ISO 13485 · Expert · 15 min lesson
Auditing medical device software and QMS software (IEC 62304, cybersecurity, Part 11)
IEC 62304:2006+A1:2015 clauses 5 to 9, ISO 13485:2016 clauses 4.1.6 and 7.5.6, MDR Annex I sections 17.2 and 17.4, FD&C Act section 524B, 21 CFR Part 11
What you will learn
- Audit software lifecycle evidence under IEC 62304, from safety class and requirements through testing, anomalies and release.
- Audit cybersecurity risk analysis, vulnerability monitoring and updates against MDR Annex I and FD&C Act section 524B.
- Audit QMS software validation and electronic records against clause 4.1.6 and 21 CFR Part 11, and write a graded finding.
Key takeaways
- IEC 62304 expects every requirement and software risk control to be verified, and results tied to the tested software version.
- Clause 5.8 requires known residual anomalies to be documented and evaluated for risk before release; clause 8.1.2 requires SOUP identification.
- Cybersecurity risk analysis must follow architecture changes (MDR Annex I 17.2, 17.4) and updates need a bill of materials and a patch process.
- Clause 4.1.6 requires QMS software validation before use and after changes, proportionate to risk.
- 21 CFR Part 11 controls (11.10, 11.50, 11.70) make electronic records and signatures trustworthy: audit trails, signature meaning, access.
Free practice question
Tessellate's traceability matrix for release 3.2.0 shows 41 requirements and 38 linked tests. Requirement 27 rounds the insulin dose and is one of the three with no test.
What is the most defensible finding?
Observation only, since coverage is above 90 percent.
Not quite. IEC 62304 clause 5.7 does not accept a coverage percentage when a risk control is unverified.
Nonconformity: a software risk control has no verification before release, against IEC 62304 clauses 5.7 and 7.
Correct. IEC 62304 clauses 5.7 and 7 require risk controls implemented in software to be verified.
No finding, because user acceptance passed.
Not quite. User acceptance is not verification of a specific requirement under IEC 62304 clause 5.7.
A finding against the test tool vendor.
Not quite. The manufacturer is responsible for verification under IEC 62304 clause 5.7, not the tool vendor.
Key terms
- SOUP: Software item already developed and generally available that was not developed for the device, identified under IEC 62304 clause 8.1.2.
- residual anomaly: A known defect remaining at release that must be documented and evaluated for risk (IEC 62304 clause 5.8).
- traceability: The link from requirement to design, test and result, including the software version tested.
- software bill of materials: A list of software components and versions in a product, expected for cyber devices under FD&C Act section 524B.
- audit trail: A secure, computer generated, time stamped record of changes to an electronic record (21 CFR 11.10(e)).
- safety class: IEC 62304 classification A, B or C based on possible harm from software failure, which sets the process rigour.
Official sources
- IEC 62304:2006 Medical device software - Software life cycle processes (ISO catalogue entry)
- IEC 62304:2006/AMD1:2015 (IEC webstore)
- FDA Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (Federal Register, 27 June 2025)
- FDA Digital Health Center of Excellence: Cybersecurity
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.