NEWEST ISO 13485 MEDICAL DEVICES
QUALITY MANAGEMENT - LEAD AUDITOR
CERTIFICATION EXAM OFFERED BY CQI &
IRCA | COMPLETE EXAM Q&A WITH
RATIONALES
1. You are conducting a Stage 1 documentation audit
for a Class II implantable device manufacturer
seeking initial ISO 13485 certification. During the
opening meeting, the Quality Manager states: “We
have fully implemented a QMS that is based on ISO
9001:2015 plus a few additional medical device
procedures.” Which aspect of this statement should
raise the most significant concern for the lead
auditor, and what is the most appropriate immediate
questioning strategy?
A) ISO 9001:2015 excludes design control
requirements for medical devices, which are
mandatory under Clause 7.3 of ISO 13485. You
should ask to see the design and development file for
a representative product, specifically the verification,
validation, and design transfer records.
,B) ISO 9001:2015 does not include any requirement
for risk management, whereas Clause 4.1.2 of ISO
13485 explicitly requires a risk-based approach to all
QMS processes.
C) ISO 9001:2015 requires fewer documented
procedures than ISO 13485, so the QMS is likely
under‑documented and will not conform.
D) The statement itself is not a concern; ISO 13485 is
fully aligned with ISO 9001:2015, and a QMS based on
the latter is automatically conforming.
Correct answer: A
Rationale: Clause 7.3 (Design and development) in
ISO 13485 contains significantly more detailed
requirements than ISO 9001:2015, including
mandatory design transfer, explicit design review
records, traceability between inputs and outputs, and
the need to address usability requirements in inputs.
ISO 9001:2015 does not have the same level of
prescriptive design control requirements for medical
devices.
,2. A medical device manufacturer uses a third‑party
logistics (3PL) provider to store and distribute
finished Class I sterile devices. The 3PL is not ISO
13485 certified, and the manufacturer has not
conducted an on‑site audit of the 3PL. The
manufacturer argues: “Our contract requires them to
follow our procedures, so they are not part of our
QMS.” As the lead auditor, which clause of ISO 13485
is most directly violated, and what is the most
appropriate finding?
A) Clause 4.1.1 – General requirements. The
manufacturer has failed to ensure control over
outsourced processes that affect product conformity,
and reliance on a contract without verification is
insufficient.
B) Clause 7.5.1 – Control of production and service
provision. The manufacturer has not validated the
storage and distribution processes of the 3PL.
C) Clause 8.2.1 – Monitoring and measurement. The
manufacturer has not established a feedback system
for the 3PL’s performance.
, D) Clause 6.4 – Work environment. The manufacturer
has not ensured that the 3PL maintains an
appropriate work environment for sterile devices.
Correct answer: A
Rationale: Clause 4.1.1 requires the organization to
ensure control over outsourced processes that affect
product conformity. ISO 13485 expects that
outsourced processes be assessed, monitored, and
controlled. A contract alone, without verification
(such as an audit or agreed performance metrics), is
not sufficient.
3. An implantable device manufacturer designs a new
orthopedic screw and plans to use a titanium alloy
with which it has no prior experience. The design
team has completed verification testing on the
screw’s mechanical properties but has not
performed any clinical validation because
“mechanical testing proves the product works.” As
the lead auditor, which requirement of Clause 7.3.6
(Design and development validation) must you cite to
justify a nonconformity?
A) Clause 7.3.6: “Validation of design and
development shall be performed on representative
QUALITY MANAGEMENT - LEAD AUDITOR
CERTIFICATION EXAM OFFERED BY CQI &
IRCA | COMPLETE EXAM Q&A WITH
RATIONALES
1. You are conducting a Stage 1 documentation audit
for a Class II implantable device manufacturer
seeking initial ISO 13485 certification. During the
opening meeting, the Quality Manager states: “We
have fully implemented a QMS that is based on ISO
9001:2015 plus a few additional medical device
procedures.” Which aspect of this statement should
raise the most significant concern for the lead
auditor, and what is the most appropriate immediate
questioning strategy?
A) ISO 9001:2015 excludes design control
requirements for medical devices, which are
mandatory under Clause 7.3 of ISO 13485. You
should ask to see the design and development file for
a representative product, specifically the verification,
validation, and design transfer records.
,B) ISO 9001:2015 does not include any requirement
for risk management, whereas Clause 4.1.2 of ISO
13485 explicitly requires a risk-based approach to all
QMS processes.
C) ISO 9001:2015 requires fewer documented
procedures than ISO 13485, so the QMS is likely
under‑documented and will not conform.
D) The statement itself is not a concern; ISO 13485 is
fully aligned with ISO 9001:2015, and a QMS based on
the latter is automatically conforming.
Correct answer: A
Rationale: Clause 7.3 (Design and development) in
ISO 13485 contains significantly more detailed
requirements than ISO 9001:2015, including
mandatory design transfer, explicit design review
records, traceability between inputs and outputs, and
the need to address usability requirements in inputs.
ISO 9001:2015 does not have the same level of
prescriptive design control requirements for medical
devices.
,2. A medical device manufacturer uses a third‑party
logistics (3PL) provider to store and distribute
finished Class I sterile devices. The 3PL is not ISO
13485 certified, and the manufacturer has not
conducted an on‑site audit of the 3PL. The
manufacturer argues: “Our contract requires them to
follow our procedures, so they are not part of our
QMS.” As the lead auditor, which clause of ISO 13485
is most directly violated, and what is the most
appropriate finding?
A) Clause 4.1.1 – General requirements. The
manufacturer has failed to ensure control over
outsourced processes that affect product conformity,
and reliance on a contract without verification is
insufficient.
B) Clause 7.5.1 – Control of production and service
provision. The manufacturer has not validated the
storage and distribution processes of the 3PL.
C) Clause 8.2.1 – Monitoring and measurement. The
manufacturer has not established a feedback system
for the 3PL’s performance.
, D) Clause 6.4 – Work environment. The manufacturer
has not ensured that the 3PL maintains an
appropriate work environment for sterile devices.
Correct answer: A
Rationale: Clause 4.1.1 requires the organization to
ensure control over outsourced processes that affect
product conformity. ISO 13485 expects that
outsourced processes be assessed, monitored, and
controlled. A contract alone, without verification
(such as an audit or agreed performance metrics), is
not sufficient.
3. An implantable device manufacturer designs a new
orthopedic screw and plans to use a titanium alloy
with which it has no prior experience. The design
team has completed verification testing on the
screw’s mechanical properties but has not
performed any clinical validation because
“mechanical testing proves the product works.” As
the lead auditor, which requirement of Clause 7.3.6
(Design and development validation) must you cite to
justify a nonconformity?
A) Clause 7.3.6: “Validation of design and
development shall be performed on representative
