Medical Devices Quality Management System (MDQMS)
Domain 2 tests whether you know the requirement architecture of ISO 13485:2016 clause by clause - which requirements exist, what evidence satisfies them, and where auditors most often find gaps.
The eight clauses
4 Quality management system; 5 Management responsibility; 6 Resource management; 7 Product realization; 8 Measurement, analysis and improvement. Most audit time is spent in 7 and 8.
High-value requirements
- 4.2.4 / 4.2.5 document and record control: records retained for at least the lifetime of the device as defined by the organization and never less than two years from release, unless regulation requires longer.
- 5.6 management review with defined inputs (feedback, complaints, regulatory actions, audits, CAPA, supplier performance, process performance) and outputs.
- 6.4.2 contamination control: documented arrangements to prevent contamination of product, work environment and personnel.
- 7.3 design inputs, outputs, review, verification, validation, transfer to manufacturing and control of design changes.
- 7.4 supplier evaluation, selection and monitoring, with verification of purchased product.
- 7.5.5–7.5.7 sterile medical devices, validation of production processes, and validation of sterilization and sterile barrier systems.
- 7.5.8 / 7.5.9 / 7.5.11 identification, traceability (including consignee records for implantable devices), preservation of product.
- 8.2.1–8.2.4 feedback, complaint handling, reporting to regulatory authorities, internal audit; 8.3 nonconforming product; 8.5.2 corrective action.
Worked example
A quality manager plans the internal audit and assigns the CAPA process to the CAPA coordinator, who then audits her own corrective actions. Clause 8.2.4 requires that auditors not audit their own work. Evidence: the audit plan and auditor allocation. The finding is written against 8.2.4 - minor if it is a single scheduling slip, major if the whole programme is built this way.
Traps that cost marks
Treating 8.2.3 as optional; assuming a documented procedure must be a separate document (it may be embedded); accepting a management review with no inputs on regulatory actions; ignoring control of outsourced processes under 4.1.