Question 1

A medical device company is undergoing an ISO 13485:2016 audit. The Lead Auditor discovers that the company's process for handling customer complaints includes detailed procedures for documentation, investigation, and corrective actions. However, the Lead Auditor also discovers that the company does not have a documented procedure for protecting patient confidentiality and complying with data privacy regulations (e.g., GDPR, HIPAA) when handling customer complaints that contain patient information. What is the MOST appropriate action for the Lead Auditor to take?

Options :

A : Acknowledge the detailed complaint handling procedure and continue the audit without further investigation on this aspect.

B : Issue a minor nonconformity, as the company has a well-defined complaint handling process.

C : Issue a major nonconformity because the lack of a data privacy procedure could result in regulatory violations and harm to patients.

D : Recommend implementing a data privacy procedure as a 'best practice' without issuing a nonconformity.

Answer: C

Question 2

A medical device company is undergoing an ISO 13485:2016 audit. The company manufactures a Class IIa medical device. The Lead Auditor discovers that the company's internal audit program is conducted by personnel who have received training on auditing techniques but lack specific technical expertise related to the processes they are auditing (e.g., design, manufacturing, sterilization). The company claims that the auditors' general understanding of the QMS is sufficient. What is the MOST appropriate action for the Lead Auditor to take?

Options :

A : Accept the company-s rationale, as the personnel are trained auditors and possess a general understanding of the QMS requirements.

B : Issue a minor nonconformity, requiring the company to enhance the general QMS knowledge of the auditors.

C : Issue a major nonconformity, requiring the company to revise its internal audit program to ensure auditors possess the necessary technical expertise or involve technical experts in the audits.

D : Recommend that the company outsource all internal audits to a qualified third-party auditing firm.

Answer: C

Question 3

A medical device company is undergoing an ISO 13485:2016 audit. The company utilizes a contract manufacturer for a critical component of their Class II medical device. The Lead Auditor reviews the company's process for controlling the outsourced process. The quality agreement with the contract manufacturer clearly defines the product specifications, quality requirements, and acceptance criteria. There is evidence of recent performance data trending showing sustained compliance, however, the quality agreement does not define how frequently the quality agreement itself is reviewed or updated. As a Lead Auditor, what is the MOST appropriate determination regarding the company's approach?

Options :

A : The lack of a defined review frequency for the quality agreement is a critical nonconformity and must be cited, as all agreements need to be reviewed and updated annually.

B : The Lead Auditor should verify that there is a process in place to address changes to the contract manufacturer-s processes or requirements that would necessitate an update to the quality agreement.

C : The Lead Auditor should only be concerned with compliance to specifications, quality requirements, and acceptance criteria. The Lead Auditor should not focus on the frequency of reviewing agreements as that is an administrative burden.

D : As long as the medical device manufacturer has evidence to show compliance to specification, there is no need to verify that agreements have a process in place to address changes to the contract manufacturer’s processes or requirements that would necessitate an update to the quality agreement.

Answer: B

Question 4

A medical device company is undergoing an ISO 13485:2016 audit. The company uses a contract manufacturer for a critical component of their Class II medical device. The Lead Auditor reviews the company's **documented procedure**, or lack thereof, for controlling the outsourced process. The quality agreement with the contract manufacturer clearly defines the product specifications, quality requirements, and acceptance criteria. The medical device company performs a thorough risk assessment of any changes notified to them. There is evidence of recent performance data trending showing sustained compliance, however, the quality agreement does not define how frequently the quality agreement itself is reviewed or updated. As a Lead Auditor, what is the MOST appropriate determination regarding the company's approach?

Options :

A : The Lead Auditor should determine that the lack of a defined review frequency may represent a significant nonconformity, requiring corrective action.

B : The Lead Auditor should determine that the approach is acceptable because the ISO 13485:2016 standard doesn't explicitly state a specific frequency.

C : The Lead Auditor should determine that the lack of a defined review frequency could be a minor issue; however, the recent trend shows that performance data ensures sustained compliance. Sustained compliance is a good foundation, but a periodic review could improve the QMS.

D : The Lead Auditor should determine that the lack of a defined review frequency could be a potential area for improvement; however, the recent trend shows that performance data and clearly defined quality requirements and acceptance criteria ensure sustained compliance, therefore no corrective action is currently needed, but the area should be added to a preventative actions review at the next audit.

Answer: D

Question 5

A medical device company is undergoing an ISO 13485:2016 audit. The company has a well-defined process for handling customer complaints, including documentation, investigation, and corrective actions. The Lead Auditor discovers that the company is using an older version of a Customer Relationship Management (CRM) software to manage customer complaint records, where the software vendor no longer provides any security patches or updates. The company has a documented procedure for backing up the data stored within the CRM. What is the MOST appropriate response for the Lead Auditor?

Options :

A : Accept the situation since the company has a backup process in place.

B : Raise a minor nonconformity, as the risk is mitigated by the backup process.

C : Raise a major nonconformity because the lack of security patches poses a significant risk to data integrity and potentially patient safety.

D : Recommend the company migrate to a newer CRM system but do not issue a nonconformity.

Answer: C