CMDA common mistakes
CMDA · Understand the traps and how to avoid them.
Building the checklist as clause numbers with yes/no prompts and then asking the auditee to confirm each clause is met.
The candidate treats the checklist as a compliance quiz instead of an evidence-gathering plan, so the audit becomes a document confirmation exercise.
What to do instead
Convert each checklist item into a criterion-evidence-source-sampling line: requirement, record or observation that would prove implementation, where to look, and how many/which items to sample.
Recording a manager's verbal assurance ('we always do that') as objective evidence of implementation.
Interviews feel efficient and confident speakers create an illusion of verification, especially when records are hard to locate.
What to do instead
Treat verbal statements only as leads; corroborate with record review, observation, or independent data before concluding conformity, and note the corroborating evidence in the audit record.
Stating the audit scope as a standard or regulation (for example, 'ISO 13485') and listing departments as the audit criteria.
Scope and criteria are related terms and candidates often use them interchangeably under time pressure.
What to do instead
Define scope as boundaries: sites, processes, product families, organizational units, and time period. Define criteria separately as the requirements, standards, regulations, procedures, and contracts against which conformity is judged.
Labelling every observation as either a major nonconformity or not a finding at all, with no middle category or written rationale.
The candidate lacks a calibrated significance rubric and defaults to the strongest or weakest label.
What to do instead
Apply explicit classification criteria covering requirement violated, objective evidence, impact on product/process/QMS, systemic versus isolated occurrence, and risk. Write the rationale in the finding and calibrate with another auditor.
Closing a corrective action once the correction or revised procedure is issued, without checking whether the corrective action prevented recurrence.
Closure pressure and a document-centric view make 'action taken' look like 'problem solved'.
What to do instead
Require evidence of root cause, action implementation, and an effectiveness check using objective data over a defined period or number of occurrences before closure.
Reviewing a process validation report as a one-time IQ/OQ/PQ document check and not tracing changes or revalidation triggers afterward.
The candidate focuses on the validation package as a deliverable rather than on the validated state being maintained.
What to do instead
Link change control, deviations, maintenance, and monitoring data back to the validation status; verify that revalidation or impact assessment occurs when changes affect the validated process.
Writing a finding as a clause or regulation number plus a general complaint, without quoting the specific requirement and the objective evidence.
Memorized clause lists and shorthand habits replace precise finding construction.
What to do instead
Use a three-part structure: exact requirement, specific objective evidence (record ID, date, observation), and the conformity gap. Avoid conclusions that are not tied to both elements.
Selecting records from the top of a stack, the most recent files, or the auditee's suggested examples without documenting sample rationale.
Time pressure and reliance on host convenience lead to non-representative samples.
What to do instead
Define the population, choose a sample method and size with a stated rationale (random, stratified by shift/product/process), select independently, and record what was sampled and why.
Auditing a process the auditor previously managed or accepting the auditee's choice of interviewees and records without checking independence or coverage.
Familiarity and site convenience create unconscious bias and reduce the chance of finding contrary evidence.
What to do instead
Declare conflicts before assignment, rotate auditors where independence is compromised, and select interviewees and samples across shifts, roles, and process steps rather than relying on host nominations.
Treating the existence of an FMEA or risk file as proof that risk controls are effective, without verifying implementation in design or production.
Risk management is often reviewed as a documentation set rather than as evidence that controls changed the product or process.
What to do instead
Trace each significant risk control to its implementation evidence: design output, verification or validation record, process control, inspection method, or post-production monitoring data. Confirm the control is both implemented and effective.