Allied Health & Imaging · Independent exam preparation
Certified Medical Device Auditor (CMDA): Free Study Guide and Practice Test Study Guide
A selective, non-exhaustive blueprint-aligned study guide for the 2020 CMDA Body of Knowledge active on October 13, 2026, with 60 applied concepts, 20 original practice questions, and 20 flashcards. The complete official Body of Knowledge applicable to your testing window defines the full examination scope.
By CertMedbry · Updated 13 October 2026
This guide prepares you for ASQ’s Certified Medical Device Auditor (CMDA), a medical-device quality-auditing certification—not a nursing or clinical practice license. It follows the 2020 Body of Knowledge active on October 13, 2026. ASQ has published a replacement outline effective November 1, 2026; confirm which outline applies to your testing window. These 60 concepts are selective and not exhaustive. Use the complete official Body of Knowledge applicable to your testing window for the full examination scope. Use the concepts to practise audit reasoning, then confirm present legal obligations through current authoritative sources for the relevant jurisdiction. The questions and cards are independent learning materials, not official ASQ items or a pass prediction.
Try 20 free practice questionsWhat is the exam format?
Check the question types, timing and outline before planning your revision.
Which CMDA blueprint does this guide use?
The 2020 CMDA Body of Knowledge is active on October 13, 2026. Its scored-question allocations are 12, 28, 38, 42, and 15 across the five domains. The published 2026 outline takes effect November 1, 2026; it changes the first two allocations to 15 and 25 while leaving the other three unchanged. Use the outline that applies to your testing window.
ASQ Medical Device Auditor Certification — CMDA · Certified Medical Device Auditor — 2020 Body of Knowledge · CMDA Body of Knowledge Map 2020–2026
How many questions and how much time are listed for computer delivery?
The computer-delivered exam is listed as 145 multiple-choice questions: 135 scored and 10 unscored. Exam time is 4 hours 18 minutes. The certification page separately describes a four-and-a-half-hour appointment, so distinguish testing time from appointment time.
What are the paper-and-pencil question count and duration?
The issuer lists a one-part paper-and-pencil exam with 135 questions and four hours of testing time. The supplied information does not state a separate scored-versus-unscored breakdown for this delivery option, so do not assume one.
ASQ Medical Device Auditor Certification — CMDA · Certified Medical Device Auditor — 2020 Body of Knowledge
What item style and language are verified?
The issuer describes multiple-choice questions and lists English as the examination language. This guide uses original four-option, single-best-answer drills; that is a learning format, not a claim that every official item has exactly four options.
ASQ Medical Device Auditor Certification — CMDA · Certified Medical Device Auditor — 2020 Body of Knowledge
Is the examination adaptive, and what delivery options are available?
The supplied issuer information verifies computer-delivered and paper-and-pencil formats but does not establish whether the exam is adaptive. Do not infer adaptivity or a particular remote-proctoring arrangement from the outline.
Is the CMDA examination open book?
ASQ states that its examinations are open book and that candidates must bring their own bound reference materials. Review current candidate instructions for permitted materials and delivery-specific rules before test day.
Does the supplied evidence establish a passing score or pass predictor?
No passing-score number is established by the supplied outline evidence. The original practice questions are for learning and do not predict an official result.
ASQ Medical Device Auditor Certification — CMDA · Certified Medical Device Auditor — 2020 Body of Knowledge
Is the practice-question distribution an official ASQ requirement?
No. This 20-question preview uses 2/4/5/6/3 items across the five domains as a design choice. ASQ’s official 2020 blueprint instead lists scored-exam allocations of 12/28/38/42/15. The preview distribution is not an official examination specification.
How should I treat legacy QSR and QSIT language in the active outline?
The 2020 outline retains legacy QSR and QSIT references, but FDA’s QMSR became effective February 2, 2026, incorporates ISO 13485:2016, and FDA stopped using QSIT. ASQ’s transition map explains that interim legacy wording addresses core quality-system concepts rather than changed numbering or document structure. Use the outline for examination scope and current FDA sources for present-day compliance.
Certified Medical Device Auditor — 2020 Body of Knowledge · CMDA Body of Knowledge Map 2020–2026 · FDA Quality Management System Regulation
The credential is Certified Medical Device Auditor (CMDA). ASQ’s legacy biomedical-auditor URL identifies this credential; it does not identify a separate clinical certification. The guide uses the active 2020 outline. The 2026 outline takes effect November 1, 2026. Official allocations describe scored examination questions; this 20-question preview uses 2/4/5/6/3 questions across the five domains as a teaching-design choice, not an ASQ requirement. The complete official outline applicable to the testing window defines the full examination scope; this selective guide does not cover it all. Regulatory examples distinguish statutes, regulations, standards, and nonbinding guidance; auditors identify criteria and report evidence, not make unsupported legal determinations.
Outline used: 2020 CMDA Body of Knowledge, active on 2026-10-13. ASQ has published a replacement 2026 Body of Knowledge effective November 1, 2026; it is not yet active on the requested date. The workbook label matches the verified official credential. Materials use the active blueprint and cross-check regulatory content against current requirements, including FDA's QMSR transition.
60 key concepts: understand, apply and avoid the traps
Work through the questions by exam domain. Explain the answer in your own words, try the example, then check the common pitfall.
Auditing Fundamentals12 of 135 scored questions (8.89%)
1.How do audit purpose, method, and party distinguish different dimensions of an audit?
Purpose explains why an audit is performed; method describes what is examined; party describes the relationship of the auditor to the audited organization. This is the guide’s practical teaching cross-classification, not a separate ASQ taxonomy. ASQ’s 2020 outline lists first-, second-, and third-party audits under “audits by method.” A supplier audit can be second-party by relationship, process-focused by method, and intended for supplier qualification by purpose. These categories can coexist.
Apply it
A manufacturer audits a prospective supplier to qualify a critical component source, focusing on purchasing and production controls. Classify relationship, purpose, and method separately before planning.
Common pitfall: Supplier audit alone does not identify every classification. Do not confuse purpose with method or party relationship, and remember ASQ places party classifications under its “audits by method” outline topic.
2.Which responsibilities belong to the auditor, audit client, and auditee?
The audit team gathers and evaluates evidence against criteria; the lead auditor coordinates the team, plan, communications, and reporting. The client authorizes or requests the audit. The auditee provides access, people, and records and responds to findings. Auditors assess and report but do not assume management’s responsibility for operating or correcting the process. Agree on roles before fieldwork, consistent with the outline’s audit-role topic.
Apply it
A client requests a supplier audit, and the supplier proposes corrective actions. The audit team evaluates evidence and reports; it does not implement the supplier’s actions.
Common pitfall: Do not promise a clean report or prescribe the auditee’s solution. Either can compromise independence and blur responsibility.
3.How should an auditor handle a conflict of interest?
Personal, financial, or recent operational interests can threaten impartiality. Disclose the circumstance to the appropriate audit authority, assess its effect, and use a safeguard such as reassignment where needed. Credibility depends on independence, objectivity, and competence; expertise does not remove a conflict of interest. The applicable ethical principles are addressed by the ASQ Code of Ethics and the CMDA outline’s professional-issues topic.
Apply it
An auditor is assigned to review a design process they recently owned. They disclose the overlap and seek an independent auditor or another documented safeguard.
Common pitfall: Do not conceal a conflict because no biased decision has occurred. Address the threat before it can affect conclusions.
ASQ Code of Ethics · Certified Medical Device Auditor — 2020 Body of Knowledge
4.Why must audit confidentiality include personal information?
Audit access may expose personnel, customer, or other sensitive data. Collect only information relevant to the agreed audit, protect it from unauthorized disclosure, and follow applicable legal and contractual controls. Confidentiality does not justify ignoring evidence or withholding a required report from an authorized recipient. Preserve enough evidence for a reliable conclusion while limiting access appropriately.
Apply it
An auditor sees personal identifiers in a complaint file. They document relevant evidence using controlled identifiers and restrict access to authorized audit personnel.
Common pitfall: Do not copy personal data for convenience or promise absolute secrecy that conflicts with legal duties or agreed reporting.
ASQ Code of Ethics · Certified Medical Device Auditor — 2020 Body of Knowledge
5.What do due care and liability mean in audit practice?
Due care requires professional judgment, competence, and diligence appropriate to the audit’s authority and scope. Carelessly overlooking material evidence, mishandling confidential information, or issuing unsupported conclusions can harm credibility and may create contractual, professional, or legal and financial consequences, depending on jurisdiction, duty, and facts. Audit results can also affect an auditee: a documented finding may put the organization on notice, and an inadequate response may be relevant evidence in later proceedings. Neither an audit finding nor its absence automatically establishes or eliminates liability.
Apply it
An auditor sees records suggesting a serious recurring failure but, without further inquiry, reports that the entire process is compliant. A later harm exposes the unsupported conclusion. The auditor should have investigated within scope, documented limitations, and reported evidence proportionately; any liability determination belongs to the appropriate legal process.
Common pitfall: A disclaimer does not excuse negligent work. Do not guarantee safety, suppress relevant evidence, or claim that an audit result itself proves legal liability.
ASQ Code of Ethics · Certified Medical Device Auditor — 2020 Body of Knowledge
Auditing and Inspection Processes28 of 135 scored questions (20.74%)
6.How should audit authority, scope, and criteria be fixed before fieldwork?
Confirm authority, objective, scope, criteria, resources, and constraints during planning. Scope defines organizational, product, process, location, and time boundaries; criteria state the requirements used to judge evidence. Criteria may include applicable regulations, standards, procedures, and contractual requirements, as authorized for the audit. Clarify uncertainty before collecting evidence so findings do not exceed the mandate or lack a defensible benchmark.
Apply it
A client requests an audit of sterilization controls but has not identified applicable criteria. The lead auditor clarifies scope, authority, and criteria before setting the schedule.
Common pitfall: A checklist organizes inquiry but does not create audit authority or requirements. Clarify the mandate first.
Certified Medical Device Auditor — 2020 Body of Knowledge · MDSAP Audit Approach — MDSAP AU P0002.009
7.Which factors make an auditor suitable for a particular assignment?
Match education, experience, industry knowledge, and technical expertise to the audit criteria and risk. Communication, problem-solving, attention to detail, cultural sensitivity, and the ability to work independently and in a team also matter. A team can combine complementary expertise to cover gaps. Selection should reflect the assigned work, not seniority alone or familiarity with the auditee, as specified by the outline’s auditor-selection topic.
Apply it
A sterilization audit uses both a process specialist and an auditor experienced in QMS evidence, with responsibilities matched to their competence areas.
Common pitfall: Do not infer technical competence from an auditor title alone. Address competence gaps through team composition or technical support.
Certified Medical Device Auditor — 2020 Body of Knowledge · MDSAP Audit Approach — MDSAP AU P0002.009
8.How can prior records improve preparation without prejudging findings?
Prior audit reports, corrective-action records, procedures, requirements, and process information can guide questions and risk-based sampling. Historical findings are leads, not proof that the same problem remains or that the process is currently compliant. Confirm conclusions with current objective evidence and distinguish known information from what must be verified. Report findings based on the present audit’s evidence.
Apply it
A prior report cited late supplier evaluations. The auditor checks current records and interviews responsible staff rather than automatically repeating the old finding.
Common pitfall: Do not copy prior nonconformities forward without re-verification. Historical evidence guides inquiry but does not establish the present condition.
Certified Medical Device Auditor — 2020 Body of Knowledge · MDSAP Audit Approach — MDSAP AU P0002.009
9.When are forward tracing, backward tracing, and discovery useful?
Forward tracing follows an input or record through production, release, distribution, or service. Backward tracing starts with a finished product, complaint, or event and follows its history toward inputs and decisions. Discovery is inquiry prompted by evidence rather than a fixed path. Choose the direction that tests the audit objective; one trace direction may not establish end-to-end control. The outline identifies tracing strategies as audit-planning tools.
Apply it
For a returned device, trace from the complaint back to device-history and component-lot records, then follow a related lot forward to assess distribution controls.
Common pitfall: Do not claim full traceability based on one path or a single sample. State the population and limits of the trace.
Certified Medical Device Auditor — 2020 Body of Knowledge · MDSAP Audit Approach — MDSAP AU P0002.009
10.How should an auditor choose an audit sample and prepare working papers?
Choose a sampling approach that fits the objective, risk, population, and available time; document its rationale, selection method, and limitations. Checklists, logs, and evidence cross-references should support consistent collection and later reconstruction. A judgmental or convenience sample can support findings about observed evidence but does not automatically establish statistical confidence or representativeness. Statistical conclusions require an appropriate plan and rationale.
Apply it
When asked whether every batch was checked, report the sampled batches, selection rationale, evidence, and limits rather than implying a census occurred.
Common pitfall: Do not call a convenience sample statistically valid without support. A checklist without recorded evidence is not an adequate working paper.
Certified Medical Device Auditor — 2020 Body of Knowledge · MDSAP Audit Approach — MDSAP AU P0002.009
11.What should an opening meeting establish?
Align participants on purpose, scope, criteria, schedule, communication routes, and any agreed finding classification. Record attendees and address access, escorts, safety, security, translation, and confidentiality arrangements as relevant. The meeting coordinates the audit; it does not negotiate away applicable requirements. Communicate and assess the effect of unexpected constraints rather than silently proceeding as planned.
Apply it
A planned production observation cannot occur because the line is stopped for maintenance. The lead records the limitation, discusses alternatives, and evaluates whether scope or timing needs an authorized change.
Common pitfall: Do not assume silence means agreement about scope or classifications. Clarify material misunderstandings and record consequential changes.
12.How do ALCOA principles strengthen audit evidence?
ALCOA asks whether data are attributable, legible, contemporaneous, original, and accurate. Assess who made an entry, whether it can be read, when it was recorded, whether the source is preserved, and whether it reflects the event. Electronic systems need controls that preserve equivalent reliability. A missing attribute may warrant investigation rather than automatic rejection of every associated record. ALCOA is specified in the active audit-process outline.
Apply it
A test result is entered days after testing with no traceable author. Seek source data and system records before deciding whether it supports release.
Common pitfall: A neat printout does not prove data integrity. Assess how underlying data were generated and controlled, and investigate discrepancies.
13.Which interview techniques produce more reliable evidence?
Use clear, neutral questions, listen without interrupting, and allow time for a considered response. Open questions help explain work; focused follow-ups clarify records or steps. Compare statements with observation and documents, adapting when supervisors or translators are present. Explore conflicting accounts respectfully and gather corroborating evidence rather than pressuring an interviewee to accept an assumption.
Apply it
An operator says a deviation was escalated, but the record is unclear. Ask the operator to describe the route and compare the account with the procedure and event record.
Common pitfall: Leading questions can generate agreement without reliable evidence. Corroborate material statements using appropriate records or observation.
14.When should an audit plan change during performance?
Adjust the plan when evidence, access, safety, timing, or emerging risk makes the original allocation ineffective. The lead assesses significance, reallocates resources when justified, and communicates material changes to the auditee and client. Maintain the audit objective and criteria unless an authorized scope change is agreed. Record areas left unexamined so conclusions reflect actual coverage; this aligns with the outline’s on-site management topic.
Apply it
Discrepancies in sterilization records increase concern. The lead reallocates time, informs the auditee, and records the effect on the remaining plan.
Common pitfall: Do not silently expand or reduce scope. Adjustments must remain authorized and transparent to relevant parties.
Certified Medical Device Auditor — 2020 Body of Knowledge · MDSAP Audit Approach — MDSAP AU P0002.009
15.What makes a defensible report, closing meeting, and audit record?
Connect each finding’s criterion to specific, verifiable evidence and a clearly described gap. At closing, restate scope and criteria, present results and limitations, confirm factual accuracy, record attendees, and clarify next steps and responsibilities. Factual concurrence does not require agreement with every conclusion. Finalize, approve, distribute, and retain reports and working records under applicable organizational, contractual, and legal controls.
Apply it
A report cites a controlled procedure and sampled records showing a required review was absent. At closing, confirm the records and discuss follow-up, without changing valid evidence merely to obtain agreement.
Common pitfall: Do not assert that a process is ineffective without a clear criterion and supporting evidence. Do not assume audit closure means all records may be discarded; retention rules still apply.
MDSAP Medical Device Regulatory Audit Report Form Guidelines — AU G0019.3.007 · Certified Medical Device Auditor — 2020 Body of Knowledge
16.How should audit follow-up and closure verify corrective action?
Evaluate whether a response addresses the problem, prioritizes risk, assigns responsibility, investigates cause, and defines an effectiveness check. Correction addresses the detected instance; corrective action seeks to prevent recurrence by addressing cause. Follow-up may examine records, observe the revised process, or conduct a re-audit. Close when agreed criteria are met and evidence supports effectiveness; escalate late or ineffective actions through the defined process.
Apply it
A supplier retrains one operator after repeated errors. Evaluate whether the response addresses the process cause and later check performance for recurrence.
Common pitfall: A revised procedure or training record alone does not prove effectiveness. Verify that the method is appropriate to the risk and recurrence mechanism.
Certified Medical Device Auditor — 2020 Body of Knowledge · GHTF Guidance on Corrective Action and Preventive Action and Related QMS Processes — 2010 · MDSAP Medical Device Regulatory Audit Report Form Guidelines — AU G0019.3.007
17.How should ISO 19011, MDSAP, and legacy QSIT references be understood?
The active outline calls for understanding general auditing principles in ISO 19011 and the MDSAP audit model, as well as legacy QSIT and FDA inspection references. Use audit principles to structure evidence-based, risk-aware planning and performance; use the applicable model or procedure for its intended context. FDA’s QMSR became effective February 2, 2026, and FDA stopped using QSIT. ASQ’s transition map says interim legacy terminology addresses core concepts, not changed numbering or document structure.
Apply it
An examination scenario uses a legacy QSIT label while describing supplier controls. Recognize the audit concept, but consult current FDA materials for present U.S. inspection and compliance work.
Common pitfall: Do not present QSIT as FDA’s current inspection method or treat a legacy outline citation as a complete current legal requirement.
Certified Medical Device Auditor — 2020 Body of Knowledge · CMDA Body of Knowledge Map 2020–2026 · FDA Quality Management System Regulation · MDSAP Audit Approach — MDSAP AU P0002.009
Medical Device Quality Management System Requirements38 of 135 scored questions (28.15%)
18.How do U.S. device classification and premarket routes relate?
The FD&C Act provides the statutory framework for device classification and premarket requirements; classification is generally by class I, II, or III, with applicable controls and pathways depending on device, intended use, and law. Routes may include exemption where available, 510(k) substantial-equivalence review, De Novo classification for certain novel devices, and premarket approval for devices requiring it. A 510(k) determination is not a finding of identical construction. Audit the organization’s documented regulatory rationale and supporting evidence; do not infer a route from a product name alone or treat a QMS audit as market authorization.
Apply it
A manufacturer changes a material but retains intended use. Review its regulatory assessment and supporting evidence rather than assuming the change automatically requires or avoids a submission.
Common pitfall: Do not equate substantial equivalence with identical design, assume all devices use the same route, or give a legal conclusion without the device facts and applicable current criteria.
Certified Medical Device Auditor — 2020 Body of Knowledge · FDA Premarket Notification 510(k)
19.How do FD&C Act statutes differ from Title 21 CFR requirements, and what do adulteration and misbranding mean?
The FD&C Act is federal statute; Title 21 CFR contains regulations issued under statutory authority. The outline names Act sections 201, 301–304, 501–502, 510, 513, 518, 522, and 704: topics include definitions, prohibited acts and enforcement, adulteration, misbranding, registration/listing, classification, remedies, post-market surveillance, and inspection. Adulteration broadly concerns a device’s condition or manufacture under applicable statutory provisions; misbranding concerns labeling or related representations. They are distinct legal concepts, and a formal conclusion depends on facts and law.
Apply it
A device appears to meet its documented manufacturing specifications, but its label may omit required information. Identify the evidence and applicable labeling criterion; distinguish that concern from a manufacturing-condition concern.
Common pitfall: Do not use adulteration and misbranding interchangeably or assert a statutory violation based only on a label, a checklist, or a product name.
20.Which named U.S. CFR topics should an auditor recognize, and how should legacy citations be handled?
The 2020 outline names 21 CFR Parts 4 (combination products), 7 (enforcement policy), 11 (electronic records and signatures), 58 (nonclinical laboratory studies), 801 (labeling), 803 (medical device reporting), 806 (corrections and removals), 807 (establishment registration and device listing), 820 (quality system requirements), 821 (tracking), and 830 (unique device identification). These are distinct subjects, not interchangeable requirements. FDA’s QMSR took effect February 2, 2026; legacy Part 820/QSR wording in the examination outline should not be mistaken for a current legal update. Determine applicability by product, activity, regulated role, date, and jurisdiction.
Apply it
An audit finds an electronic complaint record, a device listing, and a field correction. Identify which topics may be implicated, verify current requirements and the organization’s role, and trace records across the decisions.
Common pitfall: Do not assume every listed part applies to every device or entity, or use a legacy outline citation as the sole current legal criterion.
Certified Medical Device Auditor — 2020 Body of Knowledge · FDA Quality Management System Regulation · FDA Mandatory Reporting Requirements: Manufacturers, Importers and Device User Facilities
21.How should current U.S. QMSR requirements be distinguished from the older outline?
The active 2020 outline organizes quality-system topics using legacy QSR part labels. For current U.S. work, FDA’s QMSR took effect February 2, 2026, incorporates ISO 13485:2016, and preserves the precedence of applicable U.S. statutes and regulations. ASQ explains how legacy examination language is handled during transition. Use the outline for exam scope and current FDA sources and law for present obligations; the outline is not a legal update.
Apply it
A company procedure cites a legacy section number. Assess whether its control meets applicable current QMSR requirements rather than treating the old citation as decisive.
Common pitfall: Do not assume ISO 13485 incorporation displaces U.S. statutory requirements or that legacy numbering remains current law.
FDA Quality Management System Regulation · CMDA Body of Knowledge Map 2020–2026 · Certified Medical Device Auditor — 2020 Body of Knowledge
22.When do in-vitro diagnostic requirements need separate attention?
In-vitro diagnostic devices have product-specific regulatory considerations. The 2020 CMDA outline includes U.S. 21 CFR 809 and EU IVDR 2017/746. Identify device type and jurisdiction before selecting criteria; intended purpose and claims help determine relevant requirements. General QMS controls still matter but do not replace product-specific obligations applicable to the IVD. Verify current requirements for the relevant market and device category.
Apply it
An assay is supplied in the United States and the EU. Separate applicable U.S. IVD criteria from EU IVDR obligations, then trace each to controlled product and market records.
Common pitfall: Do not assume a general-device checklist fully covers IVD-specific requirements or that U.S. and EU rules are interchangeable.
Certified Medical Device Auditor — 2020 Body of Knowledge · References — Medical Device Auditor Certification — CMDA
23.Which quality standard fits a QMS, a device QMS, or a testing laboratory?
The outline asks candidates to evaluate ISO 9001, ISO 13485, and ISO 17025. Their scopes differ: ISO 9001 is a general QMS standard, ISO 13485 addresses medical-device quality management, and ISO 17025 concerns laboratory competence. Select criteria according to activity, stated scope, and applicable regulatory obligations. Certification to a management-system or laboratory standard does not by itself establish every relevant capability.
Apply it
A manufacturer outsources a critical test. Examine the laboratory’s competence evidence and method controls, not only the manufacturer’s ISO 13485 certificate.
Common pitfall: Do not treat the standards as interchangeable or infer product regulatory approval from management-system certification.
Certified Medical Device Auditor — 2020 Body of Knowledge · References — Medical Device Auditor Certification — CMDA
24.What evidence shows management responsibility for the quality system?
Management responsibility is demonstrated through quality planning, objectives, adequate resources, defined authority, competent personnel, management review, and follow-through on audit and customer information. A policy statement alone does not show an effective system. Compare decisions with resource allocation, review outputs, and action follow-through. The audit question is whether management responsibilities operate in practice.
Apply it
Management review repeatedly records an overdue resource issue without action. Trace the issue to decisions, assigned owners, and subsequent review rather than relying on meeting attendance.
Common pitfall: Do not conclude management is effective merely because a representative is named or meetings occur. Examine outcomes and follow-through.
Certified Medical Device Auditor — 2020 Body of Knowledge · FDA Quality Management System Regulation
25.How do design controls connect requirements to the released device?
Design controls link planned inputs to outputs through reviews, verification, validation, transfer, changes, and appropriate design records. Verification asks whether outputs meet specified inputs; validation asks whether the resulting device meets user needs and intended uses under defined conditions. Traceability connects requirements, evidence, and release decisions. Evaluate whether controls worked, not merely whether a file exists.
Apply it
A new interface passes specification tests, but there is no evidence that intended users can complete the task safely. Distinguish verification evidence from missing validation evidence.
Common pitfall: Do not treat an engineering test as proof of user-needs validation or assume a complete-looking file proves effective control.
Certified Medical Device Auditor — 2020 Body of Knowledge · Applying Human Factors and Usability Engineering to Medical Devices — August 3, 2026
26.How do controlled documents differ from quality records?
Documents direct or define work and require controlled approval, revision, distribution, and change management. Records provide evidence that an activity or result occurred and require protection, retrieval, and retention controls. Device master information and device history evidence serve different purposes. Trace a change from authorization through implementation and the resulting records to assess control in practice.
Apply it
A revised inspection procedure exists, but operators use an obsolete copy. Check distribution and implementation, then sample records created after the change.
Common pitfall: Do not assume revision automatically changes practice or that a completed record can be altered like a working instruction.
27.What demonstrates effective supplier qualification and purchasing control?
Supplier controls should be proportionate to the supplied item or service’s effect on product conformity and risk. Qualification, clear purchasing requirements, supplier monitoring, and incoming acceptance work together; inspection alone may not control a critical process adequately. Examine requirements, performance, response to changes, and failures. Controls should link to actual supplier and product risk, consistent with QMS requirements.
Apply it
A supplier performs a critical coating process that cannot be fully inspected afterward. Examine qualification, process evidence, change communication, and ongoing monitoring.
Common pitfall: An approved-supplier listing or certificate alone does not establish continuing control. Assess performance, risk, and response to change.
Certified Medical Device Auditor — 2020 Body of Knowledge · MDSAP Audit Approach — MDSAP AU P0002.009
28.Why must identification and traceability continue across product stages?
Identification distinguishes product and status; traceability connects product to relevant history, inputs, processing, inspection, and distribution. Required depth depends on applicable requirements and risk. Test controls by following a unit or lot in both directions where appropriate; an identifier on a label alone does not prove associated history can be recovered. UDI and other identifiers should be assessed in the context of the product and applicable market requirements.
Apply it
Select a distributed device and trace it to production and component records. Then select a component lot and identify finished-device lots using it, as the audit objective requires.
Common pitfall: Do not confuse identification with complete traceability or rely on a database link without testing the associated records.
29.When does a production process require validation rather than only inspection?
Validation is important when output cannot be fully or adequately verified by later inspection or testing. Relevant controls can include defined conditions, qualified equipment, monitoring, competent personnel, and change-based revalidation decisions. Automated-process software also needs appropriate validation. The decision depends on whether output conformity can be adequately established, not merely on a process label.
Apply it
A joining process produces a bond whose critical strength cannot be fully tested on every finished unit. Review validation and ongoing process monitoring.
Common pitfall: Do not substitute end-product sampling for process validation when output cannot be adequately verified later.
Certified Medical Device Auditor — 2020 Body of Knowledge · GHTF Quality Management Systems — Process Validation Guidance, Edition 2, January 2004
30.How should an auditor assess measuring-equipment calibration?
Equipment should be suitable for its intended measurement, maintained, and calibrated against appropriate traceable standards when required. Review status, interval rationale, results, out-of-tolerance events, and impact on product previously accepted using the instrument. Traceability alone does not prove suitability. An out-of-tolerance finding requires impact assessment, not merely recalibration and closure; measurement-system principles support this audit inquiry.
Apply it
A gauge fails calibration after several lots were accepted. Examine error extent, affected records, product-risk assessment, and action taken following the result.
Common pitfall: A current calibration sticker does not prove historical measurement validity or instrument suitability. Assess past impact as well as current status.
Certified Medical Device Auditor — 2020 Body of Knowledge · NIST/SEMATECH Handbook — Gauge R&R Studies · NIST/SEMATECH Handbook — Analysis of Bias
31.How should nonconforming product be controlled and dispositioned?
Identify and control nonconforming product to prevent unintended use or release, evaluate significance, document disposition, and control authorized rework or concession as applicable. If product has been distributed, field-action considerations may arise. Trace the nonconformity from detection through segregation, decision, authorization, and verification; a disposition is meaningful only when its action and rationale are supported.
Apply it
Inspection finds a defect in product packed for shipment. Check hold status, affected-lot scope, disposition authority, and whether released product needs assessment.
Common pitfall: Do not assume rework restores conformity without required reinspection or documentation. Trace product status through its authorized outcome.
32.How are correction, corrective action, and preventive action distinguished?
Correction addresses a detected problem; corrective action investigates and addresses its cause to prevent recurrence. Preventive action, in the outline’s terminology, addresses potential problems before occurrence. CAPA uses quality data, risk-based prioritization, cause analysis, assigned responsibility, and effectiveness checks. Assess whether the system detects patterns and whether actions address causes rather than merely document activity.
Apply it
A recurring complaint prompts repair of affected units and investigation of a shared process cause. Check whether corrective action addresses that cause and whether recurrence is monitored.
Common pitfall: Do not equate correction, retraining, or procedure revision with verified corrective-action effectiveness.
Certified Medical Device Auditor — 2020 Body of Knowledge · GHTF Guidance on Corrective Action and Preventive Action and Related QMS Processes — 2010
33.How do complaint handling, servicing, and U.S. MDR assessment connect?
Complaint and service information can reveal failures or adverse events and should feed investigation and reporting assessment. In the United States, reporting duties depend on the entity, event facts, and applicable requirements; manufacturers, importers, and user facilities may have different duties. Audit the route from receipt through evaluation, investigation where appropriate, reporting decision, and quality-data input. Reportability is not determined solely by whether a device was returned.
Apply it
A service record describes a malfunction with potential patient consequences. Check whether it entered complaint handling and whether the correct reporting-role assessment was documented.
Common pitfall: Do not assume every service event is reportable or that different regulated entities have identical obligations. Use current U.S. requirements.
Certified Medical Device Auditor — 2020 Body of Knowledge · FDA Mandatory Reporting Requirements: Manufacturers, Importers and Device User Facilities
34.What should post-market surveillance and field-action controls achieve?
Post-market surveillance evaluates information from complaints, service, adverse-event reports, distribution, and other sources. It should support trends and decisions about investigation, reporting, tracking, correction, removal, or recall as applicable. Actions depend on facts and jurisdiction. Test whether signals reach decision-makers promptly and whether decisions, rationale, scope, and action effectiveness are recorded.
Apply it
A complaint trend increases after a process change. Follow the signal through analysis, risk assessment, regulatory decisions, and any affected-product action.
Common pitfall: Absence of a recall does not prove effective surveillance. Look for timely, role-appropriate decisions and evidence.
Certified Medical Device Auditor — 2020 Body of Knowledge · FDA Mandatory Reporting Requirements: Manufacturers, Importers and Device User Facilities
35.How should an auditor compare EU, Canadian, and other jurisdictional frameworks?
The outline names EU MDR 2017/745, Canadian Medical Devices Regulations SOR/98-282, and agencies such as Australia’s TGA and Japan’s PMDA. These are not U.S. rules under different names. For each market, identify device type, intended purpose, organization role, applicable authorization or licensing evidence, QMS expectations, and post-market duties. EU MDR and IVDR are separate device and IVD frameworks; Canada uses its own device-class and licensing framework. TGA and PMDA relate to separate national regulatory systems. Confirm current primary requirements and market-specific details; the outline is an examination map, not a current legal opinion.
Apply it
A product is supplied in the United States, Canada, the EU, Australia, and Japan. Set out separate criteria and evidence for each market in scope, then verify registrations, responsible parties, and post-market processes against current local sources.
Common pitfall: Do not assume U.S. authorization, an EU conformity assessment, or one audit result automatically satisfies another jurisdiction’s requirements. Do not treat guidance or a standard as binding law without checking its status.
Certified Medical Device Auditor — 2020 Body of Knowledge · References — Medical Device Auditor Certification — CMDA
38.How are design verification and validation separated in design control?
Verification provides evidence that design outputs meet specified design inputs. Validation provides evidence that the resulting device meets user needs and intended uses under defined conditions. Both need planned methods, acceptance criteria, and records; the distinction concerns the question answered, not which department performs the test. Traceability links requirements and evidence. General design-control verification and validation are covered under Domain III in the active 2020 outline.
Apply it
A test confirms an alarm meets its specified sound level, but users have not been assessed for recognizing it in context. The first supports verification; the second may require usability validation.
Common pitfall: Do not use passed testing as a generic substitute for determining whether evidence verifies specifications or validates intended use.
Certified Medical Device Auditor — 2020 Body of Knowledge · Applying Human Factors and Usability Engineering to Medical Devices — August 3, 2026
Technical Medical Device Knowledge42 of 135 scored questions (31.11%)
36.How does risk management link design, production, and post-production information?
ISO 14971-based risk management analyzes hazards, evaluates risks, selects controls, and reviews residual risk against defined criteria. Risk work should inform design and production controls and use relevant post-production information. A risk file is not effective just because hazards are listed; trace risks to implemented controls and evidence that they work. New complaints or process changes can require reassessment.
Apply it
A post-market report identifies foreseeable misuse not previously considered. Check whether it enters risk review and leads to a justified control or rationale.
Common pitfall: Do not treat a completed risk-analysis worksheet as proof that controls are implemented or post-market signals are reviewed.
Certified Medical Device Auditor — 2020 Body of Knowledge · Applying Human Factors and Usability Engineering to Medical Devices — August 3, 2026
37.How should usability risks be evaluated for normal and fault conditions?
Usability engineering considers hazards arising from interaction with a device, including foreseeable use errors and relevant normal or fault conditions. Risk controls should be implemented in design and evaluated with representative intended users performing appropriate tasks. Training alone may be insufficient where design could reduce risk. Follow use-related hazards through analysis, design decisions, and validation evidence, as the active outline specifies.
Apply it
Intended users repeatedly connect a device component incorrectly during simulated use. Check whether design controls address the error and validation evaluates the revised interface.
Common pitfall: Do not infer safe usability from engineering verification alone or testing with people unlike intended users.
Certified Medical Device Auditor — 2020 Body of Knowledge · Applying Human Factors and Usability Engineering to Medical Devices — August 3, 2026
39.How should biological evaluation reflect finished-device contact and change?
Biological evaluation considers finished-device materials, nature and duration of body contact, and relevant manufacturing effects. Test selection should have a scientific rationale, not be an automatic checklist. Cytotoxicity, sensitization, and irritation address different endpoints. Material or manufacturing changes can affect the evaluation. FDA guidance supports evaluation but is guidance, not by itself a binding regulation.
Apply it
A supplier changes a processing aid for a patient-contacting device. Check material characterization and the rationale for any updated biological assessment.
Common pitfall: A material name alone does not prove biological equivalence, and one endpoint does not cover every contact-related concern.
Certified Medical Device Auditor — 2020 Body of Knowledge · FDA Guidance on Use of International Standard ISO 10993-1 — September 2023
40.What evidence supports packaging integrity and device shelf life?
Packaging and shelf-life evidence should support device performance over intended storage and distribution conditions. For sterile devices, aging and package-integrity evidence should support maintenance of the sterile barrier; distribution challenges may also matter. The outline names ISO 11607, ASTM D4169, and ASTM F1980. Justify shelf life through relevant characteristics and acceptance criteria, not convenience alone.
Apply it
A sterile device’s labeled shelf life is extended. Check aging and package-integrity evidence, distribution assumptions, and approval of the changed claim.
Common pitfall: Accelerated aging alone may not demonstrate real-time performance, and sterilization validation alone does not prove package integrity over time.
Certified Medical Device Auditor — 2020 Body of Knowledge · Submission and Review of Sterility Information for Devices Labeled as Sterile — January 2024
41.How should medical-device product software changes be controlled?
A controlled software lifecycle uses planned requirements, verification, validation, risk management, configuration and change control, and traceable records. Impact analysis determines retesting needs; regression testing checks that changes have not adversely affected previously verified functionality. Cybersecurity may affect risk and maintenance decisions. FDA software-validation guidance is a technical reference; check binding requirements separately.
Apply it
A software update changes a data interface. Check impact analysis, risk assessment, traceability, verification, validation, and regression evidence for affected functions.
Common pitfall: Successful compilation or a single test is not full software validation. Base test scope on impact and risk.
Certified Medical Device Auditor — 2020 Body of Knowledge · General Principles of Software Validation — January 11, 2002
42.Which labeling controls help keep device claims and instructions consistent?
Labeling controls cover device labels, instructions for use, symbols, and applicable promotional representations. Check approval, version control, consistency with intended use, and identifiers such as UDI where applicable. Legibility alone does not establish that claims are appropriate or consistent. Identify the relevant market and current requirement before reaching a compliance conclusion; the outline identifies labeling as a technical topic.
Apply it
A product label and online promotion describe different intended uses. Trace both through approval and regulatory review rather than checking only the package.
Common pitfall: A correct UDI or standardized symbol does not prove all labeling content and claims are compliant or controlled.
43.How should controlled environments be monitored and maintained?
Specifications for controlled environments should be justified by process and product needs, then qualified, monitored, and maintained. Controls may include classification, housekeeping, disinfection, personnel practices, training, bioburden, and endotoxin monitoring. ISO 14644 is identified in the outline. Initial qualification does not show ongoing control; assess trends and responses to excursions as well as room classification.
Apply it
A cleanroom result exceeds its action criterion. Check product impact, investigation, response, and evidence that environmental control was restored afterwards.
Common pitfall: Do not rely only on an initial qualification report. Routine monitoring and excursion response show whether control persists.
44.When do facility utility systems need qualification or validation?
Water, compressed gases, HVAC, and other utilities may affect product quality or environments. Determine qualification, validation, monitoring, and maintenance needs from intended use and risk. A utility supporting a critical process needs evidence it can meet specifications; routine maintenance alone may not establish performance. Follow the utility to its point of use and associated process controls, as addressed in the active outline.
Apply it
Compressed gas contacts a product surface. Check defined quality requirements, point-of-use controls, monitoring, and response to excursions when relevant.
Common pitfall: Do not assume utilities are irrelevant because facilities staff manage them. Determine and assess quality impact proportionately.
45.How do aseptic processing and terminal sterilization differ?
Terminal sterilization treats the product in its final packaged state using a validated process. Aseptically processed product is assembled or filled under controlled sterile conditions without terminal sterilization of the complete product. The distinction affects process design and evidence. Audit the actual manufacturing sequence and labeled claim; the word sterile alone does not identify the route. Both are in the active outline’s sterile-device topics.
Apply it
A device is sterilized before final assembly in a controlled environment. Determine whether the process is aseptic and check the associated controls rather than assuming terminal treatment.
Common pitfall: Do not call every cleanroom assembly process terminal sterilization. Assess the actual sequence and records.
Certified Medical Device Auditor — 2020 Body of Knowledge · Submission and Review of Sterility Information for Devices Labeled as Sterile — January 2024
46.How do common sterilization methods affect the evidence an auditor should examine?
The outline names dry heat, steam, electron beam, ethylene oxide (EtO), and radiation. These are distinct methods with method-specific process parameters, equipment, monitoring, and product considerations. For EtO and radiation, the outline highlights validation and controls such as process challenge devices, residuals, dose audits, and parametric release where applicable. Assess the chosen method’s validated process, routine control, change impact, and evidence supporting sterility assurance; do not assume one method’s control strategy transfers unchanged to another.
Apply it
A manufacturer changes from a radiation process to EtO. Review method-specific validation, routine monitoring, relevant residual controls, and product assessment rather than carrying forward the former process evidence.
Common pitfall: A sterilization certificate or a passing biological indicator alone does not establish that all method-specific validation and routine controls are adequate.
Certified Medical Device Auditor — 2020 Body of Knowledge · Submission and Review of Sterility Information for Devices Labeled as Sterile — January 2024
47.How should laboratory methods and failure analyses be assessed?
Assess method suitability, acceptance criteria, controlled procedures, personnel competence, equipment, and records. Failure analysis should preserve evidence and use a method capable of answering the question. Results need traceability to samples and conditions. ISO 17025 may be relevant to laboratory competence, but certification alone does not show a specific test is suitable for a device decision; assess the method and its scope.
Apply it
A laboratory reports a passing result using a method that cannot detect the defect implicated in a complaint. Question method suitability and the conclusion drawn from that result.
Common pitfall: A passing result does not support a conclusion if method, sample, or conditions are inadequate for the failure mode.
48.What do IQ, OQ, and PQ demonstrate in process validation?
Installation qualification documents that equipment and supporting systems are installed as intended. Operational qualification challenges operating ranges and controls. Performance qualification demonstrates effective performance under routine conditions, often with representative production. They are related, not interchangeable, validation elements. Protocols should define objectives, criteria, and records appropriate to risk and process knowledge.
Apply it
A new sealing machine passes installation checks, but no routine production challenge is documented. Identify missing performance evidence rather than treating IQ as full validation.
Common pitfall: Equipment installation or one successful run does not by itself show consistent production performance.
Certified Medical Device Auditor — 2020 Body of Knowledge · GHTF Quality Management Systems — Process Validation Guidance, Edition 2, January 2004
49.How should cleaning and reprocessing validation support reusable devices?
Reusable-device instructions and validation should reflect design, materials, soil, and intended reuse conditions. Evidence should show that the process achieves acceptance criteria and that instructions are usable in the intended setting. Changes to geometry, material, or cleaning method can affect results. FDA reprocessing guidance is a technical reference; tie conclusions to applicable requirements and evidence for the specific device.
Apply it
A reusable instrument has a narrow internal channel. Check whether cleaning validation and instructions address that feature under representative conditions.
Common pitfall: A generic cycle or a device that looks clean does not establish effective cleaning of a particular design.
Certified Medical Device Auditor — 2020 Body of Knowledge · References — Medical Device Auditor Certification — CMDA
50.Where should auditors verify evolving device standards and guidance?
The outline names sources including FDA’s Recognized Consensus Standards Database, harmonized-standard listings, medical-device guidance, NBOG materials, and Europa. Standards and guidance can change in status, edition, or jurisdictional relevance. Verify the exact document, edition, recognition or harmonization status, and applicable market. A reference in the outline does not prove a document remains current or is legally mandatory.
Apply it
A design file cites an older standard edition. Check the authoritative listing and the organization’s documented assessment of the edition change before evaluating compliance.
Common pitfall: Do not assume every published standard is harmonized, FDA-recognized, mandatory, or applicable to every device.
Certified Medical Device Auditor — 2020 Body of Knowledge · References — Medical Device Auditor Certification — CMDA
51.What do IEC 60601, RoHS, and REACH address?
The outline includes IEC 60601-1 for medical electrical equipment safety and performance topics, and RoHS and REACH chemical-control frameworks. They address different technical or regulatory concerns; applicability depends on product, market, and current legal status. Determine relevant requirements and inspect supporting assessment or test evidence rather than assuming one declaration covers every concern. Verify current jurisdictional criteria.
Apply it
An electrical device is sold in multiple markets and uses a restricted substance. Check separate electrical-safety and chemical-compliance assessments relevant to those markets.
Common pitfall: Do not confuse electrical-safety evaluation with chemical restrictions or assume a supplier declaration resolves all product-specific obligations.
Certified Medical Device Auditor — 2020 Body of Knowledge · References — Medical Device Auditor Certification — CMDA
Quality Tools and Techniques15 of 135 scored questions (11.11%)
52.How can a Pareto chart guide an audit investigation?
A Pareto chart orders categories by frequency or another selected measure, often with cumulative contribution shown. It can guide prioritization but does not prove root cause or show that the most frequent category presents the highest risk. Check category definitions, data period, denominator, and severity before drawing conclusions. It is a tool for inquiry, not a substitute for risk or causal analysis; this aligns with the outline’s quality-tool topic.
Apply it
Complaint counts show one failure category dominates, but a rarer event has greater severity. Investigate both frequency and risk rather than following rank alone.
Common pitfall: Do not mistake the largest bar for a demonstrated cause or ignore severity because another category is more frequent.
53.When should a cause-and-effect diagram, 5 Whys, or Is/Is Not analysis be used?
Cause-and-effect diagrams organize possible contributors; 5 Whys probes a plausible causal chain; Is/Is Not comparisons narrow where, when, or under what conditions a problem occurs. These methods generate and organize hypotheses, but none proves root cause. Test candidate causes against records, observation, and data. Evidence, not the tool itself, determines the conclusion, consistent with the outline’s problem-solving topics and CAPA guidance.
Apply it
A defect occurs only on one shift. Use Is/Is Not and a cause diagram to develop hypotheses, then check process data before selecting a cause and action.
Common pitfall: Do not accept the first plausible 5 Whys answer or the most popular diagram entry as a verified cause. Test candidates and distinguish evidence from opinion.
Certified Medical Device Auditor — 2020 Body of Knowledge · GHTF Guidance on Corrective Action and Preventive Action and Related QMS Processes — 2010
54.How does a control chart differ from a histogram, and how should a signal be handled?
A histogram displays a distribution but usually omits time order. A control chart plots data over time against a center line and control limits to help identify signals of special causes. Control limits are not specification limits. A signal such as a sustained shift warrants investigation of changed conditions; it does not automatically identify the cause. Use a suitable chart and interpret signals in context rather than adjusting a process for every fluctuation.
Apply it
Measurements remain within specification, but a control chart shows a sustained shift. Investigate the changed condition despite current conformance of individual readings.
Common pitfall: Do not treat specification limits as control limits or infer stability over time from a histogram alone. Do not call a process stable across a period containing a sustained signal.
55.How do Cp and Cpk distinguish spread from centering?
For a stable, approximately normal process, Cp = (USL − LSL)/(6σ), comparing specification width with within-process spread. Cpk is the smaller of (USL − mean)/(3σ) and (mean − LSL)/(3σ), so it accounts for centering. Under the same assumptions Cpk cannot exceed Cp. Neither index proves process stability or that assumptions hold; state assumptions when interpreting them. Process capability indices are in Domain V, Quality Tools and Techniques, in the active outline.
Apply it
For limits 90 and 110, mean 103, and within-process σ of 2, Cp = 20/12 = 1.67 and Cpk = min(7/6, 13/6) = 1.17. This hypothetical example assumes a suitable stable process.
Common pitfall: Do not report capability from unstable data or treat capability as a guarantee that every unit conforms.
Certified Medical Device Auditor — 2020 Body of Knowledge · NIST/SEMATECH Handbook — What Is Process Capability?
56.What are the DMAIC phases and what does each accomplish?
DMAIC means Define, Measure, Analyze, Improve, and Control. Define frames the problem; Measure establishes the current state; Analyze tests causes; Improve develops and evaluates changes; Control sustains results. It is a structured improvement cycle, not a substitute for risk assessment or required corrective action. Set measures before evaluating whether a change worked; the phases are specified in the active outline.
Apply it
A team defines late release as a problem, measures cycle times, tests causes, pilots a revised review flow, and monitors performance after implementation.
Common pitfall: Do not jump from suspected cause to solution without measurement and analysis. Ensure controls sustain results and preserve conformity.
57.How do lean tools improve flow without weakening controls?
Lean tools address waste and flow. 5S organizes the workplace, standard operations define repeatable work, kanban supports pull replenishment, error-proofing reduces mistakes, and value-stream mapping visualizes flow. Apply tools without bypassing required controls or treating speed as the only outcome. Evaluate whether improvement preserves conformity, traceability, and risk controls; these examples are included in the active outline.
Apply it
A kanban change reduces excess inventory. Check that replenishment preserves lot identity and avoids unauthorized substitutions when supplies run low.
Common pitfall: Do not remove a verification step solely because it adds time. Determine its quality and risk purpose first.
58.How do bias, repeatability, reproducibility, and stability describe a measurement system?
Bias is systematic difference from a reference. Repeatability is variation under the same conditions; reproducibility concerns variation across operators or conditions. Stability concerns measurement-system behavior over time. A system can be consistent yet consistently wrong. Measurement-system analysis helps distinguish process variation from measurement variation. Investigate the source of error before changing a process based on questionable measurements.
Apply it
Two operators obtain consistent readings individually but differ from each other. Consider reproducibility and investigate method, training, or setup before attributing the observed variation to the process.
Common pitfall: Do not assume a repeatable gauge is unbiased or that calibration alone resolves operator-to-operator variation. Assess suitability for the measurement decision.
Certified Medical Device Auditor — 2020 Body of Knowledge · NIST/SEMATECH Handbook — Gauge R&R Studies · NIST/SEMATECH Handbook — Analysis of Bias
59.Which costs belong to prevention, appraisal, internal failure, and external failure?
Prevention costs invest in avoiding defects; appraisal costs evaluate conformity; internal-failure costs arise before delivery; external-failure costs occur after delivery or use. These categories help analyze where resources are spent and how failures shift costs. They do not mean every prevention activity is effective or that reducing inspection is desirable without evidence of adequate process control. The four categories are in the active outline.
Apply it
Classify design review, incoming inspection, scrap, and field-complaint handling, then assess whether changes reduce failures without losing assurance.
Common pitfall: Do not label appraisal spending as prevention or treat reduced inspection cost as improved quality by itself.
60.How should qualitative and quantitative data, sampling type, and plan validity be evaluated?
Qualitative data describe the nature or type of an observation; quantitative data are numerical and can reveal patterns or trends when measured appropriately. Attribute plans classify units or events, such as conforming/nonconforming; variable plans use numerical measurements and depend on suitable measurement methods and assumptions. Select a plan based on the decision, population, risk, and justified statistical rationale. Evaluate the sampling frame, selection method, sample size, acceptance criteria, and limitations before claiming validity or generalizing results.
Apply it
For label presence, record attribute outcomes; for a dimensional characteristic, collect numerical measurements. For either plan, confirm that the sample represents the defined population and supports the intended decision.
Common pitfall: Do not infer a systemic problem from a few unrepresentative observations, or call convenience inspection statistically valid. A variables plan is not sound if measurement data or assumptions are unsuitable.
What to focus on during revision
The following are CertMedbry study suggestions. Use the official outline to check the full scope of your examination.
- Prioritize the largest active domains: Technical Medical Device Knowledge (42 scored questions), Medical Device Quality Management System Requirements (38), and Auditing and Inspection Processes (28).
- Keep active and upcoming blueprints separate: the 2020 outline applies on October 13, 2026; the revised first-two-domain allocations apply from November 1, 2026.
- Practise evidence-based decisions: connect criteria to objective evidence, state limitations, and avoid conclusions broader than the sample supports.
- Know the transition boundary: legacy QSR and QSIT terms appear in the active outline, but FDA QMSR is current from February 2, 2026, and FDA has stopped using QSIT.
- For regulatory scenarios, distinguish FD&C Act statutes from Title 21 CFR regulations, check device class and pathway, and identify market, regulated role, device type, and effective date before selecting criteria.
- Compare U.S., EU, Canadian, Australian, and Japanese requirements as separate jurisdictional frameworks. Verify current primary sources; do not elevate nonbinding guidance or standards into law without checking their status.
- Distinguish sterilization routes and methods, and connect each method to its own validation and routine controls. Do not treat terminal sterilization, aseptic processing, or a supplier certificate as interchangeable evidence.
- Use calculations and tools with their assumptions: capability indices require a suitable process model; charts, samples, and measurement studies answer different questions.
- The 2/4/5/6/3 practice-set distribution is a preview design choice, not an ASQ-mandated distribution. Treat the original quiz as independent practice, not as an official question bank, adaptive-test simulation, or pass predictor.
A practical preparation plan
1. Confirm your testing window
Check ASQ’s current CMDA page and identify whether your exam falls under the 2020 outline or the 2026 outline effective November 1, 2026. Do not combine their changed domain allocations.
2. Build a domain-weighted plan
Allocate the most study time to Technical Medical Device Knowledge, QMS Requirements, and Auditing and Inspection Processes, while reserving deliberate review for Fundamentals and Quality Tools.
3. Separate U.S. statutes from regulations
The FD&C Act is statute; Title 21 CFR contains regulations. The active outline names Act sections 201, 301–304, 501–502, 510, 513, 518, 522, and 704. It also names CFR Parts 4, 7, 11, 58, 801, 803, 806, 807, 820, 821, and 830. Match the provision to the topic and to the regulated entity; verify current text and applicability before treating it as an audit criterion.
4. Compare U.S. device class and premarket routes
Classification and premarket requirements depend on the device and intended use. At a high level, U.S. classes I, II, and III have different controls; possible pathways include exemption where available, 510(k), De Novo, and premarket approval when applicable. A 510(k) addresses substantial equivalence to a legally marketed predicate, not identical construction. Do not choose a pathway from a product name alone; audit the documented regulatory rationale and verify the current FDA requirements for that device.
5. Map international frameworks without conflating them
The blueprint names EU MDR 2017/745, EU IVDR 2017/746, Canadian Medical Devices Regulations SOR/98-282, and other national systems such as Australia’s TGA and Japan’s PMDA. Treat them as distinct market frameworks. Map device or IVD type, intended purpose, organization role, authorization evidence, QMS expectations, and post-market duties for each market. Verify current primary sources; the blueprint and reference list are not substitutes for current jurisdiction-specific legal advice.
6. Keep law, standards, and guidance distinct
Applicable statutes and regulations create legal obligations. A consensus standard may be voluntary or incorporated, recognized, or otherwise relevant depending on the law and market. FDA guidance generally communicates agency recommendations and is not itself a binding regulation. Check edition, status, recognition, jurisdiction, and applicability; do not make a compliance conclusion from a reference title alone.
7. Apply due care and understand potential consequences
Hypothetical case: an auditor notices records suggesting recurring product failures but does not investigate, documents an unsupported clean conclusion, and omits the limitation. If harm later occurs, the auditor’s competence, diligence, contractual duties, and reporting may be scrutinized; possible legal, professional, reputational, or financial consequences depend on jurisdiction and facts. The auditee’s knowledge and response to documented findings may also matter in later proceedings, but neither an audit finding nor its absence automatically establishes liability. Document evidence, investigate within authority, state limits, and avoid guarantees.
8. Practise traceable audit reasoning
For each scenario, name the criterion, evidence, gap, significance, and next verification step. Distinguish an interview statement from corroborated objective evidence. Record sample selection and limits.
9. Rehearse meetings, reports, and closure
Practise opening and closing meetings, documenting attendees and limitations, confirming factual evidence, assigning next steps, and retaining records according to applicable controls. Close follow-up only when agreed effectiveness evidence supports it.
10. Practise technical decisions by evidence
For design, software, biological evaluation, sterilization, packaging, and reprocessing changes, trace the change to risk, criteria, validation or verification evidence, and follow-up. Do not assume unchanged intended use removes the need for impact assessment.
11. Rehearse calculations and sampling interpretation
Work through capability, data-type, sampling, chart, and measurement-system problems with assumptions stated. Check population, plan rationale, measurement suitability, and intended decision before generalizing from a sample.
12. Prepare reference materials using issuer rules
ASQ describes the examination as open book and specifies bound reference materials. Review the latest candidate instructions for inspection and delivery-specific conditions.
13. Review errors by reasoning pattern
After each practice set, identify whether an error came from confusing jurisdictions, confusing verification with validation, overstating sample evidence, overlooking a change impact, or selecting a tool that did not answer the audit question.
Use your sample score as a starting point
The free set contains 20 original practice questions. It is a small learning sample, not an official examination or a validated pass prediction. Review each explanation and its source before moving to another topic.
Start the free sampleOfficial sources and updates
- ASQ Medical Device Auditor Certification — CMDA
- About ASQE
- Certified Medical Device Auditor — 2020 Body of Knowledge
- Certified Medical Device Auditor Body of Knowledge — 2026
- CMDA Body of Knowledge Map 2020–2026
- References — Medical Device Auditor Certification — CMDA
- ASQ Code of Ethics
- FDA Quality Management System Regulation
- MDSAP Audit Approach — MDSAP AU P0002.009
- MDSAP Medical Device Regulatory Audit Report Form Guidelines — AU G0019.3.007
- GHTF Guidance on Corrective Action and Preventive Action and Related QMS Processes — 2010
- GHTF Quality Management Systems — Process Validation Guidance, Edition 2, January 2004
- Applying Human Factors and Usability Engineering to Medical Devices — August 3, 2026
- FDA Guidance on Use of International Standard ISO 10993-1 — September 2023
- Submission and Review of Sterility Information for Devices Labeled as Sterile — January 2024
- General Principles of Software Validation — January 11, 2002
- FDA Mandatory Reporting Requirements: Manufacturers, Importers and Device User Facilities
- FDA Premarket Notification 510(k)
- NIST/SEMATECH Handbook — What Is Process Capability?
- ASQ — What Is a Pareto Chart?
- NIST/SEMATECH Handbook — Gauge R&R Studies
- NIST/SEMATECH Handbook — Analysis of Bias
Confirm current eligibility, fees, scheduling and policies directly with the examination provider. CertMedbry is independent and is not endorsed by these organisations. How we handle content and corrections.