A medical device company is undergoing an ISO 13485:2016 audit. The company outsources the manufacturing of a critical component to a supplier. During the audit, the Lead Auditor discovers the supplier performs 100% automated inspection of the critical dimensions of the component, and the medical device company's quality group does not perform incoming inspection. The Lead Auditor reviews the process for controlling these outsourced processes and confirms the supplier's automated inspection system used to verify critical product dimensions is validated. What additional action must be verified by the Lead Auditor to ensure compliance?
During an ISO 13485:2016 audit of a medical device company, the Lead Auditor discovers that the company has implemented a comprehensive training program for its employees. The program covers various aspects of the QMS, including document control, CAPA, and risk management. However, the effectiveness of the training is solely measured through post-training quizzes, with no documented evidence of how the learned knowledge and skills are applied in the employees' actual job performance. As a Lead Auditor, what is your PRIMARY concern?
A medical device company has implemented a system for monitoring and measuring key processes within its Quality Management System (QMS). The system generates various performance metrics, which are regularly reviewed by management. However, the Lead Auditor discovers that the company has not established specific, measurable, achievable, relevant, and time-bound (SMART) objectives for these metrics. As a Lead Auditor, what is the MOST significant concern?
During an ISO 13485:2016 audit, a Lead Auditor is evaluating the post-market surveillance system of a medical device company. The company primarily relies on customer complaints to identify potential issues. The Lead Auditor finds that while the company diligently collects and investigates customer complaints, the threshold for initiating a formal investigation and potential corrective action is based on a subjective assessment of the 'severity' of the complaint. There is no documented definition of 'severity' or objective criteria used to determine whether a complaint warrants a deeper investigation. What is the MOST appropriate course of action for the Lead Auditor?
A medical device company is undergoing an ISO 13485:2016 audit. The Lead Auditor discovers that the company's process for handling customer complaints includes detailed procedures for documentation, investigation, and corrective actions. However, the Lead Auditor also discovers that the company does not have a documented procedure for protecting patient confidentiality and complying with data privacy regulations (e.g., GDPR, HIPAA) when handling customer complaints that contain patient information. What is the MOST appropriate action for the Lead Auditor to take?