Question 1

A medical device company uses a contract manufacturer to produce a critical component for one of their Class III devices. During an ISO 13485:2016 audit of the medical device company (not the contract manufacturer), the Lead Auditor reviews the records pertaining to the oversight of the contract manufacturer. The records show regular communication, agreed-upon specifications, and documented inspections of incoming components. However, there is no documented evidence of periodic on-site audits of the contract manufacturer's facilities. What is the MOST appropriate conclusion for the Lead Auditor to draw?

Options :

A : The arrangement is acceptable, as long as the incoming inspections are thorough and meet acceptance criteria.

B : The absence of on-site audits is a minor nonconformity, requiring only a commitment to schedule future audits.

C : The lack of on-site audits is a major nonconformity, as it demonstrates a failure to adequately control outsourced processes.

D : The company is only required to audit the contract manufacturer if there are persistent quality issues with the incoming components.

Answer: C

Question 2

A medical device company uses a commercial off-the-shelf (COTS) software program for managing its training records. The software is not directly used in the manufacturing process but is integral to personnel training and demonstrating compliance with ISO 13485:2016. The Lead Auditor reviews the company's training procedure and notes the procedure indicates the company must perform testing of software used within the QMS, and validation is not required. Which of the following would be the MOST appropriate determination for the Lead Auditor?

Options :

A : Accept the process, as long as the procedure indicates the software is not used in production, testing is sufficient.

B : Accept the procedure, so long as the organization keeps accurate training records, the process is valid.

C : Issue a minor nonconformity, because the software validation procedure has not been followed.

D : Issue a finding, because the company-s documentation lacks justification for using a testing and not a validation approach for training software.

Answer: D

Question 3

A medical device company is undergoing an ISO 13485:2016 audit. The company uses a contract manufacturer to produce a critical component of their Class II medical device. The Lead Auditor reviews the medical device company's records pertaining to the oversight of the contract manufacturer. While the records show regular communication, agreed-upon specifications, and documented inspections of incoming components, the Lead Auditor discovers that the medical device company is performing no periodic on-site audits of the contract manufacturer's facility. The company claims that these audits are not required if the component meets all the specifications and regulatory requirements. What should be the Lead Auditor’s MOST appropriate next action?

Options :

A : Accept the company-s justification and move on to the next area of the audit, documenting the rationale.

B : Issue a nonconformity because on-site audits are always mandatory for contract manufacturers of critical components.

C : Investigate the company-s rationale for not conducting on-site audits, considering the risk associated with the component and the effectiveness of other controls.

D : Require the company to immediately schedule an on-site audit of the contract manufacturer, regardless of the risk assessment or other controls.

Answer: C

Question 4

During an ISO 13485:2016 audit, the Lead Auditor is reviewing the effectiveness of the company's Corrective and Preventive Action (CAPA) system. The auditor notes that the company's CAPA procedure includes a requirement for effectiveness checks to verify that implemented corrective actions have been effective in addressing the root cause of the problem and preventing recurrence. However, the Lead Auditor discovers that the effectiveness checks consistently focus on confirming the immediate resolution of the problem, with limited consideration of the long-term sustainability and robustness of the implemented corrective action, or its potential unintended consequences. What is the MOST appropriate next step for the Lead Auditor to take?

Options :

A : Accept the company-s approach, as the immediate resolution demonstrates the corrective action was effective.

B : Review the rationale for the short-term effectiveness checks and evaluate whether it aligns with the nature of the identified problems and the implemented corrective actions.

C : Document a minor nonconformity, since some effectiveness checks are performed, and allow the company to fix the issue after the audit.

D : Issue a major nonconformity, as the procedure is well-documented and effectiveness checks are being performed, which indicates a systematic issue.

Answer: B

Question 5

A medical device company is undergoing an ISO 13485:2016 audit. The company utilizes a contract manufacturer for a critical component of their Class II medical device. The Lead Auditor reviews the company's process for controlling the outsourced process. The quality agreement with the contract manufacturer clearly defines the product specifications, quality requirements, and acceptance criteria. There is evidence of recent performance data trending showing sustained compliance, however, the quality agreement does not define how frequently the quality agreement itself is reviewed or updated. As a Lead Auditor, what is the MOST appropriate determination regarding the company's approach?

Options :

A : The lack of a defined review frequency for the quality agreement is a critical nonconformity and must be cited, as all agreements need to be reviewed and updated annually.

B : The Lead Auditor should verify that there is a process in place to address changes to the contract manufacturer-s processes or requirements that would necessitate an update to the quality agreement.

C : The Lead Auditor should only be concerned with compliance to specifications, quality requirements, and acceptance criteria. The Lead Auditor should not focus on the frequency of reviewing agreements as that is an administrative burden.

D : As long as the medical device manufacturer has evidence to show compliance to specification, there is no need to verify that agreements have a process in place to address changes to the contract manufacturer’s processes or requirements that would necessitate an update to the quality agreement.

Answer: B