CQA cheat sheet

Audits are classified by object (system, process, product) and by relationship: first-party (internal), second-party (supplier/customer), third-party (independent certification or registrar).

An audit is a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively against audit criteria (ISO 19011).

Inspection examines product or service conformance directly, while an audit evaluates the system or processes that produce the product or service.

Objective evidence includes records, statements of fact, and other verifiable information based on observation, measurement, or test; opinions and hearsay are not objective evidence.

Audit criteria are the policies, procedures, standards, contract terms, or regulations used as the reference against which evidence is compared.

A major nonconformity indicates a system failure or a condition likely to result in nonconforming product or regulatory failure; a minor nonconformity is an isolated lapse not indicating system breakdown.

An observation is a statement of fact noted during the audit; a finding is a conclusion against criteria (conformity or nonconformity).

Audit scope defines the extent and boundaries (locations, units, processes, time period); the audit objective states the purpose; the audit criteria state the reference requirements.

Sampling risk means conclusions drawn from a sample may differ from conclusions drawn from the full population; increasing sample size reduces this risk.

Core sequence: audit initiation, preparation (document review, audit plan, checklist), execution (opening meeting, evidence collection), reporting, and closure with follow-up.

The audit plan includes objectives, scope, criteria, dates and locations, audit team, schedule, and communication arrangements.

The opening meeting confirms the plan, scope, schedule, methods, communication channels, confidentiality, and safety arrangements with the auditee.

Evidence is gathered through three channels: interviews, document and record review, and observation of activities; all evidence must be recorded and traceable to its source.

Sampling methods: random (equal chance per item), systematic (fixed interval through a list), and judgmental or risk-based (targeted at high-risk or high-volume areas); record the sampling basis.

A nonconformity statement contains three parts: the requirement (criteria), the objective evidence (what was seen, where, when), and the gap between them; opinions are excluded.

The closing meeting presents findings and conclusions, confirms the auditee understands each finding, and agrees corrective action timeframes; the report is issued afterward.

The audit report includes scope, criteria, dates, team, summary of results, findings with supporting evidence, conclusions, and optional recommendations.

Follow-up verifies that corrective actions were implemented and are effective; if not effective, the finding remains open and is escalated.

Auditor competence is the demonstrated combination of education, training, work experience, audit experience, and personal attributes (ISO 19011).

Personal attributes of an auditor include ethical, open-minded, diplomatic, observant, perceptive, versatile, tenacious, decisive, self-reliant, and collaborative.

Required knowledge includes audit principles and methods, relevant standards (e.g., ISO 9001, ISO 19011), the process approach, risk-based thinking, applicable legal and regulatory requirements, and basic sampling and statistics.

Open-ended questions ('how do you handle...') elicit evidence; closed questions confirm facts; leading questions bias the response and should be avoided.

Team roles: the lead auditor plans and directs the audit and approves the report; auditors perform assigned tasks; technical experts advise but do not audit; auditees are never team members.

Objectivity requires auditors not to audit their own work or department and to declare any conflict of interest before the audit.

Time management allocates audit duration in proportion to process risk and importance and keeps the audit on schedule.

Continuing professional development and periodic auditor performance evaluation maintain and demonstrate ongoing competence.

An audit program is a set of audits planned for a specific time frame and directed at a specific purpose; the program manager handles planning, resourcing, monitoring, reviewing, and improving it.

Program planning considers process criticality, risk, organizational changes, past audit results, customer and regulatory requirements, and business objectives.

Risk-based scheduling audits high-risk and high-impact processes more frequently and with greater depth than low-risk processes.

Resources include auditor competence and availability, audit time, budget, and technology; competence and qualification records are maintained.

Records retained include audit plans, reports, nonconformities, corrective action status, and auditor qualification evidence.

Program performance indicators include on-time audit completion, finding and closure rates, repeat nonconformities, and audit report turnaround time.

Common scheme standards include ISO 9001 (quality), ISO 14001 (environmental), ISO 45001 (OH&S), ISO 13485 (medical devices), IATF 16949 (automotive), AS9100 (aerospace), and TL 9000 (telecom).

Management system standards are built on PDCA and risk-based thinking, and management review uses audit results as a required input.

Outsourced processes remain the organization's responsibility, so second-party supplier audits are commonly included in the audit program.

Seven QC tools: Pareto chart, cause-and-effect diagram, check sheet, histogram, scatter diagram, control chart, and flowchart (stratification and run charts are often added).

A Pareto chart orders categories in descending frequency with a cumulative-percentage line, illustrating that a few causes (about 20%) produce most effects (about 80%).

Cp = (USL - LSL) / 6 sigma; Cpk = min[(USL - mean)/3 sigma, (mean - LSL)/3 sigma]; Cpk is never greater than Cp and equals Cp only when the process is centered.

On a control chart, upper and lower control limits are set at the center line plus or minus three standard deviations; points beyond limits or nonrandom patterns indicate special-cause variation.

In FMEA, the Risk Priority Number equals Severity x Occurrence x Detection, each scored 1 to 10; higher RPN values are prioritized for corrective action.

Cost of quality has four categories: prevention, appraisal, internal failure, and external failure; failure costs are reactive while prevention and appraisal costs are proactive.

Root cause tools include 5 Whys, cause-and-effect (Ishikawa) diagrams, and fault tree analysis; treating a symptom without a root cause leads to recurrence.

Acceptance sampling plans specify lot size, sample size, and acceptance number against an AQL; larger samples increase confidence and reduce sampling risk.

A scatter diagram shows correlation, not causation; the correlation coefficient r ranges from -1 to +1, with 0 indicating no linear relationship.