Quality Management Systems and Auditing
What this domain tests
Quality Management Systems and Auditing tests how you plan and conduct supplier audits against a standard or contractual requirement, classify findings, and drive closure. Expect questions on ISO 19011 principles, audit types, audit programs, evidence sampling, process approach, risk-based auditing, nonconformity grading, and follow-up. The exam favors process effectiveness over document compliance and independence over consulting.
Core rules and concepts
- ISO 19011 principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach.
- Audit types: first-party (internal), second-party (supplier), third-party (certification). A supplier audit is second-party and should use defined criteria, scope, and objectives.
- The audit program defines schedule, team competence, resources, and reporting. The audit plan covers scope, criteria, sites, processes, and timing.
- Gather evidence through interviews, observation, document review, and sampling. Triangulate: what is written, what is done, and what is recorded should agree.
- Grade findings by risk and system impact. A major nonconformity is a system failure or significant product risk; a minor is an isolated lapse. Observations are improvement opportunities, not nonconformities.
- Corrective action must address root cause and be verified for effectiveness. Correction fixes the instance; corrective action fixes the system.
- Relevant standards include ISO 9001:2015 (process approach, risk-based thinking), AS9100 (aerospace), IATF 16949 (automotive), and ISO 13485 (medical devices).
Worked example
An auditor finds three of twenty gauges without calibration records and one uncalibrated gauge used for final acceptance, with no impact assessment. Classification: major, because the calibration system failed and product acceptance is affected. If the gauge were unused, isolated, and contained, a minor could be defensible. Reasoning: grade on system failure and product risk, not on the count alone. Required follow-up: quarantine the gauge, assess affected product, recalibrate, find the root cause in the calibration schedule, and verify across the site.
Traps that cost marks
- Auditing documents instead of processes and results.
- Consulting or proposing solutions during the audit.
- Accepting correction, such as sorting, as corrective action.
- Failing to verify effectiveness at the follow-up.
- Confusing major and minor findings or writing vague evidence.
- Expanding scope without changing the plan or criteria.