CMDA study guide
CMDA · Work through your exam, one topic at a time.
The Certified Medical Device Auditor (CMDA) is a professional certification for people who audit quality management systems in the medical device industry - internal auditors, supplier and second-party auditors, quality and regulatory affairs specialists, consultants, and auditors working for certification or regulatory bodies. It signals that the holder can plan, conduct, report, and close out an audit against medical device requirements, not just recite clauses. The CMDA study guide has 7 sections and about 2,368 words.
01Auditing Fundamentals, Principles, and Types of Audits
An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively against audit criteria . Four words carry the weight: systematic (planned, sampled, repeatable), independent (free of bias and of auditing your own work), documented (evidence and conclusions recorded), and criteria (regulations, standards, SOPs, contracts - never the auditor's personal preference).
330 words, about 2 min02Medical Device Regulatory and Quality System Requirements
Clause 4 QMS (documentation, medical device file), 5 management responsibility (policy, objectives, management review), 6 resource management, 7 product realization (7.1 planning, 7.2 customer-related processes, 7.3 design and development, 7.4 purchasing, 7.5 production and service provision, 7.6 monitoring and measuring equipment), 8 measurement, analysis and improvement (8.2.1 feedback, 8.2.2 complaints, 8.2.3 reporting to authorities, 8.2.4 internal audit, 8.2.6 nonconforming product, 8.5.2 corrective action, 8.5.3 preventive action). Know the ISO 13485-only features: a medical device file for each device or family, a documented advisory-notice procedure, explicit regulatory reporting obligations, validation of QMS software, and the retained preventive action clause that ISO 9001:2015 removed.
333 words, about 2 min03Risk Management, Design Controls, and Process Validation
Know the sequence: risk management plan, risk analysis (intended use, reasonably foreseeable misuse, hazard → foreseeable sequence of events → hazardous situation → harm), risk evaluation, risk control, evaluation of residual risk, benefit-risk analysis, risk management report, and production/post-production activities feeding back into the file. Risk = combination of the probability of occurrence of harm and the severity of that harm - never probability alone.
348 words, about 2 min04Audit Programme Management, Auditor Competence, and Ethics
An audit programme is the strategic, multi-audit arrangement: objectives, risks and opportunities, roles and responsibilities, resources, procedures, schedule, and records across a cycle. An audit plan is the tactical document for one audit.
330 words, about 2 min05Audit Planning and Preparation
Objectives answer why the audit is being done (verify conformity, qualify a supplier, maintain certification). Scope answers what, where, when, and to what extent - sites, units, processes, product lines, and exclusions.
327 words, about 2 min06Audit Execution, Interviewing, and Objective Evidence
Open with a meeting that confirms objectives, scope, criteria, schedule, and reporting method. Then work the plan: collect evidence, keep notes, hold short team huddles, and adjust the plan when a lead emerges.
337 words, about 2 min07Findings, Reporting, and CAPA Follow-up
A nonconformity is a failure to fulfil a requirement - nothing more and nothing less. Programme rules then grade it: a major typically reflects a systemic breakdown, a regulatory or safety impact, or a failure of a required process; a minor is an isolated lapse that the system should have caught.
363 words, about 2 min