The FDA released an information transmittal to the MDSAP Auditing Organizations on December 31st, 2020 providing further guidance on the expansion of remote MDSAP audits during the period of the public health emergency. Under this transmittal order, FDA clarifies the difference between the following types of audits and defines when such an audit would be appropriate. Below are the types of audits defined in this order...

1. FDA Clarifies The Types Of MDSAP Audits To Be
Conducted In The Pandemic
By: Nikita Angane
The FDA released an information transmittal to the MDSAP Auditing Organizations on
December 31st, 2020 providing further guidance on the expansion of remote MDSAP audits
during the period of the public health emergency.1
Under this transmittal order, FDA clarifies the difference between the following types of
audits and defines when such an audit would be appropriate. Below are the types of audits
defined in this order:1
 Desktop Audit: An audit performed remotely by reviewing documentation.
 Remote audit: An audit performed off-site using information and communication
technology (ICT).
 Hybrid audit: An audit partially performed off-site using ICT while at least one
MDSAP qualified auditor is simultaneously on-site during a portion of the audit.
 Surrogate Audit: An audit partially performed off-site using ICT while at least one
non-MDSAP qualified auditor is simultaneously on-site during a portion of the
audit.
As per this order, an audit conducted based on ICT will not be an option for a facility
whose previous remote audit was deemed ineffective.1
The order further states that, the eligibility of a facility for alternative audit arrangements will be
based on a risk assessment that takes the facility’s compliance history, the medical devices
produced, and the production technologies employed at the facility into consideration.1
According to this risk-based system, a stage 1 remote audit can be conducted for all risk
categories, however, a remote stage 2 audit can only be conducted for low or medium risk
companies. Stage 2 audit for high-risk companies must at least be a hybrid audit if not on-site.1
In the case where a facility is ineligible for any of the audit arrangements defined above,
and an on-site audit cannot be performed, auditing organizations have the right to consider
suspension or withdrawal of their certificates.1
Furthermore, certifications renewed with a remote audit will have a validity period of not
to exceed twelve (12) months and shall be subject to subsequent on-site verification as
soon as possible. Certificates that were renewed in 2020 through a remote audit may have their
validity extended for a further 12 months if on-site verification is not possible, however, ongoing
surveillance must be carried out using alternative methods.1
It is interesting to see how the pandemic has given rise to these new definitions in the auditing
world. This is certainly going to change how audits will be conducted in the future. Has this new
auditing practice impacted you? Call us at +1 248-987-4497 or email us at

2. Page 2 of 2
info@emmainternational.com to know more about the auditing services we have to offer for
your organization.
1 FDA (Dec 2020) MDSAP Transmittal Number: AO 2020-10 retrieved on 1/24/2021 from
https://www.fda.gov/media/144883/download