CQA common mistakes
CQA · Understand the traps and how to avoid them.
Classifying the audit by where it happens or who requested it instead of by the auditor's relationship to the auditee - e.g., calling a customer's audit of its supplier a 'third-party audit,' or calling an ISO 9001 certification audit a 'second-party audit.'
Candidates memorize the labels first-party/second-party/third-party and system/process/product as vocabulary lists, then map the scenario's surface wording ('external,' 'on-site,' 'customer') onto whichever label seems closest.
What to do instead
Use a single decision rule before reading the options: first party = the organization audits itself (internal); second party = an organization audits a supplier or other organization it has a contractual interest in; third party = an independent body with no contractual relationship (certification, accreditation, regulatory). Then classify the object separately: system (the whole management system), process (one process's effectiveness), product (conformity of output). Answer only after naming both classifications in your head.
Selecting 'corrective action' when the scenario describes an immediate fix to the nonconforming product (rework, re-sort, scrap, segregation), or selecting 'correction' when the scenario describes eliminating a cause so the problem cannot recur.
Everyday English uses 'corrective' to mean 'fixing the thing,' while the standards use it to mean 'fixing the cause.' The two options are usually both present and both plausible-sounding.
What to do instead
Ask one question of every option: does this act on the nonconformity itself or on its cause? Correction removes the detected nonconformity (rework, scrap, re-inspection). Corrective action removes the cause of a detected nonconformity so it does not recur. Preventive action acts on a potential nonconformity that has not occurred. The word 'root cause,' 'recurrence,' or 'why did this happen' in the stem points to corrective action.
Choosing an answer that states a practice is 'ineffective,' 'poor,' or 'not followed' without tying it to a specific requirement, or treating a housekeeping observation as a nonconformity.
Candidates respond to the scenario's narrative tone ('the operator seemed unsure') and pick the option that sounds most like a strong finding, forgetting that a finding is a formal, three-part construct.
What to do instead
Before choosing, silently build the finding: (1) criteria - the specific 'shall' in a standard, procedure, contract, or regulation; (2) evidence - verifiable records, observations, or statements; (3) gap - what was required versus what was found. If any of the three is missing from an option, that option is an observation or improvement opportunity, not a nonconformity. An opinion or a vague adjective can never be evidence.
Placing activities at the wrong point in the audit life cycle - for example, saying the lead auditor verifies corrective action effectiveness at the closing meeting, or that the audit plan is first presented at the opening meeting.
The exam recombines four or five genuinely audit-related activities into each option, so the activities feel familiar and the sequence is never checked.
What to do instead
Anchor each activity on its output and owner: audit plan (issued before the audit, by the team leader); opening meeting (confirms scope, criteria, schedule, logistics, and communication rules); evidence collection and finding generation; closing meeting (presents findings, conclusions, and recommendations - no corrective action verification); audit report (issued after); follow-up (verification of corrective action effectiveness, performed later and reported separately).
Choosing 'assign the department supervisor, because they know the process best' as the way to staff an audit of that department, or letting a technical expert audit their own work area.
Technical knowledge feels like the dominant form of competence, and independence reads as an abstract principle rather than a hard constraint, so the 'most knowledgeable' option looks like the practical answer.
What to do instead
Treat independence as non-negotiable: no one may audit their own work. Competence is 'the ability to apply knowledge and skills to achieve intended results' - it supplements independence, it does not replace it. When the only available expert is conflicted, use them as a technical expert who advises the team but does not audit or draw conclusions about their own area, or bring in another auditor.
Treating completion of a training course, a certificate, or years of service as proof that an auditor is competent.
Training records are the most visible and easiest-to-cite evidence in a scenario, so candidates equate the input (training) with the outcome (demonstrated ability).
What to do instead
Separate the three: qualification = meeting defined prerequisites; training = acquiring knowledge; competence = demonstrated ability, evaluated against defined criteria. Look for the option describing evaluation of actual audit performance - observation of the auditor during an audit, review of their audit reports and findings, feedback from auditees and team members, and ongoing professional development. If an option stops at 'attended training' or 'holds a certificate,' it is incomplete.
Conflating the audit programme with the audit plan or schedule - e.g., selecting 'the audit team leader establishes the audit programme' or describing one audit's itinerary as 'the programme.'
Programme and plan are near-synonyms in ordinary usage, and both options typically mention planning, resources, and scheduling, so the difference is invisible unless the candidate is looking for it.
What to do instead
Use the definitions and their owners. Audit programme: arrangements for a set of one or more audits planned for a specific time frame and directed toward a specific purpose - owned by the programme manager, who sets priorities, risk-based frequency, resources, and competence needs across audits, and monitors the programme. Audit plan: description of the activities and arrangements for a single audit - owned by the audit team leader. If the option spans more than one audit or a time frame, it is programme; if it spans one audit, it is plan.
Miscategorizing cost-of-quality elements - e.g., recording warranty claims and field failures as appraisal cost, or recording incoming inspection labor as a failure cost.
The four categories are learned as a list of examples rather than as a two-way split, and options are built from plausible-sounding but wrong pairings.
What to do instead
Split first, then label. Prevention and appraisal are costs of conformance - money spent to keep failures from happening or to detect them before release (training, procedure development, calibration, inspection, test, audit). Internal and external failure are costs of nonconformance - money spent because the requirement was already missed (scrap, rework, downtime, warranty, returns, recalls, liability). Then ask only: was this spent to prevent/detect, or because it was missed, and did the customer see it?
Selecting a tool by name familiarity rather than by function - e.g., choosing a Pareto chart when the question asks how to surface all possible causes of a problem, or a control chart when the question asks to rank defect types by frequency.
Tools are memorized as a vocabulary list with pictures, so under time pressure candidates match on a loosely associated keyword ('defects' → Pareto, 'variation' → any chart) instead of on the question's stated purpose.
What to do instead
Translate the question into a purpose verb before looking at the options: generate/organize ideas = brainstorming, affinity diagram, tree diagram; find and structure causes = cause-and-effect (fishbone), 5 Whys, is/is-not analysis; prioritize or focus = Pareto, FMEA, prioritization matrix; study variation over time = control chart, run chart; understand a distribution = histogram, box plot; study relationships = scatter diagram, regression. Only after naming the verb should you name the tool.
Reasoning about acceptance sampling as if AQL were a guaranteed acceptance level, and swapping producer's risk for consumer's risk - e.g., stating that lots at AQL quality will be accepted, or calling alpha the consumer's risk.
AQL is intuitive as 'the quality we accept,' and alpha/beta are memorized as symbols with no story attached, so the two get inverted under exam pressure.
What to do instead
Attach a one-line story to each: AQL is the quality level that corresponds to a high probability of acceptance (commonly about 95 percent) when a continuing series of lots is submitted - it is not a target, and a lot at AQL quality can still be rejected. Alpha (producer's risk) is rejecting a lot that was actually good - the false alarm. Beta (consumer's risk) is accepting a lot that was actually bad - the missed defect. Producer = the one who suffers when good product is rejected; consumer = the one who suffers when bad product is accepted. Re-derive the direction from that sentence rather than from the symbol.