During a surveillance audit, it is observed that a company's Risk Management Plan for a new orthopedic implant is missing from the Medical Device File. The Quality Manager argues that risk documentation belongs in a separate department folder, not the Medical Device File (MDF). According to ISO 13485:2016 Clause 4.2.3, which statement is true?