Question 1

A medical device company utilizes a cloud-based platform for managing its Quality Management System (QMS) documentation. The company’s documented procedure for software validation and data security, while comprehensive, does not address the specific requirements for verifying the ongoing data integrity and availability of QMS data on the cloud platform. The company does not perform independent backup of their cloud data. As a Lead Auditor, what is the MOST appropriate action to take?

Options :

A : Accept the company-s reliance on the cloud provider-s security measures as sufficient evidence of data integrity and availability.

B : Issue a minor nonconformity, provided the company has a disaster recovery plan in place.

C : Issue a major nonconformity, as the lack of verification directly impacts the reliability of the QMS and data security.

D : Request the company to provide documentation of the cloud provider’s security policies and procedures and assess their suitability.

Answer: C

Question 2

A medical device company is undergoing an ISO 13485:2016 audit. The company has a documented procedure for design verification. As the Lead Auditor, you discover that the company has not formally validated the computer software used to perform finite element analysis (FEA) during design verification, where the FEA is part of the QMS and Clause 4.1.6 applies. The output of the FEA software is used as objective evidence that the design meets safety and performance requirements. The FEA software is commercial off-the-shelf software and not developed by the medical device manufacturer. The company states that they check the FEA software inputs and outputs against hand calculations as a form of verification. As the Lead Auditor, what is your MOST appropriate course of action?

Options :

A : Accept the company-s approach because the software is commercially available and inputs and outputs are verified using hand calculations.

B : Consider the company-s approach as verification and ask for the documented procedure for verification, objective evidence, and acceptance criteria for these hand calculations.

C : Document the lack of software validation as a finding and follow up during the next surveillance audit.

D : Issue a nonconformity because the FEA software used for design verification must be validated for its intended use.

Answer: D

Question 3

A medical device company is undergoing an ISO 13485:2016 audit. The company uses a cloud-based software to manage its training records. The software provider states the system is fully compliant with all relevant data privacy requirements such as GDPR and HIPAA. The manufacturer performs an annual review of the software provider’s SOC 2 Type II report to verify its compliance with relevant security standards, however, the medical device company has not performed any risk assessment to identify potential risks associated with data privacy.

Options :

A : Accept the company-s reliance on the software provider-s statement and the SOC 2 report as sufficient evidence of compliance.

B : Require the company to perform a data protection impact assessment (DPIA) or risk assessment to identify and mitigate potential data privacy risks.

C : Recommend that the company obtain a written guarantee from the software provider ensuring compliance with all applicable data privacy regulations.

D : Issue a nonconformity for the lack of a documented data privacy procedure, regardless of the risk assessment.

Answer: B

Question 4

A medical device company is undergoing an ISO 13485:2016 audit. The company utilizes a cloud-based Enterprise Resource Planning (ERP) system for managing its inventory, purchasing, and production planning. The company claims that since the cloud provider is ISO 27001 certified, they do not need to perform their own validation of the software's suitability for managing their QMS data. As a Lead Auditor, what aspect of validation and security is MOST important to investigate?

Options :

A : Confirm that the cloud provider-s ISO 27001 certification covers the specific services used by the medical device company.

B : Verify that the medical device company has a documented procedure for data backup and disaster recovery in case of a cloud outage.

C : Assess whether the medical device company has performed its own risk assessment to identify potential risks related to data integrity, data privacy and data availability when using the ERP.

D : Review the contract between the medical device company and the cloud provider to ensure it clearly defines responsibilities for data security and data privacy.

Answer: C

Question 5

A medical device manufacturer is undergoing an ISO 13485:2016 audit. They utilize a contract manufacturer to produce a critical component for one of their Class III devices. During the audit, the Lead Auditor reviews the medical device company's records pertaining to the oversight of the contract manufacturer. While the records show regular communication, agreed-upon specifications, and documented inspections of incoming components, the Lead Auditor discovers that the medical device company is performing no periodic on-site audits of the contract manufacturer's facility. What type of conclusion should the Lead Auditor draw?

Options :

A : This is acceptable if the medical device company has a robust system for monitoring the quality of incoming components and the contract manufacturer maintains ISO 13485 certification.

B : This is a minor nonconformity because the medical device company is still communicating with the contract manufacturer.

C : This is a major nonconformity because the medical device company has not ensured compliance with ISO 13485:2016 requirements.

D : This is acceptable if the medical device company has a documented rationale explaining why on-site audits are not necessary.

Answer: C

Confidently Practice Online with Free ISO-QMS-13485 Exam Cram

Buying Options: