CMDA cheat sheet

ISO 19011 definition: an audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the extent of conformity.

First-party audit = internal audit performed by (or on behalf of) the organization itself; second-party = performed by a party with an interest, such as a customer or supplier; third-party = performed by an independent certification/registration body.

ISO 19011 principles: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach, and a risk-based approach.

Independence rule: auditors must not audit their own work; an auditor cannot audit an activity for which they have direct responsibility or a conflict of interest.

Audit categories: system audit (whole QMS), process audit (one process end-to-end), product/service audit (conformity of output), and compliance/surveillance audits.

Audits are sampling exercises; conclusions are based on samples and therefore carry sampling risk - an audit provides reasonable, not absolute, assurance of conformity.

Logical chain: audit criteria + objective evidence -> audit findings -> audit conclusions -> audit report.

Conformance-based vs performance-based auditing: the first checks against written requirements, the second measures how well a process actually achieves its intended results.

ISO 13485:2016 structure: Clause 4 Quality management system, Clause 5 Management responsibility, Clause 6 Resource management, Clause 7 Product realization, Clause 8 Measurement, analysis and improvement.

21 CFR Part 820 subparts: A General provisions, B Quality system requirements, C Design controls, D Document controls, E Purchasing controls, F Identification and traceability, G Production and process controls, H Acceptance activities, I Nonconforming product, J CAPA, K Labeling and packaging, L Handling/storage/distribution, M Records, N Servicing, O Statistical techniques.

21 CFR 820.180(b) record retention: records kept for the design and expected life of the device, but never less than 2 years from the date of release for commercial distribution.

EU MDR 2017/745 replaced MDD 93/42/EEC and became applicable 26 May 2021; device classification (I, IIa, IIb, III) follows Annex VIII rules and drives conformity-assessment route.

MDSAP combines audits for five jurisdictions: US FDA, Health Canada, Australia's TGA, Brazil's ANVISA, and Japan's MHLW/PMDA.

ISO 13485 requires a risk-based approach throughout the QMS and mandates validation of software used in the quality management system; it does not itself prescribe a full ISO 14971 risk management process.

ISO 13485 excludes certain ISO 9001 requirements not appropriate for regulatory purposes (e.g., customer satisfaction as a QMS output) and emphasizes meeting applicable regulatory requirements.

Traceability: 21 CFR 820.65 requires traceability of implants and life-supporting/life-sustaining devices; ISO 13485 Clause 7.5.9 extends this to defined records and distribution records.

UDI and labeling controls tie device identification to records; labeling must be checked for accuracy before release (21 CFR 820.120, 820.130).

ISO 14971:2019 defines risk as the combination of the probability of occurrence of harm and the severity of that harm; risk is evaluated against pre-defined acceptability criteria from the risk management plan.

Risk management sequence: risk management planning -> hazard/hazardous situation identification -> risk estimation -> risk evaluation -> risk control -> evaluation of overall residual risk -> risk management review/report -> production and post-production monitoring.

Risk control option hierarchy in order of preference: (1) inherent safety by design, (2) protective measures in the device or manufacturing process, (3) information for safety (labeling, training).

Design controls (21 CFR 820.30) apply to Class II and III devices and certain Class I devices; required elements: planning, design input, design output, design review, verification, validation, transfer, design changes, and the Design History File.

Verification answers 'did we build the product right' (outputs meet inputs); validation answers 'did we build the right product' (device meets user needs and intended use under actual or simulated use conditions).

Process validation establishes objective evidence that a process consistently produces a result meeting predetermined specifications; typical stages are Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ).

21 CFR 820.75 requires validation of processes where results cannot be fully verified by subsequent inspection and test, plus defined revalidation criteria and validated software used in the process.

Special processes (e.g., sterilization, welding, soldering) require validation per ISO 13485 Clause 7.5.6; personnel competence must be qualified for such processes.

Risk management continues after release: complaints, CAPA, and adverse event data feed back into hazard analysis and residual-risk evaluation.

Audit program management follows PDCA: establish program objectives -> plan the program -> implement audits -> monitor and review program performance -> improve.

Audit program objectives must be risk-based and linked to the organization's strategic direction, compliance obligations, and prior audit performance.

Auditor competence = knowledge and skills (audit principles, standards and criteria, organization and processes, products/services, applicable law) + education + work experience + audit training + personal attributes.

Personal attributes expected of auditors per ISO 19011: ethical, open-minded, diplomatic, observant, perceptive, versatile, tenacious, decisive, self-reliant, and able to act with integrity.

Audit team leader duties: prepare the audit plan, assign tasks to team members, manage the opening and closing meetings, resolve conflicts, and approve the audit report.

Ethics rules: no gifts or hospitality that could influence judgment, protect confidentiality of information obtained during the audit, disclose conflicts of interest, and report findings truthfully without bias.

Auditor performance is evaluated through observation, review of audit reports and records, feedback from auditees, and periodic re-evaluation of competence.

Audit program records include audit plans, reports, nonconformity records, corrective action follow-up, and auditor qualification records.

Three anchor questions: scope = what is being audited (units, processes, locations); criteria = the requirements used as a reference (ISO 13485, 21 CFR 820, procedures); objectives = why the audit is being done.

Audit plan contents per ISO 19011: objectives, scope, criteria, dates and duration, locations, audit team and roles, resources, confidentiality arrangements, and follow-up actions.

The audit plan should be communicated to the auditee in advance and may be revised as the audit progresses when the evidence warrants it.

The checklist is an aide-memoire, not a script; relevant documents should be reviewed before the audit to target the checklist at high-risk processes.

Sampling methods: judgmental (based on risk, complexity, prior history) and statistical (random/systematic, e.g., ANSI/ASQ Z1.4 attribute sampling tables).

Sample size should increase with process complexity, number of personnel, volume of records, and prior nonconformity history.

Preparation includes reviewing prior audit findings and CAPA status, regulatory commitments, complaint trends, and any changes since the last audit.

The opening meeting covers: purpose and scope, criteria, schedule, team introductions, audit methods and sampling, confidentiality, safety/access rules, and how findings will be communicated.

Objective evidence is verifiable information, records, or statements of fact; it must be traceable to a document, record, observation, or person, and independently confirmable.

Evidence hierarchy: physical observation and records outweigh unverified verbal statements; hearsay and opinion are not objective evidence.

Open-ended questions (what, why, when, where, who, how) elicit detail; leading or closed yes/no questions and questions suggesting the answer should be avoided.

Interview technique: start with a clear purpose, ask one question at a time, listen without interrupting, verify understanding by summarizing, and avoid interrogating the person.

Vertical (trail) auditing follows one record or product through every process step and department; horizontal auditing samples the same practice across multiple areas for consistency.

Field notes should record who, what, where, when, document identifiers, and equipment IDs so the finding can be reconstructed and reconfirmed later.

Distinguish observation from inference: an auditor records what is seen and documented, not conclusions drawn without supporting evidence.

Closing meeting purpose: present findings and conclusions in order of significance, confirm factual accuracy with the auditee, and agree on response timing and follow-up.

Finding categories: conforming finding, observation/opportunity for improvement (no requirement violated), and nonconformity (a requirement was not met).

Major nonconformity indicators: absence of a required element of the QMS, a systemic breakdown affecting multiple areas, or a condition likely to cause product or patient safety risk.

Minor nonconformity indicators: an isolated or single-instance lapse in an otherwise implemented system, with limited impact on product or the QMS.

A nonconformity statement should cite the requirement, the objective evidence (record IDs, dates, observations), and the nature of the deficiency - without prescribing the fix.

FDA inspection outcomes are classified as NAI (No Action Indicated), VAI (Voluntary Action Indicated), and OAI (Official Action Indicated); individual observations are issued on Form FDA 483.

Correction = containment or repair of the detected condition; corrective action = action on the root cause to prevent recurrence; preventive action = action on potential causes to prevent occurrence. ISO 13485:2016 handles both under CAPA (Clause 8.5.2/8.5.3).

Verification of implementation confirms the action was done; verification of effectiveness confirms the nonconformity has not recurred and the process now conforms (evidence is taken after a defined period).

Audit report contents: objectives, scope, criteria, team and dates, summary of results, nonconformities with evidence references, conclusions on QMS effectiveness, and follow-up requirements.

Follow-up closure requires documented evidence, timely response against the agreed deadline, and escalation if the response or effectiveness evidence is inadequate.