Question 1

During an ISO 13485:2016 audit, the Lead Auditor discovers that a medical device company uses a cloud-based software to manage its training records. The software provider states the system is fully compliant with all relevant data privacy requirements such as GDPR and HIPAA. The manufacturer performs an annual review of the software provider’s SOC 2 Type II report to verify its compliance with relevant security standards. Considering the requirements of ISO 13485:2016 regarding the control of outsourced processes, what should be your MOST appropriate next action?

Options :

A : Accept the SOC 2 Type II report as sufficient evidence of compliance, and move on to another area of the audit.

B : Confirm the scope of the SOC 2 Type II report addresses the specific data privacy and security controls required by the company-s QMS and applicable regulations, and verify the medical device manufacturer has performed a documented risk assessment to identify potential risks associated with data privacy.

C : Require the company to perform a full on-site audit of the software provider-s facility to verify compliance with data privacy requirements.

D : Accept the software provider-s statement of compliance without further verification, as cloud providers are inherently responsible for data privacy.

Answer: B

Question 2

A medical device manufacturer is using a cloud-based software platform for managing its quality management system (QMS) documentation, including procedures, work instructions, and records. The manufacturer claims that since the cloud provider is ISO 27001 certified, they do not need to perform their own validation of the software's suitability for managing their QMS data. As a Lead Auditor, how should you respond?

Options :

A : Accept the manufacturer-s reasoning, as ISO 27001 certification of the cloud provider sufficiently addresses data security and integrity concerns.

B : Inform the manufacturer that ISO 27001 certification is irrelevant to the validation requirements of ISO 13485:2016, and full validation is always necessary.

C : Acknowledge the ISO 27001 certification but require the manufacturer to demonstrate through documented evidence that the software platform is suitable for managing QMS data and meets applicable regulatory requirements, focusing on data integrity, security, and accessibility.

D : Suggest that the manufacturer only needs to validate the interfaces between the cloud-based system and any local systems, as the cloud provider is responsible for validating the core functionality.

Answer: C

Question 3

During an ISO 13485:2016 audit, the Lead Auditor is reviewing the effectiveness of the company's Corrective and Preventive Action (CAPA) system. The auditor notes that the company's CAPA procedure includes a requirement for effectiveness checks to verify that implemented corrective actions have been effective in addressing the root cause of the problem and preventing recurrence. However, the Lead Auditor discovers that the effectiveness checks consistently focus on confirming the immediate resolution of the problem, with limited consideration of the long-term sustainability and robustness of the implemented corrective action, or its potential unintended consequences. What is the MOST appropriate next step for the Lead Auditor to take?

Options :

A : Accept the company-s approach, as the immediate resolution demonstrates the corrective action was effective.

B : Review the rationale for the short-term effectiveness checks and evaluate whether it aligns with the nature of the identified problems and the implemented corrective actions.

C : Document a minor nonconformity, since some effectiveness checks are performed, and allow the company to fix the issue after the audit.

D : Issue a major nonconformity, as the procedure is well-documented and effectiveness checks are being performed, which indicates a systematic issue.

Answer: B

Question 4

A medical device company is undergoing an ISO 13485:2016 audit. The company has a documented procedure for supplier evaluation, and the company has several suppliers used to produce critical components. The company’s procedure outlines initial evaluation, periodic evaluation, and performance monitoring, however, for some suppliers that are deemed “low-risk” there is no *documented rationale* for why those suppliers were classified as such. As the Lead Auditor, what is the MOST appropriate action to take?

Options :

A : Accept the company-s classification of the suppliers as "low-risk" without further investigation, as long as the products they supply consistently meet specifications.

B : Issue a minor nonconformity, and require that the company either conduct a risk assessment or generate a documented rationale for why the suppliers were classified as low risk.

C : Accept the classification if these suppliers provide components to Class I devices.

D : Issue a major nonconformity, since all supplier evaluations must be documented with a detailed, objective risk assessment.

Answer: B

Question 5

During an ISO 13485:2016 audit, the Lead Auditor is reviewing the process for design transfer. The design transfer documentation includes detailed specifications, drawings, and manufacturing instructions. However, the documentation does not explicitly define the verification activities required to ensure the design is correctly translated into production. As a Lead Auditor, what should be your PRIMARY concern?

Options :

A : The lack of documented traceability between design inputs and design outputs.

B : The absence of a risk management plan specifically for the design transfer process.

C : The lack of defined verification activities to confirm successful design transfer to production.

D : The absence of evidence of review and approval of the design transfer documentation.

Answer: C

Free ISO-QMS-13485 Mock Exam – Practice Online Confidently

Buying Options: