More study resources

About this exam

The Certified Medical Device Auditor (CMDA) is a professional certification for people who audit quality management systems in the medical device industry - internal auditors, supplier and second-party auditors, quality and regulatory affairs specialists, consultants, and auditors working for certification or regulatory bodies. It signals that the holder can plan, conduct, report, and close out an audit against medical device requirements, not just recite clauses.

The exam is multiple choice and samples the whole audit lifecycle. Expect content on audit fundamentals and audit types; quality system and regulatory requirements, including ISO 13485 and the regional frameworks that apply in your market; risk management, design controls, and process validation; audit program management and auditor competence and ethics; planning and preparation, including scope, criteria, checklists, and sampling; execution, interviewing, and gathering objective evidence; and findings classification, reporting, and corrective and preventive action follow-up. Many items are scenario-based, testing judgment rather than recall.

Preparation usually combines structured study with practice. Read ISO 19011 for audit principles and process, ISO 13485 clause by clause for requirements, ISO 14971 for risk, and the regulations governing your target market. Then audit something real - conduct mock audits, write findings, and defend your classifications. The certifying body publishes current exam logistics, eligibility, and scoring information on its website; confirm details there before you register.

What you'll study

Common questions

About CMDA preparation

What is the exam format?

It is a multiple-choice examination delivered in a single sitting. The certifying body publishes the current item count, appointment length, delivery options, and any reference materials permitted, so check its website for the figures that apply to your registration window rather than relying on older study guides.

Can you tell me how many questions and how much time I get?

No fixed number is stated here because the certifying body sets and periodically revises these details. The authoritative current figures - item count, appointment duration, and any accommodations - appear on the certifying body's official certification page. Confirm them there before you book a test appointment.

How difficult is the CMDA exam?

Candidates with hands-on audit experience generally find it manageable; those who have only read standards find it harder. Most items test applied judgment - interpreting evidence against criteria, choosing a sampling approach, or deciding whether something is a nonconformity or an observation. Depth of practical audit exposure matters more than memorization.

What are the eligibility requirements?

Eligibility typically involves a combination of education and years of auditing or quality experience in the medical device field, and some applicants use a waiver route. Requirements change, so verify the current criteria, documentation you must submit, and deadlines directly with the certifying body before applying.

What does it cost, what is the passing score, and how long is it valid?

Fees, the passing standard, recertification intervals, and continuing education requirements are set by the certifying body and are revised from time to time. Those specifics are published on its official site. Check the current fee schedule, scoring policy, and recertification requirements there before budgeting.

Can I retake it if I fail?

Retake provisions exist but the rules - waiting periods, limits on attempts, and reduced retake fees - are set by the certifying body and change. Review the current retake policy on its website, and plan your first attempt assuming you may need a second window rather than relying on an immediate re-sit.

In what order should I study?

Start with audit fundamentals from ISO 19011, since that vocabulary underpins every scenario item. Then work through ISO 13485 clause by clause, followed by risk management, design controls, and process validation. Layer in the regional regulations for your market, and finish with findings classification, reporting, and CAPA follow-up.

Should I memorize ISO 13485 clause numbers?

Know the clause structure well enough to locate a requirement quickly, and understand the intent behind each one, but do not spend weeks memorizing verbatim text. Scenario items reward reasoning about what a requirement is protecting and what evidence would demonstrate conformity, not reciting numbering.

What are the most common reasons candidates fail?

Over-memorizing standards without applying them, weak grasp of risk management linkages to design and process controls, confusing nonconformities with observations, and poor understanding of sampling and objective evidence. Many also under-prepare on CAPA follow-up and auditor ethics. Practice writing findings and justifying your classification.

How should I approach scenario-based questions?

Read for three things: the audit criteria, the objective evidence presented, and the scope. Decide whether the evidence shows conformity, a nonconformity, or simply an observation, then pick the answer that matches. Eliminate options that reference requirements outside the stated criteria, and be wary of extremes such as always or never.