ASQ CMDA Certification Guide: 2026 BoK, Eligibility and Exam Day

To earn the ASQ Certified Medical Device Auditor (CMDA) certification, you need five years of relevant experience (one in a decision-making role, with degree waivers), then pass one open-book exam of 145 multiple-choice questions in 258 minutes with a score of 550/750. From the November 2026 testing window, ASQ tests the new 2026 CMDA Body of Knowledge, so study from the 2026 BoK.

Want to see how ready you are today? Take a timed CMDA practice exam built on the same 145-question format.

The medical device industry runs on evidence. Every design decision, supplier approval, sterilization cycle and complaint investigation has to be documented, reviewed and defensible in front of a regulator or a notified body. The people who test whether that evidence holds up are auditors, and the ASQ CMDA credential is the one that proves an auditor understands both the auditing craft and the medical device rules behind it.

This guide takes you from the first question, whether you are eligible, to the last one, what to do in the exam room. It covers the exam facts, what changed in the 2026 Body of Knowledge, what each of the five domains asks of you, a preparation plan, the mistakes that cost candidates the most marks, and how the credential helps your career.

What is the ASQ CMDA certification, and who is it for?

The Certified Medical Device Auditor is ASQ's credential for professionals who audit medical device quality systems. ASQ describes the certified medical device auditor as a professional who understands the principles of standards, regulations, directives and guidance for auditing a medical device system, and who uses various tools and techniques to examine, question, evaluate and report on that system's adequacies and deficiencies. In plain terms: you know what the rules require, and you know how to find out whether a company actually meets them.

That combination is what separates CMDA from ASQ's general Certified Quality Auditor credential. A quality auditor needs strong audit technique. A medical device auditor needs the same technique plus working knowledge of FDA regulations, ISO 13485, EU MDR, risk management under ISO 14971, sterilization, biocompatibility, software lifecycle rules and the other technical areas that shape a medical device quality system.

The certification suits several groups of people:

• Internal auditors at medical device manufacturers who run the company's own audit programme.
• Supplier quality engineers who audit component suppliers, contract manufacturers and sterilizers.
• Quality and regulatory affairs professionals who prepare their site for FDA inspections, MDSAP audits or notified body audits.
• Third-party auditors and consultants who audit many companies and need a credential that clients recognise.
• Quality managers who own CAPA, complaint handling or management review and want a structured view of the whole system.

You can read ASQ's own description of the credential, its requirements and its current testing windows on the ASQ Certified Medical Device Auditor page. Check it before you apply, because testing windows and deadlines change through the year.

Are you eligible for the CMDA exam?

Eligibility is the first thing to confirm, because ASQ reviews every application before you can book a seat. The requirement is based on work experience, and education can reduce it.

The experience requirement

You need five years of on-the-job experience in one or more areas of the Certified Medical Device Auditor Body of Knowledge. At least one of those years must be in a decision-making position. ASQ defines a decision-making position as one with the authority to define, execute or control projects or processes and to be responsible for the outcome. It may or may not be a management or supervisory role. ASQ also states that candidates must have worked in a full-time, paid role.

The decision-making year is where applications most often need more detail. A lead auditor who plans audits and decides on findings qualifies. So does a CAPA owner who decides on root causes and actions, or a quality engineer who approves validation protocols. Describe that authority clearly in your application rather than listing job titles alone.

Education waivers

A completed degree from a college, university or technical school waives part of the five-year requirement. Only one waiver can be claimed:

• Associate degree: one year waived, so four years of experience remain.
• Bachelor's degree: three years waived, so two years remain.
• Master's or doctorate: four years waived, so one year remains.

The decision-making year is never waived. Even with a doctorate, the one remaining year must be in a decision-making position.

How the application works

You apply through ASQ's certification application page and choose a testing window at the same time. ASQ reviews online applications in one to two business days. Once approved, you receive an eligibility email with instructions for scheduling your appointment with Prometric, ASQ's testing partner. ASQ lists the November 1 - 30, 2026 window with an application deadline of October 12, 2026, and the January 1 - 31, 2027 window with a deadline of December 7, 2026. Both of those windows test the 2026 Body of Knowledge.

What is the CMDA exam format, cost and passing score?

The computer-delivered CMDA exam is a single-part, multiple-choice exam offered in English. ASQ states that 135 of the 145 questions are scored and 10 are unscored; the unscored items are being trialled for future exams and you cannot tell which they are, so answer every question as if it counts. Here are the exam facts in one place:

Exam detail	ASQ CMDA
Full name	ASQ Certified Medical Device Auditor
Exam code	CMDA
Vendor	ASQ
Number of questions	145 (135 scored + 10 unscored, per ASQ)
Duration	Total appointment time- 270 / Exam Time - 258 (minutes)
Exam fee	ASQ MEMBERS - $450 / NON-MEMBERS - $550 / RETAKES - $350
Passing score	550/750
Body of Knowledge	2026 BoK from the November 2026 testing window
Format	Open book, multiple choice, computer-based at Prometric

A few points in that table deserve a closer look.

Time per question

With 258 minutes of exam time for 145 questions, you have about 1.8 minutes per question. That sounds generous, but it is less than it seems on an open-book exam. Every time you open a reference to check a clause number, you spend time you will need later for long scenario questions. The candidates who run out of time are usually the ones who look up answers they already know.

The fee and the retake rate

ASQ members pay less for the initial exam than non-members, so if you plan to take more than one ASQ certification, compare the membership cost with the saving before you apply. The retake rate applies if you do not pass: ASQ says you can apply at the reduced retake rate for two years from your previous attempt.

Open-book rules

All ASQ exams are open book, but the rules are strict. Every reference, including your own notes, must be bound and stay bound during the exam: stitched or glued books, or pages held by fasteners that go through every sheet, such as ring binders, spiral binders or screw posts. Hand-stapled documents and loose notes are not allowed, and sticky notes are allowed only as tabs attached before you arrive. The test centre inspects every reference before you enter the room.

Results for the November 2026 pilot

Normally, a computer-based ASQ exam shows your result as soon as you submit. The November 2026 CMDA exam is different: it is the pilot for the new 2026 Body of Knowledge, and ASQ says pilot results are sent four to six weeks after you sit the exam. Plan for that wait if your employer or a job application needs the result by a certain date.

What changes with the 2026 CMDA Body of Knowledge?

ASQ updated the CMDA Body of Knowledge after a job analysis survey of certified medical device auditors. ASQ's statement on its CMDA page is clear: the new Certified Medical Device Auditor Body of Knowledge is tested starting with the November 2026 testing window. If you sit the exam in November 2026 or later, study from the 2026 CMDA Body of Knowledge, not the 2020 version.

The good news is that most of the content stayed the same. ASQ's comparison says all the topics in the 2020 BoK are still relevant, one subtopic was added, none were removed, and no area changed its cognitive level. What did change is the balance of questions between the first two domains and the regulatory language in domain III.

Domain	2020 BoK	2026 BoK
I. Auditing Fundamentals	12	15
II. Auditing and Inspection Processes	28	25
III. Medical Device Quality Management System Requirements	38	38
IV. Technical Medical Device Knowledge	42	42
V. Quality Tools and Techniques	15	15
Total scored questions	135	135

The main changes, taken from ASQ's CMDA Body of Knowledge map, which sets the 2020 and 2026 versions side by side:

• Auditing Fundamentals grows from 12 to 15 questions and Auditing and Inspection Processes falls from 28 to 25. The total number of scored questions stays at 135.
• QSR becomes QMSR. FDA's amended Quality Management System Regulation, which incorporates ISO 13485:2016 by reference, became effective on February 2, 2026. Section III.D is now titled Quality Management System Regulation (QMSR) requirements incorporating ISO 13485:2016, and its subtopics cite QMSR sections alongside ISO 13485 clauses.
• One new subtopic: Waste Electrical and Electronic Equipment (WEEE) joins IEC 60601-1, RoHS and REACH under common medical device directives and standards.
• Revised wording in several subtexts, for example "supplier management" replaces "supplier qualification" among audits by purpose, "follow-up audit" is added, and the FDA procedural reference is now CPG 7382.850, with the QSIT subsystem wording removed.

ASQ keeps both Bodies of Knowledge online until January 1, 2027, when the 2020 version is archived. If you started studying from the 2020 BoK, you do not need to start again. Re-weight your time slightly toward Auditing Fundamentals, relearn the QMSR citations, and add WEEE to your notes.

What does each CMDA domain cover in the 2026 BoK?

The five domains below follow the 2026 Body of Knowledge. The question counts tell you where to spend your time: domains III and IV together make up 80 of the 135 scored questions.

I. Auditing Fundamentals (15 questions)

This domain is about what an audit is and how an auditor behaves. You must identify and distinguish audits by purpose, such as regulatory compliance, supplier management, risk management, design and development, for-cause and follow-up audits, and by type: product, process, system, first-, second- and third-party, internal, external, desk, onsite, remote and hybrid. It also covers the roles of the lead auditor, audit team members, client and auditee.

Ethics carries real weight here. Expect questions on the ASQ Code of Ethics, due diligence and due care, confidentiality, conflicts of interest and auditor independence, plus the legal consequences of careless or negligent audit work. Data privacy is part of the domain too: an auditor must protect personal data, with HIPAA and the EU GDPR named as examples, and proprietary business information seen during an audit.

II. Auditing and Inspection Processes (25 questions)

This is the audit lifecycle from start to finish. Planning comes first: verifying audit authority, setting purpose, scope and criteria, choosing auditors, gathering pre-audit information, preparing checklists and sampling plans, and choosing strategies such as forward and backward tracing. Then comes performance: the opening meeting, data collection, interviewing technique, handling conflict, managing time on site and the closing meeting.

Two topics stand out. Data integrity asks you to judge whether records are attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring and available, the ALCOA+ principles. Objective evidence asks you to classify findings by significance, severity, frequency and risk. The domain closes with audit reports, record retention, CAPA review, follow-up and closure, and the procedural references: ISO 19011, the MDSAP audit model and FDA Compliance Program Guidance 7382.850.

III. Medical Device Quality Management System Requirements (38 questions)

This is the regulatory heart of the exam. It starts with US law: the parts of 21 CFR named in the BoK, including Part 11 on electronic records, Part 801 on labeling, Part 803 on medical device reporting, Part 806 on corrections and removals, Part 807 on registration and listing, Part 820 on the quality management system, Part 821 on tracking and Part 830 on unique device identification, plus the FD&C Act on device classification, misbranding and adulteration. It then moves abroad: EU MDR 2017/745, Health Canada's SOR/98-282, and agencies such as the TGA, Japan's PMDA, China's NMPA and Brazil's ANVISA. In vitro diagnostics under 21 CFR 809 and IVDR 2017/746 have their own topic.

The largest block is III.D, the QMSR incorporating ISO 13485:2016. It walks through management responsibility, design and development, document and record control, purchasing controls, identification and traceability, production and process controls, measuring equipment, nonconforming product, CAPA, handling and storage, complaint files, servicing and statistical techniques. Post-market surveillance closes the domain: vigilance, medical device reporting, trend reporting, recalls, corrections and removals. Most of these topics are tested at the Evaluate or Analyze level, which means scenario questions, not definitions.

IV. Technical Medical Device Knowledge (42 questions)

The largest domain covers the engineering and science an auditor must be able to question. Risk management comes first, under ISO 14971, ISO/TR 24971, IEC 62366 and the risk-based controls of ISO 13485. Design control topics include human factors and usability, biological evaluation under ISO 10993-1, packaging under ISO 11607 with ASTM D4169 and ASTM F1980, device shelf life and the EU MDR general safety and performance requirements.

The domain continues with software lifecycle for devices and Software as a Medical Device under IEC 62304, including cybersecurity and technologies such as large language models; labeling, symbols under ISO 15223 and UDI; controlled environments under ISO 14644 and utility systems such as water, compressed gas and HVAC; sterile devices, sterilization methods and validation under ISO 11135, ISO 11137 and ISO 11737; laboratory testing and failure analysis; process validation (IQ/OQ/PQ); reprocessing of reusable devices; IEC 60601-1, RoHS, REACH and the new WEEE subtopic; and the sources of new standards, from the FDA Recognized Consensus Standards Database to MDCG guidance.

V. Quality Tools and Techniques (15 questions)

The last domain tests the tools an auditor uses to read data. You need to interpret Pareto charts, cause and effect diagrams, flowcharts, control charts, check sheets, scatter diagrams, histograms, root cause analysis, PDCA, alert and action levels, 5 Whys, Is/Is Not analysis, FMEA, fault tree analysis and affinity diagrams. Process improvement topics include capability indices (Cp, Cpk, Pp, Ppk), six sigma DMAIC, lean tools, measurement system analysis and the four cost of quality categories. The domain ends with data types and sampling: when to use attributes or variables sampling, and whether a sampling plan is risk-based and statistically valid.

How should you prepare for the CMDA exam?

A good plan follows the question weights, uses the open-book format wisely and builds speed with timed practice. The steps below assume you work in the industry and can study for about an hour a day over two to three months.

Step 1: Download the 2026 BoK and map it to your experience

Print the 2026 Body of Knowledge and mark each subtopic green, amber or red: green for topics you use at work, amber for topics you know in theory, red for topics you have never touched. Most candidates find that audit technique is green and parts of domain IV, such as sterilization validation or packaging standards, are red. Your red list is your study plan.

Step 2: Give time in proportion to the questions

Domains III and IV carry 80 of the 135 scored questions, so they deserve well over half of your study time. Do not neglect domain I, though: at 15 questions in the 2026 BoK, auditing fundamentals and ethics now carry more weight than before, and they are among the easiest marks to secure.

Step 3: Learn the regulations by intent, not by clause number

You can look up a clause number during an open-book exam. You cannot look up judgment. For each QMSR and ISO 13485 requirement, ask what problem it prevents and what evidence would show it is working. When a question describes a complaint that was never assessed for reportability, you should recognise the gap at once and only open a book to confirm the citation.

Step 4: Build your open-book references early

Decide early which references you will take into the exam, and study from those same books so you know where everything is. Many candidates take the CMDA handbook, a copy of ISO 13485 and their own bound notes. Add tabs for each domain and a one-page index of the topics you look up most often. Remember that every page must be bound, so arrange binding well before exam week.

Step 5: Practise with scenario questions

Most CMDA questions describe a situation and ask for the best action, the most serious finding or the correct classification. Start with the free CMDA sample questions to see the style, then move to full-length timed tests. Review every wrong or guessed answer, write down why the correct option is better, and keep that error log as your revision list.

Step 6: Take at least two full-length timed tests

A full 145-question test in 258 minutes is the only way to learn your pace with references on the desk. Take one about a month before the exam and one in the final week, on questions you have not seen. A rising score and a shorter error list are the signs that you are ready.

Which mistakes cost CMDA candidates the most marks?

• Studying the wrong Body of Knowledge. From November 2026 the exam follows the 2026 BoK, with new question counts and QMSR wording.
• Over-relying on the open book. Looking up everything leaves no time for the long scenario questions at the end.
• Neglecting the technical domain. Domain IV is the largest, and auditors who have never worked with sterilization, packaging or software often lose most of their marks here.
• Memorising without applying. Many subtopics are tested at the Evaluate level, so you must judge a situation, not recall a definition.
• Unbound references. Loose or hand-stapled notes are taken away at the door.

What should you do in the final week and on exam day?

The last week is for consolidation. You should have covered every domain at least once; the aim now is to turn that coverage into fast, confident answers.

Seven days out

Take your final full-length timed test and sort your errors by domain. Spend the next three days on the domain with the most errors, going back to the Body of Knowledge subtext for each missed topic. Check that your references are bound, tabbed and indexed, and that your index points to the pages you actually use.

The day before

Confirm your appointment time and the Prometric test centre address. Pack a valid government-issued photo ID with a signature that matches the name on your application, your bound references and, if you want one, a silent, battery-operated, non-programmable calculator; a basic scientific calculator is also available on screen. Plan to arrive 30 minutes before your appointment, because ASQ says late arrivals are not allowed to test and forfeit the exam fee. Then stop studying and rest.

During the exam

Answer the questions you know first and flag the rest. Read the last line of each scenario before the details, so you know what is being asked. Watch for words such as MOST, FIRST, BEST and NOT, which decide many CMDA questions. Use your references to confirm a citation or a figure, not to learn a topic. Aim to finish your first pass with at least 40 minutes left for the flagged questions.

After the exam

If you sit the November 2026 pilot, expect your result four to six weeks later rather than on screen. If you do not pass, ASQ sends a performance summary by email, and you can reapply at the retake rate within two years. Use the summary to rebuild your plan around the weakest domains.

Is the CMDA certification worth it for your career?

For anyone whose job involves auditing medical device quality systems, the CMDA is one of the most relevant credentials available. Medical device companies face FDA inspections, MDSAP audits, notified body audits under EU MDR and audits by their own customers. Every one of those depends on people who can plan an audit, read a quality system critically and write findings that stand up to scrutiny. The credential gives employers independent evidence that you can do that.

It helps in three practical ways. It strengthens applications for internal audit, supplier quality, quality systems and regulatory compliance roles, where CMDA is often listed as preferred. It adds credibility when you audit suppliers or lead an audit team, because auditees know the standard behind the credential. And it gives you a structured view of the whole medical device quality system, which is useful long after the exam, especially now that FDA has moved to QMSR and aligned with ISO 13485.

The 2026 Body of Knowledge also makes this a good moment to certify. The new BoK reflects current practice, including QMSR, cybersecurity and AI in device software, and data integrity under ALCOA+, so what you study is what auditors actually meet on the job today.

When you are ready to check your preparation, start with the free sample questions, then take a full timed practice test. Together they show which domains still need work and whether your pace is right for 145 questions in 258 minutes.

Frequently Asked Questions

What are the eligibility requirements for the ASQ CMDA exam?

ASQ requires five years of on-the-job experience in one or more areas of the CMDA Body of Knowledge, with at least one year in a decision-making position. A degree waives part of it: one year for an associate degree, three for a bachelor's degree and four for a master's or doctorate.

How many questions are on the CMDA exam, and how long is it?

The computer-delivered CMDA exam has 145 multiple-choice questions, of which ASQ scores 135 and leaves 10 unscored. Exam time is 258 minutes within a total appointment time of 270 minutes, which gives you about 1.8 minutes per question, including any time spent checking your open-book references.

How much does the CMDA exam cost?

The CMDA exam fee is listed as ASQ MEMBERS - $450, NON-MEMBERS - $550 and RETAKES - $350. The member rate applies to the initial exam, and the retake rate is available for two years after a previous attempt. Confirm the current fee on ASQ's CMDA page before applying.

What is the passing score for the CMDA exam?

You need a score of 550/750 to pass the CMDA exam. For the November 2026 pilot of the new 2026 Body of Knowledge, ASQ sends results four to six weeks after the exam instead of showing them on screen, so allow for that wait when you plan your application timeline.

When does the 2026 CMDA Body of Knowledge take effect?

ASQ tests the new 2026 CMDA Body of Knowledge starting with the November 2026 testing window. Domain I rises from 12 to 15 questions and domain II falls from 28 to 25, while domains III, IV and V keep 38, 42 and 15 questions. The 2020 BoK is archived on January 1, 2027.

Is the CMDA exam open book?

Yes. All ASQ exams are open book, but every reference, including your own notes, must be bound and stay bound during the exam. Ring and spiral binders are fine; hand-stapled or loose pages are not. Sticky notes are allowed only as tabs attached before you arrive at the Prometric test centre.

Select ratingPoorOkayGoodGreatAwesome

Rating: 4.8 / 5 (114 votes)