use for data analysis?

• Reportability assessment procedure with jurisdiction-specific criteria -- FDA MDR (21 CFR 803), Health Canada Mandatory Problem Reporting (CMDR s.59--61), ANVISA Tecnovigilancia (RDC 67/2009), PMDA adverse event reporting (PMD Act Art. 68-10), TGA adverse event reporting (TG(MD)R Part 4 Div 2)
• Regulatory reporting timeline matrix showing required timeframes per jurisdiction and event type -- FDA 30-day/5-day, Health Canada 10-day/48-hour, ANVISA 72-hour/24-hour, PMDA 15-day/immediate, TGA 10-day/48-hour
• Records of regulatory reports submitted in the past 24 months -- verify reports were submitted within required timeframes
• Records of events evaluated and determined not reportable -- verify rationale is documented per jurisdiction

• Reports were submitted to FDA but not to other applicable jurisdictions -- the organization reported to its primary regulatory authority but did not assess reportability for Health Canada, ANVISA, PMDA, or TGA (Grade 4 -- direct regulatory impact).
• Reports were submitted but outside the required timeframe -- jurisdiction-specific timelines were not met (Grade 3).
• Reportability assessment criteria are generic and do not account for differences between jurisdictions -- the same threshold is applied regardless of the jurisdiction's specific definition of a reportable event (Grade 3).
• No records exist for events determined not reportable -- the organization cannot demonstrate it performed a reportability assessment (Grade 2).

Review 3 regulatory reports and verify submission timeliness. Review 2 events determined not reportable and verify rationale per jurisdiction. Cross-reference complaint records from Task 3.1 with reporting records.

• Walk me through a recent reportability decision. How did you determine which jurisdictions required a report?
• Can you show me an event that was reportable in one jurisdiction but not another, and explain the difference?

• Post-market surveillance plan for at least one device -- verify it defines data sources, collection methods, analysis frequency, and actions based on findings
• Post-market surveillance data and analysis records -- verify data collection is active, not just planned
• Evidence that post-market surveillance findings feed into risk management, CAPA, and design processes
• Records showing post-market surveillance data was reported to applicable regulatory authorities where required (periodic safety reports, PSUR equivalents)

• No post-market surveillance plan exists -- the organization relies on complaint handling as its only source of post-market information without proactive data collection (Grade 2).
• Post-market surveillance plan exists but is generic across all devices regardless of risk class -- no risk-proportionate approach to data collection and analysis frequency (Grade 1).
• Post-market surveillance data is collected but not analyzed or fed back into the risk management file -- the process is disconnected from the rest of the QMS (Grade 2).

Review the post-market surveillance plan for the highest-risk device. Verify data was collected and analyzed within the defined timeframe. Check that at least one finding was routed to risk management or CAPA.

• Beyond complaints, what other data sources do you use for post-market surveillance?
• How do post-market surveillance findings trigger updates to your risk management files?

• Software validation procedure covering scope (which software requires validation), validation approach (IQ/OQ/PQ or equivalent), roles, and revalidation triggers
• Inventory of software used in the QMS with validation status -- verify critical software (complaint database, CAPA system, document management, production control, inspection systems) is validated
• Validation records for at least one critical QMS software system -- verify validation included requirements definition, test protocols, test results, and approval
• Revalidation records for software that has been updated or upgraded -- verify revalidation was performed within a defined timeframe after the change

• No inventory of QMS-related software exists -- the organization cannot identify which software systems require validation (Grade 2).
• Excel spreadsheets used for critical calculations (acceptance criteria, statistical analysis, label generation) are not validated -- the organization does not consider spreadsheets as software requiring validation (Grade 3).
• Software was validated at initial installation but has undergone multiple updates without revalidation -- current software version does not match the validated version (Grade 2).
• Validation records consist only of 'installation verified' without functional testing, edge case testing, or data integrity verification (Grade 2).

Review the software inventory. Walk the production floor and identify software not on the inventory. Review validation records for one critical system. Verify revalidation was performed after the most recent update.

• How do you determine which software systems require validation?
• Are there any Excel spreadsheets or databases used for quality-critical calculations? Are they validated?
• How do you manage revalidation when your cloud-based QMS software provider releases an update?

• Adverse event identification procedure listing all information sources that must be monitored -- complaints, service reports, returned product analysis, literature, registries, social media, distributor reports, clinical studies
• Evidence that each information source is actively monitored -- not just documented, but demonstrate actual monitoring activities with records
• Records showing potential adverse events identified from sources other than direct complaints -- at least one example from literature, post-market surveillance, or service data
• Cross-referencing between complaint records and adverse event evaluation records -- verify no complaints that could involve harm were excluded from adverse event evaluation

• Adverse event identification relies solely on the complaint handling process -- service reports, returned product analysis, and literature monitoring are not evaluated for potential adverse events (Grade 3).
• Distributor and sales force reports are not systematically captured and evaluated for adverse event information -- the organization has no mechanism to collect safety information from the distribution channel (Grade 3).
• Literature monitoring for adverse events is not performed, or is performed for clinical literature only without monitoring regulatory authority databases, recall databases, or competitor field actions for similar devices (Grade 2).

Review the adverse event identification procedure. Verify at least 3 information sources are actively monitored with records. Cross-reference 5 complaint records against adverse event evaluation records to verify none were missed.

• Show me an example of an adverse event that was identified from a source other than a customer complaint.
• Do you monitor regulatory databases for events involving similar devices from other manufacturers?
• How do you ensure service records and returned product data are evaluated for potential adverse events?

• Reportability determination procedure with decision criteria for each MDSAP jurisdiction -- verify criteria match current regulatory requirements (not outdated references)
• Decision flowcharts or matrices showing how events are assessed against each jurisdiction's reportability criteria
• Records of reportability determinations for at least 5 events -- verify qualified personnel made the determination, rationale is documented, and the determination was made within the required timeframe
• Training records showing personnel involved in reportability determination are trained on jurisdiction-specific criteria and updated when requirements change

• Reportability criteria reference outdated regulatory requirements -- FDA MDR criteria reference superseded guidance or Health Canada criteria do not reflect current CMDR amendments (Grade 3).
• Reportability determinations are made by personnel without training on jurisdiction-specific criteria -- a single person makes all determinations using only FDA criteria regardless of the jurisdiction (Grade 3).
• Time from event awareness to reportability determination exceeds the reporting window for at least one jurisdiction -- the determination process itself consumes the available reporting time (Grade 4).

Review 5 reportability determinations. Verify each addresses all applicable jurisdictions independently. Check the elapsed time from event awareness to determination. Verify at least one 'not reportable' determination has documented rationale per jurisdiction.

• Walk me through a recent reportability determination. How did you apply each jurisdiction's criteria independently?
• What happens if your regulatory affairs staff disagree on reportability? Is there an escalation process?

• Regulatory reporting timeline matrix per jurisdiction and event severity -- FDA 5-day/30-day, Health Canada 10-day/48-hour, ANVISA 72-hour/24-hour, PMDA 15-day/immediate, TGA 10-day/48-hour
• Report submission records for events reported in the past 24 months -- verify each report was submitted within the required timeframe per jurisdiction
• Tracking system showing reporting deadlines, submission dates, and follow-up report due dates
• Copies of submitted reports or submission confirmations from each regulatory authority

• Adverse event reports were submitted to FDA within the required 30 days but not to Health Canada within the required 10 days, or not to ANVISA within 72 hours -- the organization applied the longest deadline to all jurisdictions (Grade 4).
• Follow-up reports required by the regulatory authority were not submitted or were submitted late (Grade 3).
• No tracking system for reporting deadlines -- the organization relies on individual regulatory affairs staff to remember deadlines without systematic tracking (Grade 2).

Review all adverse event reports from the past 24 months. Calculate elapsed time from event awareness to report submission for each. Verify compliance with each jurisdiction's timeline. Check follow-up report status.

• How do you track reporting deadlines when an event is reportable in multiple jurisdictions with different timelines?
• Have you ever submitted a report late? If so, what corrective action did you take?

• Recall and advisory notice procedure covering initiation criteria, risk assessment, scope determination, notification content, effectiveness checks, and regulatory authority notification requirements per jurisdiction
• Recall or advisory notice records from the past 3 years -- verify regulatory notifications were submitted to all applicable jurisdictions within required timeframes
• If no recalls have occurred, review the recall procedure for adequacy and verify recall readiness through a mock recall exercise record
• Recall effectiveness check records -- verify the organization assessed whether the recall achieved its intended objective

• Recall procedure does not address jurisdiction-specific notification requirements -- some jurisdictions require pre-notification before initiating a recall, while others require notification within a defined timeframe (Grade 3).
• A field corrective action was performed as a voluntary quality improvement without recognizing it met the regulatory definition of a recall -- the action was not reported to regulatory authorities (Grade 4).
• No evidence of recall readiness -- no mock recall exercises, no recall team identified, no communication templates prepared, and recall procedure has never been tested (Grade 2).
• Recall effectiveness was not assessed -- the organization performed a recall but did not measure the percentage of product returned or corrected (Grade 2).

If recalls have occurred, review at least one recall record end-to-end. If not, review the procedure and mock recall exercise records. Verify regulatory notification compliance for each jurisdiction.

• When was your last recall or field safety corrective action? Walk me through the process from decision to effectiveness check.
• If you have never had a recall, when was your last mock recall exercise? What did you learn from it?
• How do you determine whether a voluntary field action meets the regulatory definition of a recall?

• Adverse event investigation procedure defining investigation depth based on event severity, required investigation elements, and timelines
• Investigation records for at least 3 adverse events -- verify investigations include device examination (where possible), failure analysis, root cause determination, and corrective action assessment
• Evidence that investigation findings feed back into risk management files, CAPA, and design processes
• Records showing trends in adverse events are analyzed and systemic corrective actions are taken when patterns emerge

• Adverse event investigations are superficial -- records show the complaint was reviewed and a report was filed, but no technical investigation (device examination, failure analysis, process review) was performed (Grade 3).
• Investigation timelines are not defined or not adhered to -- some investigations remain open for extended periods without explanation or interim regulatory notification (Grade 2).
• Investigation findings do not feed back into the risk management file -- new hazards or hazardous situations identified through adverse event investigation are not incorporated into the risk analysis (Grade 3).

Review 3 adverse event investigation records with varying severity levels. Verify investigation depth is proportionate. Check that at least one investigation resulted in a risk management file update or CAPA initiation.

• How do you determine the appropriate depth of investigation for an adverse event?
• Can you show me an adverse event investigation that resulted in a change to a risk management file?

• Adverse event trending procedure defining data sources, analysis methods, signal detection criteria, and reporting triggers
• Trend analysis reports showing adverse event and complaint data analyzed over time by device, event type, severity, and root cause category
• Records of any trend reports submitted to regulatory authorities -- FDA requires MDR trend reporting under certain conditions, other jurisdictions have periodic safety reporting requirements
• Evidence that trend analysis results are reviewed in management review and fed into post-market surveillance and risk management processes

• No systematic trending of adverse events -- individual events are investigated but cumulative data is not analyzed for emerging patterns or safety signals (Grade 2).
• Trend analysis frequency is insufficient for the complaint volume -- high-volume devices require more frequent trending than quarterly (Grade 1).
• Trend reports identify increasing event rates but no action is taken -- the trend is documented but not evaluated for regulatory reporting obligations or risk management impact (Grade 3).

Review the most recent adverse event trend analysis. Verify signal detection criteria are defined. Check that trend results were presented at management review and any required trend reports were submitted to regulatory authorities.

• How do you define a safety signal in your adverse event data?
• Can you show me a trend analysis that identified an emerging pattern and what action was taken?

• Design and development procedure defining the organization's standard design control process -- stages, gate reviews, deliverables, and approval requirements at each stage
• Design plan for a current or recent design project -- verify it defines scope, stages, activities, responsibilities, design review schedule, and interfaces with other functions (regulatory, manufacturing, quality, risk management)
• Evidence that the design plan was updated during the project -- verify at least one plan revision reflecting a scope change, schedule change, or new information discovered during design
• Records showing resources were allocated as defined in the plan -- personnel, equipment, test facilities

• Design plan is a static document created at project initiation and never updated -- actual design activities deviated significantly from the plan without documented rationale (Grade 2).
• Design plan does not define design review stages or review responsibilities -- reviews occurred ad hoc without a planned schedule (Grade 2).
• No design plan exists for a design project that resulted in a marketed device -- the organization performed design activities without the planning required by ISO 13485 clause 7.3.2 (Grade 3).

Select one design project. Review the design plan, verify at least one plan update, and cross-reference plan stages against design review records. If the organization excludes design controls, verify the justification.

• Can you walk me through how the design plan was updated during this project?
• How do you determine which design projects require formal design controls versus informal development processes?

• Design input document or requirements specification for the selected design project -- verify it includes all required input categories (functional, performance, safety, regulatory, risk, human factors, usability, biocompatibility where applicable)
• Approval records showing design inputs were formally reviewed and approved before design activities commenced
• Traceability matrix linking each design input to its source (user need, regulatory requirement, risk analysis output, standard requirement)
• Evidence that design inputs were evaluated for completeness, non-contradiction, and verifiability -- records of design input review meeting or checklist

• Design inputs do not include applicable regulatory requirements for all jurisdictions where the device will be marketed -- inputs reference FDA requirements but omit Health Canada, ANVISA, PMDA, or TGA-specific requirements (Grade 2).
• Design inputs are not traceable to user needs or intended use -- requirements exist but the organization cannot demonstrate why each requirement was defined (Grade 2).
• Design inputs include subjective requirements ('easy to use,' 'lightweight') that are not verifiable against measurable acceptance criteria (Grade 1).
• Risk management outputs are not included as design inputs -- the risk analysis identifies hazards and required risk controls, but these are not captured in the design input specification (Grade 3).

Review the design input specification for the selected project. Verify completeness against the required input categories. Check the traceability matrix for at least 5 design inputs -- verify each has a source and a verification method.

• How do you ensure risk management outputs are captured as design inputs?
• Can you show me the traceability matrix and demonstrate that every design input has a corresponding verification activity?
• How were regulatory requirements for each target jurisdiction incorporated into design inputs?

• Design output documentation for the selected project -- specifications, drawings, software requirements, manufacturing instructions, labeling artwork -- verify they are in a form that allows comparison against design inputs
• Evidence that each design output can be traced to a design input and that the output satisfies the input requirement
• Verification that design outputs include essential safety and performance characteristics identified in the risk analysis
• Evidence that design outputs include information needed for production (manufacturing specifications, process parameters) and purchasing (component specifications)

• Design outputs do not reference acceptance criteria -- drawings and specifications define nominal dimensions or performance values but do not include tolerances or acceptance ranges needed for verification (Grade 2).
• No traceability between design outputs and design inputs -- the output documents exist but cannot be mapped to specific input requirements (Grade 2).
• Design outputs do not include essential performance characteristics identified in the risk analysis as requiring post-market monitoring (Grade 3).
• Design outputs are incomplete for design transfer -- manufacturing instructions reference 'see engineering team' for critical process parameters instead of documented, controlled specifications (Grade 3).

For the selected project, trace 5 design inputs to their corresponding design outputs. Verify acceptance criteria are defined. Check that essential performance characteristics from the risk analysis are included in design outputs.

• Can you show me how a specific design input requirement was addressed in the design output documentation?
• How do you ensure design outputs include all information needed for manufacturing without requiring informal knowledge from the design team?

• Design review records for each planned review stage -- verify attendees, topics discussed, issues identified, and actions assigned
• Attendee lists showing participation of all required functions -- at minimum, design engineering, quality, regulatory, manufacturing, and risk management, plus at least one independent reviewer not directly involved in the design
• Action item tracking showing design review actions were completed and verified before proceeding to the next stage
• Evidence that design review considered risk management status, regulatory compliance, and manufacturing feasibility -- not just design engineering topics

• Design reviews were conducted but attendee records show only design engineering participants -- no representation from quality, regulatory, manufacturing, or independent reviewers (Grade 2).
• Design review action items were assigned but not tracked to closure -- the review identified issues but the design proceeded without verifying resolution (Grade 3).
• Design reviews were not conducted at all planned stages -- one or more stages were skipped or combined without documented justification (Grade 2).

Review design review records for at least 2 stages. Verify cross-functional attendance and independent reviewer participation. Track at least 3 action items to closure.

• How do you ensure independent review at each design review stage?
• Can you show me a design review action item that was tracked to closure before the design proceeded?

• Verification plan or protocol defining verification activities, methods, acceptance criteria, and responsible personnel for each design input requirement
• Verification test records or reports showing test results against acceptance criteria -- verify traceability to specific design input requirements
• Evidence that verification was completed before design validation or design transfer -- verify sequence
• Records of any verification failures, the disposition of failures, and retesting after design modifications

• Design verification does not cover all design inputs -- a traceability gap exists where some requirements have no corresponding verification activity (Grade 3).
• Verification acceptance criteria are not defined before testing -- pass/fail criteria were determined after the test results were known, making the verification biased (Grade 3).
• Verification testing was performed using uncalibrated instruments or unvalidated test methods -- the verification results are not reliable (Grade 3).
• Verification failures were not documented -- design changes were made and retesting occurred, but the failed results and failure analysis were not recorded (Grade 2).

For the selected project, verify the verification plan covers all design inputs. Review verification test records for at least 5 requirements. Check calibration records for instruments used in verification. Verify any failures were documented with retesting.

• Can you show me the traceability from a design input through verification to the test result?
• Were any verification tests failed? If so, show me the failure record and the subsequent design change and retest.

• Validation plan or protocol defining validation activities, user scenarios, acceptance criteria, and the rationale for any simulated (versus actual) use conditions
• Evidence that validation was performed on production-representative units (or justified rationale for using non-production units)
• Validation test records or reports showing results against acceptance criteria -- verify testing addressed intended use, user needs, and applicable clinical requirements
• Software validation records where the device includes software -- verify software validation followed IEC 62304 and included testing of intended use scenarios

• Design validation was performed on prototype units that differ from production units in material, manufacturing process, or configuration -- validation results may not be representative of the marketed device (Grade 3).
• Validation did not include testing under the conditions of actual or simulated use -- bench testing was performed but no human factors or usability testing was conducted for a user-operated device (Grade 3).
• Clinical evaluation or clinical data supporting validation is insufficient -- the organization references published literature for a predicate device without establishing equivalence (Grade 3).
• Software validation was not performed or was limited to unit testing without system-level validation of intended use scenarios (Grade 3).

Review the validation plan and protocol. Verify units used were production-representative. Check that use conditions match intended use. Review at least 3 validation test results. Verify clinical evidence adequacy for at least one intended use claim.

• How did you determine the validation units were representative of production?
• Was any human factors or usability testing included in design validation? Why or why not?
• How does your clinical evidence support the intended use claims in your labeling?

• Design transfer plan or procedure defining what is transferred, who receives it, and how completeness is verified
• Design transfer records showing each design output (specifications, drawings, procedures, test methods) was formally transferred to production documentation
• Verification records confirming production can consistently produce the device to specification using transferred documentation -- process validation results, initial production runs, first article inspections
• Evidence that production personnel were trained on transferred documentation before production commenced

• Design transfer was not formally executed -- production uses engineering drawings and documents that were never formally controlled or approved as production documentation (Grade 3).
• Not all design outputs were transferred -- critical process parameters remain as informal knowledge within the design team and are not documented in production procedures (Grade 3).
• Production training was not completed before the start of production -- operators received on-the-job training after production had already begun (Grade 2).

For the selected project, compare at least 3 design output documents against corresponding production documents. Verify they match. Check training records for production personnel. Review first article inspection or initial production run results.

• How do you verify that all design outputs were successfully transferred to production?
• Are there any process parameters or assembly steps that production knows through experience but are not in the documented procedures?

• Design change procedure defining how changes are initiated, evaluated, approved, implemented, and documented
• Design change records for at least 2 changes -- verify each includes impact assessment, verification and validation (where needed), regulatory notification assessment per jurisdiction, and approval before implementation
• Evidence that the change impact assessment covers previously validated devices, marketed product, and labeling -- not just the component being changed
• Records showing regulatory notification assessment was performed for design changes -- did the change require a new 510(k), Health Canada Significant Change, ANVISA change notification, PMDA partial change, or TGA change notification?

• Design changes were implemented in production before completing verification and validation -- the change order shows implementation date before verification completion date (Grade 3).
• Impact assessment for design changes does not address regulatory notification requirements -- the organization changed a critical component without assessing whether a new regulatory submission was required in any jurisdiction (Grade 3).
• Design change verification is limited to testing the changed element without assessing system-level impact -- a material change was verified for biocompatibility but its effect on device performance, sterilization, and shelf life was not evaluated (Grade 3).
• Design change records are incomplete -- some changes were implemented through informal engineering updates without formal change documentation (Grade 3).

Review 2 design change records. Verify impact assessment, verification/validation records, regulatory notification assessment, and approval before implementation. Cross-reference with Chapter 2 regulatory submissions.

• Can you show me a recent design change and walk through the impact assessment?
• How do you determine whether a design change requires regulatory notification in each jurisdiction?
• Have you ever implemented a design change and later discovered it required a regulatory submission you did not make?

• Design history file (DHF) or technical file for the selected device -- verify it contains or references all required design control records (plan, inputs, outputs, reviews, verification, validation, transfer, changes)
• DHF index or table of contents showing the file is organized and complete -- cross-reference against the design plan to verify all planned deliverables are present
• Evidence that the DHF is maintained as a living document -- verify recent design changes are reflected in the file, not just the original design records
• Accessibility verification -- the file can be located, retrieved, and presented within a reasonable timeframe (not scattered across multiple unlinked locations)

• Design history file is incomplete -- design review records, verification test reports, or risk management file references are missing from the DHF (Grade 2).
• DHF has not been updated to reflect design changes made after initial market release -- the file documents the original design but not the current marketed configuration (Grade 2).
• DHF content is scattered across multiple locations (network drives, physical binders, different electronic systems) with no unified index or table of contents -- the complete design history cannot be efficiently reviewed (Grade 1).

Review the DHF for the selected device. Verify completeness against the design plan. Check that at least one post-market design change is reflected in the file. Verify the file can be retrieved and navigated within 10 minutes.

• Can you show me the DHF for your most recently designed device and walk through its organization?
• Is the DHF updated when design changes are made to a marketed device, or does it only document the original design?

• Manufacturing procedures or work instructions for at least 2 production processes -- verify they define process parameters, equipment settings, in-process controls, and acceptance criteria
• Production floor observation -- verify operators follow documented procedures, equipment is identified and maintained, and work instructions are accessible at the workstation
• Production records (batch records, device history records) for at least 2 recent production runs -- verify process parameters were recorded and compared against defined limits
• Equipment qualification records (IQ/OQ/PQ) for at least one critical production machine

• Work instructions at the production station are an outdated revision -- operators are following a superseded procedure while the current revision is available only in the document management system (Grade 3).
• Process parameters are not defined in the work instruction -- operators set equipment parameters based on experience rather than documented specifications (Grade 3).
• In-process monitoring or inspection is not performed at the stages required by the device history record template -- operators skip monitoring steps that are defined but not enforced (Grade 3).
• Production equipment is not identified with a calibration or maintenance status -- the organization cannot demonstrate the equipment was in a qualified state during production (Grade 2).

Observe at least 2 production operations. Compare observed practice against documented procedures. Review batch records for at least 2 recent production runs. Check calibration status of at least one critical production machine.

• Can you show me the work instruction for this operation and verify it matches what the operator is doing?
• How do you ensure operators are aware when a procedure revision is issued?

• List of validated processes (sterilization, welding, sealing, soldering, software, cleaning, surface treatment) with validation status and revalidation dates
• Validation protocol and report for at least one validated process -- verify IQ, OQ, PQ were performed with pre-defined acceptance criteria
• Evidence that process parameters established during validation are maintained in production -- compare validated parameters against current production settings
• Revalidation records -- verify revalidation was performed when required triggers occurred (equipment change, material change, process change, prolonged downtime)

• A special process is performed in production but has not been validated -- the organization relies on final product testing to verify the process output, which by definition cannot fully verify a special process (Grade 4).
• Process validation was performed but the validated parameters do not match current production parameters -- the process was changed after validation without revalidation (Grade 3).
• Revalidation triggers are not defined -- the organization has no criteria for when revalidation is required after changes to equipment, materials, or process parameters (Grade 2).
• Validation was performed on equipment that has since been replaced -- the new equipment was not qualified or validated (Grade 3).

Review the validated process list. Select one process and review the validation protocol, report, and current production parameters. Verify parameters match. Check for revalidation triggers and recent revalidation records.

• How do you identify which processes are special processes requiring validation?
• Can you show me the revalidation criteria for your most critical validated process?
• What was the last trigger that caused a process revalidation?

• Identification and traceability procedure defining how devices are identified at each production stage and how traceability is maintained from raw materials through distribution
• Traceability records for at least one finished device -- trace from finished device (lot/serial number) back to raw material lot numbers, production records, inspection records, and sterilization records
• Forward traceability records -- given a raw material lot number, can the organization identify all finished devices that contain it?
• UDI compliance records -- verify devices subject to UDI requirements have compliant identifiers per applicable jurisdiction timelines

• Traceability cannot be demonstrated from finished device to component lot numbers -- the batch record does not capture all component lot numbers used during production (Grade 3).
• Forward traceability is not possible -- given a component recall, the organization cannot identify which finished devices contain the affected component (Grade 4 -- direct patient safety impact).
• Implantable devices do not have unit-level traceability -- lot-level traceability is maintained but individual device serial numbers are not linked to specific component lots (Grade 3 for implantables).
• UDI requirements have not been implemented for devices subject to current UDI compliance deadlines (Grade 3).

Select one finished device lot. Trace backward to component lots, production records, and inspection records. Select one component lot and trace forward to all finished devices containing it. Verify UDI compliance for at least one device.

• If a component supplier notified you of a defective lot, how quickly could you identify all affected finished devices and their distribution?
• Show me the traceability chain for a specific finished device -- from finished product back to raw materials.

• Preservation procedure covering handling, storage, packaging, and shipping requirements -- including environmental controls (temperature, humidity, cleanliness) where applicable
• Storage area inspection records showing environmental monitoring data, expiration date management, and stock rotation (FIFO or equivalent)
• Packaging validation records for sterile barrier systems or other critical packaging -- verify validation covers seal integrity, transit simulation, and shelf life
• Shipping records showing controlled conditions are maintained during transit where required (cold chain, shock indicators, humidity indicators)

• Temperature-sensitive products are stored without environmental monitoring -- no temperature logs or alarm systems for controlled storage areas (Grade 3).
• Sterile barrier system packaging has not been validated for the actual distribution conditions -- shelf life and transit studies do not reflect real-world shipping conditions (Grade 3).
• Expired raw materials or finished goods are found in storage without proper segregation or disposition -- the organization does not have an effective expiration date management process (Grade 2).
• No evidence of first-expired-first-out stock rotation -- older product remains in storage while newer product is shipped (Grade 1).

Walk the storage area. Check environmental monitoring records. Verify expiration date management. Review packaging validation records for at least one product. Check 3 items in storage for proper identification and condition.

• How do you manage expiration dates for raw materials and finished goods in storage?
• Has your packaging been validated for the most extreme shipping conditions in your distribution network?

• Calibration procedure defining equipment inventory, calibration intervals, methods, acceptance criteria, and actions when equipment is found out of calibration
• Calibration records for at least 3 pieces of measuring equipment -- verify calibration is current, traceable to national or international standards, and within acceptance criteria
• Evidence that calibration status is identifiable on the equipment -- labels, tags, or electronic system showing calibration date, due date, and status
• Records showing impact assessment when equipment was found out of calibration -- verification of the validity of previous measurements and product disposition decisions

• Calibration for critical measuring equipment has lapsed -- equipment was used for product acceptance beyond the calibration due date without recalibration (Grade 3).
• Equipment was found out of calibration but no impact assessment was performed -- the organization recalibrated the equipment without evaluating whether product accepted using the out-of-calibration equipment conforms to specifications (Grade 3).
• Calibration intervals are not risk-based -- all equipment is calibrated annually regardless of criticality, historical drift data, or frequency of use (Grade 1).
• Calibration is not traceable to national or international standards -- the organization calibrates equipment using in-house references that are not themselves traceable (Grade 2).

Check calibration status for at least 3 pieces of equipment observed in use. Review calibration records for currency and traceability. Verify at least one out-of-calibration impact assessment record.

• Can you show me a case where equipment was found out of calibration and describe what impact assessment was performed?
• How do you determine calibration intervals for your measuring equipment?

• Final inspection and testing procedure defining required tests, acceptance criteria, sampling plans, and release authority
• Final inspection records for at least 2 recent production lots -- verify all required tests were performed, results meet acceptance criteria, and the record is signed by authorized personnel
• Device history record (DHR) for at least one production lot -- verify it contains all required elements: production records, inspection records, component traceability, labeling records, and release authorization
• Evidence that product is not released until all required acceptance activities are complete -- verify the release process prevents shipment of uninspected product

• Product was released before all final acceptance activities were complete -- the DHR shows the release date before the date of the final inspection (Grade 4 -- nonconforming product may have been distributed).
• Final inspection acceptance criteria do not match the design output specification -- the inspection procedure uses different (often wider) tolerances than the approved design specification (Grade 3).
• DHR is incomplete at the time of product release -- required elements (sterilization records, labeling verification, calibration status) are missing or added after release (Grade 3).
• Identity of the person performing final acceptance is not recorded -- inspection records show pass/fail results but not who performed the inspection (Grade 2).

Review 2 DHRs for completeness. Verify final inspection records, release authorization, and that release did not occur before inspection completion. Cross-reference acceptance criteria against design specifications for at least 3 parameters.

• Can you show me a complete DHR and walk through each element?
• How do you prevent product from being shipped before the DHR is complete and released?

• Installation procedure defining installation requirements, acceptance criteria, and documentation requirements (if applicable)
• Installation records for at least 2 installations -- verify acceptance criteria were met and records are complete
• Servicing procedure defining service activities, parts management, training requirements, and record-keeping
• Service records showing service activities performed, parts used, and post-service verification

• Installation records do not demonstrate that acceptance activities were performed after installation -- the device was installed but not functionally verified in its installed environment (Grade 2).
• Service records are incomplete -- service activities are tracked in a CRM system but do not capture the technical details needed for trend analysis and post-market surveillance (Grade 1).
• Service personnel training records are not maintained -- the organization cannot demonstrate that service technicians were trained on the devices they service (Grade 2).

If applicable, review 2 installation records and 2 service records. Verify completeness and linkage to complaint/adverse event processes. If not applicable, verify the exclusion justification.

• How do service reports feed into your complaint handling and post-market surveillance processes?
• Are third-party service organizations subject to the same documentation requirements as internal service teams?

• Sterilization validation records per applicable standard -- ISO 11135 (EtO), ISO 17665 (steam), ISO 11137 (radiation), or equivalent
• Routine sterilization monitoring records -- biological indicators, chemical indicators, physical parameters, and parametric release data where used
• Sterilization revalidation records -- verify revalidation frequency and triggers are defined and current
• Sterility assurance level (SAL) documentation -- verify SAL of 10^-6 is demonstrated for terminally sterilized devices
• If sterilization is outsourced, review the quality agreement and verification records per Task 1.5 (outsourced process controls)

• Sterilization process is not validated per the applicable standard -- the organization uses sterilization but has not performed a formal validation per ISO 11135, ISO 17665, or ISO 11137 (Grade 4).
• Sterilization monitoring parameters show excursions from validated ranges but no investigation or corrective action was taken (Grade 4).
• Revalidation has not been performed within the defined interval or after process changes (Grade 3).
• Outsourced sterilization provider changed a key process parameter without notifying the manufacturer -- no quality agreement clause requires such notification (Grade 3).

Review sterilization validation records for at least one method. Check routine monitoring records for the last 3 months. Verify revalidation currency. If outsourced, review the quality agreement.

• Can you show me the current sterilization validation summary report and the most recent routine monitoring records?
• When was sterilization last revalidated, and what triggered the revalidation?

• Purchasing procedure defining the purchasing process, supplier qualification requirements, and purchasing document requirements
• Evidence that purchasing controls are risk-based -- critical components, raw materials, and outsourced processes receive more stringent controls than non-critical supplies
• Approved supplier list (ASL) or equivalent showing all suppliers of critical components and services with their qualification status
• Purchasing documents (purchase orders) for at least 2 critical components -- verify they include complete specifications, quality requirements, and reference to applicable standards

• Purchasing controls are uniform across all suppliers regardless of risk -- the same level of evaluation and monitoring is applied to a critical component supplier and an office supply vendor (Grade 1).
• Purchase orders for critical components do not include quality requirements, specifications, or reference to applicable standards -- the organization relies on verbal agreements or catalog descriptions (Grade 3).
• Components are purchased from suppliers not on the approved supplier list -- unapproved suppliers are used for convenience without the required evaluation (Grade 3).

Review the purchasing procedure. Check the ASL for completeness. Review purchase orders for at least 2 critical components. Verify risk-based purchasing controls are implemented.

• How do you classify suppliers and purchased products by risk?
• Can you show me a purchase order for a critical component and verify it includes complete quality requirements?

• Supplier evaluation procedure defining evaluation criteria, methods (questionnaire, audit, performance review, certification review), and approval authority
• Supplier evaluation records for at least 3 suppliers -- including at least one critical component supplier and one service provider -- verify evaluations are documented with objective criteria and approval decisions
• Evidence that evaluation criteria include quality system capability, regulatory compliance, and ability to meet specification requirements -- not just price and delivery
• Records showing re-evaluation or ongoing assessment of existing suppliers -- verify supplier evaluations are not one-time events

• Supplier evaluations are based solely on ISO certificate review without verifying the certificate scope covers the products or services being purchased -- the supplier's ISO certification may not cover the relevant manufacturing processes (Grade 2).
• Supplier evaluation records consist only of a self-assessment questionnaire returned by the supplier without independent verification -- the organization accepts supplier self-reported capabilities at face value (Grade 1).
• Critical component suppliers have not been re-evaluated since initial approval -- some suppliers have been on the ASL for years without any reassessment of their continued capability (Grade 2).
• No supplier evaluation was performed -- a new supplier was added to the ASL based on a single successful purchase order without formal evaluation (Grade 3).

Review evaluation records for at least 3 suppliers with varying criticality levels. Verify evaluation criteria are objective and documented. Check at least one re-evaluation record for a long-standing supplier.

• How do you verify that a supplier's ISO certificate covers the specific products or services you purchase from them?
• How often do you re-evaluate existing suppliers, and what triggers a re-evaluation outside the scheduled cycle?

• Supplier monitoring procedure or practice defining metrics, data collection, review frequency, and actions for underperformance
• Supplier scorecard or performance reports for at least 2 critical suppliers -- verify metrics include quality (reject rate, nonconformance rate), delivery, and responsiveness
• Evidence that supplier performance data is reviewed periodically and discussed in management review or supplier review meetings
• Records showing action taken when a supplier's performance deteriorated -- corrective action requests, supplier audits, conditional approval, or disqualification

• No ongoing supplier performance monitoring exists -- the organization evaluates suppliers at initial qualification but does not track their performance over time (Grade 2).
• Supplier performance metrics are collected but not analyzed for trends -- individual reject events are addressed but deteriorating performance patterns are not identified (Grade 1).
• A supplier with consistently poor quality performance remains on the ASL without corrective action, conditional approval, or disqualification decision -- the organization continues to purchase from underperforming suppliers (Grade 2).

Review supplier performance data for at least 2 critical suppliers over the past 12 months. Verify action was taken for any performance issues. Check that supplier performance is reported in management review.

• Which supplier currently has the highest reject rate, and what action have you taken?
• How does supplier performance data feed into your supplier re-evaluation and CAPA processes?

• Incoming inspection procedure defining inspection requirements, acceptance criteria, sampling plans, and disposition authorities for different product categories
• Incoming inspection records for at least 3 received lots of critical components -- verify acceptance criteria, test results, disposition, and inspector identity are documented
• Evidence that incoming inspection acceptance criteria match the purchase specification -- verify consistency between what was ordered and what was inspected against
• Records showing disposition of received material that failed incoming inspection -- reject, return, concession decision with rationale

• Incoming inspection acceptance criteria do not match the purchase specification or design specification -- the inspection checks different parameters or uses different tolerances than what was specified (Grade 3).
• No incoming inspection is performed for critical components -- the organization relies entirely on the supplier's certificate of conformance without any independent verification (Grade 3).
• Sampling plans for incoming inspection are not based on a recognized statistical method (ANSI/ASQ Z1.4, ISO 2859) and are not justified by risk assessment (Grade 1).
• Material that failed incoming inspection was accepted by concession without documented rationale or appropriate approval authority (Grade 3).

Review incoming inspection records for at least 3 critical component lots. Verify acceptance criteria match specifications. Check at least one failure/rejection record. Verify sampling plan basis.

• For which components do you accept product based solely on the supplier's certificate of conformance?
• Can you show me an incoming inspection failure and the resulting disposition?

• Quality agreements or supply agreements for critical suppliers that include change notification clauses -- verify the clause requires advance notification of changes to materials, processes, specifications, or quality system status
• Records of supplier change notifications received and the organization's impact assessment for each
• Evidence that supplier changes triggered appropriate actions -- incoming inspection adjustment, revalidation, regulatory assessment, design change evaluation
• Records showing the organization verifies supplier change notification compliance -- periodic checks that suppliers are honoring notification commitments

• Quality agreements with critical suppliers do not include change notification clauses -- the organization has no contractual mechanism to require advance notice of supplier changes (Grade 2).
• Supplier change notifications were received but no impact assessment was performed -- the organization acknowledged receipt without evaluating the effect on the medical device (Grade 3).
• A supplier changed a material or process without notification and the change was discovered during incoming inspection or product failure investigation -- the quality agreement did not require notification or was not enforced (Grade 3).

Review quality agreements for 2 critical suppliers for change notification clauses. Check at least one supplier change notification and the resulting impact assessment. If no notifications have been received, assess whether this is reasonable given the supplier base size and timeframe.

• Can you show me a recent supplier change notification and the impact assessment you performed?
• How do you verify that suppliers are honoring their change notification commitments?

• Cross-jurisdictional regulatory requirements gap analysis document -- a matrix or comparison showing where requirements of FDA, Health Canada, ANVISA, PMDA, and TGA differ from each other and from ISO 13485
• Evidence that the gap analysis covers all major QMS process areas -- adverse event reporting, complaint handling, labeling, design changes, marketing authorization, record retention, and post-market surveillance
• Records showing the gap analysis is maintained -- updated when new regulatory requirements are published or when the organization enters new jurisdictions
• Mapping of each identified gap to the QMS procedure or process that addresses it

• No systematic cross-jurisdictional gap analysis has been performed -- the organization assumes ISO 13485 compliance satisfies all jurisdictions without verifying jurisdiction-specific requirements (Grade 3).
• Gap analysis was performed at MDSAP initial certification but has not been updated to reflect regulatory changes in any jurisdiction (Grade 2).
• Gap analysis identifies differences but does not map each difference to a specific QMS procedure or process -- gaps are identified but not demonstrably closed (Grade 2).

Review the gap analysis document. Verify it covers all 5 jurisdictions and all major QMS process areas. Select 3 identified gaps and verify the QMS procedure that addresses each. Check the gap analysis revision history for currency.

• When was this gap analysis last updated, and what triggered the update?
• Who performed the gap analysis, and what jurisdiction-specific expertise did they bring?
• Can you show me a specific requirement that differs between jurisdictions and how your QMS addresses both?

• Adverse event reporting procedure with a jurisdiction-specific section or appendix for each MDSAP jurisdiction -- verify definitions of reportable events, reporting timelines, report format requirements, and follow-up obligations are specified per jurisdiction
• Comparison of reporting timelines by jurisdiction and event type showing the organization has identified the earliest deadline for multi-jurisdiction events
• Records of adverse event reports submitted in the past 24 months -- verify each reportable event was reported to ALL applicable jurisdictions, not just the primary market
• Records of events determined not reportable in a specific jurisdiction with documented rationale addressing that jurisdiction's specific criteria

• Adverse event was reported to FDA but not to Health Canada, ANVISA, PMDA, or TGA -- the organization applied only one jurisdiction's reporting criteria to a multi-jurisdiction event (Grade 4).
• Reporting procedure uses generic criteria that do not account for jurisdiction-specific differences in reportable event definitions -- Health Canada's 'incident' definition is broader than FDA's 'death/serious injury/malfunction' definition, but the procedure only uses the FDA definition (Grade 3).
• Reports to secondary jurisdictions (ANVISA, PMDA, TGA) are consistently submitted later than reports to FDA or Health Canada -- secondary jurisdictions are treated as lower priority despite having their own timeline requirements (Grade 3).

Review 3 adverse event reports. For each, verify all applicable jurisdictions received timely reports. Review 2 non-reportable determinations and verify rationale addresses each jurisdiction's criteria independently.

• Show me an event that was reportable in all 5 jurisdictions. Were all 5 reports submitted within their respective timelines?
• Have you ever had an event that was reportable in one jurisdiction but not another? Explain the difference.

• Record retention schedule showing retention periods per record type with jurisdiction-specific requirements identified -- FDA (expected lifetime + 2 years for certain records), Health Canada (device life + 1 year), ANVISA, PMDA, and TGA-specific periods
• Evidence that the organization applies the most stringent retention period -- verify the schedule selects the longest applicable period for each record type
• Records management system or archive demonstrating records are retrievable for the defined retention periods
• Evidence that electronic records are backed up and accessible for the full retention period -- data migration records for system changes

• Record retention schedule only addresses FDA requirements and does not identify or apply longer retention periods required by other jurisdictions (Grade 2).
• Records were destroyed before the retention period expired because the organization applied a shorter jurisdiction's retention period instead of the longest applicable period (Grade 3).
• Electronic records from a previous quality system or document management system are no longer accessible after system migration -- records within the retention period cannot be retrieved (Grade 3).

Review the retention schedule for completeness across jurisdictions. Verify at least 2 record types apply the most stringent period. Request retrieval of one record near the end of its retention period to verify accessibility.

• How do you determine the 'expected lifetime' of your devices for record retention purposes?
• When you last migrated your quality system software, how did you ensure all records remained accessible?

• Centralized tracking system or spreadsheet showing all marketing authorizations, establishment registrations, and device listings per jurisdiction with status, expiration dates, and renewal due dates
• Evidence of current status for each entry -- authorization letters, registration confirmations, or database screenshots from each jurisdiction's regulatory system
• Records of timely renewals or re-registrations -- verify no gaps in authorization or registration status
• Process for adding new jurisdictions or removing discontinued devices from tracking

• No centralized tracking exists -- marketing authorizations and registrations are managed by different individuals for different jurisdictions with no single view of compliance status (Grade 2).
• A marketing authorization or establishment registration has expired without the organization being aware -- the tracking system did not generate alerts before expiration (Grade 4).
• Devices are marketed in a jurisdiction where the marketing authorization has lapsed or was never obtained -- particularly common in secondary markets managed by distributors (Grade 4).

Review the centralized tracking system. Verify status is current for at least 3 authorizations/registrations across different jurisdictions. Cross-reference with distribution records to verify no devices are shipped to unregistered markets.

• Can you show me a single view of all your marketing authorizations across all jurisdictions with their current status?
• How do you verify that distributors in secondary markets are maintaining the required local registrations?

• Procedure or training materials showing the organization understands the MDSAP nonconformity grading system per GHTF/SG3/N19:2012
• Records of previous MDSAP audit nonconformities showing how grades were assigned, corrective actions planned, and evidence submitted within the required timeframes
• Evidence that the organization tracks remediation deadlines -- 15 days for corrective action plan, 30 days for evidence of implementation
• Training records showing quality and management personnel understand the 5-Day Notice process and its regulatory implications

• Organization does not understand the MDSAP grading system and cannot explain the difference between Grade 3 and Grade 4 nonconformities or the 5-Day Notice implications (Grade 1 -- informational).
• Previous MDSAP audit corrective actions were not completed within the required timeframes -- corrective action plans were submitted late or evidence of implementation was not provided within 30 days (Grade 2).
• No process exists for managing MDSAP audit nonconformity remediation -- the organization treats MDSAP NCs the same as internal audit findings without tracking the specific MDSAP remediation timelines (Grade 1).

Review previous MDSAP audit reports. Verify NC remediation timelines were met. Check that the organization has documented the grading system and 5-Day Notice process in its quality procedures or training materials.

• What is your process for responding to an MDSAP audit nonconformity, and how do you ensure you meet the 15-day and 30-day deadlines?
• Have you ever received a Grade 4 or 5 nonconformity? If so, describe the 5-Day Notice process and your response.

• Organizational chart or role assignments showing regulatory responsibility assignments per jurisdiction
• Qualifications and training records for regulatory affairs personnel covering jurisdiction-specific requirements -- verify personnel are trained on the regulatory frameworks of the jurisdictions they are responsible for
• Evidence of continuing education or regulatory intelligence activities -- conference attendance, regulatory association memberships, training on regulatory changes
• Records showing jurisdiction-specific regulatory expertise was applied in decision-making -- regulatory submission reviews, reportability determinations, change notification assessments

• All regulatory activities for all 5 jurisdictions are managed by a single person with deep expertise in only one jurisdiction -- the organization lacks backup capability and jurisdiction-specific depth for 4 of 5 jurisdictions (Grade 2).
• Regulatory personnel have not received training on recent regulatory changes in jurisdictions they manage -- they are applying outdated requirements (Grade 2).
• No regulatory expertise exists in-house for ANVISA, PMDA, or TGA -- the organization relies entirely on external consultants with no internal understanding of those jurisdictions' requirements (Grade 1).

Verify regulatory responsibility assignments for each jurisdiction. Review qualifications and training records for at least 2 regulatory personnel. Check continuing education or regulatory update records from the past 12 months.

• Who is responsible for regulatory compliance in each MDSAP jurisdiction?
• How do you ensure your regulatory staff stays current on changes in all five jurisdictions?

• Labeling compliance matrix showing requirements per jurisdiction -- language requirements (bilingual for Canada, Portuguese for Brazil, Japanese for Japan), UDI requirements, regulatory symbols, and content requirements
• Verification records showing labels and IFU were reviewed against each jurisdiction's requirements before market release
• Sample labels for at least one device -- verify compliance with language, UDI, and content requirements for each applicable jurisdiction
• Translation verification records for multi-language labeling -- back-translation or native speaker review

• Labels for the Canadian market do not include bilingual (English/French) text as required by Health Canada (Grade 3).
• Instructions for Use are not available in the local language for all jurisdictions where the device is marketed (Grade 2).
• UDI compliance has not been achieved for devices subject to current implementation deadlines in one or more jurisdictions (Grade 3).
• Regulatory symbols used on labels do not meet the specific requirements of all jurisdictions -- some jurisdictions require text in addition to or instead of certain symbols (Grade 1).

Select one device sold in at least 3 jurisdictions. Verify the label and IFU meet each jurisdiction's requirements. Check UDI compliance status. Verify translation quality records.

• How do you ensure labeling compliance is verified for each jurisdiction before market release?
• What is your process for managing labeling changes when a jurisdiction updates its requirements?

• Management review agenda and minutes showing jurisdiction-specific compliance was addressed -- not just overall QMS performance, but performance per jurisdiction (regulatory submissions, reporting compliance, marketing authorization status, labeling compliance)
• Jurisdiction-specific compliance metrics presented at management review -- adverse event reporting timeliness per jurisdiction, marketing authorization renewal status per jurisdiction, and regulatory query response timeliness
• Records of management decisions addressing cross-jurisdictional compliance gaps -- resource allocation for under-served jurisdictions, process improvements for multi-jurisdiction requirements
• Evidence that management review output includes actions specific to cross-jurisdictional compliance improvement

• Management review does not address jurisdiction-specific compliance -- QMS performance is reviewed at a global level without distinguishing between regulatory performance in each MDSAP jurisdiction (Grade 2).
• Compliance metrics are reported for FDA only -- no data is presented on adverse event reporting timeliness, marketing authorization status, or regulatory correspondence for Health Canada, ANVISA, PMDA, or TGA (Grade 2).
• Cross-jurisdictional compliance gaps were identified but not escalated to management or addressed in management review output actions (Grade 1).

Review the last management review minutes for jurisdiction-specific content. Verify compliance metrics were presented per jurisdiction. Check that at least one management review output action addresses cross-jurisdictional compliance.

• Can you show me the jurisdiction-specific compliance data that was presented at the last management review?
• Has management ever made a resource allocation decision specifically to address a cross-jurisdictional compliance gap?