MDSAP Gap Analysis Checklist: What It Is and How to Use It

MDSAP Gap Analysis Checklist: What It Is and How to Use It

A downloadable MDSAP gap analysis checklist exists, covering all eight modules of the Medical Device Single Audit Program (MDSAP). It enables quality assurance leads, regulatory affairs specialists, and internal auditors to assess compliance with the requirements of ISO 13485, FDA 21 CFR Part 820, Health Canada’s Medical Devices Regulations, and other national regulatory frameworks. The checklist maps each requirement to audit-ready evidence criteria and includes scoring guidance to prioritise findings.

You can download the full MDSAP gap analysis checklist here: MDSAP Gap Analysis Checklist.

What the Checklist Covers

The checklist is structured around the eight official MDSAP audit model chapters:

1. Management Responsibility – Assesses leadership commitment, quality policy, and resource allocation.
2. Resource Management – Evaluates infrastructure, personnel training, and environmental controls.
3. Product Realisation – Reviews design controls, risk management per ISO 14971, and production planning.
4. Document and Record Control – Checks document approval, revision control, and retention periods.
5. Design and Development – Verifies design inputs, outputs, reviews, verification, and validation.
6. Supplier Controls – Assesses supplier qualification, monitoring, and oversight of outsourced processes.
7. Production and Service Controls – Examines process validation, labelling, and sterilisation controls.
8. Corrective and Preventive Action (CAPA) – Evaluates complaint handling, nonconforming product, and root cause analysis.

Each section includes a series of yes/no/NA questions, with space for evidence references and auditor notes. Scoring is weighted based on regulatory criticality, allowing teams to calculate a compliance maturity score.

Who Should Use This Tool

The checklist is designed for:

• Regulatory compliance managers in medical device firms
• Internal auditors preparing for MDSAP surveillance or initial audits
• Consultants supporting clients in FDA, TGA, or Health Canada markets
• Quality system implementers building ISO 13485-aligned processes

It is not intended for small startups without an established quality management system (QMS), as it assumes foundational documentation is already in place.

How to Conduct a Gap Analysis Using the Checklist

Begin by assembling a cross-functional team: quality, regulatory, R&D, and manufacturing. Assign each module to a subject matter expert who can locate and present evidence.

For each question in the checklist:

• Identify the relevant procedure or record
• Confirm whether the requirement is fully met, partially met, or not met
• Reference the document name, version, and location
• Note any discrepancies or missing elements

After completing all sections, compile findings into a gap register. Use the scoring system to prioritise high-risk deficiencies, those related to design controls, CAPA, or supplier oversight typically carry higher weight.

Common Pitfalls to Avoid

Many organisations fail their MDSAP audits not due to missing systems, but due to inconsistent implementation. The checklist helps avoid these issues:

• Inadequate design traceability: Teams often document design inputs and outputs but fail to link them to risk analyses or verification results. The checklist includes traceability checks aligned with ISO 13485:2016 clause 7.3.
• Weak CAPA linkage: Complaints or nonconformities may trigger corrective actions, but root cause analysis is superficial. The tool includes prompts for 5-why or fishbone diagram usage.
• Supplier oversight gaps: Organisations may qualify suppliers initially but fail to monitor performance annually. The checklist flags re-evaluation requirements per FDA 820.50.

Integrating with Other Standards

The MDSAP audit model harmonises five regulatory jurisdictions: the United States, Canada, Australia, Brazil, and Japan. The checklist includes annotations showing where each country’s unique requirements apply, for example, Brazil’s ANVISA demands additional technical file elements, while Australia’s TGA requires specific post-market surveillance reporting.

It also cross-references ISO 13485 clauses and FDA 21 CFR Part 820 subparts, enabling teams to align with international best practices beyond MDSAP.

Post-Gap Actions

After completing the assessment, the checklist becomes a roadmap for remediation. High-priority gaps should trigger formal CAPA records. Medium and low findings can be addressed through process updates or training.

Organisations should repeat the gap analysis every 12 to 18 months, or after major system changes, to maintain audit readiness. The downloadable version includes a tracking sheet to monitor closure of findings over time.

While the checklist is comprehensive, it does not replace auditor training or regulatory consultation. For firms developing software-based medical devices, additional compliance with IEC 62304 is essential, and the linked course provides targeted guidance on integrating software lifecycle controls into MDSAP readiness.

Final Thoughts

A well-structured MDSAP gap analysis checklist is not just a pre-audit tool, it’s a living document that strengthens quality culture. By making compliance visible and measurable, it empowers teams to move from reactive fixes to proactive governance.

The version available for download includes editable fields, jurisdiction-specific annotations, and evidence mapping templates, making it suitable for both preparation and ongoing compliance monitoring.