Quality Management System (ISO 9001) Auditing
The Quality Management System (ISO 9001) Auditing domain tests whether you can plan, conduct, report and follow up an audit against ISO 9001:2015 using ISO 19011:2018 principles and, for certification, ISO/IEC 17021-1 requirements. Questions stress evidence-based conclusions, process thinking and the distinction between conformity, effectiveness and improvement.
Core rules and concepts
An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it against audit criteria. The audit plan fixes objective, scope, criteria, methods, sampling and roles; the audit trail must link each conclusion to a requirement and to recorded evidence.
- Principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based and risk-based approaches (ISO 19011). Internal auditors must not audit their own work.
- Process approach: trace inputs, activities, outputs, interfaces and performance measures across ISO 9001 clauses 4–10. Interview process owners and test effectiveness, not merely document existence.
- Evidence: interviews, observation and document/record review. Record source, sample and what was verified. A sample supports a population conclusion only if planned and representative; hearsay and opinion are not objective evidence.
- Findings: state requirement, evidence and location. A nonconformity is a failure to meet a requirement; severity depends on the scheme. Correction fixes the immediate problem; corrective action removes the cause; follow-up verifies implementation and effectiveness.
- Reporting: report against criteria and scope, avoid prescribing solutions, and retain records.
Worked example
An internal auditor audits clause 8.5.1 in a machining cell. The lathe work instruction is revision C; the controlled-document register shows revision D. The operator says he was never trained on D and continues to use C. Five completed parts conform. The objective evidence is the revision mismatch and the operator statement; criteria are ISO 9001 8.5.1 and the document-control procedure. Conforming parts do not cancel the nonconformity because control of documented information and competence are ineffective at that point. If only this cell is affected, record a minor nonconformity; if revision D was released plant-wide without training, treat it as systemic and likely major. Require correction (replace the instruction, assess affected product) and corrective action (why release and training failed).
Traps
Common mark-losers: auditing documents rather than processes; leading questions (“You do calibrate, don’t you?”); accepting explanation as evidence; sampling only convenient records; writing a nonconformity without requirement or objective evidence; confusing correction with corrective action; closing a finding without verifying effectiveness; and scope creep.