Medical Devices Quality Management System (MDQMS)
Domain 2 - Medical Devices Quality Management System (MDQMS)
This domain tests your knowledge of ISO 13485:2016 Clauses 4–8: documentation, management responsibility, resources, product realization, and measurement, analysis and improvement. Expect questions on which activities need documented procedures, records, and how clauses apply to device types.
Clause map
- Clause 4 - QMS: process identification, sequence and interaction, risk-based control, software validation (4.1.6), quality manual, medical device file (4.2.3), document control (4.2.4), record control (4.2.5).
- Clause 5 - Management responsibility: top management commitment, customer focus, quality policy, objectives and planning, responsibility and authority, management representative, internal communication, management review with defined inputs and outputs.
- Clause 6 - Resource management: human resources and competence, infrastructure, work environment and contamination control.
- Clause 7 - Product realization: planning, customer processes, design and development (including transfer), purchasing and supplier evaluation, production and service provision, process validation, sterilization, installation, servicing, traceability, preservation, and control of monitoring and measuring equipment.
- Clause 8 - Measurement, analysis and improvement: feedback, complaint handling, regulatory reporting, internal audit, process and product monitoring, control of nonconforming product, analysis of data, improvement, corrective and preventive action.
Worked example
A final inspection finds nonconforming connectors. Under Clause 8.3 the organization must identify and control them to prevent unintended use or delivery, record the nonconformity and actions, and dispose of them by correction, concession with authorized approval, rework followed by re-verification, or rejection. If already delivered, Clause 8.3.3 requires action appropriate to the effects of the nonconformity, including an advisory notice where regulation requires it. The event should also feed the CAPA system and risk management file.
Traps that cost marks
- Mixing up "documented procedure" requirements with activities that only require records.
- Confusing verification (are we building it right?) with validation (does it meet intended use?).
- Forgetting design transfer, advisory notices, and regulatory reporting.
- Treating supplier control as purchase-order paperwork only; ISO 13485 requires evaluation and monitoring proportional to risk.
- Forgetting that traceability records must be kept for at least the device lifetime defined by the organization, never less than two years from release, or as regulation requires.