NEW Version of MDSAP Audit Approach Ver 11 was released this month!

This month, MDSAP released a new version of the MDSAP Audit Approach Ver 11 and have added a lot of requirements around cybersecurity for software medical devices and Australia's updated regulatory requirement. In this article, we will summarize the major changes and let you know how your QMS may be impacted by this change, and whether or not you are ready to be audited with this update that takes effect, immediately!

1. A major reoccurring theme is the expansion of risk requirements. The requirement for Risk analysis is more than just for the product; but also for the QMS processes. The addition of risk assessment has now expanded into the following processes:

• risk evaluation is now required in Sections 4.1.1 and 5.4.2 of the ISO 13485:2016

• risk evaluation as a part of product realization in Section 7.1 of the ISO 13485:2016; including a mechanism for updating the risk management file during the post-market phase

  
  

2.Software as a medical device manufacturer is going to need to provide additional documentation especially around cybersecurity:

• USA requires the organization to gather cybersecurity threats, vulnerability reports, security incident data, and threat intelligence to the device and to the QMS infrastructure as a part of the feedback process and serve as an input of risk considerations in the following processes:

  • 7.1 Product Realization

  • 8.5 Improvement Processes

  • 7.3.9 Design and Development changes

• Evidence that cyber device meets the cybersecurity requirements in Section 524B(b) of the FD&C Act

• Update of 7.1 Product Realization to include security risk assessment to identify and manage patient safety risks

  
  

3.Australia updated requirements:

• Australia Sponsor Agreement needs to be updated with UDI responsibilities

• Australia UDI requirements and transitional plan

• Medical Device File update with the Essential Principles checklist updated
  

After a thorough review of the new MDSAP Audit Approach Ver 11 being released, organizations who haven't been maintaining up to date risk analysis, cybersecurity software requirements, and compliance requirements, be prepared to be updating a lot of SOPs in the next couple months. Hire us as an expert today to guide you through the necessary changes, provide you the updated documentation, to ensure your system is compliant before your next audit. For internal auditors; these are additional MDSAP requirements and you will need to update your audit checklist, with these new MDSAP specific requirements. At A. Quality | Regulatory Consulting Firm, we can provide templates and support to help you prepare compliant and effective compliance. Contact us today to receive your free gap assessment and learn how we can support your regulatory and quality compliance needs.