I85PREP
⌘ K
Exemplar Global QMS Lead Auditor study materials
Exemplar Global QMS Lead Auditor study resources

Exemplar Global QMS Lead Auditor practice questions

One question at a time. Build your Exemplar Global QMS Lead Auditor understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Quality Management System (ISO 9001) Auditing

During a certification audit of a manufacturer, the lead auditor needs to determine whether the organization has established a process for controlling documented information of external origin. Which clause of ISO 9001:2015 is most directly relevant to this determination?

  1. Clause 7.5.3 Control of documented information Correct answer.
  2. Clause 8.5.1 Control of production and service provision
  3. Clause 7.1.6 Organizational knowledge
  4. Clause 4.2 Understanding the needs and expectations of interested parties

Explanation

Clause 7.5.3 requires documented information to be controlled, and it explicitly extends control to documented information of external origin determined by the organization to be necessary for the QMS. The other clauses address knowledge, production control, and interested parties rather than document control.

Question 2Quality Management System (ISO 9001) Auditing

An audit team is planning a surveillance audit and wants to sample records from the previous twelve months. Which audit principle most directly supports the decision to base conclusions on representative samples rather than examining every record?

  1. Confidentiality
  2. Evidence-based decision-making Correct answer.
  3. Independence
  4. Continual improvement

Explanation

Evidence-based decision-making recognizes that audit evidence is derived from sampling and that conclusions should rest on verifiable, representative evidence. It justifies sampling while requiring that the sample be sufficient to support credible findings.

Question 3Quality Management System (ISO 9001) Auditing

While reviewing a nonconformity report, the lead auditor notices the auditor recorded the finding as 'the calibration register was incomplete' without citing the specific requirement. Which element is missing from this nonconformity statement?

  1. The name of the responsible process owner
  2. The proposed corrective action
  3. The due date for closure
  4. The requirement against which the evidence was evaluated Correct answer.

Explanation

A well-formed nonconformity statement identifies the requirement, the objective evidence, and the gap between them. Without citing the applicable requirement, the finding cannot be verified or effectively corrected. Process owner, corrective action, and due date belong to the response, not the finding statement.

Question 4Quality Management System (ISO 9001) Auditing

An organization's internal audit programme shows that the same two processes have been audited every year for three years, while the riskier design and development process has never been audited. Which ISO 9001:2015 requirement is most clearly compromised?

  1. The audit programme must be planned considering the importance of processes and prior results Correct answer.
  2. Each process must be audited at least once per calendar year
  3. Audit criteria must be approved by top management before each audit
  4. Internal audits must be performed by external competent auditors

Explanation

Clause 9.2.2 requires the audit programme to be planned, established, implemented and maintained, taking into consideration the importance of the processes concerned, changes affecting the organization, and the results of previous audits. Repeatedly auditing low-risk processes while ignoring a high-risk one contradicts that risk-based planning requirement.

Question 5Quality Management System (ISO 9001) Auditing

During an opening meeting, the lead auditor explains the audit scope, criteria, schedule, and methods. A process owner asks whether the auditors will also evaluate the organization's compliance with customer-specific requirements not covered by ISO 9001. How should the lead auditor respond?

  1. The auditors will assess all customer requirements automatically because they are implied by ISO 9001
  2. The process owner must submit the customer requirements to the certification body for approval during the meeting
  3. The audit will assess conformity only against the agreed audit criteria, and any additional customer requirements would need to be included as criteria beforehand Correct answer.
  4. Customer-specific requirements are outside any management system audit and cannot be examined

Explanation

Audit criteria define what is audited, and the audit is conducted against the agreed criteria. Additional customer-specific requirements can be included only if they are established as part of the audit criteria before or through proper planning. The lead auditor cannot unilaterally expand scope during the opening meeting.

Question 6Quality Management System (ISO 9001) Auditing

An auditor is gathering evidence about whether top management demonstrates leadership and commitment. Which observation provides the most direct evidence against clause 5.1.1?

  1. Management review minutes show the last three meetings were cancelled and no decisions on QMS changes were recorded Correct answer.
  2. The quality policy is displayed on a poster in the reception area
  3. The organization has appointed a management representative for the QMS
  4. The quality objectives have been documented for the current year

Explanation

Clause 5.1.1 requires top management to demonstrate leadership by, among other things, conducting management reviews and making decisions related to the QMS. Repeatedly cancelled reviews with no recorded decisions directly indicate a failure of that commitment. The other observations are neutral or supportive.

Question 7Quality Management System (ISO 9001) Auditing

An audit reveals that operators performing a critical soldering task have no records showing they were assessed as competent, and the supervisor states training was 'done on the job.' Which clause should the auditor cite as the primary basis for the finding?

  1. Clause 8.7 Control of nonconforming outputs
  2. Clause 7.4 Communication
  3. Clause 7.1.5 Monitoring and measuring resources
  4. Clause 7.2 Competence Correct answer.

Explanation

Clause 7.2 requires the organization to determine the necessary competence of persons doing work affecting quality, ensure they are competent, and retain documented information as evidence of competence. On-the-job training without retained evidence of competence assessment is the gap.

Question 8Quality Management System (ISO 9001) Auditing

A lead auditor is selecting audit methods for a process that is highly complex and critical to product safety. Which approach best reflects the guidance to match audit methods to the situation?

  1. Relying solely on a remote questionnaire sent to the process owner
  2. Deferring the process to a future audit because of its complexity
  3. Reducing the sample size to shorten the audit and avoid disrupting production
  4. Conducting a more in-depth, on-site examination with expanded sampling of that process Correct answer.

Explanation

Audit methods and sampling should be proportionate to the significance and complexity of the process being audited. A critical, complex process warrants deeper examination and larger or more targeted sampling, not reduced scrutiny.

Question 9Quality Management System (ISO 9001) Auditing

Which statement best describes the role of the audit programme manager as distinct from the lead auditor of an individual audit?

  1. The programme manager is always an external certification body employee while the lead auditor is internal
  2. The programme manager manages the overall set of audits and resources, while the lead auditor manages the conduct of a specific audit Correct answer.
  3. The programme manager sets the audit findings and the lead auditor approves the audit report
  4. The programme manager conducts every audit personally and the lead auditor only observes

Explanation

The audit programme encompasses the arrangement and management of multiple audits over time, including resources and scheduling, whereas the lead auditor is responsible for the conduct and reporting of a single audit. The two roles are complementary but distinct in scope.

Question 10Quality Management System (ISO 9001) Auditing

During an audit, an auditee offers the auditor a copy of a confidential customer contract and asks that it not be shared with the audit team. Which principle should guide the auditor's handling of this information?

  1. Fair presentation, publishing the contract in the audit report
  2. Evidence-based decision-making, sharing the contract with all interested parties
  3. Independence, refusing all information offered by the auditee
  4. Confidentiality, using the information only for the audit purpose and not disclosing it improperly Correct answer.

Explanation

Confidentiality requires auditors to exercise discretion in the use and protection of information acquired during the audit. Information should be used only for the audit purpose and not disclosed without proper authorization. Sharing or publishing it would breach that principle.

Question 11Quality Management System (ISO 9001) Auditing

An auditor is verifying that the organization has addressed risks and opportunities. The quality manager presents a risk register with entries for every department. What additional evidence is most important for the auditor to seek?

  1. Evidence that the risk register is stored in a controlled electronic system
  2. Evidence that the number of risks listed exceeds a defined minimum
  3. Evidence that the identified risks and opportunities have led to actions and that the actions are evaluated for effectiveness Correct answer.
  4. Evidence that the risk register has been signed by every department head

Explanation

Clause 6.1 requires planning to address risks and opportunities and to evaluate the effectiveness of the actions taken. A populated register alone shows identification but not that actions were implemented and evaluated. The auditor should therefore seek evidence linking risks to actions and results.

Question 12Quality Management System (ISO 9001) Auditing

An audit finding states that a supplier of critical components was not evaluated or monitored, and no records of supplier performance exist. Which clause is the most appropriate basis for this nonconformity?

  1. Clause 9.1.2 Customer satisfaction
  2. Clause 8.4.1 Control of externally provided processes, products and services Correct answer.
  3. Clause 8.5.4 Preservation
  4. Clause 7.1.3 Infrastructure

Explanation

Clause 8.4.1 requires the organization to ensure that externally provided processes, products and services conform to requirements, including evaluating and selecting suppliers and monitoring their performance. Missing evaluation and performance records is a direct gap against that clause.

Question 13Quality Management System (ISO 9001) Auditing

A lead auditor is reviewing an audit report draft and finds that a minor nonconformity has been written as 'the process could be improved.' Why is this statement inadequate as a nonconformity?

  1. It describes an opportunity for improvement rather than a failure to meet a requirement Correct answer.
  2. It does not include the auditor's name and signature
  3. It is too long to be included in a summary report
  4. It fails to identify the auditee's responsible manager

Explanation

A nonconformity must demonstrate a failure to fulfil a requirement, supported by objective evidence. A statement that a process could be improved is an observation or improvement opportunity, not evidence of non-fulfilment of a requirement. It should be reclassified or rewritten with the specific requirement and evidence.

Question 14Quality Management System (ISO 9001) Auditing

During a closing meeting, the auditee disagrees with a nonconformity and states that the requirement does not apply to them. What is the most appropriate action for the lead auditor?

  1. Withdraw the finding immediately to preserve a cooperative relationship
  2. Record the disagreement and explain the objective evidence and requirement, while noting the auditee's view in the report Correct answer.
  3. Escalate the dispute to the auditee's customers for a decision
  4. Refuse to close the meeting until the auditee accepts the finding

Explanation

The closing meeting should present findings and allow the auditee to seek clarification or express disagreement. The lead auditor should explain the evidence and requirement and record unresolved disagreement, without unilaterally withdrawing valid findings.

Question 15Quality Management System (ISO 9001) Auditing

An auditor samples five purchase orders and finds that three were placed with suppliers not on the approved supplier list. The organization's procedure requires all purchases to use approved suppliers. What type of evidence best supports this finding?

  1. The auditor's general impression that purchasing seemed disorganized
  2. The organization's annual sales figures
  3. The sampled purchase orders, the approved supplier list, and the purchasing procedure Correct answer.
  4. A verbal statement from a competitor about industry practice

Explanation

Objective evidence must be verifiable and traceable to the audit criteria. The purchase orders show the actual practice, the approved supplier list shows the control, and the procedure states the requirement, together demonstrating the gap. Impressions, competitor comments and sales figures do not substantiate this finding.

Question 16Quality Management System (ISO 9001) Auditing

A lead auditor is compiling the audit team and must ensure the team can objectively audit the accounts payable process. Which situation would most clearly compromise the team's impartiality?

  1. A team member previously audited a different process in the same department
  2. A team member has never worked in the finance function
  3. A team member completed auditor training six months ago
  4. A team member was responsible for managing the accounts payable process within the past year Correct answer.

Explanation

Impartiality requires that auditors are not auditing their own work. A team member who recently managed the process being audited would be evaluating their own prior decisions, which compromises objectivity. Recent training, lack of finance experience, or auditing a different process do not create the same conflict.

Question 17Quality Management System (ISO 9001) Auditing

An organization claims certification to ISO 9001:2015 but has excluded clause 8.3 Design and development, stating it is 'not applicable.' Which condition must be met for this exclusion to be acceptable?

  1. The organization must still perform design verification even if it does not design products
  2. The organization must obtain written permission from every customer
  3. The organization must exclude the entire clause 8 from its QMS scope
  4. The organization must justify that design and development requirements are not applicable and that this does not affect its ability to ensure conforming products and services Correct answer.

Explanation

ISO 9001:2015 permits determining that a requirement is not applicable only when it does not affect the organization's ability to ensure the conformity of its products and services or enhance customer satisfaction, and the justification must be maintained as documented information. Exclusions must be limited to clause 8 requirements and properly justified.

Question 18Quality Management System (ISO 9001) Auditing

Which activity is the best example of an auditor verifying the effectiveness of a corrective action rather than merely its implementation?

  1. Reviewing subsequent production and complaint records to confirm the problem has not recurred Correct answer.
  2. Checking that the corrective action form has a completion date
  3. Verifying that the responsible manager attended a meeting
  4. Confirming that a new procedure was written and signed

Explanation

Effectiveness means the action achieved the intended result and the nonconformity no longer occurs or its recurrence is controlled. Reviewing later records for recurrence tests effectiveness, whereas confirming documents, dates, or attendance only shows that actions were taken.

Question 19Quality Management System (ISO 9001) Auditing

An auditor observes that a measuring instrument used to accept final product has an expired calibration label. Which clause is the most appropriate basis for the finding?

  1. Clause 8.3.4 Design and development controls
  2. Clause 7.1.5 Monitoring and measuring resources Correct answer.
  3. Clause 8.6 Release of products and services
  4. Clause 7.1.4 Environment for the operation of processes

Explanation

Clause 7.1.5 requires measuring equipment to be calibrated or verified at specified intervals, or prior to use, against measurement standards traceable to international or national standards. Using equipment with expired calibration is a direct failure of that requirement.

Question 20Quality Management System (ISO 9001) Auditing

A lead auditor is preparing to audit a remote warehouse using a video walkthrough and shared screen review of records. Which consideration is most important to ensure the evidence remains reliable?

  1. Avoiding any sampling and reviewing every record shown on screen
  2. Relying only on the auditee's verbal descriptions of the warehouse
  3. Increasing the number of questions asked to compensate for the lack of physical presence
  4. Confirming the identity of locations and records observed and ensuring connectivity and recording integrity Correct answer.

Explanation

When using information and communication technology, auditors must verify that the technology supports reliable evidence, including confirming identities, locations, and the integrity of records observed. Verbal descriptions alone or indiscriminate full review do not substitute for verified, representative evidence.

Question 21Quality Management System (ISO 9001) Auditing

An organization's management review records show discussion of audit results and customer feedback, but no consideration of the status of actions from previous management reviews or changes in external and internal issues. Which clause requirement is unmet?

  1. Clause 9.1.3 Analysis and evaluation
  2. Clause 10.2 Nonconformity and corrective action
  3. Clause 9.3.3 Management review outputs
  4. Clause 9.3.2 Management review inputs Correct answer.

Explanation

Clause 9.3.2 lists the required inputs to management review, which include the status of actions from previous management reviews and changes in external and internal issues relevant to the QMS. Omitting these inputs means the review does not meet the input requirements.

Question 22Quality Management System (ISO 9001) Auditing

An auditor is evaluating whether the organization has determined the knowledge necessary for the operation of its processes. Which situation would most likely indicate a gap against clause 7.1.6?

  1. The organization maintains a documented quality policy
  2. A long-serving specialist retired and no records or arrangements were made to retain the specialist's process knowledge Correct answer.
  3. The organization conducts annual customer surveys
  4. The organization uses a shared drive to store work instructions

Explanation

Clause 7.1.6 requires the organization to determine the knowledge necessary for its processes and to maintain and make it available as needed. Losing critical knowledge when a specialist leaves, without arrangements to retain it, indicates a failure to address that requirement.

Question 23Quality Management System (ISO 9001) Auditing

During an audit, the auditor notices that the organization's quality policy is displayed but staff cannot explain how it relates to their work. Which aspect of clause 5.2 is most directly at issue?

  1. The policy must be communicated, understood and applied within the organization Correct answer.
  2. The policy must be written in every employee's native language
  3. The policy must be reviewed annually by the certification body
  4. The policy must contain measurable targets for each department

Explanation

Clause 5.2.2 requires the quality policy to be available and communicated, understood and applied within the organization. Display alone does not demonstrate understanding and application, so staff being unable to relate the policy to their work points to that requirement.

Question 24Quality Management System (ISO 9001) Auditing

An audit team finds that a nonconformity from a previous internal audit was marked 'closed' after the responsible department submitted a corrective action plan. No evidence of implementation was reviewed. What is the most significant weakness in the audit follow-up?

  1. The corrective action plan was submitted in writing
  2. The department was allowed to propose its own corrective action
  3. The nonconformity was recorded in the internal audit report
  4. Closure was based on a plan rather than verified implementation and effectiveness of the action Correct answer.

Explanation

Follow-up should verify that corrective actions were implemented and effective, not merely that a plan exists. Closing a nonconformity on the basis of a plan leaves the actual correction unverified and risks recurrence.

Question 25Quality Management System (ISO 9001) Auditing

A lead auditor is deciding whether a situation should be classified as a major or minor nonconformity during a certification audit. Which factor is most relevant to that judgement?

  1. Whether the auditee has previously received any nonconformities in other domains
  2. Whether the finding was identified in the morning or afternoon session
  3. Whether the responsible employee has been with the organization for less than one year
  4. Whether the failure affects the capability of the management system to achieve its intended results, considering the nature and extent of the failure Correct answer.

Explanation

Grading a nonconformity depends on the nature and extent of the failure and its effect on the management system's ability to achieve intended results. It is a professional judgement about significance, not about unrelated history, employee tenure, or the timing of the observation.

Question 26Quality Management System (ISO 9001) Auditing

Which ISO 9001:2015 clause requires the organization to plan actions to address risks and opportunities and to evaluate the effectiveness of those actions?

  1. Clause 8.5.1
  2. Clause 9.2
  3. Clause 7.1.5
  4. Clause 6.1 Correct answer.

Explanation

Clause 6.1 requires the organization to determine the risks and opportunities that need to be addressed, plan actions for them, and evaluate the effectiveness of those actions. It sits within the planning section of the standard, linking context and objectives to preventive thinking. The other clauses address resources, production control, and internal audit respectively.

Question 27Quality Management System (ISO 9001) Auditing

During an audit an operator shows the auditor a work instruction that is current, available at the point of use, and matches the revision in the document register. Which requirement is being directly satisfied?

  1. Competence of personnel
  2. Control of documented information Correct answer.
  3. Customer communication
  4. Control of nonconforming outputs

Explanation

Clause 7.5 requires documented information to be available and suitable for use where and when it is needed, and to be controlled against unintended changes. A current revision at the point of use is the classic evidence of that control. The other options relate to different clauses and are not demonstrated by this observation.

Question 28Quality Management System (ISO 9001) Auditing

Which statement correctly describes the purpose of an internal audit under ISO 9001:2015?

  1. To identify which employees should be disciplined for process failures
  2. To verify that every product leaving the plant has been inspected by a competent person
  3. To determine whether the QMS conforms to the organization's own requirements and is effectively implemented and maintained Correct answer.
  4. To satisfy the certification body so that external audits can be reduced in scope

Explanation

Clause 9.2 requires internal audits to determine whether the QMS conforms to the organization's own requirements and to the standard, and whether it is effectively implemented and maintained. It is a conformity and effectiveness tool, not a product inspection or disciplinary mechanism. Planning must consider process importance, changes, and previous results.

Question 29Quality Management System (ISO 9001) Auditing

An auditor is checking that the organization has determined the boundaries and applicability of its quality management system. Which element of the standard is being examined?

  1. Quality policy
  2. Scope of the quality management system Correct answer.
  3. Organizational roles and responsibilities
  4. Management review inputs

Explanation

Clause 4.3 requires the organization to determine the boundaries and applicability of the QMS to establish its scope, considering external and internal issues, interested parties, and its products and services. The scope must be available as documented information. The other elements concern policy, roles, and review inputs.

Question 30Quality Management System (ISO 9001) Auditing

Which of the following is the best evidence that top management has ensured quality objectives are compatible with the strategic direction of the organization?

  1. Objectives are established for relevant functions and are consistent with the policy and strategic plans discussed in management review Correct answer.
  2. Objectives are reviewed once every five years
  3. Objectives are written on a poster in the reception area
  4. Objectives are set only for the quality department

Explanation

Clause 6.2 requires quality objectives to be consistent with the quality policy and relevant to product and service conformity and enhancement. Evidence of alignment with strategic direction appears when objectives are set for relevant functions and linked to policy and business planning. Posters, single-department targets, and infrequent review do not demonstrate that alignment.

Question 31Quality Management System (ISO 9001) Auditing

An auditor wants to confirm that the organization has determined the knowledge necessary for the operation of its processes and has made it available. Which clause should the auditor reference in the finding if this is missing?

  1. Clause 7.1.6 Correct answer.
  2. Clause 7.2
  3. Clause 7.5
  4. Clause 7.4

Explanation

Clause 7.1.6 addresses organizational knowledge, requiring the organization to determine the knowledge necessary for its processes and to maintain and make it available. Clause 7.2 is about competence, 7.4 about communication, and 7.5 about documented information. The distinction matters because knowledge is broader than individual competence.

Question 32Quality Management System (ISO 9001) Auditing

Which of the following best describes the difference between a correction and a corrective action?

  1. A correction eliminates the cause, while a corrective action eliminates the detected nonconformity
  2. A correction is recorded only by the certification body, while a corrective action is recorded internally
  3. A correction is always more expensive than a corrective action
  4. A correction eliminates the detected nonconformity, while a corrective action eliminates the cause so the nonconformity does not recur Correct answer.

Explanation

Clause 10.2 distinguishes correction, which deals with the immediate nonconformity, from corrective action, which addresses the root cause to prevent recurrence. Effective corrective action typically includes reviewing the nonconformity, determining causes, and reviewing the effectiveness of action taken. Cost and who records the action are not part of the definition.

Question 33Quality Management System (ISO 9001) Auditing

An auditor observes that the organization has identified its interested parties and their relevant requirements but has not decided which of those requirements it will monitor and review. Which clause is most directly relevant?

  1. Clause 8.2
  2. Clause 5.1
  3. Clause 6.3
  4. Clause 4.2 Correct answer.

Explanation

Clause 4.2 requires the organization to determine relevant interested parties and the relevant requirements of those parties, and to monitor and review information about them. Failing to decide what to monitor and review is a gap against that clause. The other clauses concern leadership, change planning, and customer requirements respectively.

Question 34Quality Management System (ISO 9001) Auditing

A process owner tells the auditor that the process was changed three months ago but no one assessed whether the change affected the QMS or its resources. Which requirement has most likely not been met?

  1. Clause 6.3 planning of changes Correct answer.
  2. Clause 8.4 control of externally provided processes
  3. Clause 7.4 communication
  4. Clause 9.1.2 customer satisfaction

Explanation

Clause 6.3 requires changes to the QMS to be carried out in a planned manner, considering purpose, consequences, integrity, resources, and allocation of responsibilities. A change made without assessing its effect on the system and resources is a gap against that clause. The other clauses address external providers, customer satisfaction, and communication.

Question 35Quality Management System (ISO 9001) Auditing

An auditor finds that the organization's monitoring and measuring equipment register lists an instrument as calibrated, but the calibration certificate on file is for a different serial number. What is the most appropriate characterization?

  1. A nonconformity against clause 7.1.5 because the equipment is not demonstrably fit for purpose and traceable Correct answer.
  2. A nonconformity against clause 8.5.1 because production was not controlled
  3. An observation only, because calibration certificates are not required records
  4. A nonconformity against clause 9.1.1 because monitoring was not planned

Explanation

Clause 7.1.5 requires measuring equipment to be calibrated or verified at specified intervals, identified to enable determination of status, and safeguarded from misuse. A certificate that does not match the instrument means the calibration status is not reliably demonstrated, which is a nonconformity. The other clauses do not directly address measurement traceability.

Question 36Quality Management System (ISO 9001) Auditing

An auditor is reviewing the organization's process map and notes that outsourced heat treatment is described as a 'support activity' and is not controlled under clause 8.4. What should the auditor conclude?

  1. The process is covered only by clause 7.1.3 infrastructure
  2. The process is externally provided and must be controlled under clause 8.4 regardless of how it is labelled Correct answer.
  3. The process must be brought in-house before certification
  4. The process is exempt because it is described as support

Explanation

Clause 8.4 applies to externally provided processes, products, and services, and the organization must determine the controls to apply when it outsources processes that affect conformity. Internal labels such as 'support activity' do not remove the requirement. The auditor should follow the actual process and its effect on product conformity.

Question 37Quality Management System (ISO 9001) Auditing

During the opening meeting, the lead auditor should confirm which of the following?

  1. The names of employees who will be disciplined if findings are raised
  2. The certification decision that will be made at the end of the audit
  3. The audit plan, the audit criteria and scope, and the communication arrangements for the audit Correct answer.
  4. The auditor's personal opinion of the organization's management style

Explanation

An opening meeting confirms the audit plan, criteria, scope, team, schedule, and communication arrangements, and gives the auditee an opportunity to ask questions. It does not predetermine certification outcomes or personnel consequences. Auditors should also remind participants of confidentiality and sampling limitations.

Question 38Quality Management System (ISO 9001) Auditing

Which of the following best describes the auditor's responsibility when evidence gathered during sampling suggests a possible nonconformity?

  1. Verify the evidence against the audit criteria, gather additional evidence if needed, and record the finding objectively Correct answer.
  2. Ignore it if the sample size was small
  3. Report the finding immediately to the certification body before discussing it with the auditee
  4. Record it as a major nonconformity in all cases

Explanation

Auditors must evaluate evidence against the audit criteria and ensure findings are supported before recording them. Additional sampling or verification may be needed to confirm the pattern. Findings should be discussed with the auditee and stated factually, and classification as major or minor depends on the significance and effect.

Question 39Quality Management System (ISO 9001) Auditing

An organization's quality policy is available to relevant interested parties, but the auditor finds that employees in two departments cannot describe how their work contributes to the policy. What is the most appropriate finding?

  1. Nonconformity against clause 7.5 because the policy is not a controlled document
  2. Nonconformity against clause 9.3 because management review did not cover the policy
  3. Nonconformity against clause 5.2 because the policy is not communicated, understood, and applied within the organization Correct answer.
  4. Observation only, because the policy is displayed

Explanation

Clause 5.2 requires the quality policy to be communicated, understood, and applied within the organization, and available to relevant interested parties. Display alone does not demonstrate understanding and application, so the gap is against clause 5.2. The other clauses concern document control and management review, which are not the primary issue here.

Question 40Quality Management System (ISO 9001) Auditing

An auditor is planning a process audit of the maintenance function. Which approach best reflects a process-based audit?

  1. Audit each clause of the standard in numerical order with the maintenance manager
  2. Follow the process from inputs through activities to outputs, examining interfaces, performance indicators, and risks Correct answer.
  3. Interview only the maintenance manager and review the last audit report
  4. Check that a maintenance procedure exists and move on

Explanation

A process-based audit examines how a process transforms inputs into outputs, how it interacts with other processes, and how its performance is monitored and improved. It considers risks, indicators, and interfaces rather than walking through clauses mechanically. Document existence alone does not demonstrate process effectiveness.

Question 41Quality Management System (ISO 9001) Auditing

Which of the following is the most appropriate way for a lead auditor to address a conflict of interest involving a team member who previously worked for the auditee in the area being audited?

  1. Ask the auditee to sign a waiver accepting the risk
  2. Let the team member audit only the areas they know best
  3. Keep the assignment but note the conflict in the report
  4. Reassign the team member to another area or remove them from the audit to preserve objectivity Correct answer.

Explanation

Auditors must be objective and impartial, and a recent working relationship with the auditee in the area under audit creates a conflict. The lead auditor should reassign or remove the person so that objectivity is not compromised. Noting the conflict or obtaining a waiver does not remove the underlying risk to impartiality.

Question 42Quality Management System (ISO 9001) Auditing

An auditor is reviewing a nonconformity report and finds that the root cause analysis states 'operator error' and the action is 'retrain the operator'. Which comment is most appropriate?

  1. The action is adequate because retraining always prevents recurrence
  2. The finding should be upgraded to a major nonconformity automatically
  3. The analysis is superficial because it does not examine systemic causes such as procedures, work design, or supervision Correct answer.
  4. The report should be closed because the operator was retrained

Explanation

Corrective action requires determining the cause of the nonconformity and addressing it so it does not recur. Attributing the issue solely to operator error often misses systemic causes such as unclear instructions, inadequate resources, or process design. Retraining alone may not prevent recurrence if the underlying cause remains.

Question 43Quality Management System (ISO 9001) Auditing

During an audit, the auditee asks the auditor to provide advice on how to redesign a process so that it will conform. How should the auditor respond?

  1. Provide a detailed redesign plan to help the auditee pass the next audit
  2. Decline to provide consultancy and explain that the auditor can report findings and criteria but cannot design the solution Correct answer.
  3. Ask the auditee to sign a confidentiality agreement so advice can be given
  4. Recommend a specific software vendor to automate the process

Explanation

Auditors must remain independent of the activity being audited and should not provide consultancy that could compromise impartiality, particularly in third-party audits. The auditor can explain the finding and the criteria but the organization must determine and implement the solution. Offering a redesign plan or vendor recommendation crosses into consultancy.

Question 44Quality Management System (ISO 9001) Auditing

An auditor is reviewing the organization's management review records and finds that inputs include audit results and customer satisfaction but there is no evidence of consideration of the status of actions from previous management reviews. Which clause is most directly relevant?

  1. Clause 9.3 Correct answer.
  2. Clause 9.2
  3. Clause 10.1
  4. Clause 9.1

Explanation

Clause 9.3 specifies the inputs that management review must consider, including the status of actions from previous management reviews. A missing input is a gap against that clause. Clause 9.1 covers monitoring and measurement, 9.2 internal audit, and 10.1 improvement in general.

Question 45Quality Management System (ISO 9001) Auditing

A lead auditor is deciding whether to report a situation as a major nonconformity. Which consideration is most relevant?

  1. Whether the auditee has had any previous major nonconformities in the last five years
  2. Whether the nonconformity was found in the first hour of the audit
  3. Whether the auditee agrees with the classification
  4. Whether the nonconformity affects the capability of the QMS to achieve intended results and whether the system has failed to ensure controlled processes Correct answer.

Explanation

Classification as major generally depends on the significance of the nonconformity, such as a system failure, an unaddressed requirement affecting product or service conformity, or a situation that raises doubt about the QMS's ability to achieve intended results. History, timing, and auditee agreement are not the deciding criteria, although they may inform context.

Question 46Quality Management System (ISO 9001) Auditing

An auditor is examining how the organization controls production changes. The production manager explains that engineering changes are implemented on the line as soon as they are received by email. What is the most significant audit concern?

  1. Email is not an acceptable communication method under clause 7.4
  2. Engineering changes should always be approved by the customer
  3. Changes are not being reviewed and controlled before implementation, so conformity of outputs may be affected Correct answer.
  4. Production should stop until the audit is complete

Explanation

Clause 8.5.6 requires the organization to review and control changes for production or service provision to the extent necessary to ensure continuing conformity with requirements. Implementing changes immediately without review or authorization risks nonconforming outputs. Email itself is not prohibited, and customer approval is only required where specified.

Question 47Quality Management System (ISO 9001) Auditing

An auditor finds that two internal audit reports for the same process were conducted by the process owner using a checklist that covers only document control. What is the most significant weakness in the audit programme?

  1. The checklist was too long for the available time
  2. The audits lack independence and do not cover the full scope of the process against the standard Correct answer.
  3. The process owner did not use a software tool
  4. The reports were issued in the wrong language

Explanation

Clause 9.2 requires auditors to be objective and impartial, and the audit programme must cover the full scope and criteria. A process owner auditing their own process lacks independence, and a checklist limited to document control does not evaluate conformity of the process against the standard. These are systemic weaknesses in the programme.

Question 48Quality Management System (ISO 9001) Auditing

A lead auditor is reviewing evidence that a supplier of a safety-critical component was approved, but the approval was based only on the supplier's self-declaration and no verification of the supplier's process controls was performed. Which conclusion is most defensible?

  1. The organization has not applied proportionate controls based on the potential impact of the externally provided product Correct answer.
  2. The finding should be raised against clause 7.1.6 organizational knowledge
  3. The supplier must be replaced immediately
  4. The organization has conformed because a self-declaration is always sufficient

Explanation

Clause 8.4 requires the organization to apply criteria for evaluation, selection, monitoring of performance, and re-evaluation of external providers, and to determine controls proportionate to the potential impact on the ability to meet requirements. For a safety-critical component, reliance on self-declaration alone may be insufficient. The auditor should evaluate whether the controls match the risk.

Question 49Quality Management System (ISO 9001) Auditing

During an audit, an auditee provides a procedure that is being followed, but the auditor notices that the procedure conflicts with a mandatory requirement of ISO 9001. How should the auditor treat this?

  1. Accept the situation because the organization is following its own procedure
  2. Report it only as an opportunity for improvement
  3. Ignore the conflict because the procedure is internally controlled
  4. Raise a nonconformity because following an inadequate procedure does not demonstrate conformity with the standard Correct answer.

Explanation

Audit criteria include the standard as well as the organization's own requirements. A procedure that conflicts with a mandatory ISO 9001 requirement cannot demonstrate conformity, even if it is consistently followed. The auditor should raise a nonconformity and cite the relevant requirement.

Question 50Quality Management System (ISO 9001) Auditing

An auditor is evaluating whether the organization has effectively implemented actions to address risks and opportunities. Which evidence would be most convincing?

  1. A list of risks prepared once at the start of the certification cycle
  2. A statement in the quality manual that risks are managed
  3. A risk workshop attended by top management without follow-up
  4. Records showing that planned actions were implemented, monitored through indicators, and evaluated for effectiveness Correct answer.

Explanation

Clause 6.1 requires the organization to plan actions to address risks and opportunities and to evaluate the effectiveness of those actions. Convincing evidence links planned actions to implementation, monitoring, and evaluation of results. A one-time list, a policy statement, or an unfollowed workshop does not demonstrate effectiveness.