Question 1

A medical device company is undergoing an ISO 13485:2016 audit. The company outsources the manufacturing of a critical component to a supplier. During the audit, the Lead Auditor discovers the supplier performs 100% automated inspection of the critical dimensions of the component, and the medical device company's quality group does not perform incoming inspection. The Lead Auditor reviews the process for controlling these outsourced processes and confirms the supplier's automated inspection system used to verify critical product dimensions is validated. What additional action must be verified by the Lead Auditor to ensure compliance?

Options :

A : The Lead Auditor should verify that the medical device company’s quality control personnel are trained on the supplier’s automated inspection system.

B : The Lead Auditor should verify there is a procedure for periodic calibration of the automated inspection system, and for reviewing the results to evaluate the ongoing validity of the automated inspection data.

C : The Lead Auditor should verify the supplier performs a manual inspection, in addition to the automated inspection, to serve as a comparison between the two.

D : The Lead Auditor should verify the medical device company performs on-site audits of the supplier’s facility and evaluates the performance of the automated inspection system.

Answer: B

Question 2

During an ISO 13485:2016 surveillance audit, a Lead Auditor reviews the management review process of a medical device company. The company conducts management reviews quarterly, as required. However, the Lead Auditor notices that the documented outputs of these reviews consistently lack specific action items with assigned responsibilities and deadlines for addressing identified issues. Which of the following is the MOST significant concern regarding this situation?

Options :

A : The frequency of the management reviews is insufficient to address the company-s needs.

B : The lack of documented action items and responsibilities undermines the effectiveness of the management review process.

C : The documented outputs should also include a review of the company-s financial performance.

D : The management review process is compliant since the company is conducting reviews as frequently as documented.

Answer: B

Question 3

A medical device company is undergoing an ISO 13485:2016 audit. The Lead Auditor observes that the company uses a software program to manage customer complaints and track corrective actions. The software program allows users to easily generate reports and analyze trends in customer feedback. The manufacturer has performed initial validation and has documented a process for regular preventative maintenance of the software. What additional action must be verified by the Lead Auditor to ensure compliance?

Options :

A : The Lead Auditor should verify the integrity of the software is maintained and secured against unauthorized changes.

B : The Lead Auditor should verify that the software generates aesthetically pleasing and easily understandable reports.

C : The Lead Auditor should verify the software developers hold an ISO 13485:2016 Lead Auditor certification.

D : The Lead Auditor should verify the software is also used for other business functions such as marketing.

Answer: A

Question 4

During an ISO 13485:2016 audit, the Lead Auditor discovers that a medical device company uses a cloud-based software to manage its training records. The software provider states the system is fully compliant with all relevant data privacy requirements such as GDPR and HIPAA. The manufacturer performs an annual review of the software provider’s SOC 2 Type II report to verify its compliance with relevant security standards. Considering the requirements of ISO 13485:2016 regarding the control of outsourced processes, what should be your MOST appropriate next action?

Options :

A : Accept the SOC 2 Type II report as sufficient evidence of compliance, and move on to another area of the audit.

B : Confirm the scope of the SOC 2 Type II report addresses the specific data privacy and security controls required by the company-s QMS and applicable regulations, and verify the medical device manufacturer has performed a documented risk assessment to identify potential risks associated with data privacy.

C : Require the company to perform a full on-site audit of the software provider-s facility to verify compliance with data privacy requirements.

D : Accept the software provider-s statement of compliance without further verification, as cloud providers are inherently responsible for data privacy.

Answer: B

Question 5

A medical device company is undergoing an ISO 13485:2016 audit. The company utilizes a contract manufacturer for a critical component of their Class II medical device. The Lead Auditor reviews the company's process for controlling the outsourced process. The quality agreement with the contract manufacturer clearly defines the product specifications, quality requirements, and acceptance criteria. There is evidence of recent performance data trending showing sustained compliance, however, the quality agreement does not define how frequently the quality agreement itself is reviewed or updated. As a Lead Auditor, what is the MOST appropriate determination regarding the company's approach?

Options :

A : The lack of a defined review frequency for the quality agreement is a critical nonconformity and must be cited, as all agreements need to be reviewed and updated annually.

B : The Lead Auditor should verify that there is a process in place to address changes to the contract manufacturer-s processes or requirements that would necessitate an update to the quality agreement.

C : The Lead Auditor should only be concerned with compliance to specifications, quality requirements, and acceptance criteria. The Lead Auditor should not focus on the frequency of reviewing agreements as that is an administrative burden.

D : As long as the medical device manufacturer has evidence to show compliance to specification, there is no need to verify that agreements have a process in place to address changes to the contract manufacturer’s processes or requirements that would necessitate an update to the quality agreement.

Answer: B