Back to library Guide · Nov 2026

Medical device audit scheduling: ISO 13485, MDSAP and unannounced audits

How certification and notified bodies schedule medical device audits: scarce product competence, the MDSAP cycle, unannounced audits and what planners must check on every allocation.

By Aman Hemchand, Head of AI TransformationMedical devicesStandards2 min readIn English
5regulators served by one MDSAP audit
Short answer

Medical device audits are scheduled around scarce, product-specific auditor competence, a three-year cycle with annual surveillance, and unannounced audits that must stay confidential. Under MDSAP one audit serves several regulators, so the team must cover every participating jurisdiction in scope. ScheduleAI by Checkfirst checks competence per technical area on every allocation, forms teams and keeps unannounced dates hidden from the client. Check the current programme documents for the detail.

Key takeaways

  1. Competence is tied to device types and technologies, and few auditors hold each one.
  2. MDSAP follows a three-year cycle with annual surveillance.
  3. Unannounced audits need hidden dates and standby auditors.
  4. Travel is often international, so clustering matters.

What drives the schedule?

Programmes and their scheduling effect
ProgrammeScheduling effect
ISO 13485Three-year cycle, annual surveillance, device-specific competence
MDSAPOne audit for participating regulators; team must cover every jurisdiction in scope
EU notified body auditsUnannounced audits in addition to planned ones; dates confidential

How does the MDSAP cycle run?

  1. Year 1Initial auditStage 1 and stage 2.
  2. Year 2SurveillanceAnnual surveillance audit.
  3. Year 3SurveillanceSecond surveillance audit.
  4. ThenRecertificationCycle starts again.

What must a planner check on every allocation?

  • ✓Auditor competence for the device type and technology.
  • ✓Coverage of every regulator in scope for MDSAP.
  • ✓No conflict of interest with the manufacturer.
  • ✓Language for the site.
  • ✓For unannounced audits: the date is hidden and a standby auditor exists.

Related reading

See unannounced audit scheduling, technical expert scheduling and matching auditors to sub-codes.

How ScheduleAI handles this

ScheduleAI by Checkfirst checks device-specific competence on every allocation, forms teams that cover the full scope, keeps unannounced dates confidential and clusters international trips. Planners approve every booking.

Book a demo Estimate your savings

Questions

Which regulators take part in MDSAP?

Australia, Brazil, Canada, Japan and the United States.

How often are MDSAP audits?

A three-year cycle: an initial audit, then annual surveillance, then recertification.

Can software schedule unannounced audits?

Yes. The date is planned internally and withheld from the client.

Keep reading
ArticleUnannounced audit scheduling: keeping dates secret and fairRead ArticleTechnical expert scheduling: booking the specialist with the auditRead GuideHow to match auditors to sub-codes: IAF, NACE, EAC and IATFRead