Audit Process
What the candidate must understand
The audit process runs in phases: initiation and planning (confirm objectives, scope, and criteria; select the team; review documents; issue the audit plan; prepare work documents), conducting (opening meeting, then collecting evidence through interviews, observation, and document and record review, supported by representative sampling), reporting (classifying findings, writing the report, holding the closing meeting), completion (retaining records), and follow-up (verifying corrective action).
Know the finding categories: conformity, nonconformity, observation or opportunity for improvement. A major nonconformity signals a system breakdown, an absent control, or risk of nonconforming product escaping; a minor is an isolated lapse in an otherwise effective control. Every nonconformity must cite the requirement, present objective evidence, and state the gap. Keep correction (fix the instance) separate from corrective action (remove the cause through root cause analysis). Follow-up verifies both implementation and effectiveness.
Traps that show up in questions
- Confusing the audit plan (this audit) with the audit program (the multi-audit schedule).
- Treating the checklist as a script to read aloud rather than a memory aid; the audit trail should follow process flow and risk.
- Accepting verbal assurances as objective evidence, or letting the auditee steer evidence selection.
- Sampling conveniently (first file in the drawer) instead of representatively.
- Confusing opening meeting purpose (confirm logistics and method) with closing meeting purpose (present findings and agree timing).
- Recommending specific solutions - that drifts into consultancy and threatens objectivity.
- Verifying a corrective action was implemented but not that it was effective.
Rule of thumb
Write every nonconformity as a three-part statement: requirement, evidence, gap. Example: Procedure PR-07 requires supplier re-evaluation annually; three of eight supplier files show no evaluation since 2019; the requirement is therefore not met.