ASQ CHA / CFSQA cheat sheet

Audit: systematic, independent, documented process for obtaining objective evidence and evaluating it against criteria.

Three audit types by relationship: first-party (internal), second-party (supplier/customer), third-party (independent certification).

Objective evidence = verifiable data (records, observations, measurements); opinions and hearsay are not evidence.

Audit criteria are the policies, standards, contracts, or requirements against which conformity is judged.

Audit findings classification: nonconformity (requirement not met), observation/opportunity for improvement, and conforming practice.

Corrective action removes root cause; correction removes the detected nonconformity; containment limits immediate effect.

Quality audit vs. inspection: audits evaluate systems and processes; inspection evaluates product conformance.

Independence principle: an auditor shall not audit their own work to preserve objectivity and impartiality.

Audit program = set of interrelated audits planned for a specific time frame and directed at a specific purpose.

Risk-based scheduling: prioritize audit frequency by process risk, past performance, and change significance.

Audit program metrics: schedule adherence, finding closure rate, audit cost per audit, and repeat-finding rate.

Resource plan must match auditor competence and count to the audit scope and duration.

Audit records retention is governed by contractual, regulatory, and organizational requirements.

Program review: top management evaluates program suitability at planned intervals (e.g., annually).

Auditor assignment must avoid conflict of interest and respect impartiality requirements.

Audit program scope defines which processes, sites, and standards are covered in the cycle.

Competence = demonstrated ability to apply knowledge and skills; distinct from qualification or certification alone.

Competence elements: education, training, experience, and personal attributes (e.g., ethical, open-minded, observant).

Auditor evaluation methods: record review, testing, observation, interviews, and feedback from auditees.

Technical auditors may be used for specialized processes but must be paired with qualified lead auditor.

Auditor code of conduct: integrity, fair presentation, due professional care, confidentiality, independence.

Continuing professional development keeps auditor competence current with standards and technology.

Lead auditor responsibilities: plan audit, manage team, resolve conflicts, and issue the report.

Auditor performance should be evaluated after each audit to identify improvement needs.

Audit objectives, scope, and criteria must be defined before any audit activity begins.

Audit plan documents schedule, activities, team assignments, and documents to be reviewed.

Document review before audit identifies areas needing on-site verification and gaps in the system.

Checklist preparation aligns questions with audit criteria to ensure coverage without bias.

Opening meeting confirms scope, criteria, schedule, and communication channels with auditee.

Sampling plan must be defensible: sample size reflects risk, process volume, and history.

Audit team briefing assigns process areas and clarifies roles before fieldwork.

Audit plan may be revised as evidence emerges but scope changes require auditee agreement.

Evidence collection techniques: interviews, document review, observation, and sampling of records.

Auditor should verify evidence through multiple sources (triangulation) before recording a finding.

Nonconformity statement includes requirement, evidence, and the specific clause/standard reference.

Interview technique: ask open questions, avoid leading questions, and confirm understanding of responses.

Observation must reflect normal operations; auditors avoid altering process behavior during audit.

Sampling risk: findings from a sample apply to the population only with stated confidence.

Findings should be discussed with the auditee as they are identified to ensure factual accuracy.

Audit trail: record what was examined, who was interviewed, and what was observed for traceability.

Audit report contents: objectives, scope, criteria, findings, conclusions, and recommendations.

Report distribution is controlled; confidentiality of auditee information must be maintained.

Nonconformity grading: major (system failure or significant risk) vs. minor (isolated lapse).

Corrective action request requires root cause analysis, action plan, and target completion date.

Follow-up verifies implementation and effectiveness of corrective actions, not just completion.

Finding closure requires objective evidence that the root cause has been eliminated.

Escalation: unresolved or overdue corrective actions are reported to top management.

Report should be factual, clear, and free of opinion; conclusions are supported by evidence.