Exemplar Global QMS Lead Auditor key terms

The set of requirements used as a reference against which audit evidence is compared, such as standards, contracts, procedures, or legal rules. Auditors judge conformity only against agreed criteria.

Records, statements of fact, or other verifiable information relevant to the audit criteria. Evidence must be traceable and able to be checked; it is the raw material from which findings are drawn.

Data supporting the existence or truth of something, obtained through observation, measurement, or testing and not dependent on personal opinion. It strengthens an audit finding against challenge.

The result of evaluating collected evidence against audit criteria. Findings may indicate conformity or nonconformity, and are recorded with supporting evidence so the auditee can understand and act on them.

A failure to meet a requirement, whether from the standard, the organization's own procedures, customer requirements, or law. It must be documented, corrected, and investigated for cause.

A nonconformity that seriously undermines the management system's ability to achieve intended results, or a total absence of a required element. It usually blocks certification until resolved by a follow-up audit.

An isolated or limited lapse that does not by itself defeat the system's effectiveness, such as a single missing record. It is normally closed through accepted correction and corrective action without a further on-site visit.

A statement of fact or concern noted by an auditor that is not yet a nonconformity, often a risk of future failure or a weak practice. It may be reported as an improvement opportunity.

Fulfilment of a requirement. In an audit, conformity is concluded only where evidence positively demonstrates that the requirement is met, not merely assumed from absence of problems.

The auditor's professional judgement about the significance of the audit results, given the audit objectives and all findings. It states whether the system as a whole meets criteria and notes any limitations.

What an audit is intended to accomplish, such as verifying conformity, evaluating effectiveness, or following up prior findings. Objectives shape scope, criteria, sampling, and the evidence an auditor seeks.

The boundaries of an audit: the organizational units, locations, processes, products, and time period covered. Scope must be agreed with the client and stated accurately in the report.

The set of planned audits for a defined period, arranged to cover the management system systematically and to allocate resources. It is distinct from a single audit plan.

The description of activities and arrangements for one specific audit, including schedule, areas to be examined, team assignments, and documents to review. It is agreed with the auditee before starting.

One or more auditors, possibly supported by technical experts or auditors in training, conducting an audit. The lead auditor directs the team and is accountable for the report.

The auditor with overall responsibility for managing an audit, including planning, directing the team, conducting meetings, resolving conflicts, and signing the final report. Competence and impartiality are essential.

A person who provides specific knowledge or expertise to the audit team but does not audit as an auditor. Experts advise; they do not decide findings or conclusions unless also qualified as auditors.

The demonstrated ability to apply knowledge and skills needed for auditing, including education, training, work experience, and audit experience. Competence is maintained and evaluated through continuing professional development.

Freedom from bias, conflict of interest, or undue influence that could affect audit judgements. Auditors must not audit their own work and must disclose any relationship that could compromise objectivity.

The organizational and personal separation that allows auditors to reach conclusions without pressure from the auditee or commercial interests. It is a precondition for credible third-party certification.

A short meeting at the start of an audit that confirms scope, criteria, schedule, communication channels, and confidentiality, and explains how findings will be reported. It sets expectations and prevents later disputes.

The meeting at the end of an audit where findings, conclusions, and any nonconformities are presented to the auditee's management. It allows factual corrections and agrees follow-up actions and timelines.

The formal record of the audit, covering objectives, scope, criteria, dates, team, findings, and conclusions. It is the property of the client and must be accurate, complete, and clear.

A review of documented information performed away from the auditee's site, often before an on-site visit. It checks that the system is adequately described and identifies areas needing deeper examination.

The initial part of a certification audit that evaluates readiness for stage 2 by reviewing documentation, scope, resources, and internal audit and management review results. It is not a full conformity assessment.

The certification audit phase that evaluates implementation and effectiveness of the management system on site. It gathers evidence across processes and results in a recommendation for or against certification.

A third-party audit by an accredited body to determine whether an organization's management system conforms to a standard and is effective. Success leads to a certificate with defined validity.

A periodic audit after certification, typically annual, to confirm the system continues to conform and improve. It samples key processes and follows up corrective actions from previous audits.

A full audit before a certificate expires, usually every three years, that re-evaluates the entire management system. It is more comprehensive than surveillance and may include a stage 1 review.

An organization that audits and certifies management systems against standards, usually under accreditation. It must be independent, competent, and free of consultancy conflicts with its clients.

Formal recognition by an authoritative body that a certification body is competent to perform specific certification activities. Accreditation gives certificates international credibility and is often confirmed through mutual recognition arrangements.

Selecting less than the whole population of records or activities to draw conclusions about the whole. Samples must be representative and sufficient, and the rationale for selection should be documented.

Managing activities as interrelated processes that transform inputs into outputs, with attention to interactions and overall performance. Auditors trace process inputs, outputs, controls, and measures rather than isolated clauses.

An audit that examines one process end to end, from inputs and resources through controls to outputs and performance measures. It tests whether the process achieves planned results and interacts correctly with others.

A simple diagram used in process auditing to map a process: inputs, outputs, resources, competent people, methods, and performance measures. It helps auditors see links and decide what evidence to collect.

The documented path that allows an auditor to trace an activity or record from start to finish, or backward from an output to its origin. A clear trail demonstrates control and traceability.

The ability to follow the history, application, or location of an object or record through recorded identification. It supports product recall, complaint investigation, and verification of conformity.

An approach that identifies and addresses risks and opportunities that could affect the management system's ability to achieve intended results. Auditors examine how risks are determined and acted on.

Action taken to eliminate the cause of a nonconformity so it does not recur. It differs from correction, which only fixes the immediate problem, and must be verified for effectiveness.

A structured investigation to find the underlying reason a nonconformity occurred, beyond the immediate symptom. Methods include five whys, fishbone diagrams, and fault tree analysis. Effective corrective action depends on it.

Verification that agreed corrective actions have been implemented and are effective. It may be done through records review, a site visit, or at the next scheduled audit, and closes the loop on findings.