# ISO 13485 MDR and MDSAP Audit Checklist > Source: https://netray.co/tools/iso-13485-mdr-mdsap-audit-add-on-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Add-on audit questions for EU MDR and the five MDSAP jurisdictions, to use alongside your ISO 13485 internal audit checklist. ## Category quality ## Industry Medical Devices ## Audience - Medical device quality managers - Internal auditors - Regulatory affairs ## Tool **Kind:** checklist **Scoring Note:** Use this alongside a full ISO 13485:2016 clause checklist. ISO 13485 alone does not cover jurisdiction-specific law. Treat each unticked critical item as a potential nonconformity and record it in your audit report with the evidence reviewed. Confirm current regulatory text, as rules and guidance change. **Groups:** #### EU MDR (Regulation 2017/745) additions **Items:** **Text:** A Person Responsible for Regulatory Compliance (PRRC) is named with documented qualifications and authority **Critical:** true Technical documentation follows the structure of Annexes II and III and is kept current **Text:** General Safety and Performance Requirements (Annex I) are mapped to evidence for each device **Critical:** true **Text:** Clinical evaluation is planned, documented and updated with post-market clinical follow-up data **Critical:** true UDI assignment, labeling and database registration processes are in place and followed **Text:** A post-market surveillance plan exists, with periodic safety update reports where required **Critical:** true **Text:** Vigilance procedure covers serious incident and field safety corrective action reporting timelines **Critical:** true Economic operator roles (authorized representative, importer, distributor) are defined with written agreements Strategy for regulatory compliance is documented as required for manufacturers Liability coverage for the risk class and device is in place where required #### MDSAP common requirements **Items:** **Text:** Regulatory requirements of each participating jurisdiction you sell into are identified and controlled in the QMS **Critical:** true Management review includes regulatory changes, advisory notices and complaint trends **Text:** Complaint handling includes decision logic for reporting to each regulator **Critical:** true Corrective and preventive action covers data from audits, complaints, service and monitoring Supplier controls include criteria for evaluation and re-evaluation with purchase information **Text:** Design changes are verified, validated and reviewed, with regulatory impact assessed **Critical:** true Sterilization and software validation are covered where relevant **Text:** Advisory notice and recall procedures are tested and documented **Critical:** true #### Country-specific items (US, Canada, Brazil, Japan, Australia) **Items:** **Text:** United States: FDA requirements applicable to your devices are mapped in the QMS, including the Quality Management System Regulation that incorporates ISO 13485 **Critical:** true United States: medical device reporting and corrections and removals procedures are in place **Text:** Canada: Medical Device License numbers and the reporting rules under the Medical Devices Regulations are controlled **Critical:** true Brazil: ANVISA registration and good manufacturing practice requirements are identified Japan: marketing authorization holder arrangements and local ordinance requirements are identified Australia: Therapeutic Goods Administration inclusion and sponsor responsibilities are identified #### Audit report completeness **Items:** Audit scope, criteria, dates and auditors are recorded Each finding cites the clause or regulation and the objective evidence **Text:** Findings are classified and linked to CAPA with due dates **Critical:** true Auditor independence from the audited area is documented Results feed management review and the next audit plan ## Content **Intro:** ISO 13485 certifies your quality system, but EU MDR and MDSAP add jurisdiction-specific duties that a plain clause checklist misses. This add-on checklist covers those extra items so your internal audit report reflects the real regulatory picture. **Sections:** #### How to use the add-on checklist **Body:** Run your normal ISO 13485 internal audit first. Then use this list for each market you serve. Skip groups that do not apply, tick items you can support with records, and note findings for the rest. Export to PDF or Excel and attach it to the audit report. If you sell in several jurisdictions, the MDSAP group is a good way to test that regulatory requirements are really built into your procedures. #### Why MDR and MDSAP need their own questions **Body:** ISO 13485:2016 requires you to identify and comply with applicable regulatory requirements, but it does not list them. EU MDR adds explicit duties such as a PRRC, UDI, clinical evaluation and structured post-market surveillance. MDSAP is a single audit program recognized by regulators in Australia, Brazil, Canada, Japan and the United States, using ISO 13485 plus each country's requirements. An auditor will test these directly. **Bullets:** - MDR is law in the EU, assessed by a notified body - MDSAP is an audit program run by recognized auditing organizations - Both rely on a working QMS, but test regulatory-specific outputs #### Writing the audit report **Body:** A good ISO 13485 audit report names scope, criteria and dates, then lists findings with clause or regulation references and objective evidence. Classify each finding, link it to a CAPA and set a due date. Record auditor independence, which clause 8.2.4 expects. State positive observations too, since they show coverage. Management review should receive the summary and the trend against previous audits. #### Common mistakes **Body:** Frequent gaps are in the regulatory interfaces rather than the core QMS. **Bullets:** - No procedure for deciding which complaints are reportable in each country - Technical documentation not updated after design change - PRRC named but with no documented authority - Audit reports with no objective evidence - Using a US-only mindset for a global MDSAP scope **Cta:** If complaints, CAPA and supplier records sit in your ERP and quality systems, we can add a private AI layer on your own servers that helps auditors find evidence faster. **Faq:** #### What is MDSAP and who needs it? **Answer:** The Medical Device Single Audit Program lets one audit satisfy regulators in Australia, Brazil, Canada, Japan and the United States. Canada requires it for licensing. Other markets accept it in different ways, so check whether it helps your approvals. #### Does ISO 13485 certification meet EU MDR? **Answer:** Not by itself. ISO 13485 is a strong base and notified bodies expect it, but MDR adds requirements such as clinical evaluation, UDI, PRRC and vigilance timelines that must be shown separately in technical documentation and procedures. #### Can I use this as an ISO 13485 audit report? **Answer:** It is an add-on checklist, and the last group covers report completeness. Pair it with the full ISO 13485 internal audit checklist, record findings with evidence, and export both. The export works as a base for your formal audit report. #### Is it available in Excel? **Answer:** Yes. Use the export buttons to save the checklist as Excel, PDF or Word. Your ticks and the critical flags are retained, so you can track findings and share the list with your notified body or consultant. ## Search terms iso 13485 mdr checklist, iso 13485 mdsap checklist, iso 13485 compliance checklist, iso 13485 audit checklist pdf, iso 13485 audit checklist excel, iso 13485 audit report, audit report iso 13485, internal audit checklist template iso 13485 --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json