Question 1

A medical device company is undergoing an ISO 13485:2016 audit. The company has a documented procedure for supplier evaluation, and the company has several suppliers used to produce critical components. The company’s procedure outlines initial evaluation, periodic evaluation, and performance monitoring, however, for some suppliers that are deemed “low-risk” there is no *documented rationale* for why those suppliers were classified as such. As the Lead Auditor, what is the MOST appropriate action to take?

Options :

A : Accept the company-s classification of the suppliers as "low-risk" without further investigation, as long as the products they supply consistently meet specifications.

B : Issue a minor nonconformity, and require that the company either conduct a risk assessment or generate a documented rationale for why the suppliers were classified as low risk.

C : Accept the classification if these suppliers provide components to Class I devices.

D : Issue a major nonconformity, since all supplier evaluations must be documented with a detailed, objective risk assessment.

Answer: B

Question 2

A medical device company is undergoing an ISO 13485:2016 audit. During a tour of the manufacturing facility, the Lead Auditor observes that several production machines are connected to the company's internal network. The company has a firewall and intrusion detection system in place. However, there is no documented assessment of the cybersecurity risks associated with these network-connected machines, including the potential impact on product quality or patient safety if a machine were compromised. What is the MOST appropriate action for the Lead Auditor to take?

Options :

A : Accept the existing security measures as sufficient, given the presence of a firewall and intrusion detection system.

B : Issue a minor nonconformity, recommending the company conduct a cybersecurity awareness training for manufacturing personnel.

C : Issue a major nonconformity because there is no documented risk assessment of cybersecurity vulnerabilities.

D : Inquire with the IT department about their standard cybersecurity policies, and accept those policies for manufacturing.

Answer: C

Question 3

A medical device company is undergoing an ISO 13485:2016 audit. The company utilizes a contract manufacturer for a critical component of their Class II medical device. The Lead Auditor reviews the company's process for controlling the outsourced process. The quality agreement with the contract manufacturer clearly defines the product specifications, quality requirements, and acceptance criteria. There is evidence of recent performance data trending showing sustained compliance, however, the quality agreement does not define how frequently the quality agreement itself is reviewed or updated. As a Lead Auditor, what is the MOST appropriate determination regarding the company's approach?

Options :

A : The lack of a defined review frequency for the quality agreement is a critical nonconformity and must be cited, as all agreements need to be reviewed and updated annually.

B : The Lead Auditor should verify that there is a process in place to address changes to the contract manufacturer-s processes or requirements that would necessitate an update to the quality agreement.

C : The Lead Auditor should only be concerned with compliance to specifications, quality requirements, and acceptance criteria. The Lead Auditor should not focus on the frequency of reviewing agreements as that is an administrative burden.

D : As long as the medical device manufacturer has evidence to show compliance to specification, there is no need to verify that agreements have a process in place to address changes to the contract manufacturer’s processes or requirements that would necessitate an update to the quality agreement.

Answer: B

Question 4

A medical device company is undergoing an ISO 13485:2016 audit. The company uses a cloud-based software to manage its training records. The software provider states the system is fully compliant with all relevant data privacy requirements such as GDPR and HIPAA. The manufacturer performs an annual review of the software provider’s SOC 2 Type II report to verify its compliance with relevant security standards, however, the medical device company has not performed any risk assessment to identify potential risks associated with data privacy.

Options :

A : Accept the company-s reliance on the software provider-s statement and the SOC 2 report as sufficient evidence of compliance.

B : Require the company to perform a data protection impact assessment (DPIA) or risk assessment to identify and mitigate potential data privacy risks.

C : Recommend that the company obtain a written guarantee from the software provider ensuring compliance with all applicable data privacy regulations.

D : Issue a nonconformity for the lack of a documented data privacy procedure, regardless of the risk assessment.

Answer: B

Question 5

A medical device company uses a contract manufacturer to produce a critical component for one of their Class III devices. During an ISO 13485:2016 audit of the medical device company (not the contract manufacturer), the Lead Auditor reviews the records pertaining to the oversight of the contract manufacturer. The records show regular communication, agreed-upon specifications, and documented inspections of incoming components. However, there is no documented evidence of periodic on-site audits of the contract manufacturer's facilities. What is the MOST appropriate conclusion for the Lead Auditor to draw?

Options :

A : The arrangement is acceptable, as long as the incoming inspections are thorough and meet acceptance criteria.

B : The absence of on-site audits is a minor nonconformity, requiring only a commitment to schedule future audits.

C : The lack of on-site audits is a major nonconformity, as it demonstrates a failure to adequately control outsourced processes.

D : The company is only required to audit the contract manufacturer if there are persistent quality issues with the incoming components.

Answer: C

Smartly Prepare Exam with Free Online ISO-QMS-13485 Practice Test

Buying Options: