Question 1

A medical device company manufactures Class IIa devices and is undergoing an ISO 13485:2016 audit. During a review of the organization's change control process, the Lead Auditor discovers that the company's impact assessment for product changes only focuses on assessing the impact to the design and manufacturing processes. There is no documented procedure for assessing the impact of the change on device labeling, including IFU (Instructions for Use), warnings and precautions, symbols, or any regulatory labeling requirements. As the Lead Auditor, what is the MOST appropriate action to take?

Options :

A : Accept the existing procedure, as it adequately covers the primary aspects of product change impact.

B : Issue a finding related to inadequate consideration of change impact on the risk management file.

C : Inquire if all change control personnel have been trained on identifying labeling requirements.

D : Issue a finding related to inadequate consideration of change impact on labeling.

Answer: D

Question 2

During an ISO 13485:2016 audit, the Lead Auditor discovers that a medical device company uses a cloud-based software to manage its training records. The software provider states the system is fully compliant with all relevant data privacy requirements such as GDPR and HIPAA. The manufacturer performs an annual review of the software provider’s SOC 2 Type II report to verify its compliance with relevant security standards. Considering the requirements of ISO 13485:2016 regarding the control of outsourced processes, what should be your MOST appropriate next action?

Options :

A : Accept the SOC 2 Type II report as sufficient evidence of compliance, and move on to another area of the audit.

B : Confirm the scope of the SOC 2 Type II report addresses the specific data privacy and security controls required by the company-s QMS and applicable regulations, and verify the medical device manufacturer has performed a documented risk assessment to identify potential risks associated with data privacy.

C : Require the company to perform a full on-site audit of the software provider-s facility to verify compliance with data privacy requirements.

D : Accept the software provider-s statement of compliance without further verification, as cloud providers are inherently responsible for data privacy.

Answer: B

Question 3

A medical device company uses a contract manufacturer to produce a critical component for one of their Class III devices. During an ISO 13485:2016 audit of the medical device company (not the contract manufacturer), the Lead Auditor reviews the records pertaining to the oversight of the contract manufacturer. The records show regular communication, agreed-upon specifications, and documented inspections of incoming components. However, there is no documented evidence of periodic on-site audits of the contract manufacturer's facilities. What is the MOST appropriate conclusion for the Lead Auditor to draw?

Options :

A : The arrangement is acceptable, as long as the incoming inspections are thorough and meet acceptance criteria.

B : The absence of on-site audits is a minor nonconformity, requiring only a commitment to schedule future audits.

C : The lack of on-site audits is a major nonconformity, as it demonstrates a failure to adequately control outsourced processes.

D : The company is only required to audit the contract manufacturer if there are persistent quality issues with the incoming components.

Answer: C

Question 4

A medical device company is undergoing an ISO 13485:2016 audit. The company has a documented procedure for design verification. As the Lead Auditor, you discover that the company has not formally validated the computer software used to perform finite element analysis (FEA) during design verification, where the FEA is part of the QMS and Clause 4.1.6 applies. The output of the FEA software is used as objective evidence that the design meets safety and performance requirements. The FEA software is commercial off-the-shelf software and not developed by the medical device manufacturer. The company states that they check the FEA software inputs and outputs against hand calculations as a form of verification. As the Lead Auditor, what is your MOST appropriate course of action?

Options :

A : Accept the company-s approach because the software is commercially available and inputs and outputs are verified using hand calculations.

B : Consider the company-s approach as verification and ask for the documented procedure for verification, objective evidence, and acceptance criteria for these hand calculations.

C : Document the lack of software validation as a finding and follow up during the next surveillance audit.

D : Issue a nonconformity because the FEA software used for design verification must be validated for its intended use.

Answer: D

Question 5

A medical device manufacturer is using a cloud-based software platform for managing its quality management system (QMS) documentation, including procedures, work instructions, and records. The manufacturer claims that since the cloud provider is ISO 27001 certified, they do not need to perform their own validation of the software's suitability for managing their QMS data. As a Lead Auditor, how should you respond?

Options :

A : Accept the manufacturer-s reasoning, as ISO 27001 certification of the cloud provider sufficiently addresses data security and integrity concerns.

B : Inform the manufacturer that ISO 27001 certification is irrelevant to the validation requirements of ISO 13485:2016, and full validation is always necessary.

C : Acknowledge the ISO 27001 certification but require the manufacturer to demonstrate through documented evidence that the software platform is suitable for managing QMS data and meets applicable regulatory requirements, focusing on data integrity, security, and accessibility.

D : Suggest that the manufacturer only needs to validate the interfaces between the cloud-based system and any local systems, as the cloud provider is responsible for validating the core functionality.

Answer: C

Higher Test Marks with Free Online ISO-QMS-13485 Exam Practice

Buying Options: