Multi-market medical-device export: one audit with MDSAP

Five regulators, one audit instead of five

Picture a Turkish manufacturer of infusion pumps that lands three serious export wins in the same quarter: a distributor in Canada, a hospital group in Brazil, and a tender in Australia. The orders are the easy part. A few months later the audit notices begin to arrive. Health Canada wants proof of a certified quality system. ANVISA expects a manufacturing inspection. The Therapeutic Goods Administration asks for conformity-assessment evidence. Each regulator brings its own checklist, its own auditors, and its own calendar, and for one production site that can mean three or four separate audits inside a single year, every one of them pulling the quality team off the line for days at a time.

The Medical Device Single Audit Program, known as MDSAP, was created to collapse exactly that burden. One audit, carried out by one recognised auditing organisation, produces a report that five regulators will accept. It does not soften what any of those markets expects of your quality system. It changes how many times, and to how many different auditors, you have to prove it.

The five markets a single audit consolidates

MDSAP is built around five participating regulatory authorities: Health Canada, the United States Food and Drug Administration, Australia's Therapeutic Goods Administration, Brazil's ANVISA, and Japan's Ministry of Health, Labour and Welfare alongside the PMDA. The audit is run against ISO 13485 as the core quality-management standard, with the particular regulatory requirements of each of those five countries layered on top. What comes out is a single certificate and a single audit report that are recognised across all five jurisdictions at once.

The point that matters for an exporter is that MDSAP does not treat those five markets as equals. In one of them it is the legal price of entry. In the others it is accepted as evidence that spares you a separate inspection. Reading that difference correctly is what turns MDSAP from a compliance expense into a real market-access advantage, and it is where planning earns its return.

How one audit can answer to five authorities

The reason a single audit can satisfy five regulators lies in the way the audit itself is structured. Rather than walking a standard clause by clause, the MDSAP model follows the flow of your business through a set of linked processes: management, design and development, production and service controls, purchasing, and the handling of complaints and adverse-event reporting, among others. Inside each process the auditor runs a defined set of tasks and, most importantly, checks the country-specific regulatory requirements at the points where they bite. A device-reporting task, for example, is examined against Canadian, American, Brazilian, Australian and Japanese reporting rules in turn.

Nonconformities are graded on a common scale, and the more serious grades are reported back to the participating regulators. That shared grammar is what lets five authorities trust one report. For a manufacturer it also means a finding is never just a local inconvenience, because the corrective actions you take are visible to every regulator in the programme. An audit that is taken seriously in one market is, by design, taken seriously in all of them.

None of this is a one-off. An MDSAP certificate is not a single event but the opening of an ongoing audit cycle, where the first assessment is followed by recurring surveillance and periodic recertification on a fixed schedule. The efficiency of a single audit therefore repeats, cycle after cycle, because you keep access to all five markets on one audit calendar rather than five. When you weigh the decision, the recurring effort of that surveillance counts as much as the cost of the first certification.

Where MDSAP is mandatory and where it is a strategic choice

Canada sits at one end of the spectrum. Since the start of 2019, Health Canada has required MDSAP certification from virtually every manufacturer that wants to hold a Medical Device Licence for Class II, III and IV devices, replacing the older CMDCAS scheme outright. If Canada is anywhere on your export map, MDSAP is not a choice, and a Canadian licence application simply does not move without it.

The United States sits at the other end. For the FDA, MDSAP is voluntary, and its value is that the agency accepts an MDSAP report in place of its own routine establishment inspection. That substitution does not extend to a pre-market approval inspection or a for-cause visit, but for the periodic surveillance inspection every registered manufacturer faces, it removes a recurring and unpredictable disruption from the calendar. Australia, Brazil and Japan fall between those poles, each accepting the report in its own way, which is where the per-market detail starts to matter.

The Canada and Japan routes in practice

Canada and Japan deserve to be singled out, because they are where exporters most often misjudge the work. For Canada the sequence is quality system first, licence second. You need the MDSAP certificate in hand before Health Canada will grant the Medical Device Licence that lets the product onto the market, so building the Canadian requirements into your system early, rather than retrofitting them after an audit finding, is the difference between one clean cycle and a year of corrective actions. Manufacturers planning that step usually treat the Canadian medical-device licence route and the audit as a single coordinated project rather than two.

Japan is the market where the single audit removes the most opaque obstacle. Japanese approval has traditionally involved a separate quality audit on the PMDA's terms and timeline, hard to coordinate from Istanbul or Izmir. Folding that audit into MDSAP takes one of the most awkward pieces off the table, even though the product side, the Shonin or Ninsho marketing authorisation, still runs on its own track. Exporters who understand the Japanese medical-device approval path before they begin tend to sequence the two far more smoothly.

What a single audit does not replace

MDSAP audits your quality system. It does not register your product. In every one of the five markets you still file for market authorisation separately: a 510(k) or PMA submission to the FDA, ANVISA registration in Brazil, ARTG inclusion in Australia, the Shonin or Ninsho in Japan, and the Medical Device Licence in Canada. MDSAP settles the quality-system question that sits beneath all of those filings. It does not settle the filings themselves.

The larger gap for a Turkish exporter is Europe. The European Union is only an official observer of MDSAP, not a participating member, so the certificate does nothing for CE marking. Selling in Europe still means working with a Notified Body under the Medical Device Regulation, a separate assessment with its own technical documentation and clinical-evaluation demands, and the United Kingdom sits outside MDSAP as well. For most Turkish device makers the practical reading is straightforward: MDSAP is the efficient way into the Americas, Australia and Japan, while Europe runs on its own CE marking route under the MDR. The two are complementary, not competing.

Deciding whether the single audit fits your plan

MDSAP earns its place the moment you are serious about more than one of its five markets. If Canada is in scope, the decision is already made, because the certificate is mandatory there. If you are aiming at three or four of the five, the arithmetic of one audit against three or four usually settles it, both in audit days and in the production time each separate visit would consume. If a single non-Canadian market is genuinely all you intend to reach, a country-specific route may well be lighter, and it is worth being honest about that rather than certifying for markets you will not enter.

Whichever way the decision falls, the foundation is the same. A quality system that genuinely conforms to ISO 13485 is the platform MDSAP audits against before it tests the country-specific layers on top. A manufacturer whose 13485 system is mature walks in adding regulatory detail to something that already works. One whose system is shaky is trying to build the foundation and the extension at the same time, now under five sets of rules instead of one. Mapping your processes to the MDSAP audit model and planning the order in which you open markets is work best finished before the first audit is booked, not discovered halfway through it.