ASQ CBA Certified Biomedical Auditor

Which of the following BEST describes the primary purpose of a third-party audit?

• ATo assess a supplier's quality system on behalf of the purchasing organization
• BTo evaluate a company's own processes for internal improvement
• CTo provide an independent, impartial assessment of an organization's quality management s…
• DTo verify that a competitor's products meet regulatory requirements

Under ISO 13485:2016, which clause specifically requires the organization to establish and maintain a quality manual?

• AClause 4.1
• BClause 4.2.2
• CClause 5.4
• DClause 7.1

A biomedical auditor discovers that a medical device manufacturer has been implementing changes to device design without updating the Design History File. Which FDA 21 CFR Part 820 section is most directly violated?

• A820.30 — Design Controls
• B820.40 — Document Controls
• C820.80 — Receiving, In-Process, and Finished Device Acceptance
• D820.100 — Corrective and Preventive Action

Which standard provides the primary framework for conducting medical device quality management system audits, covering audit principles, managing an audit programme, and performing audits?

• AISO 13485:2016
• BISO 14971:2019
• CISO 19011:2018
• DFDA 21 CFR Part 820

During a supplier audit, an auditor observes that the supplier's employees are following undocumented procedures that differ from the written SOPs. How should the auditor classify this finding?

• AObservation only, since no regulatory requirement is cited
• BNonconformance, because actual practice does not conform to documented procedures
• COpportunity for improvement, because the undocumented practices may be more efficient
• DMinor nonconformance only if the difference creates a product risk

Under FDA 21 CFR Part 803 (Medical Device Reporting), a manufacturer must submit a MDR report to FDA within how many days of becoming aware of information reasonably suggesting that a device caused or contributed to a serious injury?

• A5 working days
• B15 working days
• C30 calendar days
• D60 calendar days

Which element is NOT required to be included in an audit plan according to ISO 19011:2018?

• AThe audit objectives, scope, and criteria
• BThe locations, dates, and expected duration
• CThe names of the auditee's senior management team
• DThe roles and responsibilities of the audit team members

ISO 14971:2019 defines risk as which of the following?

• AThe probability that a hazard will occur
• BThe combination of the probability of occurrence of harm and the severity of that harm
• CThe severity of injury to a patient caused by a device failure
• DThe likelihood that a hazard will be detected before reaching the patient

During an audit opening meeting, the lead auditor's primary objective is to:

• AReview audit findings and obtain auditee agreement on nonconformances
• BIntroduce the audit team, confirm scope and objectives, and explain the audit process
• CCollect objective evidence and conduct interviews with process owners
• DPresent the draft audit report and allow auditee rebuttal

Under FDA 21 CFR Part 820.100, which CAPA element requires that the effectiveness of the corrective action be confirmed before the CAPA is closed?

• AAnalyzing the source of the problem
• BVerification or validation of corrective action
• CImplementing and recording changes to methods and procedures
• DDisseminating information related to quality problems

A process validation study is divided into Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ). Which phase demonstrates that the process consistently produces acceptable product under actual or simulated production conditions?

• AIQ — Installation Qualification
• BOQ — Operational Qualification
• CPQ — Performance Qualification
• DDQ — Design Qualification

Which of the following BEST describes 'objective evidence' in the context of an audit?

• AThe auditor's professional judgment about process effectiveness
• BData or information that is qualitative or quantitative, verifiable, and not based on rea…
• CAuditee management's verbal assurances of compliance
• DThe auditor's observation notes taken during process walkthroughs

FDA 21 CFR Part 11 establishes requirements for which of the following?

• AMedical device corrections and removals reporting
• BElectronic records and electronic signatures
• CPostmarket surveillance study design
• DMedical device labeling requirements

In ISO 14971:2019, which term describes the potential source of harm?

• ARisk
• BHarm
• CHazard
• DHazardous situation

An auditor is reviewing a medical device company's complaint handling process. Which FDA regulation specifically governs the requirements for handling and investigating customer complaints?

• A21 CFR 820.90 — Nonconforming Product
• B21 CFR 820.198 — Complaint Files
• C21 CFR 820.100 — Corrective and Preventive Action
• D21 CFR 803.50 — Reports by Manufacturers

Which of the following sampling approaches is MOST appropriate when an auditor wants to focus on high-risk or high-complexity processes rather than randomly sampling all records?

• ASimple random sampling
• BSystematic sampling
• CJudgment (purposive) sampling
• DStratified random sampling

ISO 13485:2016 Clause 7.5.2 requires the organization to validate any processes for production and service provision where the resulting output cannot be verified by subsequent monitoring or measurement. This is commonly known as:

• ADesign Verification
• BSpecial Processes Validation
• CIncoming Acceptance Testing
• DPost-Production Surveillance

During an audit, an auditor finds that an employee was given access to a computer system to modify electronic quality records but that the company has no record of this individual's system access authorization. Which regulatory requirement is MOST directly related?

• A21 CFR Part 820.40 — Document Controls
• B21 CFR Part 11.10(d) — Limiting Access
• C21 CFR Part 820.75 — Process Validation
• DISO 13485:2016 Clause 6.2 — Human Resources

Which of the following BEST describes the concept of 'audit trail' as required by 21 CFR Part 11 for electronic records?

• AA written log of who physically accessed the facility during audit hours
• BA computer-generated, time-stamped record of operator actions that create, modify, or del…
• CA summary of audit findings prepared by the lead auditor after fieldwork
• DA sequential list of all corrective actions taken during a quality audit

A medical device company is conducting a risk assessment using ISO 14971:2019. After identifying all hazards, they estimate probability and severity for each risk. What is the NEXT step in the risk management process?

• AImplement risk control measures immediately
• BEvaluate risk acceptability against the company's risk acceptance criteria
• CClose the risk management file
• DSubmit the risk assessment to FDA for review

In the context of the CBA exam's auditing process, which type of audit is performed to confirm that previously identified nonconformances have been addressed?

• ASurveillance audit
• BFollow-up audit
• CCombined audit
• DSystem audit

Under FDA 21 CFR Part 806 (Medical Device Corrections and Removals), a manufacturer is required to submit a report to FDA within how many calendar days of initiating a correction or removal to reduce a risk to health posed by the device?

• A5 calendar days
• B10 calendar days
• C30 calendar days
• D60 calendar days

Which of the following is a key difference between the ISO 13485:2016 QMS standard and the current FDA Quality Management System Regulation (QMSR, 21 CFR Part 820 as revised in 2024)?

• AISO 13485 applies only to manufacturers, while the QMSR covers all supply chain members
• BThe revised QMSR aligns the regulatory requirements with ISO 13485:2016, replacing the or…
• CISO 13485 requires design controls only for Class III devices, while the QMSR requires th…
• DThe QMSR prohibits electronic records while ISO 13485 encourages them

During an audit of a sterilization process, an auditor is reviewing bioburden data. Bioburden testing in medical device sterilization primarily determines:

• AThe sterility assurance level (SAL) already achieved by the device
• BThe number and type of viable microorganisms on a product before sterilization
• CThe maximum temperature the device can withstand during the sterilization cycle
• DThe chemical residue levels remaining on the device after sterilization

An audit team is preparing a checklist for a supplier audit of a critical component manufacturer. According to ISO 19011, what is the PRIMARY purpose of audit checklists?

• ATo serve as the official audit report submitted to management
• BTo guarantee complete compliance verification by requiring every item be checked
• CTo provide guidance and ensure consistency in the audit process while allowing flexibility
• DTo replace the need for the audit plan when auditing critical suppliers

In ISO 13485:2016, what is the specific requirement regarding the retention period for records?

• ARecords must be retained for a minimum of 3 years from the date of creation
• BRecords must be retained for at least the lifetime of the device as defined by the organi…
• CRecords must be retained for the period specified by applicable regulatory requirements
• DRecords must be retained indefinitely unless the organization decides otherwise

Which of the following is an example of a 'supplier quality agreement' element that an auditor would expect to find documented for a critical component supplier?

• AA signed confidentiality agreement covering trade secrets
• BDefined quality requirements, inspection criteria, and notification requirements for chan…
• CA marketing agreement covering exclusive distribution rights
• DA list of the supplier's employee certifications and training records

An auditor interviews an operator and asks, 'What do you do when you find a nonconforming product on the line?' This type of question is BEST classified as:

• AA leading question
• BAn open-ended question
• CA closed question
• DA hypothetical question

ISO 10993 is a series of standards that addresses which aspect of medical device development?

• AElectrical safety testing for active implantable devices
• BBiocompatibility evaluation of materials used in medical devices
• CSterility assurance for terminally sterilized devices
• DClinical investigation requirements for medical devices in humans

When auditing design controls, an auditor asks to see evidence that the design outputs meet the design inputs. This verification activity is MOST closely aligned with which FDA 21 CFR 820.30 sub-element?

• A820.30(e) — Design Review
• B820.30(f) — Design Verification
• C820.30(g) — Design Validation
• D820.30(j) — Design Changes

Which of the following BEST describes the purpose of management review in ISO 13485:2016?

• ATo verify that individual employee performance targets are met
• BTo evaluate the suitability, adequacy, and effectiveness of the QMS at planned intervals
• CTo review and approve all design changes before implementation
• DTo conduct internal audits of all QMS processes annually

A biomedical auditor is evaluating an auditee's CAPA system and finds that root cause analysis was performed but the identified cause was 'human error.' How should the auditor assess this finding?

• AAccept it as a valid root cause, since human error is a recognized cause category
• BCite it as a nonconformance because ISO 13485 prohibits attributing causes to human error
• CNote it as a concern — 'human error' is typically a symptom, not a root cause, and requir…
• DEscalate immediately to the FDA since human error indicates inadequate training

Which of the following software validation activities is required by FDA 21 CFR Part 11 for computer systems used to manage electronic quality records?

• ACommissioning the software only once during initial installation
• BValidating the computer system to ensure it functions as intended for its regulatory use
• CMaintaining paper backup copies of all electronic records at all times
• DSubmitting the software validation protocol to FDA for pre-approval

During audit closing meeting, the lead auditor presents findings. The auditee's management strongly disagrees with a major nonconformance finding. What is the BEST course of action for the auditor?

• AImmediately withdraw the finding to avoid conflict and maintain the auditor-auditee relat…
• BEscalate the disagreement to the auditing organization and remove the finding pending res…
• CRecord the disagreement, document the basis for the finding with objective evidence, and…
• DChange the classification from major to minor to reach a compromise

Which statistical sampling standard is commonly used in medical device manufacturing to determine acceptable quality levels (AQL) for incoming and in-process inspection?

• AISO 14971:2019
• BISO 2859-1 (ANSI/ASQ Z1.4) — Sampling Procedures for Inspection by Attributes
• CISO 13485:2016 Clause 7.4.3
• DFDA 21 CFR Part 11

A manufacturer's written procedure requires that all Design Validation activities be completed before commercial distribution. An auditor finds that marketing of the device began prior to completing one validation test. This is BEST classified as:

• AOpportunity for improvement — the validation test may not be critical
• BObservation — the missing test may be unrelated to safety
• CMajor nonconformance — device was distributed without completing required validation
• DMinor nonconformance — the procedure was partially followed

ISO 13485:2016 Clause 8.5.2 and FDA 21 CFR 820.100 both address CAPA. Which of the following is a CAPA element required by BOTH standards?

• ASubmission of CAPA reports to FDA within 30 days
• BAnalyzing data to detect adverse trends in process or product quality
• CRequiring third-party verification of all corrective actions
• DImplementing preventive actions only for Class III devices

When performing a process audit at a sterilization facility, an auditor finds that the biological indicator (BI) challenge tests are consistently passing but the sterilization cycle parameters are not always maintained within validated limits. The auditor should:

• AAccept the process as adequate since BIs are passing, indicating sterility is achieved
• BIssue a nonconformance because the process must be executed within validated parameters r…
• CRecord this as an observation and request that parameters be re-validated to match actual…
• DWaive the finding if the auditee provides a statistical analysis showing BI results are a…

The EU Medical Device Regulation (EU MDR 2017/745) introduced which major new requirement for higher-risk medical devices compared to the previous Medical Device Directive (MDD)?

• ARegistration of devices with a national competent authority
• BCE marking before marketing in the EU
• CEnhanced clinical evidence requirements and post-market clinical follow-up (PMCF)
• DAppointment of an authorized representative in the EU

Which of the following is the CORRECT sequence for conducting a corrective action process under ISO 13485:2016?

• AImplement fix → Identify root cause → Verify effectiveness → Document
• BDocument problem → Implement containment → Identify root cause → Implement corrective act…
• CSubmit to FDA → Implement fix → Document → Close CAPA
• DIdentify problem → Close CAPA → Verify effectiveness → Implement fix

An auditor is sampling Device History Records (DHRs) for a medical device. The DHR is incomplete — the date of manufacture is missing for several units. Under FDA 21 CFR 820.184, what must a DHR contain?

• AOnly the final inspection and test records
• BQuantities manufactured, accepted, and distributed; dates of manufacture; acceptance reco…
• COnly the device specification and drawing numbers
• DCustomer complaints received during the product's marketed life

In quality auditing, an 'audit finding' is BEST defined as:

• AAny observation made during the audit, whether positive or negative
• BThe results of evaluating collected audit evidence against audit criteria
• COnly negative outcomes identified during the audit fieldwork
• DThe auditor's opinion about the overall state of the auditee's quality system

Which of the following is a PRIMARY output required from the corrective action process under FDA 21 CFR 820.100?

• AUpdated device labeling to reflect the deficiency
• BDocumented results of the investigation and corrective action taken
• CAn annual CAPA summary submitted to FDA
• DRevised manufacturing processes only if the deficiency involves production

A Pareto chart is used in quality auditing to:

• AShow the relationship between two variables to identify correlation
• BDisplay the frequency of causes or problems in descending order to identify the most sign…
• CMap the detailed steps of a manufacturing process
• DTrack performance metrics over time to detect trends

Under ISO 13485:2016 Clause 7.3.3, which of the following is required to be documented for design inputs?

• AOnly the final functional performance specifications
• BFunctional, performance, and safety requirements appropriate to the intended use, includi…
• CThe manufacturing process steps needed to produce the device
• DPost-market surveillance data collected after device launch

An auditor reviewing an organization's audit program notes that internal auditors are auditing their own work areas. According to ISO 19011:2018 and ISO 13485:2016, this practice:

• AIs acceptable if the auditors are certified
• BIs acceptable if management approves the assignments
• CViolates the requirement for auditor independence and objectivity
• DIs encouraged as it promotes ownership of the quality system