Question 1

A medical device company manufactures Class IIa devices and is undergoing an ISO 13485:2016 audit. The company performs internal audits. The Lead Auditor reviews the internal audit reports and discovers that the reports consistently lack objective evidence to support the audit findings and conclusions. The Quality Manager explains that while the audit reports may not contain direct objective evidence in the report, they maintain detailed working papers with all the objective evidence, that can be requested and reviewed upon request, and which support the report's findings. What should be the Lead Auditor's MOST appropriate course of action?

Options :

A : Accept the Quality Manager-s explanation and close the audit finding, as long as working papers are available upon request.

B : Issue a minor nonconformity, since the objective evidence is available even if not included in the report.

C : Issue a major nonconformity, as the lack of objective evidence in the audit report hinders the effectiveness of the audit process and the ability to demonstrate QMS compliance.

D : Recommend the company outsource their internal audit program to ensure impartiality and objectivity.

Answer: C

Question 2

During an ISO 13485:2016 audit, the Lead Auditor is reviewing the effectiveness of the company's Corrective and Preventive Action (CAPA) system. The auditor notes that the company's CAPA procedure includes a requirement for effectiveness checks to verify that implemented corrective actions have been effective in addressing the root cause of the problem and preventing recurrence. However, the Lead Auditor discovers that the effectiveness checks consistently focus on confirming the immediate resolution of the problem, with limited consideration of the long-term sustainability and robustness of the implemented corrective action, or its potential unintended consequences. What is the MOST appropriate next step for the Lead Auditor to take?

Options :

A : Accept the company-s approach, as the immediate resolution demonstrates the corrective action was effective.

B : Review the rationale for the short-term effectiveness checks and evaluate whether it aligns with the nature of the identified problems and the implemented corrective actions.

C : Document a minor nonconformity, since some effectiveness checks are performed, and allow the company to fix the issue after the audit.

D : Issue a major nonconformity, as the procedure is well-documented and effectiveness checks are being performed, which indicates a systematic issue.

Answer: B

Question 3

A medical device company manufactures Class IIa devices and is undergoing an ISO 13485:2016 audit. During a review of the organization's change control process, the Lead Auditor discovers that the company's impact assessment for product changes only focuses on assessing the impact to the design and manufacturing processes. There is no documented procedure for assessing the impact of the change on device labeling, including IFU (Instructions for Use), warnings and precautions, symbols, or any regulatory labeling requirements. As the Lead Auditor, what is the MOST appropriate action to take?

Options :

A : Accept the existing procedure, as it adequately covers the primary aspects of product change impact.

B : Issue a finding related to inadequate consideration of change impact on the risk management file.

C : Inquire if all change control personnel have been trained on identifying labeling requirements.

D : Issue a finding related to inadequate consideration of change impact on labeling.

Answer: D

Question 4

A medical device company is undergoing an ISO 13485:2016 audit. The Lead Auditor observes that the company uses a software program to manage customer complaints and track corrective actions. The software program allows users to easily generate reports and analyze trends in customer feedback. The manufacturer has performed initial validation and has documented a process for regular preventative maintenance of the software. What additional action must be verified by the Lead Auditor to ensure compliance?

Options :

A : The Lead Auditor should verify the integrity of the software is maintained and secured against unauthorized changes.

B : The Lead Auditor should verify that the software generates aesthetically pleasing and easily understandable reports.

C : The Lead Auditor should verify the software developers hold an ISO 13485:2016 Lead Auditor certification.

D : The Lead Auditor should verify the software is also used for other business functions such as marketing.

Answer: A

Question 5

During an ISO 13485:2016 audit, the Lead Auditor is reviewing the Supplier Quality Agreement between the medical device company and a contract manufacturer of a critical component. The Supplier Quality Agreement details the product specifications, quality requirements, and acceptance criteria. The Lead Auditor confirms there is evidence of recent performance data trending showing sustained compliance. However, the Lead Auditor discovers that the Supplier Quality Agreement does not define how the contract manufacturer must manage changes to its own suppliers, including sub-tier supplier changes. As a Lead Auditor, what is the MOST appropriate determination regarding the company's approach?

Options :

A : The company-s approach is acceptable because the contract manufacturer is responsible for managing their own suppliers.

B : The company-s approach is acceptable, provided the contract manufacturer is ISO 13485 certified.

C : The company-s approach is noncompliant. The medical device company should have approval authority over the contract manufacturer-s changes to sub-tier suppliers.

D : The company-s approach is acceptable because of the evidence of recent performance data trending showing sustained compliance.

Answer: C