Hosting a Regulatory Audit? Three Essentials Every Medical Device Company Should Know (MDSAP & ISO 13485) -

Hosting a Regulatory Audit? Three Essentials Every Medical Device Company Should Know (MDSAP & ISO 13485)

by John Lafferty, Life Sciences Programme Director at SQT Training Ltd.

Read time: 4 minutes.

Why This Matters for EU & Irish Medical Device Companies

For medical device manufacturers across Ireland and Europe, regulatory audits—whether under MDSAP or ISO 13485—are a critical part of maintaining market access and compliance. Having worked extensively with companies across the sector, I consistently hear the same concern:

“Some audit non-conformities don’t feel fully justified.”

In many cases, this arises due to lack of clarity in the audit and audit reporting processes..

In this article, we explore how to help to ensure that your organisation does not receive any unjustified non-conformities – especially in the environment of the MDSAP.

Key Takeaways for Medical Device Companies

Not all audit findings are equal — some non-conformities stem from auditor interpretation rather than explicit regulatory requirements.
Set expectations early — use the Three Things Principle at the audit opening meeting.
Demand clarity and traceability — every non-conformity should link clearly to a specific requirement.
Reduce audit risk under MDSAP — structured, evidence-based dialogue strengthens your position.
Build internal capability — trained teams are better equipped to challenge unclear findings professionally. MDSAP Internal Auditor Training Course – SQT Training

Why Do Audit Non-Conformities Sometimes Feel Unjustified?

Auditors are highly experienced professionals—but they are also human.

Common auditing mistakes include:

Auditing against ‘best practice’ rather than the actual regulatory requirements
Assessing risks based on previous experience rather than the current context.
Interpreting requirements through a subjective lens

This is particularly relevant when auditing against standards like ISO 13485:2016, where intent and interpretation matter.

So, the key question becomes:

How do you prevent the auditor’s opinion from becoming your non-conformity?

Interested in our MDSAP Internal Auditor Training Course? View the Course details here.

The “Three Things Principle”: A Practical MDSAP Audit Strategy

I recommend what I call the “Three Things Principle”.

Establish Ground Rules at the Audit Opening Meeting

During the audit Opening Meeting, agree with the auditor that any non-conformity raised must include three clearly defined elements:

The Observation

What exactly did the auditor see, read, or hear?

The Standard it Offends

Which specific regulation, standard, or internal procedure has not been met?

How the Observation Offends the Standard

The critical step: How does the exact wording of the requirement explicitly prohibit what was observed?

Why This Audit Strategy Works (especially under MDSAP)

This approach aligns with best practice auditing principles and is central to professional auditor training.

In fact, it is a core concept taught in SQT Training’s MDSAP Internal Auditor programmes.

So why isn’t it always applied? Because most organisations don’t explicitly ask for it.

The Most Important Element: Linking Evidence to Requirement in Audit Findings

The third element—how the observation offends the standard—is where weak findings collapse.

It forces:

Objectivity
Traceability
Evidence-based conclusions

Without this, a “non-conformity” may simply reflect:

Assumptions
Preferences
Or past experiences

View the MDSAP Internal Auditor Training Course

Real-World Example: When a Non-Conformity Isn’t One

Scenario

Observation: Tool No. XYZ is not listed on a Line Clearance Form
Standard cited: ISO 13485:2016, Clause 7.5.1 Control of Production and Service Provision – Production and service provision shall be planned, carried out, monitored and controlled to ensure that product conforms to specification.

At first glance, this appears to be a valid non-conformity. However, by applying the Three Things Principle, we will be able to test it for validity:

In this case, the auditor has given us the first two ‘Things’ but not the third. They have clearly listed the Observation and the Standard, but they have not documented ‘how the observation offends the standard’, and this omission is crucial.

What’s Missing from this Non-Conformity?

👉 There is no explicit requirement in ISO 13485 for line clearance.

Deeper Analysis

The standard does require control to ensure product conformity and the company has sufficient controls in place: The company’s risk assessment (pFMEA) shows that there is no risk to product quality related to the use of this tool. The company has justified the exclusion of this tool from Line Clearance based on risk.

Conclusion

Without demonstrating how the requirement is explicitly breached, the finding does not qualify as a true non-conformity.

MDSAP Readiness in Ireland & Europe: Raising Your Audit Game

In the MDSAP environment, where audits are:

Structured
Cross-regulatory (FDA, Health Canada, TGA, etc.)
Highly detailed

…organisations must agree the ground rules with the auditor before the audits commences so that they can be confident in:

Challenging unclear findings professionally
Demonstrating risk-based rationale
Ensuring alignment between observation and requirement

This is not about resisting auditors—it is about ensuring fair, accurate, and compliant outcomes.

Are You Truly Audit-Ready?

If your organisation is preparing for:

An MDSAP or EU MDR audit
ISO 13485 certification or surveillance audit
Internal auditor capability building

Learn how to apply the Three Things Principle in practice and build audit confidence with expert-led training at SQT Training.

MDSAP Internal Auditor Training Course with SQT Training

Learn:

MDSAP Internal Auditor Training
Practical audit techniques
Real-world case studies from industry experts

TAILORED TRAINING OPTION:

This training is also available on an in-company basis and can be tailored to meet your specific training needs and requirements. The in-company training can be tailored to align with your internal procedures and processes and examples from your workplace can be incorporated into the training. We can also offer you feedback on your risk management procedure during the training, if required.

About John Lafferty