Question 1

A medical device company is undergoing an ISO 13485:2016 audit. During a tour of the manufacturing facility, the Lead Auditor observes that several production machines are connected to the company's internal network. The company has a firewall and intrusion detection system in place. However, there is no documented assessment of the cybersecurity risks associated with these network-connected machines, including the potential impact on product quality or patient safety if a machine were compromised. What is the MOST appropriate action for the Lead Auditor to take?

Options :

A : Accept the existing security measures as sufficient, given the presence of a firewall and intrusion detection system.

B : Issue a minor nonconformity, recommending the company conduct a cybersecurity awareness training for manufacturing personnel.

C : Issue a major nonconformity because there is no documented risk assessment of cybersecurity vulnerabilities.

D : Inquire with the IT department about their standard cybersecurity policies, and accept those policies for manufacturing.

Answer: C

Question 2

A medical device manufacturer is using a cloud-based software platform for managing its quality management system (QMS) documentation, including procedures, work instructions, and records. The manufacturer claims that since the cloud provider is ISO 27001 certified, they do not need to perform their own validation of the software's suitability for managing their QMS data. As a Lead Auditor, how should you respond?

Options :

A : Accept the manufacturer-s reasoning, as ISO 27001 certification of the cloud provider sufficiently addresses data security and integrity concerns.

B : Inform the manufacturer that ISO 27001 certification is irrelevant to the validation requirements of ISO 13485:2016, and full validation is always necessary.

C : Acknowledge the ISO 27001 certification but require the manufacturer to demonstrate through documented evidence that the software platform is suitable for managing QMS data and meets applicable regulatory requirements, focusing on data integrity, security, and accessibility.

D : Suggest that the manufacturer only needs to validate the interfaces between the cloud-based system and any local systems, as the cloud provider is responsible for validating the core functionality.

Answer: C

Question 3

A medical device company is undergoing an ISO 13485:2016 audit. The company utilizes a contract manufacturer for a critical component of their Class II medical device. The Lead Auditor reviews the company's process for controlling the outsourced process. The quality agreement with the contract manufacturer clearly defines the product specifications, quality requirements, and acceptance criteria. There is evidence of recent performance data trending showing sustained compliance, however, the quality agreement does not define how frequently the quality agreement itself is reviewed or updated. As a Lead Auditor, what is the MOST appropriate determination regarding the company's approach?

Options :

A : The lack of a defined review frequency for the quality agreement is a critical nonconformity and must be cited, as all agreements need to be reviewed and updated annually.

B : The Lead Auditor should verify that there is a process in place to address changes to the contract manufacturer-s processes or requirements that would necessitate an update to the quality agreement.

C : The Lead Auditor should only be concerned with compliance to specifications, quality requirements, and acceptance criteria. The Lead Auditor should not focus on the frequency of reviewing agreements as that is an administrative burden.

D : As long as the medical device manufacturer has evidence to show compliance to specification, there is no need to verify that agreements have a process in place to address changes to the contract manufacturer’s processes or requirements that would necessitate an update to the quality agreement.

Answer: B

Question 4

A medical device company uses a contract manufacturer to produce a critical component for one of their Class III devices. During an ISO 13485:2016 audit of the medical device company (not the contract manufacturer), the Lead Auditor reviews the records pertaining to the oversight of the contract manufacturer. The records show regular communication, agreed-upon specifications, and documented inspections of incoming components. However, there is no documented evidence of periodic on-site audits of the contract manufacturer's facilities. What is the MOST appropriate conclusion for the Lead Auditor to draw?

Options :

A : The arrangement is acceptable, as long as the incoming inspections are thorough and meet acceptance criteria.

B : The absence of on-site audits is a minor nonconformity, requiring only a commitment to schedule future audits.

C : The lack of on-site audits is a major nonconformity, as it demonstrates a failure to adequately control outsourced processes.

D : The company is only required to audit the contract manufacturer if there are persistent quality issues with the incoming components.

Answer: C

Question 5

A medical device company manufactures Class IIa devices and is undergoing an ISO 13485:2016 audit. During a review of the organization's change control process, the Lead Auditor discovers that the company's impact assessment for product changes only focuses on assessing the impact to the design and manufacturing processes. There is no documented procedure for assessing the impact of the change on device labeling, including IFU (Instructions for Use), warnings and precautions, symbols, or any regulatory labeling requirements. As the Lead Auditor, what is the MOST appropriate action to take?

Options :

A : Accept the existing procedure, as it adequately covers the primary aspects of product change impact.

B : Issue a finding related to inadequate consideration of change impact on the risk management file.

C : Inquire if all change control personnel have been trained on identifying labeling requirements.

D : Issue a finding related to inadequate consideration of change impact on labeling.

Answer: D

Free ISO-QMS-13485 Mock Exam – Practice Online Confidently

Buying Options: