I85PREP
⌘ K
ISO 13485 LA study materials
ISO 13485 LA study resources

ISO 13485 LA practice questions

One question at a time. Build your ISO 13485 LA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which document within an ISO 13485 quality management system states the manufacturer's commitment to meeting applicable regulatory requirements and to maintaining the effectiveness of the quality management system?

  1. The quality manual
  2. The management review minutes
  3. The quality policy Correct answer.
  4. The quality objectives

Explanation

The quality policy is the top-level statement of the organization's overall intentions and direction, and ISO 13485 requires it to include commitment to compliance with applicable requirements and to maintaining QMS effectiveness. Quality objectives translate that policy into measurable targets, while the manual and review records serve different purposes.

Question 2Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

A manufacturer defines the scope of its quality management system. Which element must be documented when a clause of ISO 13485 is not applicable?

  1. The justification for any exclusion or non-applicability and evidence of the resulting risk control Correct answer.
  2. A record of the customer complaints that led to the exclusion
  3. A statement that the exclusion was approved by the notified body
  4. A list of the products for which the excluded clause is irrelevant

Explanation

ISO 13485 permits certain clauses to be non-applicable only where the nature of the device and the organization's activities make them inapplicable, and any such determination must be justified and documented. Because roles such as design and development or servicing may still affect device safety, the justification must also address the associated risk.

Question 3Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Under ISO 13485, which activity is required to be performed by top management rather than delegated to a subordinate function?

  1. Qualifying suppliers of critical components
  2. Reviewing the suitability of the quality management system at planned intervals Correct answer.
  3. Conducting internal audits of the sterile packaging process
  4. Performing verification of design outputs

Explanation

Management review is a responsibility of top management, which must assess the continuing suitability, adequacy and effectiveness of the QMS at planned intervals. Internal audits, design verification and supplier qualification are operational activities that may be delegated to competent personnel.

Question 4Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

A company operates a corporate quality management system covering several sites that manufacture different device families. What does ISO 13485 require regarding the documentation of this system?

  1. Only the corporate headquarters must hold controlled copies of the procedures
  2. The corporate system may be documented centrally provided the documentation is available where needed and covers all applicable requirements Correct answer.
  3. The documentation must be identical at every site with no site-specific additions
  4. Each site must maintain a completely independent and unrelated QMS

Explanation

ISO 13485 allows a single QMS to cover multiple sites, provided the documentation addresses all applicable requirements and is available at the locations where the processes are performed. Site-specific processes may be described in additional documentation as long as control is maintained.

Question 5Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which statement best describes how ISO 13485 treats the process approach?

  1. It requires processes to be re-engineered at every management review
  2. It requires identification of the processes needed for the QMS and determination of their sequence and interaction Correct answer.
  3. It requires a process map to be displayed in every production area
  4. It requires each department to own exactly one process

Explanation

The standard requires the organization to identify the processes needed for the QMS, determine their sequence and interaction, and apply criteria and methods to ensure effective operation and control. A visual process map is one way to satisfy this, but it is not itself mandated.

Question 6Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

A manufacturer's quality manual references a work instruction that has been superseded. What does this most directly indicate about the document control system?

  1. The organization has failed to conduct design verification
  2. The organization has failed to ensure that documents remain legible and identifiable
  3. The organization has failed to ensure adequate training of production operators
  4. The organization has failed to prevent the unintended use of obsolete documents Correct answer.

Explanation

Document control requires that documents be reviewed and approved, that changes be identified and controlled, and that obsolete documents be prevented from unintended use. A manual pointing to a superseded instruction demonstrates a breakdown in controlling document status and references.

Question 7Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which record-retention requirement applies to a manufacturer of implantable devices under ISO 13485?

  1. Records must be retained indefinitely in every case
  2. Records must be retained only until the next management review
  3. Records must be retained for a minimum of one year after release
  4. Records must be retained for at least the lifetime of the device as defined by the organization, and for not less than two years from product release Correct answer.

Explanation

ISO 13485 requires records to be retained for at least the lifetime of the device as defined by the organization, but for a period of not less than two years from the date of product release. Other regulatory regimes may impose longer periods, which the organization must also respect.

Question 8Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

What is the primary purpose of the management representative role in an ISO 13485 quality management system?

  1. To approve every purchase order for components
  2. To act as the legal signatory for all regulatory submissions
  3. To ensure processes needed for the QMS are established, implemented and maintained, and to report on QMS performance Correct answer.
  4. To perform all internal audits independently

Explanation

Top management must appoint a member of management with responsibility and authority to ensure the processes of the QMS are established, implemented and maintained, and to report on the effectiveness and any need for improvement. The role also includes promoting awareness of regulatory and customer requirements.

Question 9Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

A company claims conformity to ISO 13485. Which statement about the standard's relationship to regulatory requirements is correct?

  1. ISO 13485 supersedes national medical device laws in all jurisdictions
  2. ISO 13485 is a voluntary consensus standard and does not replace applicable regulatory requirements Correct answer.
  3. Conformity to ISO 13485 automatically grants a CE mark in the European Union
  4. ISO 13485 is only applicable to manufacturers located outside the European Union

Explanation

ISO 13485 is an international standard that can support regulatory conformity, but it does not itself confer market authorization or override national legislation. Organizations must still meet the applicable regulatory requirements of each market in which they place devices.

Question 10Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which of the following best characterizes a 'medical device' in the context of an ISO 13485 quality management system?

  1. Only sterile single-use products
  2. Only software that analyzes patient data
  3. An instrument, apparatus, implement, machine or implant intended by the manufacturer for diagnostic or therapeutic purposes, whose primary action is not achieved by pharmacological, immunological or metabolic means Correct answer.
  4. Any product used in a hospital regardless of its intended purpose

Explanation

The definition centers on the manufacturer's intended use for diagnosis, prevention, monitoring, treatment or alleviation of disease or injury. Products whose principal intended action is pharmacological, immunological or metabolic are generally medicines rather than devices, although devices may assist such action.

Question 11Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

A contract manufacturer performs sterilization on behalf of several legal manufacturers. How does ISO 13485 apply to this organization?

  1. It applies to the processes the organization performs, and the organization must have a documented agreement defining responsibilities with its customers Correct answer.
  2. It applies only after the customer obtains certification
  3. It applies only if the organization also designs the devices
  4. It does not apply because the organization does not place the device on the market

Explanation

ISO 13485 applies to organizations involved in one or more stages of the product life cycle, including suppliers and contract manufacturers performing processes such as sterilization. Where processes are outsourced, a documented agreement must define the responsibilities of both parties, including any quality requirements.

Question 12Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which of the following is a required input to management review under ISO 13485?

  1. The curriculum vitae of every new employee
  2. The marketing plan for the next fiscal year
  3. The results of internal and external audits Correct answer.
  4. The price list of approved suppliers

Explanation

Management review inputs include audit results, feedback, complaints, process performance, corrective and preventive actions, follow-up actions from previous reviews and changes affecting the QMS. Audit results, both internal and external, are explicitly among the required inputs.

Question 13Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

An organization identifies a process as outsourced. What does ISO 13485 require regarding control of that process?

  1. The supplier must be certified to ISO 13485 before any work begins
  2. The organization must monitor and ensure control over the outsourced process through a documented agreement and appropriate controls proportionate to the risk involved Correct answer.
  3. The process must be brought in-house before certification
  4. The outsourced process may be excluded from the QMS scope

Explanation

When an organization outsources a process affecting product conformity, it remains responsible for that process and must apply controls proportionate to the risk involved, supported by a documented agreement. Certification of the supplier may be one consideration but is not a universal precondition.

Question 14Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which of the following statements about the role of risk in an ISO 13485 QMS is most accurate?

  1. Risk management applies only during design and development
  2. Risk management is optional for class I devices
  3. Risk is addressed only through the corrective action process
  4. Risk-based approaches must be applied across product realization and in the selection of controls for suppliers and processes Correct answer.

Explanation

ISO 13485 requires a risk-based approach throughout the QMS, including product realization, purchasing controls and the control of outsourced processes. Risk management activities are expected to be proportionate to the risk associated with the device.

Question 15Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which document is required to describe the structure of the documentation used in the quality management system?

  1. The quality manual or an equivalent document Correct answer.
  2. The design history file
  3. The device master record
  4. The batch release certificate

Explanation

ISO 13485 requires the organization to document a quality manual or equivalent that outlines the structure of the documentation used in the QMS, including the scope and any justified exclusions. The device master record and design history file are product-specific records rather than descriptions of the QMS documentation structure.

Question 16Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which statement best explains why ISO 13485 emphasizes the safety and performance of the device in addition to customer satisfaction?

  1. Because performance is only relevant to in-vitro diagnostic devices
  2. Because customer satisfaction is not a concern for medical device manufacturers
  3. Because customers are not permitted to provide feedback on devices
  4. Because the standard recognizes that meeting customer requirements alone may not ensure that applicable regulatory and safety requirements are met Correct answer.

Explanation

The standard requires the organization to meet customer requirements and applicable regulatory requirements, reflecting the fact that device safety and performance are governed by law and cannot be assured solely by customer satisfaction. Feedback mechanisms remain an important part of the QMS.

Question 17Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

What is the required relationship between the quality objectives and the quality policy?

  1. Quality objectives must be approved by the notified body
  2. Quality objectives must be broader in scope than the quality policy
  3. Quality objectives must be consistent with the quality policy Correct answer.
  4. Quality objectives must be revised monthly

Explanation

Top management must ensure that quality objectives, including those needed to meet applicable requirements, are established at relevant functions and levels and are measurable and consistent with the quality policy. They translate the policy into actionable targets.

Question 18Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

A manufacturer receives a complaint about a device malfunction. Under ISO 13485, which action is required if investigation shows the malfunction may recur?

  1. Take action to investigate and, where appropriate, issue a corrective action and consider regulatory notification Correct answer.
  2. Wait for the next scheduled management review before taking any action
  3. File the complaint without further action if the device was already sold
  4. Refer the matter to the marketing department for a customer response only

Explanation

ISO 13485 requires feedback and complaint handling processes that include investigation and, where appropriate, corrective and preventive action. Where the event meets the criteria for reporting to regulatory authorities, notification must also be considered.

Question 19Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which of the following best describes the concept of 'validation of processes' in an ISO 13485 QMS?

  1. Approving the process owner's job description
  2. Confirming that a process consistently produces results meeting predetermined requirements where output cannot be verified by subsequent monitoring or measurement Correct answer.
  3. Reviewing the process documentation for spelling and grammar errors
  4. Confirming that the process is the least expensive option available

Explanation

Process validation is required for processes where the resulting output cannot be verified by subsequent monitoring or measurement, such as sterilization or certain joining operations. The organization must demonstrate that the process consistently achieves planned results.

Question 20Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

A manufacturer's internal audit schedule covers every clause of ISO 13485 once every three years. What is the most significant concern with this approach?

  1. Internal audits must cover only production processes
  2. Internal audits must always be performed by an external body
  3. The audit frequency should be based on the status and importance of the processes and areas audited, so a fixed three-year cycle may not provide adequate coverage Correct answer.
  4. Internal audits must be announced at least six months in advance

Explanation

ISO 13485 requires internal audits to be conducted at planned intervals, with the programme planned taking into account the status and importance of the processes and areas concerned. A rigid three-year cycle may not detect problems in high-risk or high-change areas in a timely way.

Question 21Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which of the following situations most clearly demonstrates a failure to maintain the independence required for internal audits?

  1. An auditor uses a checklist during the audit
  2. An auditor audits a process in which the auditor has operational responsibility Correct answer.
  3. An auditor reports findings to the management representative
  4. An auditor reviews procedures from another department

Explanation

ISO 13485 requires auditors to be competent and to be independent of the activity being audited. Auditing a process for which the auditor has operational responsibility compromises objectivity and is a clear breach of this principle.

Question 22Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which statement about the relationship between ISO 13485 and ISO 9001 is correct?

  1. ISO 13485 can only be implemented after ISO 9001 certification is obtained
  2. ISO 13485 is a stand-alone standard that includes requirements specific to medical devices and does not require ISO 9001 certification Correct answer.
  3. ISO 13485 is a subset of ISO 9001 with no additional requirements
  4. ISO 13485 and ISO 9001 are identical in all respects

Explanation

ISO 13485 is a stand-alone standard written to support medical device regulatory requirements, containing requirements not found in ISO 9001, such as those for regulatory compliance and device-specific controls. Certification to ISO 9001 is not a prerequisite, although the standards share a common structure.

Question 23Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

A manufacturer introduces a new supplier of a critical component. Which principle should guide the extent of supplier controls applied?

  1. All suppliers must receive identical controls regardless of the component supplied
  2. Supplier controls may be omitted if the supplier provides a certificate of analysis
  3. Controls should be proportionate to the risk associated with the supplied product and its effect on device conformity Correct answer.
  4. Supplier controls are only needed for suppliers located in the same country

Explanation

ISO 13485 requires the type and extent of control applied to suppliers to be proportionate to the risk associated with the purchased product and its impact on device conformity. A certificate of analysis is one input but does not by itself eliminate the need for other controls.

Question 24Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Which of the following is the best example of a 'record' rather than a 'document' in an ISO 13485 QMS?

  1. A quality policy signed by the chief executive
  2. A completed batch production and testing log Correct answer.
  3. A procedure describing how to operate a filling machine
  4. A work instruction for visual inspection

Explanation

Documents provide information and guidance, such as procedures, policies and work instructions, while records provide evidence of results achieved or activities performed. A completed batch log is evidence of what occurred and is therefore a record.

Question 25Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

An organization's corrective action procedure addresses correction of the nonconformity but does not require investigation of the cause. What is the most significant deficiency?

  1. The procedure fails to require a management review for every nonconformity
  2. The procedure fails to require a design review for every nonconformity
  3. The procedure lacks a requirement to determine and eliminate the cause so the nonconformity does not recur Correct answer.
  4. The procedure fails to require a customer notification for every nonconformity

Explanation

Corrective action requires investigating the cause of nonconformities and determining action to eliminate the cause so the problem does not recur, with effectiveness reviewed. Simply correcting the immediate nonconformity addresses containment but not the underlying cause.

Question 26Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

Under ISO 13485, what is the principal purpose of the document control procedure in a medical device quality management system?

  1. To specify the retention time for every record generated by production and servicing activities
  2. To ensure that only current, approved versions of documents are available at points of use and that obsolete documents are prevented from unintended use Correct answer.
  3. To define the organizational chart and the reporting lines of all personnel who handle device documentation
  4. To describe how the manufacturer communicates with regulatory authorities about device changes

Explanation

ISO 13485 requires documents to be reviewed and approved before issue, to be available at the points of use in their current version, and to be protected from unintended use of superseded copies. Document control therefore centers on version status and availability at the point of use. Retention periods and regulatory communication are separate requirements addressed elsewhere in the standard.

Question 27Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

A manufacturer defines a process as outsourced but argues that because the supplier holds an ISO 13485 certificate, no further control is needed. How should the manufacturer respond under ISO 13485?

  1. Require the supplier to be audited annually on site regardless of the process risk involved
  2. Transfer responsibility for the outsourced process entirely to the supplier through the purchasing contract
  3. Accept the certificate as sufficient evidence and monitor the supplier only through a periodic certificate check
  4. Apply controls proportionate to the risk and the supplier's ability to meet requirements, including written agreements and monitoring of supplier performance Correct answer.

Explanation

ISO 13485 requires the organization to retain responsibility for outsourced processes and to control them in proportion to the risk involved and the supplier's ability to meet requirements. That control is documented through agreements and ongoing monitoring rather than reliance on a certificate. Certification alone does not establish that the specific process meets the manufacturer's requirements.

Question 28Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

A manufacturer's quality policy commits the company to meeting customer and regulatory requirements, but no measurable quality objectives have been established at relevant functions. Which ISO 13485 principle is most directly unfulfilled?

  1. The requirement that the quality management system documentation include a description of the interaction between processes
  2. The requirement that top management review the suitability of the quality management system at planned intervals
  3. The requirement that quality objectives be measurable and consistent with the quality policy Correct answer.
  4. The requirement that the quality policy be communicated and understood within the organization

Explanation

ISO 13485 requires quality objectives to be measurable and consistent with the quality policy, and to be established at relevant functions and levels. A policy without measurable objectives breaks that link between direction and performance. Communication of the policy and management review are separate obligations that the scenario does not show to be breached.

Question 29Fundamental principles and concepts of a Medical Devices Quality Management System (MDQMS)

During a process validation exercise, a manufacturer confirms the output meets specifications but has not established that the process consistently produces conforming output over time. Which statement best reflects the ISO 13485 validation requirement?

  1. Validation is required only when a regulatory authority explicitly asks for it in writing
  2. Validation is satisfied once finished-device testing shows that all specification limits are met
  3. Validation must demonstrate the ability of the process to consistently meet requirements, using defined methods and acceptance criteria Correct answer.
  4. Validation applies only to design outputs and has no role in production processes

Explanation

ISO 13485 requires validation of processes where the resulting output cannot be verified by subsequent monitoring or measurement, and the validation must demonstrate the process consistently meets requirements. This involves defined arrangements, acceptance criteria, and revalidation as needed. End-product testing alone does not establish process consistency.

Question 30Medical Devices Quality Management System (MDQMS)

Under ISO 13485:2016, who is required to appoint a member of management with defined authority and responsibility for the quality management system, and what must that appointment include?

  1. The quality manager must be appointed by the notified body during the initial certification audit and given authority over regulatory submissions
  2. The management representative must be an external consultant contracted to maintain objectivity and independence from production
  3. Any employee nominated by the operations director may act as management representative on a temporary basis without documented appointment
  4. Top management must appoint a member of management who, irrespective of other responsibilities, has responsibility and authority for the QMS including ensuring processes maintain integrity during changes Correct answer.

Explanation

ISO 13485:2016 clause 5.5.2 requires top management to appoint a member of management who, irrespective of other responsibilities, has defined responsibility and authority for the QMS. This includes ensuring processes maintain their integrity when changes are planned and implemented, and reporting on QMS performance to top management.

Question 31Medical Devices Quality Management System (MDQMS)

A manufacturer is deciding which records must be retained under ISO 13485:2016. Which statement best reflects the standard's requirement for record retention periods?

  1. Retention periods are set solely by the notified body during certification and recorded in the certificate annex
  2. Retention periods must be at least the lifetime of the medical device as defined by the organization, but not less than two years from the release date Correct answer.
  3. Records must be kept for a fixed five years from the date of the last product sale in all jurisdictions
  4. Records need only be retained until the next surveillance audit has been completed successfully

Explanation

Clause 4.2.5 requires the organization to define and control records, and the standard specifies retention for at least the lifetime of the device as defined by the organization, but never less than two years from the date of product release. Where regulatory requirements are longer, those take precedence.

Question 32Medical Devices Quality Management System (MDQMS)

During internal audit planning, an ISO 13485 auditor finds the organization audits each process annually but always uses the same auditor for the design process, who also manages that process. What is the most significant nonconformity?

  1. Auditors shall not audit their own work, so the independence requirement for the design process audit is not met Correct answer.
  2. The audit frequency is too high for a small organization and should be reduced to once every three years
  3. Internal audits must always be performed by an external certification body to ensure impartiality
  4. Auditors are not permitted to audit any process they have previously worked in during their career

Explanation

Clause 8.2.4 requires that auditors not audit their own work, and audit criteria, scope, interval and methods must be planned considering process status and importance. Using the process manager as auditor of that same process breaches the independence requirement regardless of frequency.

Question 33Medical Devices Quality Management System (MDQMS)

Which activity is specifically required by ISO 13485:2016 when a nonconforming product is detected after delivery?

  1. The product must be recalled in every market regardless of risk or regulatory requirement
  2. Only the production manager needs to be informed so the batch can be reworked quietly
  3. The organization shall take action appropriate to the effects, or potential effects, of the nonconformity and shall notify relevant regulatory authorities where required Correct answer.
  4. The nonconformity must always be reported to the certification body within 24 hours

Explanation

Clause 8.3 addresses nonconforming product, and clause 8.3.1 requires action appropriate to the effects or potential effects of the nonconformity. Where applicable regulatory requirements demand notification to authorities, the organization must also issue advisory notices as appropriate.

Question 34Medical Devices Quality Management System (MDQMS)

In the context of ISO 13485:2016 clause 7.3 design and development, what must design verification confirm?

  1. That the product is commercially viable in the target market
  2. That manufacturing costs remain within the budget set at project initiation
  3. That the design outputs meet the design input requirements Correct answer.
  4. That the design inputs were approved by the regulatory authority before development began

Explanation

Design verification confirms that design outputs meet design input requirements, and the results and conclusions must be recorded. Design validation is a separate activity confirming that the resulting product meets requirements for its specified use.

Question 35Medical Devices Quality Management System (MDQMS)

A company receives complaints about a device and determines that a corrective action is needed. Which sequence best reflects the corrective action requirements of ISO 13485:2016?

  1. Review the nonconformity, determine its causes, evaluate the need for action, implement the action, review its effectiveness, and update risk management outputs as appropriate Correct answer.
  2. Issue a preventive action first, then document the complaint, then close the record without further review
  3. Assign the complaint to sales, record the customer's opinion, and archive the file after 30 days
  4. Immediately change the specification, then inform customers, then investigate whether a problem exists

Explanation

Clause 8.5.2 requires reviewing nonconformities, determining causes, evaluating the need for action, determining and implementing the action, reviewing effectiveness, and updating documentation including risk management files where relevant. Records of investigation and actions must be maintained.

Question 36Medical Devices Quality Management System (MDQMS)

Which of the following is a requirement of ISO 13485:2016 regarding contamination control?

  1. Contamination control plans must be approved by the notified body before each production lot is released
  2. Contamination is controlled solely by final visual inspection of finished devices
  3. Contamination control applies only to sterile devices and may be ignored for non-sterile devices
  4. The organization shall document requirements for control of contaminated or potentially contaminated product to prevent contamination of the work environment, personnel, or product Correct answer.

Explanation

Clause 6.4.1 requires the organization to document requirements for control of product contaminated or potentially contaminated (for example by microorganisms, chemicals, or foreign matter) to prevent contamination of the work environment, personnel, or product. Arrangements for control of contaminated product must be defined.

Question 37Medical Devices Quality Management System (MDQMS)

Under ISO 13485:2016, what is the required relationship between the organization and its suppliers when the organization outsources a process that affects product conformity?

  1. Responsibility for the outsourced process transfers entirely to the supplier once a purchase order is accepted
  2. The organization must apply controls to the outsourced process proportionate to the risk involved and retain responsibility for conformity Correct answer.
  3. Outsourced processes are outside the QMS scope and need no controls if the supplier is certified to any standard
  4. The organization must audit every supplier annually on site regardless of risk or performance

Explanation

Clause 4.1.5 requires that when the organization chooses to outsource a process, it monitors and ensures control over that process, with controls proportionate to the risk involved, and retains responsibility for conformity to customer and applicable regulatory requirements.

Question 38Medical Devices Quality Management System (MDQMS)

What does ISO 13485:2016 require regarding the validation of processes for production and service provision?

  1. Validation may be replaced entirely by a final inspection sampling plan
  2. Validation is required for processes where the resulting output cannot be verified by subsequent monitoring or measurement Correct answer.
  3. All production processes must be validated regardless of whether the resulting output can be verified
  4. Process validation is only needed when a new supplier is introduced

Explanation

Clause 7.5.6 requires validation of processes where the resulting output cannot be verified by subsequent monitoring or measurement, including processes where deficiencies become apparent only after the product is in use. Validation must demonstrate the ability to achieve planned results.

Question 39Medical Devices Quality Management System (MDQMS)

An auditor reviews how a manufacturer establishes product traceability. Which requirement of ISO 13485:2016 applies to traceability of implantable devices?

  1. Traceability is optional for implantable devices if the lot number appears on the outer carton
  2. Traceability records for implantable devices need only identify the distributor, not the device or its components
  3. The organization shall establish documented procedures for traceability, and for implantable devices traceability records must extend to the extent specified by applicable regulatory requirements Correct answer.
  4. Traceability is required only when a customer explicitly requests it in the purchase contract

Explanation

Clause 7.5.9.1 requires documented procedures for traceability, with traceability records maintained for the defined traceability extent. For implantable devices, records must extend to the extent specified by applicable regulatory requirements, and unique device identification must be maintained where required.

Question 40Medical Devices Quality Management System (MDQMS)

Which statement accurately describes the ISO 13485:2016 requirement for a quality manual?

  1. The quality manual is only required for organizations that design and manufacture sterile devices
  2. The organization shall establish and maintain a quality manual that includes the scope of the QMS, documented procedures or references to them, and a description of the interaction between QMS processes Correct answer.
  3. A quality manual is optional and may be replaced by a process map in all cases
  4. The quality manual must reproduce the full text of every clause of ISO 13485 verbatim

Explanation

Clause 4.2.2 requires a quality manual that includes the scope of the QMS with justification for any exclusion or non-application, documented procedures or references to them, and a description of the interaction between the processes of the QMS.

Question 41Medical Devices Quality Management System (MDQMS)

A manufacturer wants to exclude a clause of ISO 13485:2016 from its QMS. Which condition governs such exclusions?

  1. Exclusions are limited to clause 6, resource management, because resources are not product-related
  2. Exclusions require prior written approval from the certification body before the quality manual is issued
  3. Any clause may be excluded provided the organization records a business rationale in the quality manual
  4. Any exclusion must be justified in the quality manual and must not affect the organization's ability or responsibility to ensure conformity of product and service to applicable requirements Correct answer.

Explanation

Clause 4.2.2 requires the quality manual to include justification for any exclusion or non-application, and clause 1 states that exclusions are permitted only where they do not affect the organization's ability or responsibility to ensure conformity. Regulatory requirements may also limit what can be excluded.

Question 42Medical Devices Quality Management System (MDQMS)

What does ISO 13485:2016 require concerning the competence of personnel performing work affecting product quality?

  1. Training records may be kept informally by supervisors without inclusion in the QMS records
  2. Only personnel in the quality department require documented competence records
  3. Competence is demonstrated by the number of years employed by the organization, regardless of task
  4. Competence must be established through documented education, training, skills, and experience, with records maintained and effectiveness of training evaluated Correct answer.

Explanation

Clause 6.2 requires that personnel performing work affecting product quality be competent on the basis of appropriate education, training, skills, and experience, and that records of education, training, skills, and experience be maintained. The organization must also evaluate the effectiveness of actions taken to achieve competence.

Question 43Medical Devices Quality Management System (MDQMS)

An organization operates a cleanroom for assembling sterile devices. Which ISO 13485:2016 requirement governs monitoring and control of the work environment?

  1. Environmental conditions need only be recorded when a customer complains about product quality
  2. Cleanroom monitoring is entirely delegated to the facility landlord and excluded from the QMS
  3. The organization shall document requirements for the work environment and monitor and control conditions where they could adversely affect product quality, including arrangements for personnel health, cleanliness, and clothing Correct answer.
  4. Environmental monitoring records may be discarded after each shift once the cleanroom has been cleaned

Explanation

Clause 6.4.1 requires the organization to document requirements for the work environment and to monitor and control conditions where they could adversely affect product quality. It also requires special arrangements for personnel who are not employees, and for personnel health, cleanliness, and clothing where contact with product is a factor.

Question 44Medical Devices Quality Management System (MDQMS)

Which of the following best describes the ISO 13485:2016 requirement for review of requirements related to the product before a commitment to supply?

  1. The organization shall review requirements, ensure differences from the tender are resolved, and confirm it has the ability to meet the defined requirements, with results recorded Correct answer.
  2. The review may be verbal and need not be recorded if the order is accepted by sales staff
  3. The review is required only for custom-made devices and not for catalogue products
  4. The review must be performed by the customer and documented in the purchase order

Explanation

Clause 7.2.2 requires review of requirements related to product before the organization commits to supply, including requirements specified by the customer, those not stated but necessary, and applicable regulatory requirements. Differences between the tender and contract must be resolved, and results of the review recorded.

Question 45Medical Devices Quality Management System (MDQMS)

Under ISO 13485:2016, what must the organization do when applicable regulatory requirements change in a way that affects a marketed device?

  1. Ignore the change until the next scheduled recertification audit
  2. Withdraw the device from all markets immediately without further assessment
  3. Review and update QMS processes and product documentation as necessary to maintain conformity, and assess the impact on the device and its risk management file Correct answer.
  4. Delegate the assessment of the change to the distributor in each market

Explanation

The standard requires the organization to identify and have access to applicable regulatory requirements and to review them as they change. Changes must be reflected in the QMS and product documentation, with impact on risk management and conformity assessed and actions taken.

Question 46Medical Devices Quality Management System (MDQMS)

An organization records a complaint that a device did not meet specifications. Under ISO 13485:2016, what must the complaint handling procedure include?

  1. Requirements for receiving, investigating, and evaluating complaints, and for determining whether the complaint should be reported to regulatory authorities Correct answer.
  2. A rule that complaints from distributors are excluded from the complaint system
  3. A requirement that all complaints be resolved within 24 hours of receipt
  4. A provision that verbal complaints need not be recorded if no injury occurred

Explanation

Clause 8.2.2 requires documented procedures for timely complaint handling, including requirements for receiving and recording information, evaluating complaints, investigating where appropriate, and determining the need to report to regulatory authorities. Records of complaints and investigations must be maintained.

Question 47Medical Devices Quality Management System (MDQMS)

What is the ISO 13485:2016 expectation for the measurement, analysis, and improvement of the QMS through statistical techniques?

  1. The organization shall establish documented procedures for identifying valid statistical techniques and control their application where used to analyze data Correct answer.
  2. Statistical analysis is required for every process regardless of whether data are collected
  3. Statistical techniques apply only to design verification and never to production data
  4. Statistical techniques are prohibited unless approved by the notified body

Explanation

Clause 8.1 requires the organization to determine, collect, and analyze appropriate data to demonstrate the suitability and effectiveness of the QMS. Clause 8.4 requires documented procedures for identifying valid statistical techniques and controlling their application where statistical methods are used.

Question 48Medical Devices Quality Management System (MDQMS)

A design team changes a component supplier after design transfer. Under ISO 13485:2016, how should the organization handle the change?

  1. Control the design change through review, verification, validation as appropriate, and approval before implementation, and assess its effect on the design inputs and risk management file Correct answer.
  2. Treat it as a routine purchasing change with no design or risk review required
  3. Apply the change only after the supplier obtains ISO 13485 certification
  4. Implement the change first and document it retrospectively at the next management review

Explanation

Clause 7.3.9 requires design changes to be reviewed, verified, validated as appropriate, and approved before implementation, with the effect of the change on constituent parts and product already delivered evaluated. Changes affecting risk must also be reflected in the risk management file.

Question 49Medical Devices Quality Management System (MDQMS)

Which of the following is required by ISO 13485:2016 for the control of monitoring and measuring equipment?

  1. Equipment must be recalibrated every six months regardless of use or stability
  2. Equipment used only for internal quality checks is exempt from calibration control
  3. Calibration may be performed by any operator without documented competence or traceability
  4. The organization shall establish documented procedures to ensure monitoring and measuring equipment is calibrated or verified at specified intervals, identified, safeguarded, and protected from damage Correct answer.

Explanation

Clause 7.6 requires documented procedures for control of monitoring and measuring equipment, including calibration or verification at specified intervals or prior to use, identification to enable calibration status to be determined, safeguarding from adjustments, and protection from damage. Records of calibration must be kept.

Question 50Medical Devices Quality Management System (MDQMS)

How does ISO 13485:2016 treat risk-based approaches in the QMS?

  1. Risk management is confined to the design phase and has no role in purchasing or production
  2. The organization shall apply a risk-based approach to the control of the QMS, with risk management activities proportionate to the risk associated with the device Correct answer.
  3. Risk management is only required for Class III devices and may be omitted for lower-risk devices
  4. Risk management may be replaced by a customer satisfaction survey program

Explanation

ISO 13485:2016 requires a risk-based approach throughout the QMS, and clause 7.1 requires risk management activities throughout product realization proportionate to the risk associated with the device. Risk management outputs also feed into purchasing, process control, and corrective action decisions.