Free GAQM ISO-QMS-13485 Exam Questions

Question 1

A medical device company is undergoing an ISO 13485:2016 audit. The company utilizes a cloud-based Enterprise Resource Planning (ERP) system for managing its inventory, purchasing, and production planning. The company claims that since the cloud provider is ISO 27001 certified, they do not need to perform their own validation of the software's suitability for managing their QMS data. As a Lead Auditor, what aspect of validation and security is MOST important to investigate?

A : Confirm that the cloud provider's ISO 27001 certification covers the specific services used by the medical device company.

B : Verify that the medical device company has a documented procedure for data backup and disaster recovery in case of a cloud outage.

C : Assess whether the medical device company has performed its own risk assessment to identify potential risks related to data integrity, data privacy and data availability when using the ERP.

D : Review the contract between the medical device company and the cloud provider to ensure it clearly defines responsibilities for data security and data privacy.

Answer: C

Question 2

A medical device company is undergoing an ISO 13485:2016 audit. The Lead Auditor observes that the company uses a software program to manage customer complaints and track corrective actions. The software program allows users to easily generate reports and analyze trends in customer feedback. The manufacturer has performed initial validation and has documented a process for regular preventative maintenance of the software. What additional action must be verified by the Lead Auditor to ensure compliance?

A : The Lead Auditor should verify the integrity of the software is maintained and secured against unauthorized changes.

B : The Lead Auditor should verify that the software generates aesthetically pleasing and easily understandable reports.

C : The Lead Auditor should verify the software developers hold an ISO 13485:2016 Lead Auditor certification.

D : The Lead Auditor should verify the software is also used for other business functions such as marketing.

Answer: A

Question 3

A medical device company utilizes a cloud-based platform for managing its Quality Management System (QMS) documentation. The company’s documented procedure for software validation and data security, while comprehensive, does not address the specific requirements for verifying the ongoing data integrity and availability of QMS data on the cloud platform. The company does not perform independent backup of their cloud data. As a Lead Auditor, what is the MOST appropriate action to take?

A : Accept the company-s reliance on the cloud provider-s security measures as sufficient evidence of data integrity and availability.

B : Issue a minor nonconformity, provided the company has a disaster recovery plan in place.

C : Issue a major nonconformity, as the lack of verification directly impacts the reliability of the QMS and data security.

D : Request the company to provide documentation of the cloud provider’s security policies and procedures and assess their suitability.

Answer: C

Question 4

A medical device company uses a contract manufacturer to produce a critical component for one of their Class III devices. During an ISO 13485:2016 audit of the medical device company (not the contract manufacturer), the Lead Auditor reviews the records pertaining to the oversight of the contract manufacturer. The records show regular communication, agreed-upon specifications, and documented inspections of incoming components. However, there is no documented evidence of periodic on-site audits of the contract manufacturer's facilities. What is the MOST appropriate conclusion for the Lead Auditor to draw?

A : The arrangement is acceptable, as long as the incoming inspections are thorough and meet acceptance criteria.

B : The absence of on-site audits is a minor nonconformity, requiring only a commitment to schedule future audits.

C : The lack of on-site audits is a major nonconformity, as it demonstrates a failure to adequately control outsourced processes.

D : The company is only required to audit the contract manufacturer if there are persistent quality issues with the incoming components.

Answer: C

Question 5

During an ISO 13485:2016 audit, the Lead Auditor is reviewing the Supplier Quality Agreement between the medical device company and a contract manufacturer of a critical component. The Supplier Quality Agreement details the product specifications, quality requirements, and acceptance criteria. The Lead Auditor confirms there is evidence of recent performance data trending showing sustained compliance. However, the Lead Auditor discovers that the Supplier Quality Agreement does not define how the contract manufacturer must manage changes to its own suppliers, including sub-tier supplier changes. As a Lead Auditor, what is the MOST appropriate determination regarding the company's approach?

A : The company-s approach is acceptable because the contract manufacturer is responsible for managing their own suppliers.

B : The company-s approach is acceptable, provided the contract manufacturer is ISO 13485 certified.

C : The company-s approach is noncompliant. The medical device company should have approval authority over the contract manufacturer-s changes to sub-tier suppliers.

D : The company-s approach is acceptable because of the evidence of recent performance data trending showing sustained compliance.

Answer: C