Free GAQM ISO-QMS-13485 Exam Questions

Question 1

A medical device company manufactures Class IIa devices and is undergoing an ISO 13485:2016 audit. The company performs internal audits. The Lead Auditor reviews the internal audit reports and discovers that the reports consistently lack objective evidence to support the audit findings and conclusions. The Quality Manager explains that while the audit reports may not contain direct objective evidence in the report, they maintain detailed working papers with all the objective evidence, that can be requested and reviewed upon request, and which support the report's findings. What should be the Lead Auditor's MOST appropriate course of action?

A : Accept the Quality Manager's explanation and close the audit finding, as long as working papers are available upon request.

B : Issue a minor nonconformity, since the objective evidence is available even if not included in the report.

C : Issue a major nonconformity, as the lack of objective evidence in the audit report hinders the effectiveness of the audit process and the ability to demonstrate QMS compliance.

D : Recommend the company outsource their internal audit program to ensure impartiality and objectivity.

Answer: C

Question 2

A medical device company is undergoing an ISO 13485:2016 audit. During a tour of the manufacturing facility, the Lead Auditor observes that several production machines are connected to the company's internal network. The company has a firewall and intrusion detection system in place. However, there is no documented assessment of the cybersecurity risks associated with these network-connected machines, including the potential impact on product quality or patient safety if a machine were compromised. What is the MOST appropriate action for the Lead Auditor to take?

A : Accept the existing security measures as sufficient, given the presence of a firewall and intrusion detection system.

B : Issue a minor nonconformity, recommending the company conduct a cybersecurity awareness training for manufacturing personnel.

C : Issue a major nonconformity because there is no documented risk assessment of cybersecurity vulnerabilities.

D : Inquire with the IT department about their standard cybersecurity policies, and accept those policies for manufacturing.

Answer: C

Question 3

A medical device company is undergoing an ISO 13485:2016 audit. The company outsources the manufacturing of a critical component to a supplier. During the audit, the Lead Auditor discovers the supplier performs 100% automated inspection of the critical dimensions of the component, and the medical device company's quality group does not perform incoming inspection. The Lead Auditor reviews the process for controlling these outsourced processes and confirms the supplier's automated inspection system used to verify critical product dimensions is validated. What additional action must be verified by the Lead Auditor to ensure compliance?

A : The Lead Auditor should verify that the medical device company’s quality control personnel are trained on the supplier’s automated inspection system.

B : The Lead Auditor should verify there is a procedure for periodic calibration of the automated inspection system, and for reviewing the results to evaluate the ongoing validity of the automated inspection data.

C : The Lead Auditor should verify the supplier performs a manual inspection, in addition to the automated inspection, to serve as a comparison between the two.

D : The Lead Auditor should verify the medical device company performs on-site audits of the supplier’s facility and evaluates the performance of the automated inspection system.

Answer: B

Question 4

A medical device company is undergoing an ISO 13485:2016 audit. The company has a documented procedure for design verification. As the Lead Auditor, you discover that the company has not formally validated the computer software used to perform finite element analysis (FEA) during design verification, where the FEA is part of the QMS and Clause 4.1.6 applies. The output of the FEA software is used as objective evidence that the design meets safety and performance requirements. The FEA software is commercial off-the-shelf software and not developed by the medical device manufacturer. The company states that they check the FEA software inputs and outputs against hand calculations as a form of verification. As the Lead Auditor, what is your MOST appropriate course of action?

A : Accept the company's approach because the software is commercially available and inputs and outputs are verified using hand calculations.

B : Consider the company's approach as verification and ask for the documented procedure for verification, objective evidence, and acceptance criteria for these hand calculations.

C : Document the lack of software validation as a finding and follow up during the next surveillance audit.

D : Issue a nonconformity because the FEA software used for design verification must be validated for its intended use.

Answer: D

Question 5

A medical device company is undergoing an ISO 13485:2016 audit. The Lead Auditor observes that the company uses a software program to manage customer complaints and track corrective actions. The software program allows users to easily generate reports and analyze trends in customer feedback. The manufacturer has performed initial validation and has documented a process for regular preventative maintenance of the software. What additional action must be verified by the Lead Auditor to ensure compliance?

A : The Lead Auditor should verify the integrity of the software is maintained and secured against unauthorized changes.

B : The Lead Auditor should verify that the software generates aesthetically pleasing and easily understandable reports.

C : The Lead Auditor should verify the software developers hold an ISO 13485:2016 Lead Auditor certification.

D : The Lead Auditor should verify the software is also used for other business functions such as marketing.

Answer: A