API Lead Auditor cheat sheet

Audit program = set of one or more audits planned for a specific time frame and directed toward a specific purpose; the program is managed, individual audits are executed.

Risk-based planning ranks audit frequency by process criticality, past nonconformity history, complaint and recall data, and change activity; higher risk means shorter audit intervals.

Audit scope states what is covered (sites, processes, product lines); audit criteria are the requirements against which evidence is compared (API Q1, ISO 9001, contract, internal procedures).

An audit plan allocates time to clauses and processes; it is a schedule of activities, not a checklist of findings, and remains flexible as evidence emerges.

Sampling is a documented, risk-informed decision: larger samples for high-risk or high-volume processes, and the sampling rationale is recorded in the audit record.

Lead auditor selects the team and assigns clause or process ownership so no auditor evaluates their own work; independence is a planning constraint, not an execution detail.

Opening meeting agenda: purpose and scope, criteria, schedule, communication method, confidentiality, sampling caveat, and confirmation of escorts and safety rules.

Audit program performance indicators include on-time completion, finding closure cycle time, repeat nonconformity rate, and coverage of critical processes.

ISO 9001 clause structure: 4 Context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement; API Q1 adds oil-and-gas-specific requirements on top.

Documented information = documents (retain as evidence of what was done) plus records; control requires availability, protection, and retention per defined periods.

Risk-based thinking: clause 6.1 requires identification of risks and opportunities and actions proportionate to their potential impact on product conformity.

API Q1 adds requirements for contingency planning, management of change, and control of outsourced processes beyond baseline ISO 9001.

Nonconforming product control requires identification, segregation, documented disposition (rework, repair, regrade, scrap, concession), and notification where required.

Monitoring and measuring resources must be calibrated or verified at specified intervals, with traceability to recognized standards where no standard exists.

Competence (7.2) is evidenced by education, training, skills, and experience records tied to defined competence requirements for each role.

Management review inputs and outputs are specified; absence of documented review of performance data is a clause-level nonconformity, not a minor observation.

Evidence hierarchy: records and objective data outrank interview statements; corroborate verbal claims with documents or direct observation before citing them.

Objective evidence is verifiable and traceable to a source; an auditor's opinion without evidence is not a finding.

Questioning path: ask what the process is, then request the record, then observe the activity, then trace one sample end-to-end.

Traceability test: select one unit or order and follow it through receiving, production, inspection, and release to confirm records link correctly.

Nonconformity is confirmed only when evidence shows the requirement was not met; a gap in evidence is raised as a question first, then as a finding if unresolved.

Interview technique: open questions first, closed questions to confirm, avoid leading questions; interview the person performing the activity, not only the manager.

Time discipline: track planned versus actual minutes per process; overruns signal scope creep and must be reconciled in the audit record.

Closing meeting presents findings, their classification, and the corrective action expectation; it does not negotiate away valid evidence.

Nonconformity statement structure: requirement (clause and text), evidence (what was observed, where, when), and the gap between them.

Grading: major nonconformity = systemic failure or absence of a required process; minor = isolated lapse where the process exists and generally functions.

Corrective action has two parts: containment/correction (fix the instance) and root cause correction (prevent recurrence); conflating them is a common weakness.

Root cause analysis methods include 5-Why, fishbone, and fault tree; effective root cause reaches a systemic control failure, not an individual's mistake.

Verification of effectiveness requires evidence after implementation, at a defined interval, that the nonconformity has not recurred.

Repeat nonconformity on the same clause across audits indicates the prior corrective action was not effective and may escalate to a major.

Finding closure requires objective evidence of implementation, not a statement of intent or a revised procedure alone.

Response timelines are defined by the certification or customer scheme; overdue responses are tracked as program-level performance data.

Auditor competence rests on four pillars: education, training, work experience, and audit experience, evidenced by records.

Lead auditor responsibilities: team selection, audit plan, opening and closing meetings, findings adjudication, report issuance, and follow-up.

Independence and impartiality: auditors must not audit their own work or a process they managed within a defined look-back period.

Confidentiality: information obtained during an audit is not disclosed to third parties without authorization, except where legally required.

Conflicts of interest, gifts, and consulting relationships with the auditee must be declared and, where material, result in reassignment.

Ethical conduct includes reporting evidence accurately, resisting pressure to downgrade or withdraw valid findings, and disclosing uncertainty.

Team management: assign work by competence, monitor progress, resolve disagreements among team members before the closing meeting.

Continuing professional development maintains competence; audit records demonstrate current, relevant experience for the schemes audited.

This section is intentionally minimal; content is consolidated in the other five domains to avoid duplication.

Audit program records include plans, checklists, notes, findings, reports, and closure evidence, retained per defined retention periods.

Remote and hybrid audit methods require documented justification, technology verification, and equivalent evidence quality to on-site audits.

Witnessed and joint audits require clear role definition so the lead auditor retains authority for findings and the final report.