ISO 13485 MDR and MDSAP Audit Checklist
ISO 13485 certifies your quality system, but EU MDR and MDSAP add jurisdiction-specific duties that a plain clause checklist misses. This add-on checklist covers those extra items so your internal audit report reflects the real regulatory picture.
0 of 29 items complete
12 critical items still open - these are the highest-risk gaps.
EU MDR (Regulation 2017/745) additions
MDSAP common requirements
Country-specific items (US, Canada, Brazil, Japan, Australia)
Audit report completeness
Use this alongside a full ISO 13485:2016 clause checklist. ISO 13485 alone does not cover jurisdiction-specific law. Treat each unticked critical item as a potential nonconformity and record it in your audit report with the evidence reviewed. Confirm current regulatory text, as rules and guidance change.
Find audit evidence faster
Optional: learn how a private AI layer can search complaint, CAPA and supplier records on your own infrastructure.
Optional. The tool and every export work without this. No spam.
How to use the add-on checklist
Run your normal ISO 13485 internal audit first. Then use this list for each market you serve. Skip groups that do not apply, tick items you can support with records, and note findings for the rest. Export to PDF or Excel and attach it to the audit report. If you sell in several jurisdictions, the MDSAP group is a good way to test that regulatory requirements are really built into your procedures.
Why MDR and MDSAP need their own questions
ISO 13485:2016 requires you to identify and comply with applicable regulatory requirements, but it does not list them. EU MDR adds explicit duties such as a PRRC, UDI, clinical evaluation and structured post-market surveillance. MDSAP is a single audit program recognized by regulators in Australia, Brazil, Canada, Japan and the United States, using ISO 13485 plus each country's requirements. An auditor will test these directly.
- MDR is law in the EU, assessed by a notified body
- MDSAP is an audit program run by recognized auditing organizations
- Both rely on a working QMS, but test regulatory-specific outputs
Writing the audit report
A good ISO 13485 audit report names scope, criteria and dates, then lists findings with clause or regulation references and objective evidence. Classify each finding, link it to a CAPA and set a due date. Record auditor independence, which clause 8.2.4 expects. State positive observations too, since they show coverage. Management review should receive the summary and the trend against previous audits.
Common mistakes
Frequent gaps are in the regulatory interfaces rather than the core QMS.
- No procedure for deciding which complaints are reportable in each country
- Technical documentation not updated after design change
- PRRC named but with no documented authority
- Audit reports with no objective evidence
- Using a US-only mindset for a global MDSAP scope
Frequently Asked Questions
What is MDSAP and who needs it?
The Medical Device Single Audit Program lets one audit satisfy regulators in Australia, Brazil, Canada, Japan and the United States. Canada requires it for licensing. Other markets accept it in different ways, so check whether it helps your approvals.
Does ISO 13485 certification meet EU MDR?
Not by itself. ISO 13485 is a strong base and notified bodies expect it, but MDR adds requirements such as clinical evaluation, UDI, PRRC and vigilance timelines that must be shown separately in technical documentation and procedures.
Can I use this as an ISO 13485 audit report?
It is an add-on checklist, and the last group covers report completeness. Pair it with the full ISO 13485 internal audit checklist, record findings with evidence, and export both. The export works as a base for your formal audit report.
Is it available in Excel?
Yes. Use the export buttons to save the checklist as Excel, PDF or Word. Your ticks and the critical flags are retained, so you can track findings and share the list with your notified body or consultant.
If complaints, CAPA and supplier records sit in your ERP and quality systems, we can add a private AI layer on your own servers that helps auditors find evidence faster.
Related Tools
ISO 13485 Internal Audit Checklist
A clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
Quality & InspectionISO 13485 Supplier Audit Checklist
A clause-based checklist for auditing component, material and service suppliers to a medical device manufacturer, covering QMS, process control, traceability and change control.
Compliance & ContractsFDA 21 CFR 820 to ISO 13485 Clause Crosswalk
Map each 21 CFR 820 quality system topic to the corresponding ISO 13485 clause to speed up QMSR gap assessments and procedure rewrites.
Compliance & ContractsNonconformance and Corrective Action Standards Clause Map
A lookup of clause numbers that cover nonconforming outputs, corrective action and related controls in ISO 9001, AS9100D, IATF 16949 and ISO 13485.
Supply Chain & InventoryISO 13485 Approved Supplier List Risk Ranking and Audit Plan Worksheet
Scores suppliers with a risk priority number, sets audit intervals, and totals audits per year and audit cost so your supplier control is proportional to risk.
More Quality & Inspection tools
See all- CAPA Corrective and Preventive Action Form Template
- Device History Record (DHR) Template
- Process Validation IQ OQ PQ Template
- Medical Device Complaint Handling Form Template
- ISO 14971 Risk Management Worksheet
- Sterilization Load Record Template
- Medical Device Design Verification Protocol Template
- Medical Device Supplier Evaluation Scoring Worksheet
- Medical Device Cleanroom Environmental Monitoring Log
Keep exploring
Free tools
- ISO 13485 Internal Audit ChecklistA clause-organized checklist for auditing a medical device quality management system against ISO 13485:2016, with critical items flagged.
- ISO 13485 Supplier Audit ChecklistA clause-based checklist for auditing component, material and service suppliers to a medical device manufacturer, covering QMS, process control, traceability and change control.
- ISO 13485 Internal Audit Report TemplateA fillable ISO 13485 internal audit report with scope, findings by clause, CAPA references, conclusions and a short audit checklist. Includes realistic sample content.
Guides
- ISO 13485 ERP Requirements for Medical Device Contract ManufacturersWhat ISO 13485 and FDA QMSR actually require of an ERP at a medical device contract manufacturer: records, traceability, change control and software validation.
- ERP for Medical Device Manufacturing: Compliance, Traceability, and ValidationERP for medical device manufacturing: FDA 21 CFR Part 820, ISO 13485, UDI and DHR traceability requirements, plus vendor fit and implementation guidance.
- ISO 13485 Medical Injection Molding Validation: IQ, OQ and PQHow medical injection molders structure IQ, OQ, PQ validation under ISO 13485: equipment, process window, capability runs, lot traceability and ERP records.
AI on your ERP
- AI on Infor SyteLine for Medical Device Manufacturers: Genealogy, DHR and Audit EvidencePrivate AI on Infor SyteLine for medical device makers: lot and serial genealogy, DHR assembly, UDI and QMSR evidence, with human approval on every write.
- AI on Your ERP for Medical Device Manufacturing Under QMSR and ISO 13485Private AI on your ERP for medical device makers: DHR assembly, UDI, complaints, CAPA and supplier controls under FDA QMSR and ISO 13485, kept on your own infrastructure.
Manufacturing hubs
- Medical Device Manufacturing in Minneapolis-St. PaulMedical device manufacturing in Minneapolis-St. Paul: ecosystem, FDA and ISO 13485 requirements, and ERP, quoting and document problems contract makers face.
- MDMA, AdvaMed and medical device manufacturing: regulation, ERP and AI realitiesMDMA and AdvaMed medical device manufacturing: FDA QMSR, ISO 13485, UDI and EU MDR, plus the ERP, traceability and private AI issues device makers face.