A medical device manufacturer is undergoing an ISO 13485:2016 audit. They utilize a contract manufacturer to produce a critical component for one of their Class III devices. During the audit, the Lead Auditor reviews the medical device company's records pertaining to the oversight of the contract manufacturer. While the records show regular communication, agreed-upon specifications, and documented inspections of incoming components, the Lead Auditor discovers that the medical device company is performing no periodic on-site audits of the contract manufacturer's facility. What type of conclusion should the Lead Auditor draw?
During an ISO 13485:2016 audit, the Lead Auditor is reviewing the effectiveness of the company's Corrective and Preventive Action (CAPA) system. The auditor notes that the company's CAPA procedure includes a requirement for effectiveness checks to verify that implemented corrective actions have been effective in addressing the root cause of the problem and preventing recurrence. However, the Lead Auditor discovers that the effectiveness checks consistently focus on confirming the immediate resolution of the problem, with limited consideration of the long-term sustainability and robustness of the implemented corrective action, or its potential unintended consequences. What is the MOST appropriate next step for the Lead Auditor to take?
A medical device company utilizes a cloud-based platform for managing its Quality Management System (QMS) documentation. The company’s documented procedure for software validation and data security, while comprehensive, does not address the specific requirements for verifying the ongoing data integrity and availability of QMS data on the cloud platform. The company does not perform independent backup of their cloud data. As a Lead Auditor, what is the MOST appropriate action to take?
A medical device company is undergoing an ISO 13485:2016 audit. The company has a documented procedure for supplier evaluation, and the company has several suppliers used to produce critical components. The company’s procedure outlines initial evaluation, periodic evaluation, and performance monitoring, however, for some suppliers that are deemed “low-risk” there is no *documented rationale* for why those suppliers were classified as such. As the Lead Auditor, what is the MOST appropriate action to take?
A medical device company is undergoing an ISO 13485:2016 audit. The company uses a contract manufacturer to produce a critical component of their Class II medical device. The Lead Auditor reviews the medical device company's records pertaining to the oversight of the contract manufacturer. While the records show regular communication, agreed-upon specifications, and documented inspections of incoming components, the Lead Auditor discovers that the medical device company is performing no periodic on-site audits of the contract manufacturer's facility. The company claims that these audits are not required if the component meets all the specifications and regulatory requirements. What should be the Lead Auditor’s MOST appropriate next action?