I85PREP
⌘ K
CMDA study materials
CMDA study resources

CMDA practice questions

One question at a time. Build your CMDA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Auditing fundamentals, principles, and types of audits

Which auditing principle requires auditors to report findings, conclusions, and audit reports truthfully and accurately?

  1. Fair presentation Correct answer.
  2. Confidentiality
  3. Integrity
  4. Due professional care

Explanation

Fair presentation means audit findings, conclusions, and reports reflect the audit activities truthfully and accurately. It includes disclosing significant obstacles and unresolved differences. Integrity is the broader foundation of honesty, while fair presentation specifically governs reporting.

Question 2Auditing fundamentals, principles, and types of audits

An audit performed by an organization on its own quality management system is called:

  1. A supplier audit
  2. A regulatory audit
  3. A certification audit
  4. An internal audit Correct answer.

Explanation

An internal audit, also called a first-party audit, is conducted by the organization itself, often to verify its own management system. Supplier and certification audits are external second- and third-party audits. Regulatory audits are also external.

Question 3Auditing fundamentals, principles, and types of audits

The documented requirements against which an audit is performed are known as the:

  1. Audit scope
  2. Audit plan
  3. Audit criteria Correct answer.
  4. Audit evidence

Explanation

Audit criteria are the set of requirements, standards, or procedures used as a reference against which conformity is evaluated. They are distinct from the scope, which defines boundaries, and the plan, which schedules activities.

Question 4Auditing fundamentals, principles, and types of audits

Which type of audit examines a specific product or service to verify that it meets specified requirements?

  1. Process audit
  2. System audit
  3. Product audit Correct answer.
  4. Compliance audit

Explanation

A product audit evaluates a product or service against specified requirements, such as specifications or standards. Process audits examine how processes are performed, and system audits evaluate the management system as a whole.

Question 5Auditing fundamentals, principles, and types of audits

An audit performed by a customer on a supplier is best described as:

  1. A regulatory audit
  2. A customer audit Correct answer.
  3. An internal audit
  4. A certification audit

Explanation

A customer audit is a second-party audit, performed by an organization on a supplier or potential supplier. It is used to verify the supplier's capability and conformity with contractual or quality requirements.

Question 6Auditing fundamentals, principles, and types of audits

What is the main purpose of an opening meeting at the start of an audit?

  1. Issuing the audit report
  2. Agreeing corrective actions
  3. Confirming the audit plan Correct answer.
  4. Presenting audit findings

Explanation

The opening meeting confirms the audit plan, scope, criteria, schedule, and logistics, and ensures the auditee understands the audit process. Findings, corrective actions, and the report come later in the audit.

Question 7Auditing fundamentals, principles, and types of audits

Objective evidence in an audit is best described as:

  1. A planned sampling approach
  2. A summary of audit findings
  3. Verifiable records or facts Correct answer.
  4. An auditor's professional opinion

Explanation

Objective evidence is verifiable information, records, or statements of fact relevant to the audit criteria. It must be traceable to its source so that findings and conclusions can be substantiated.

Question 8Auditing fundamentals, principles, and types of audits

Which statement best distinguishes an audit from an inspection?

  1. Audits evaluate processes; inspections evaluate products. Correct answer.
  2. Audits check every item; inspections sample.
  3. Audits review documentation only; inspections test product samples.
  4. Audits are external; inspections are internal.

Explanation

Audits evaluate processes, systems, or management systems for conformity and effectiveness against criteria. Inspection is typically the examination of product characteristics, such as dimensions or performance, against specifications.

Question 9Auditing fundamentals, principles, and types of audits

What is the primary purpose of a third-party audit?

  1. Independent verification for certification Correct answer.
  2. Handling of customer complaints and appeals
  3. Internal management review
  4. Supplier development

Explanation

A third-party audit is performed by an independent organization, often to certify conformity with a standard or to satisfy regulatory requirements. It provides impartial verification to external interested parties.

Question 10Auditing fundamentals, principles, and types of audits

In auditing, the audit scope defines:

  1. The extent and boundaries of the audit Correct answer.
  2. The requirements the audit is measured against
  3. The methods used to collect evidence
  4. The qualifications required of auditors

Explanation

Audit scope defines the extent and boundaries of the audit, including the functions, processes, locations, and time period covered. Audit criteria are the requirements used for evaluation.

Question 11Auditing fundamentals, principles, and types of audits

When an auditor uses sampling, the sample should be:

  1. Selected only from records that are easy to retrieve
  2. Large enough to include every process area
  3. Representative of the population being examined Correct answer.
  4. Chosen by the auditee to speed the audit

Explanation

Sampling is valid only when the selected items are representative of the population under review. Auditors should use a documented sampling approach and avoid bias in selection.

Question 12Auditing fundamentals, principles, and types of audits

A nonconformity is best described as:

  1. An auditor's personal preference
  2. A suggestion for improving efficiency
  3. A minor issue with no supporting evidence
  4. A failure to meet a specified requirement Correct answer.

Explanation

A nonconformity is a failure to meet a specified requirement, such as a standard clause, procedure, or regulation. It must be supported by objective evidence and stated against the relevant criterion.

Question 13Auditing fundamentals, principles, and types of audits

An audit programme is:

  1. The corrective action log for findings
  2. A set of audits over a period Correct answer.
  3. The schedule of meetings for one audit
  4. The checklist used during an audit

Explanation

An audit programme is the set of audits planned for a defined time period and directed at a specific objective. It is broader than a single audit plan, which covers one audit.

Question 14Auditing fundamentals, principles, and types of audits

Auditor competence should be based on:

  1. Membership in a professional body
  2. Completion of an online course
  3. Demonstrated knowledge and skills Correct answer.
  4. Years of service in the organization

Explanation

Auditor competence is evaluated on demonstrated knowledge, skills, and personal attributes needed to perform audits effectively. Formal qualifications alone do not establish competence.

Question 15Auditing fundamentals, principles, and types of audits

Which situation most clearly compromises auditor independence?

  1. The auditor audits a process they previously managed Correct answer.
  2. The auditor reviews a process they did not design
  3. The auditor interviews staff from another department
  4. The auditor uses a checklist prepared by the audit team

Explanation

Auditors must remain independent of the activity being audited and should not audit their own work. Having previously managed the process creates a self-review threat.

Question 16Auditing fundamentals, principles, and types of audits

The evidence-based approach to auditing requires that audit conclusions are:

  1. Agreed with the auditee before reporting
  2. Limited to findings that are easy to correct
  3. Supported by verifiable audit evidence Correct answer.
  4. Based on the lead auditor's experience

Explanation

The evidence-based approach requires that conclusions and findings be founded on verifiable evidence obtained through sampling and verification. Experience may guide the auditor but is not a substitute for evidence.

Question 17Auditing fundamentals, principles, and types of audits

Risk-based auditing means audit effort is focused on:

  1. Higher-risk areas and processes Correct answer.
  2. Every clause of the standard equally
  3. Processes with the most staff employed
  4. Departments that request an audit

Explanation

Risk-based auditing allocates more attention and resources to areas with greater risk to product quality, safety, or system effectiveness. It does not require equal coverage of every clause.

Question 18Auditing fundamentals, principles, and types of audits

Corrective action differs from correction because corrective action:

  1. Removes the immediate symptom only
  2. Closes the audit without follow-up
  3. Addresses the root cause Correct answer.
  4. Is always taken by the auditor

Explanation

Corrective action eliminates the cause of a nonconformity so it does not recur, while correction addresses the immediate problem. Effective corrective action includes root-cause analysis and verification of effectiveness.

Question 19Auditing fundamentals, principles, and types of audits

A desk audit is limited mainly because it:

  1. Requires travel to the supplier site
  2. Always takes longer than an on-site audit
  3. Relies on documents, not observed practice Correct answer.
  4. Cannot review any documented information at all

Explanation

A desk audit reviews documented information remotely and does not observe actual practice or verify implementation on site. This limits its ability to confirm that processes are effective.

Question 20Auditing fundamentals, principles, and types of audits

A combined audit differs from a joint audit in that a combined audit:

  1. Uses a single auditor for all areas
  2. Covers multiple management systems at one auditee Correct answer.
  3. Involves two or more separate auditing organizations
  4. Is always conducted by a regulator

Explanation

A combined audit covers two or more management systems at the same auditee, such as quality and environmental systems. A joint audit involves two or more auditing organizations cooperating on one auditee.

Question 21Auditing fundamentals, principles, and types of audits

A vertical audit is best described as one that:

  1. Samples only final product records
  2. Follows a process through all its stages Correct answer.
  3. Examines only management responsibilities
  4. Reviews one clause across many departments

Explanation

A vertical audit follows a process or product through its stages, from inputs to outputs, to verify conformity and traceability. A horizontal audit, by contrast, examines one requirement across departments.

Question 22Auditing fundamentals, principles, and types of audits

An auditor who previously wrote the procedure being audited should:

  1. Audit it to save time and cost
  2. Disclose the conflict and continue auditing
  3. Be replaced to preserve objectivity Correct answer.
  4. Audit it only with management approval

Explanation

Auditors must be independent of the activity being audited and avoid self-review. An auditor who wrote the procedure has a conflict of interest and should be replaced for that portion of the audit.

Question 23Auditing fundamentals, principles, and types of audits

The audit conclusion is:

  1. The opening meeting summary
  2. A request for corrective action from the auditee
  3. Overall judgment against audit criteria Correct answer.
  4. A complete list of every nonconformity found

Explanation

The audit conclusion is the audit team's overall judgment of conformity and effectiveness against the audit criteria, considering the findings. It is broader than a list of individual nonconformities.

Question 24Auditing fundamentals, principles, and types of audits

A surveillance audit is conducted to:

  1. Maintain certification between full audits Correct answer.
  2. Extend certification to new products
  3. Investigate a specific complaint only
  4. Replace the initial certification audit entirely

Explanation

Surveillance audits are periodic audits after initial certification to confirm that the management system continues to conform and that corrective actions remain effective. They do not replace recertification audits.

Question 25Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Which international standard specifies requirements for a quality management system that is specific to the medical device industry and against which organizations can be certified?

  1. ISO 13485 Correct answer.
  2. ISO 10993-1
  3. ISO 14971
  4. ISO 14155

Explanation

ISO 13485 is the international standard for medical device quality management systems and is used as the basis for certification and for many regulatory schemes. The other standards listed address risk management, biological evaluation and clinical investigation rather than QMS requirements.

Question 26Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

In the United States, the quality system requirements applicable to medical device manufacturers are codified in which part of Title 21 of the Code of Federal Regulations?

  1. 21 CFR Part 820 Correct answer.
  2. 21 CFR Part 806
  3. 21 CFR Part 801
  4. 21 CFR Part 11

Explanation

21 CFR Part 820 contains the Quality System Regulation for devices, covering design controls, production, CAPA, records and related requirements. The other parts address electronic records, labeling and reports of corrections and removals respectively.

Question 27Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Which European Union regulation sets out the current requirements for medical devices other than in vitro diagnostic devices?

  1. Regulation (EU) 2017/746
  2. Regulation (EU) 2017/745 Correct answer.
  3. Regulation (EU) 2019/1020
  4. Directive 93/42/EEC

Explanation

Regulation (EU) 2017/745 on medical devices has applied since 26 May 2021 and replaced the Medical Devices Directive 93/42/EEC. It covers general safety and performance requirements, classification, conformity assessment, clinical evaluation and post-market obligations.

Question 28Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Which standard provides the framework for a medical device manufacturer's risk management process, including hazard identification and evaluation of overall residual risk?

  1. ISO 10993-1
  2. ISO 11607-1
  3. ISO 14155
  4. ISO 14971 Correct answer.

Explanation

ISO 14971 describes the risk management process for medical devices and is referenced by both ISO 13485 and regional regulations. It requires risk analysis, evaluation, control, and review of production and post-production information.

Question 29Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

What is the primary purpose of a corrective and preventive action (CAPA) system?

  1. To eliminate causes of nonconformities and prevent recurrence Correct answer.
  2. To replace the annual internal audit programme
  3. To document every customer complaint received for regulatory reporting
  4. To confirm that design outputs meet design inputs

Explanation

A CAPA system exists to investigate the underlying cause of existing nonconformities and of potential nonconformities, then act on those causes so the problem does not recur or occur. Complaint handling, internal auditing and design verification are separate QMS processes that may feed into CAPA.

Question 30Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

How does ISO 13485:2016 specify the frequency of management review of the quality management system?

  1. At intervals the organization defines and documents Correct answer.
  2. At the close of each production lot
  3. Whenever requested by the notified body or regulator
  4. At fixed 12-month calendar intervals mandated by the standard

Explanation

The standard requires top management to review the QMS at documented intervals that the organization itself establishes, and it does not impose a fixed frequency such as annually. The review must cover defined inputs and produce outputs related to improvement, resource needs and regulatory obligations.

Question 31Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Within design controls, design verification is performed to confirm that:

  1. the device meets the needs of the intended user
  2. the manufacturing process has been validated
  3. design outputs meet design inputs Correct answer.
  4. the device is safe under all foreseeable clinical use conditions

Explanation

Design verification confirms that the design outputs satisfy the design inputs, for example by testing, inspection or analysis. Confirmation that the device meets user needs and intended use is design validation, which is a distinct activity.

Question 32Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Under ISO 13485:2016, what is the minimum period for which quality records must be retained?

  1. One year past the end of the labelled shelf life, with no upper limit
  2. Five years from the date of last manufacture
  3. The lifetime of the device, minimum two years from release Correct answer.
  4. Six months from the date of release

Explanation

Records must be retained for at least the lifetime of the medical device as defined by the organization, and in no case less than two years from the date of device release. A longer period applies where regulatory requirements or the organization's own procedures specify one.

Question 33Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

The FDA final rule that incorporates ISO 13485:2016 by reference into the quality system regulation becomes effective on:

  1. February 2, 2026 Correct answer.
  2. August 2, 2023
  3. January 1, 2024
  4. December 31, 2025

Explanation

The Quality Management System Regulation (QMSR) was published in February 2024 and takes effect on February 2, 2026, after which 21 CFR Part 820 aligns with ISO 13485:2016 plus certain FDA-specific requirements. Manufacturers must plan transition activities so that compliance is in place by the effective date.

Question 34Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

In the United States, unique device identifier records for marketed devices are submitted to which database?

  1. EUDAMED
  2. NHRIC
  3. MAUDE
  4. GUDID Correct answer.

Explanation

The Global Unique Device Identification Database (GUDID) is the FDA repository for device identification data submitted by labelers. EUDAMED is the EU database, MAUDE holds adverse event reports, and NHRIC was an earlier device naming system.

Question 35Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

A manufacturer learns that a device failure has necessitated a field correction to prevent an unreasonable risk of substantial harm to public health. Under 21 CFR Part 803, the report must be submitted within:

  1. 30 calendar days
  2. 5 working days Correct answer.
  3. 10 working days
  4. 15 calendar days

Explanation

Events that require remedial action to prevent an unreasonable risk of substantial harm to public health are reported within 5 working days. The standard 30-day timeframe applies to other reportable deaths, serious injuries and malfunctions.

Question 36Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Under the EU MDR, a serious incident that is neither a serious public health threat nor a death must be reported by the manufacturer no later than:

  1. 10 calendar days
  2. 2 calendar days
  3. 30 calendar days
  4. 15 calendar days Correct answer.

Explanation

The MDR sets reporting deadlines according to severity: 2 days for serious public health threats, 10 days for death or serious deterioration in health, and 15 days for other serious incidents. The report is submitted through the vigilance system once the manufacturer becomes aware of the incident.

Question 37Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

ISO 13485:2016 requires the organization to establish criteria for which activities relating to suppliers?

  1. Auditing by the notified body only
  2. Training, calibration and maintenance of equipment
  3. Selection, evaluation and re-evaluation Correct answer.
  4. Pricing, delivery and packaging

Explanation

The purchasing clause requires documented criteria for selecting, evaluating and re-evaluating suppliers, along with monitoring of supplier performance. The extent of controls applied to purchased product must be proportionate to the risk involved.

Question 38Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

ISO 13485:2016 requires validation of production and service provision processes when:

  1. the output cannot be verified by later measurement Correct answer.
  2. the device is intended for sterile use
  3. the process uses automated production equipment
  4. the process is performed by an external supplier

Explanation

Validation is required where the resulting output cannot be verified by subsequent monitoring or measurement, so deficiencies would only become apparent once the product is in use. Sterilization and sealing are typical examples, but the trigger is the inability to verify output rather than the type of technology used.

Question 39Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

The purpose of design transfer is to ensure that:

  1. design outputs are verified as suitable for manufacturing Correct answer.
  2. design changes are approved by the notified body
  3. clinical evidence is sufficient to support the CE marking decision
  4. the design history file is archived after launch

Explanation

Design transfer confirms that design outputs are suitable for manufacturing and are correctly translated into production specifications before the design becomes final. It bridges design and production and is a documented activity under design controls.

Question 40Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

For implantable devices, ISO 13485:2016 requires distribution records to include:

  1. the patient's name, date of birth and implant site
  2. the sterilization load number only
  3. the implanting surgeon's identifier
  4. name and address of the shipping consignee Correct answer.

Explanation

The traceability clause requires that records include the name and address of the shipping package consignee for implantable devices, supporting the ability to trace devices to the point of distribution. Patient-level tracking is generally handled by the healthcare provider, not mandated by this clause.

Question 41Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Which statement about internal quality audits under ISO 13485:2016 is correct?

  1. Internal audits must cover every clause each quarter
  2. Internal audits must be performed by an accredited certification body
  3. Internal audits are required only after a nonconformity is detected
  4. Auditors shall not audit their own work Correct answer.

Explanation

The standard requires auditors to be selected and audits conducted in a way that ensures objectivity and impartiality, which is normally achieved by auditors not auditing their own work. Audits are planned at defined intervals considering the status and importance of the processes and previous results.

Question 42Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Which standard covers validation and routine control of radiation sterilization of medical devices?

  1. ISO 11137 Correct answer.
  2. ISO 11135
  3. ISO 17665
  4. ISO 14937

Explanation

ISO 11137 is the standard series for radiation sterilization, addressing validation and routine control of the process. The other standards cover ethylene oxide, moist heat and generic sterilizing agents respectively.

Question 43Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Under the EU MDR, the technical documentation requirements that a manufacturer must compile are set out in which annex?

  1. Annex XIV
  2. Annex I
  3. Annex II Correct answer.
  4. Annex IX

Explanation

Annex II of the MDR describes the technical documentation, including device description, design and manufacturing information, general safety and performance requirements, risk analysis and the clinical evaluation documentation. Annex III then covers documentation on post-market surveillance.

Question 44Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

A 510(k) premarket notification is cleared by FDA when the submitter demonstrates that the device is:

  1. of low-to-moderate risk with no legally marketed predicate
  2. substantially equivalent to a marketed predicate device Correct answer.
  3. manufactured in compliance with ISO 13485
  4. safe and effective as demonstrated in a pivotal clinical trial

Explanation

The 510(k) pathway relies on demonstrating substantial equivalence to a legally marketed predicate device with respect to intended use and technological characteristics. If equivalence cannot be established, or no predicate exists, a different pathway such as De Novo or PMA is needed.

Question 45Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Under Rule 11 of Annex VIII to the EU MDR, software intended to provide information used to take decisions with diagnostic or therapeutic purposes is classified by default as:

  1. Class IIa Correct answer.
  2. Class III
  3. Class I
  4. Class IIb

Explanation

Rule 11 places such decision-support software in Class IIa by default, but escalates it to Class IIb where a serious deterioration of health or a surgical intervention may result, and to Class III where death or irreversible deterioration may result. Software that only monitors physiological processes is generally Class IIa as well.

Question 46Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Under the EU MDR, the periodic safety update report for a Class IIa device must be updated at least:

  1. when a serious incident occurs
  2. every two years Correct answer.
  3. every six months
  4. every year

Explanation

Article 86 requires the PSUR to be updated at least annually for Class IIb and Class III devices and at least every two years for Class IIa devices. Class I devices, other than those with measuring or sterile functions, instead require a post-market surveillance report.

Question 47Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

ISO 13485:2016 requires that computer software used in the quality management system be validated:

  1. before initial use and after changes, as appropriate Correct answer.
  2. only when the software is purchased from a commercial vendor
  3. once every three years by an external auditor
  4. only if it produces records used in design

Explanation

The software validation requirement applies to software used in QMS activities and requires validation prior to initial use and, as appropriate, after changes, with an approach proportionate to the risk associated with the software. Validation of software used in production or service provision is a related but separate requirement.

Question 48Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

FDA assigns a recall to Class I when:

  1. the device violates labelling requirements but poses no health hazard
  2. the device is misbranded but remains safe for use
  3. the device has a minor defect unlikely to cause harm
  4. there is a reasonable probability of serious adverse health consequences or death Correct answer.

Explanation

Recall classification reflects the degree of health hazard: Class I is the most serious and is used where the defective device may cause serious adverse health consequences or death. Class II covers temporary or reversible harm, and Class III covers situations unlikely to cause harm.

Question 49Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

ISO 13485:2016 requires design validation to be performed on:

  1. initial production units or their equivalents Correct answer.
  2. units manufactured after regulatory clearance is granted
  3. engineering prototypes representative of the final design
  4. simulated devices approved by the notified body

Explanation

Design validation must be conducted under defined operating conditions on initial production units, lots or batches, or their equivalents, to confirm the device meets user needs and intended use. Prototypes are typically used in design verification and may not reflect production processes.

Question 50Medical device regulatory and quality system requirements (e.g., QMS requirements, ISO 13485, regional regulations)

Under ISO 13485:2016, a manufacturer that performs no design and development activities may exclude clause 7.3 from its quality management system only when:

  1. an accredited certification body approves the exclusion at the audit
  2. the manufacturer records the decision in a risk management file
  3. applicable regulatory requirements permit that exclusion Correct answer.
  4. the device carries the lowest risk classification in every market

Explanation

Clause 1 of ISO 13485:2016 allows design and development controls to be excluded only where applicable regulatory requirements permit such an exclusion, and the justification must then be documented in the quality manual as required by clause 4.2.2. The standard does not create a free-standing right to exclude the clause for other reasons.