ASQ Certified Medical Device
Auditor (CMDA) Examination
Preparation V2.0: 150 Advanced
Multiple-Choice Questions with
Scenario-Based Application,
Regulatory Integration, and
Technical Depth for the
September 1–30, 2026 Testing
Window.
Table of Contents
Section Topic Questions
I Auditing Fundamentals 1–18
II Auditing and Inspection Processes 19–48
III Medical Device Quality Management System Requirements 49–88
,Section Topic Questions
IV Technical Medical Device Knowledge 89–130
V Quality Tools and Techniques 131–150
Correct Answers and Rationales All
Section I: Auditing Fundamentals (Questions 1–18)
1. During a notified body surveillance audit of a Class III implantable device manufacturer, the lead
auditor discovers that the organization's internal audit program has not audited the design control
process in two consecutive audit cycles. The organization's procedure defines an annual audit cycle
covering all ISO 13485 clauses. Which classification and clause citation is MOST appropriate?
A. Observation against Clause 7.3 (Design and Development)
B. Minor nonconformity against Clause 8.2.4 (Internal Audit)
C. Major nonconformity against Clause 8.2.4 (Internal Audit)
D. Opportunity for improvement against Clause 4.1 (General Requirements)
Correct Answer: C. Major nonconformity against Clause 8.2.4 (Internal Audit)
Rationale: The systematic failure to audit a critical process over two consecutive cycles represents a
breakdown of the internal audit program itself. This is a major nonconformity because the audit
program is not achieving its intended objective of verifying conformity across all QMS processes. The
issue is not with design control itself but with the audit program's failure to cover it.
2. An auditor is engaged to conduct a gap assessment of a contract sterilizer against ISO 13485:2016.
The sterilizer also holds ISO 9001:2015 certification. Which statement BEST describes the relationship
between these standards for audit purposes?
A. ISO 9001 certification fully satisfies ISO 13485 requirements for sterilization
B. ISO 9001 certification is irrelevant because it does not address medical device-specific requirements
C. ISO 9001 certification may reduce audit scope but does not eliminate the need to verify ISO 13485-
specific requirements
D. ISO 9001 certification automatically qualifies the sterilizer as an approved supplier
Correct Answer: C. ISO 9001 certification may reduce audit scope but does not eliminate the
need to verify ISO 13485-specific requirements
Rationale: ISO 9001 is a general quality management standard and does not address medical device-
specific requirements such as risk management, design controls, traceability, or regulatory reporting.
,While ISO 9001 certification demonstrates a baseline QMS, the auditor must still verify conformity to
ISO 13485 clauses relevant to sterilization services.
3. Under the FDA's QMSR, which of the following statements accurately describes the relationship
between 21 CFR Part 820 and ISO 13485:2016?
A. ISO 13485:2016 fully replaces 21 CFR Part 820 with no additional requirements
B. 21 CFR Part 820 incorporates ISO 13485:2016 by reference and adds certain FDA-specific
requirements
C. ISO 13485:2016 is optional for FDA compliance; manufacturers may choose either framework
D. 21 CFR Part 820 and ISO 13485:2016 are mutually exclusive regulatory frameworks
Correct Answer: B. 21 CFR Part 820 incorporates ISO 13485:2016 by reference and adds certain
FDA-specific requirements
Rationale: The QMSR, effective February 2, 2026, amends 21 CFR Part 820 to incorporate ISO
13485:2016 by reference. The FDA has also established additional requirements to clarify certain
expectations and ensure consistency with other FDA requirements, such as those related to labeling and
record retention.
4. A medical device manufacturer has a supplier of critical components that is located in a country
with no mutual recognition agreement with the manufacturer's regulatory jurisdiction. The
manufacturer has not conducted an on-site audit of this supplier. Which ISO 13485:2016 clause is MOST
directly applicable to this situation?
A. Clause 7.4.1 (Purchasing Process)
B. Clause 7.4.2 (Purchasing Information)
C. Clause 4.1.5 (Outsourced Processes)
D. Clause 8.2.3 (Monitoring and Measurement of Product)
Correct Answer: A. Clause 7.4.1 (Purchasing Process)
Rationale: Clause 7.4.1 requires the organization to establish criteria for evaluation and selection of
suppliers based on the supplier's ability to provide product in accordance with requirements. The
frequency and extent of supplier monitoring, including audits, should be defined and risk-based.
Geographic location and lack of mutual recognition agreements increase risk and should influence the
decision to audit.
5. An auditor is reviewing a medical device manufacturer's CAPA system and finds that 40% of
corrective actions are closed without documented effectiveness verification. The auditor's next step
should be to:
, A. Immediately issue a major nonconformity against Clause 8.5.2
B. Expand the sample to determine whether this is a systemic or isolated issue
C. Interview the CAPA owner to understand their interpretation of the procedure
D. All of the above, in sequence, to gather sufficient objective evidence
Correct Answer: D. All of the above, in sequence, to gather sufficient objective evidence
Rationale: The auditor should first gather more evidence to determine the scope of the issue (expand
sampling), then interview responsible personnel to understand root causes, and finally determine the
appropriate classification based on the totality of evidence. Jumping directly to a nonconformity without
sufficient evidence is not good audit practice.
6. Which of the following BEST describes the concept of "audit criteria" as defined in ISO
19011:2018?
A. The evidence gathered during the audit
B. The set of requirements used as a reference against which audit evidence is compared
C. The conclusions reached by the audit team
D. The plan developed to conduct the audit
Correct Answer: B. The set of requirements used as a reference against which audit evidence is
compared
Rationale: Audit criteria are the set of policies, procedures, standards, laws, regulations, contracts, or
other requirements against which audit evidence is compared. Audit findings are the result of
comparing evidence to criteria.
7. A medical device manufacturer is preparing for an FDA inspection under the QMSR. The FDA
investigator requests records related to a specific complaint from 18 months ago. The manufacturer's
procedure specifies a 12-month retention period for complaint records. What is the MOST likely
outcome?
A. The FDA will accept the 12-month retention period if it is documented in the procedure
B. The manufacturer is in violation because ISO 13485 requires complaint records to be retained for at
least 5 years
C. The manufacturer should have retained the record because the FDA expects records to be retained
for at least the lifetime of the device, but not less than 2 years from release
D. The FDA has no authority to request records older than 12 months
Correct Answer: C. The manufacturer should have retained the record because the FDA expects
records to be retained for at least the lifetime of the device, but not less than 2 years from release
Rationale: The QMSR and ISO 13485:2016 Clause 4.2.5 require that records be retained for a period
defined by the organization, at least for the lifetime of the medical device as defined by the
Auditor (CMDA) Examination
Preparation V2.0: 150 Advanced
Multiple-Choice Questions with
Scenario-Based Application,
Regulatory Integration, and
Technical Depth for the
September 1–30, 2026 Testing
Window.
Table of Contents
Section Topic Questions
I Auditing Fundamentals 1–18
II Auditing and Inspection Processes 19–48
III Medical Device Quality Management System Requirements 49–88
,Section Topic Questions
IV Technical Medical Device Knowledge 89–130
V Quality Tools and Techniques 131–150
Correct Answers and Rationales All
Section I: Auditing Fundamentals (Questions 1–18)
1. During a notified body surveillance audit of a Class III implantable device manufacturer, the lead
auditor discovers that the organization's internal audit program has not audited the design control
process in two consecutive audit cycles. The organization's procedure defines an annual audit cycle
covering all ISO 13485 clauses. Which classification and clause citation is MOST appropriate?
A. Observation against Clause 7.3 (Design and Development)
B. Minor nonconformity against Clause 8.2.4 (Internal Audit)
C. Major nonconformity against Clause 8.2.4 (Internal Audit)
D. Opportunity for improvement against Clause 4.1 (General Requirements)
Correct Answer: C. Major nonconformity against Clause 8.2.4 (Internal Audit)
Rationale: The systematic failure to audit a critical process over two consecutive cycles represents a
breakdown of the internal audit program itself. This is a major nonconformity because the audit
program is not achieving its intended objective of verifying conformity across all QMS processes. The
issue is not with design control itself but with the audit program's failure to cover it.
2. An auditor is engaged to conduct a gap assessment of a contract sterilizer against ISO 13485:2016.
The sterilizer also holds ISO 9001:2015 certification. Which statement BEST describes the relationship
between these standards for audit purposes?
A. ISO 9001 certification fully satisfies ISO 13485 requirements for sterilization
B. ISO 9001 certification is irrelevant because it does not address medical device-specific requirements
C. ISO 9001 certification may reduce audit scope but does not eliminate the need to verify ISO 13485-
specific requirements
D. ISO 9001 certification automatically qualifies the sterilizer as an approved supplier
Correct Answer: C. ISO 9001 certification may reduce audit scope but does not eliminate the
need to verify ISO 13485-specific requirements
Rationale: ISO 9001 is a general quality management standard and does not address medical device-
specific requirements such as risk management, design controls, traceability, or regulatory reporting.
,While ISO 9001 certification demonstrates a baseline QMS, the auditor must still verify conformity to
ISO 13485 clauses relevant to sterilization services.
3. Under the FDA's QMSR, which of the following statements accurately describes the relationship
between 21 CFR Part 820 and ISO 13485:2016?
A. ISO 13485:2016 fully replaces 21 CFR Part 820 with no additional requirements
B. 21 CFR Part 820 incorporates ISO 13485:2016 by reference and adds certain FDA-specific
requirements
C. ISO 13485:2016 is optional for FDA compliance; manufacturers may choose either framework
D. 21 CFR Part 820 and ISO 13485:2016 are mutually exclusive regulatory frameworks
Correct Answer: B. 21 CFR Part 820 incorporates ISO 13485:2016 by reference and adds certain
FDA-specific requirements
Rationale: The QMSR, effective February 2, 2026, amends 21 CFR Part 820 to incorporate ISO
13485:2016 by reference. The FDA has also established additional requirements to clarify certain
expectations and ensure consistency with other FDA requirements, such as those related to labeling and
record retention.
4. A medical device manufacturer has a supplier of critical components that is located in a country
with no mutual recognition agreement with the manufacturer's regulatory jurisdiction. The
manufacturer has not conducted an on-site audit of this supplier. Which ISO 13485:2016 clause is MOST
directly applicable to this situation?
A. Clause 7.4.1 (Purchasing Process)
B. Clause 7.4.2 (Purchasing Information)
C. Clause 4.1.5 (Outsourced Processes)
D. Clause 8.2.3 (Monitoring and Measurement of Product)
Correct Answer: A. Clause 7.4.1 (Purchasing Process)
Rationale: Clause 7.4.1 requires the organization to establish criteria for evaluation and selection of
suppliers based on the supplier's ability to provide product in accordance with requirements. The
frequency and extent of supplier monitoring, including audits, should be defined and risk-based.
Geographic location and lack of mutual recognition agreements increase risk and should influence the
decision to audit.
5. An auditor is reviewing a medical device manufacturer's CAPA system and finds that 40% of
corrective actions are closed without documented effectiveness verification. The auditor's next step
should be to:
, A. Immediately issue a major nonconformity against Clause 8.5.2
B. Expand the sample to determine whether this is a systemic or isolated issue
C. Interview the CAPA owner to understand their interpretation of the procedure
D. All of the above, in sequence, to gather sufficient objective evidence
Correct Answer: D. All of the above, in sequence, to gather sufficient objective evidence
Rationale: The auditor should first gather more evidence to determine the scope of the issue (expand
sampling), then interview responsible personnel to understand root causes, and finally determine the
appropriate classification based on the totality of evidence. Jumping directly to a nonconformity without
sufficient evidence is not good audit practice.
6. Which of the following BEST describes the concept of "audit criteria" as defined in ISO
19011:2018?
A. The evidence gathered during the audit
B. The set of requirements used as a reference against which audit evidence is compared
C. The conclusions reached by the audit team
D. The plan developed to conduct the audit
Correct Answer: B. The set of requirements used as a reference against which audit evidence is
compared
Rationale: Audit criteria are the set of policies, procedures, standards, laws, regulations, contracts, or
other requirements against which audit evidence is compared. Audit findings are the result of
comparing evidence to criteria.
7. A medical device manufacturer is preparing for an FDA inspection under the QMSR. The FDA
investigator requests records related to a specific complaint from 18 months ago. The manufacturer's
procedure specifies a 12-month retention period for complaint records. What is the MOST likely
outcome?
A. The FDA will accept the 12-month retention period if it is documented in the procedure
B. The manufacturer is in violation because ISO 13485 requires complaint records to be retained for at
least 5 years
C. The manufacturer should have retained the record because the FDA expects records to be retained
for at least the lifetime of the device, but not less than 2 years from release
D. The FDA has no authority to request records older than 12 months
Correct Answer: C. The manufacturer should have retained the record because the FDA expects
records to be retained for at least the lifetime of the device, but not less than 2 years from release
Rationale: The QMSR and ISO 13485:2016 Clause 4.2.5 require that records be retained for a period
defined by the organization, at least for the lifetime of the medical device as defined by the
