CQI/IRCA EMS Lead Auditor common mistakes
CQI/IRCA EMS Lead Auditor · Understand the traps and how to avoid them.
Citing ISO 14001:2015 clause numbers and titles from memory and getting them wrong - e.g. quoting '4.2 Environmental aspects', '6.1.3 Legal and other requirements', or attributing 'emergency preparedness and response' to clause 8.2 of ISO 9001 and 7.x of 14001. The candidate writes a plausible-sounding clause reference in the answer that does not match the standard's actual numbering or its 2015 titles (Environmental aspects = 6.1.2; Compliance obligations = 6.1.3; Emergency preparedness and response = 8.2; Evaluation of compliance = 9.1.2).
Candidates revise from summarised notes and flowcharts rather than the standard itself, and 14001:2015 renumbered almost everything relative to the 2004 version, so older memorised mappings leak through under exam pressure. The 2015 titles also deliberately changed (e.g. 'legal and other requirements' became 'compliance obligations'), so a candidate who learned the 2004 text produces answers that are both old and wrong.
What to do instead
Study from an unannotated copy of ISO 14001:2015 and build a one-page clause map in your own handwriting (4.1–4.4, 5.1–5.3, 6.1.1–6.1.4, 6.2, 7.1–7.5, 8.1–8.2, 9.1.1–9.3, 10.2–10.3) with the exact 2015 titles. Recite it from blank paper until the numbers and titles are automatic, and in every practice answer write the clause number plus the exact title before writing the finding.
Asserting that ISO 14001:2015 requires a 'documented procedure' for a given activity - e.g. 'the organisation must have a documented procedure for identifying environmental aspects', for corrective action, or for internal audit - and raising a nonconformity against that invented requirement.
The 2004 edition was built around six documented procedures and many candidates were trained on it, or transfer the 'maintain a documented procedure' habit from ISO 9001:2008. The 2015 edition replaced this with 'maintain documented information' and only requires it in specific places, so the candidate audits against a requirement that does not exist.
What to do instead
Make a definitive list, taken directly from the 2015 text, of every place the standard requires documented information to be maintained or retained (e.g. scope 4.3, policy 5.2, objectives 6.2.1, evidence of competence 7.2, operational control 8.1, emergency preparedness 8.2, monitoring results 9.1.1, compliance evaluation results 9.1.2, internal audit evidence 9.2.2, management review results 9.3, nonconformity and corrective action records 10.2) and audit only against that list. Before writing any nonconformity, locate the 'shall' in the standard text and quote it verbatim.
Auditing aspects and impacts only as an internal process snapshot - missing the explicit requirements to apply a life cycle perspective when determining environmental aspects (6.1.2), to control outsourced processes and consider the value chain in operational control (8.1), and to evaluate compliance with its compliance obligations rather than merely listing them (9.1.2). The candidate accepts 'we look at our site's activities' as full conformity.
The life cycle perspective and the outsourcing/value-chain language are the two genuinely new conceptual demands of the 2015 edition and are not intuitive to auditors grounded in site-based, permit-driven thinking. Because they are easy to read past in a single clause, candidates default to the familiar aspects-register exercise and never probe upstream/downstream stages or contractor control.
What to do instead
Build a three-question probe you apply in every practice scenario: (1) Which life cycle stages - raw material, design, transport, use, end-of-life - did you consider, and where is that consideration recorded? (2) Which processes are outsourced, and what documented information gives confidence they are controlled? (3) Show me the output of your compliance evaluation, not just your list of obligations. Match each probe to 6.1.2, 8.1 and 9.1.2 respectively.
Using 'audit programme' and 'audit plan' interchangeably, and answering programme-management questions at the level of a single audit - e.g. describing the agenda and team assignments when asked who is responsible for managing the audit programme, how its risks and opportunities are addressed, or what records must be retained.
The two terms are close in ordinary English and both are covered by ISO 19011, so candidates collapse them. The exam frequently tests the programme level (objectives, extent, frequency, resources, monitoring, review, records) precisely because it is the part practitioners neglect in favour of the more familiar on-site activity.
What to do instead
Fix a sharp definition pair and rehearse it: the programme is the set of audits planned for a time period, with agreed objectives, extent, frequency, resources and risk-based prioritisation, owned by the person managing the programme; the plan is the description of activities and arrangements for one audit. When a question mentions frequency, resourcing, competence of the audit team across audits, or records of the programme's implementation and review, answer at programme level only.
Confusing scope with criteria - writing 'audit scope: ISO 14001:2015' or 'audit criteria: the environmental department' - and omitting the mandatory elements of the audit plan (objectives, scope, criteria, dates and locations, expected time and duration, roles and responsibilities, allocation of resources, and the audit methods to be used).
In the audit context, scope, criteria and objectives sound like overlapping abstractions, and candidates answer with whichever term comes to mind. Preparation content is often skimmed because candidates assume on-site performance matters more; the result is an answer that names a standard as the scope, which conflates what will be examined with what it will be measured against.
What to do instead
Use a fixed three-line framing before answering any planning question: scope = the organisational units, functions, physical boundaries and activities to be audited; criteria = the requirements used as the reference (ISO 14001, permits, internal procedures, legal requirements); objectives = what the audit is for. Then check the plan against the seven-element list above, physically ticking each one off.
Treating acceptance of verbal assurance as evidence - recording a finding or, worse, recording conformity because a manager said 'we always do that' - and drawing conclusions from a sample of one without stating the sample or its limits. Related behaviour: asking leading or closed questions ('You do check contractor waste licences, don't you?') and abandoning a line of enquiry at the first answer that contradicts the documented process.
Auditors new to on-site work confuse information obtained with evidence obtained, and the interview is the fastest way to fill the time available. Under exam pressure the 'plausible and cooperative auditee' distractor is also attractive because it produces a tidy, agreeably conforming answer.
What to do instead
Apply a personal rule before writing anything as a finding: evidence must be traceable to a record, an observation or a verified statement, with source identified (document ID, record number, location, date, person's role). Always state the sample basis ('three of twelve waste transfer notes sampled'). Convert leading questions into open ones ('Walk me through what happens when...') and always ask 'show me' after 'we do'.
Grading findings by emotional or practical considerations rather than by the definitions - raising a major nonconformity for a single missing signature or one overdue calibration with no systemic breakdown, or, conversely, downgrading a genuine system failure to an 'observation' or 'opportunity for improvement' because the auditee is defensive. Also writing OFIs where the evidence actually shows a requirement not met.
Candidates want to appear rigorous (over-grading) or want to avoid conflict (under-grading), and neither motive is connected to the classification criteria. Many candidates have also never had to justify a grade to a certification decision maker, so they have no calibrated sense of what a system failure looks like.
What to do instead
Write the grade after writing the finding, not before, and force the justification into one sentence referencing risk and systemicity: major = the requirement is not addressed at all, the system has failed to achieve its intended outcome, there is significant risk or regulatory exposure, or the finding is a repeat; minor = an isolated lapse that does not undermine the system's ability to achieve its intended outcome. If no requirement has been breached, it is an OFI, not a nonconformity - and an OFI must never be used to soften a breach.
Writing nonconformity statements with no citable requirement and no objective evidence - 'environmental records are not fully maintained' or 'the process is not effectively implemented' - and closing follow-up by accepting 'we will retrain staff' as evidence that corrective action was effective.
Candidates write the summary they would say out loud rather than a three-part statement. Follow-up is also frequently the weakest step in practice because the auditee's promised action is mistaken for completed correction, and 'retraining' is a comfortable generic answer that exam distractors reward.
What to do instead
Draft every statement against a three-slot template and refuse to submit until all three are filled: (1) Requirement - standard clause plus exact text, or regulatory/procedural reference; (2) Evidence - what was seen, where, when, document/record identifiers, sample size; (3) Gap - precisely how the evidence fails the requirement. For follow-up, require evidence of implementation plus evidence that the nonconformity no longer recurs (re-sampling the same activity), and differentiate correction, root-cause analysis and effectiveness verification in the answer.
Choosing the 'helpful' option in ethics and conduct scenarios - answering that the auditor should advise the auditee on the correct remedial action, accept a gift or hospitality to preserve the relationship, continue auditing a former employer's area without declaring it, or disclose a client's confidential data to a colleague outside the team. Also accepting a team assignment where the auditor lacks the technical competence or the language to audit, without raising it.
Consultancy is what most candidates actually do in their day job, and helping feels like professionalism rather than a threat to impartiality. Independence risks are usually presented in the exam as mild, socially normal situations (a former colleague, a small gift, an off-hand request for copies of a report), so the rule-breaking is easy to miss.
What to do instead
Memorise and apply the absolute prohibitions: do not consult, do not recommend solutions, do not audit your own work or your employer's work within the certification cycle, declare and withdraw from any conflict, do not accept benefits that could influence judgement, do not disclose information without authority. In each scenario question, first ask 'does this option compromise independence, confidentiality or competence?' and eliminate on that basis before considering effectiveness or client satisfaction.
Treating ISO 14001 certification as evidence of legal compliance, or mixing up the bodies in the system - describing the certification body as the accreditation body, expecting the accreditation body to perform the audits, assuming the certification body grants the organisation its environmental permits, or expecting the certification auditor to enforce the regulations. The candidate answers that 'the regulator will be informed of the major nonconformity' or that certification demonstrates compliance with permits.
The three roles - regulatory authority, certification body and accreditation body - are rarely seen side by side in a practitioner's daily work, and 'certification means you comply' is a widespread market shorthand. Candidates therefore import a plausible but incorrect assumption about who does what into the scenario answer.
What to do instead
Hold the roles distinctly: the regulator sets and enforces legal requirements and issues permits; the certification body audits against ISO 14001 and makes the certification decision (through its decision maker, separate from the audit team); the accreditation body accredits the certification body against ISO/IEC 17021-1 and does not assess the certified organisation. ISO 14001 requires the organisation to evaluate and demonstrate its compliance obligations, but certification is not a statement of legal compliance - write that sentence from memory before answering any question in this domain.