CMDA flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Audit (ISO 19011)

A systematic, independent, documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the extent to which the criteria are fulfilled.

Third-party audit

An audit performed by an independent external organization, typically a certification body, to verify conformity against a standard such as ISO 13485 for the purpose of issuing or maintaining certification.

Audit criteria

The set of requirements used as a reference and against which objective evidence is compared, such as ISO 13485, 21 CFR Part 820, EU MDR, and the organization's own procedures.

Audit evidence

Records, statements of fact, or other verifiable information which are relevant to the audit criteria and can be confirmed independently; evidence becomes a finding only when compared to a criterion.

Independence in auditing

The principle that auditors must be free of bias and conflict of interest and must not audit their own work, ensuring findings are objective and conclusions are credible.

ISO 13485 clause structure

Five main clauses: 4 Quality management system, 5 Management responsibility, 6 Resource management, 7 Product realization, and 8 Measurement, analysis and improvement. Clause 7 holds most manufacturing and design requirements.

21 CFR 820 subpart J

The CAPA subpart requiring manufacturers to establish procedures for receiving and investigating complaints, identifying existing and potential causes of nonconformity, and verifying the effectiveness of corrective and preventive actions.

EU MDR 2017/745

The European Medical Device Regulation that replaced the Medical Devices Directive and became applicable on 26 May 2021, setting classification rules, clinical evidence, and conformity assessment obligations.

MDSAP jurisdictions

Medical Device Single Audit Program covers five regulators: US FDA, Health Canada, Australia's TGA, Brazil's ANVISA, and Japan's MHLW/PMDA, allowing one audit to satisfy all five.

Device master record

A compilation of records containing the procedures and specifications for a finished device, required by 21 CFR 820.181 and controlled under document control requirements.

Risk under ISO 14971

The combination of the probability of occurrence of harm and the severity of that harm, estimated and then evaluated against acceptability criteria defined in advance in the risk management plan.

Risk control hierarchy

The required order of preference for risk control: first inherent safety by design, then protective measures in the device or process, and last information for safety such as labeling and training.

Verification versus validation

Verification confirms design outputs meet design inputs; validation confirms the device meets user needs and its intended use under actual or simulated conditions of use.

IQ OQ PQ

The three process validation stages: Installation Qualification confirms equipment is installed as specified; Operational Qualification challenges the process across its operating range; Performance Qualification shows consistent output under routine conditions.

Design History File

A compilation of records documenting the design history of a finished device, demonstrating that the design was developed in accordance with the approved design plan and 21 CFR 820.30 requirements.

Audit program PDCA

Audit program management follows Plan-Do-Check-Act: set program objectives, plan and schedule audits, implement them, monitor performance indicators, and improve the program.

Auditor competence elements

Competence combines education, work experience, audit training, knowledge of standards and regulations, knowledge of the organization's processes and products, and required personal attributes such as integrity and objectivity.

Auditor conflict of interest

An auditor must decline or disclose any assignment where prior responsibility, commercial pressure, gifts, or personal relationships could compromise impartiality in evaluating objective evidence.

Audit team leader duties

The team leader prepares the audit plan, assigns tasks, manages opening and closing meetings, controls the audit pace, resolves disagreements, and approves the final audit report.

Scope versus criteria

Scope defines the extent and boundaries of the audit (processes, sites, product lines); criteria define the requirements against which conformity is judged, such as standards, regulations, and internal procedures.

Sampling in audits

Audits examine a portion of available records and activities; sampling may be judgmental (risk-based) or statistical, and larger samples are used for complex or historically nonconforming processes.

Audit plan content

A documented plan includes audit objectives, scope, criteria, dates and duration, locations, audit team roles, resources, confidentiality arrangements, and provisions for follow-up.

Checklist function

A checklist is a memory aid covering the requirements to be examined; it guides coverage but should not restrict the auditor from pursuing evidence that emerges during the audit.

Objective evidence

Verifiable data, records, or observed facts that are traceable to a source and can be independently confirmed; it is the only acceptable basis for an audit finding.

Open-ended questioning

Questions beginning with what, why, when, where, who, or how that encourage the auditee to describe processes in detail and to volunteer information rather than answer yes or no.

Audit trail technique

Following a single record, product, or batch through every process step and department to verify that each stage meets its requirement and that linkages between records are consistent.

Opening meeting purpose

To confirm the audit scope, criteria, schedule, methods, and sampling approach; introduce the team; explain reporting and nonconformity handling; and confirm confidentiality, safety, and access arrangements.

Major nonconformity

A deficiency indicating the absence of a required system element, a systemic breakdown across processes, or a condition likely to result in a product that does not meet requirements or poses safety risk.

Correction versus corrective action

A correction fixes or contains the detected nonconformity; corrective action addresses its root cause so the nonconformity does not recur. Only corrective action prevents recurrence.

Verification of effectiveness

Evidence collected after a defined period showing that the corrective action eliminated the root cause and the nonconformity has not recurred, distinct from verifying that the action was implemented.

FDA Form 483

The form on which FDA investigators record inspectional observations of objectionable conditions or practices; the facility responds in writing, and the inspection is later classified NAI, VAI, or OAI.

Audit report content

A report states audit objectives, scope, criteria, team, dates, findings with objective evidence references, conclusions on QMS effectiveness, and required follow-up actions and deadlines.