ISO 9001 LA common mistakes
ISO 9001 LA · Understand the traps and how to avoid them.
When asked how the process approach or PDCA affects audit planning, the candidate recites the clause titles of ISO 9001 clauses 4–10 in order instead of describing how to trace a process's inputs, outputs, sequence and interaction with other processes, its performance indicators and its risks.
Exam preparation is often reduced to memorising the structure of the standard, so the clause list becomes the only mental model available; the candidate has never practised converting the process approach into audit activity.
What to do instead
Rehearse a one-page 'process walk': for any process, state its inputs, outputs, interactions, owner, KPIs, risks and the clauses most likely to yield evidence, and practise this aloud for three processes (e.g. purchasing, production, calibration) until the walk, not the clause list, is the first thing that comes to mind.
Raising nonconformity or stating as a requirement that the organisation must have a quality manual, six mandatory documented procedures, a management representative, or a preventive action procedure.
A large share of study material and candidate experience predates ISO 9001:2015, and the 2008 structure is heavily over-learned, so it leaks into answers under time pressure.
What to do instead
Build a one-page list of what the 2015 standard actually requires as documented information (e.g. scope 4.3, quality policy 5.2, objectives 6.2, and the 'retain' items in 8.5.6, 8.7, 9.2, 9.3, 10.2) and, before writing any finding, check the text of the clause cited for the word 'shall' and for 'documented information'.
Treating clause 6.1 as requiring a documented risk register, a formal risk-assessment method, or a procedure linking risks to every process, and then writing a nonconformity when no such register exists.
Risk management frameworks from other disciplines (ISO 31000, enterprise risk registers) are familiar and feel authoritative, so the candidate imports requirements that ISO 9001 does not state.
What to do instead
Memorise the exact wording and intent of 6.1: the organisation must plan actions to address risks and opportunities, integrate and implement them into QMS processes, and evaluate their effectiveness - no documented risk register is required; practise writing audit questions about how risks were determined for a named process rather than about the existence of a document.
Confusing the status of different source documents - for example citing a paragraph of ISO 19011 as if it were a certifiable requirement, or imposing ISO/IEC 17021-1 certification-body obligations on an organisation's internal audit process.
Both documents are used in the same course and contain overlapping language; the candidate memorises content without tagging which document it comes from and who it binds.
What to do instead
Label every fact learned with its source and addressee (ISO 9001 = requirements on the organisation; ISO 19011 = guidance for auditors and audit programmes; ISO/IEC 17021-1 = requirements on certification bodies), and in multiple-choice items first ask 'who is being required to do this?' before selecting.
Producing an audit plan that is a clause-by-clause timetable (4.1 at 09:00, 4.2 at 09:30 …) with no process coverage, no sampling rationale, no assignment of auditor responsibility per area, and no explicit statement of objectives, scope and criteria.
Clause-structured plans are easy to generate and look thorough, and candidates under time pressure default to the visible structure of the standard rather than to the auditee's real processes.
What to do instead
Use the fixed plan skeleton: objectives, scope (with justification of any exclusion and treatment of outsourced processes), criteria (ISO 9001 plus applicable statutory/regulatory and the organisation's own requirements), audit team and areas with times, and a sampling note; then map processes onto that skeleton and check that every clause is covered through a process, not as a stand-alone slot.
Writing a nonconformity as a conclusion - e.g. 'the purchasing process is not effective' or 'clause 8.4 is not complied with' - with no specific requirement quoted and no objective evidence (document, record, observation, interview result) that another person could re-verify.
The candidate knows something is wrong but writes the judgement rather than the evidence chain, often because the evidence was never recorded at the time it was seen.
What to do instead
Force every finding through the three-part template 'Requirement (quoted shall) + Evidence (what was seen, where, when, sample size) + Significance (why it matters)', and refuse to write a finding until the evidence line is complete; practise retro-fitting five findings into this template.
Accepting a verbal assurance ('yes, we always do that', 'training is done annually') as sufficient evidence and closing the trail there, without asking for the record, observing the activity, or stating how the sample was selected.
Interviews are the fastest evidence source and auditees' confident answers feel conclusive; candidates also fear the awkwardness of asking for proof.
What to do instead
Adopt the rule 'statement → request the objective evidence → follow one item through to its output' and always verbalise the sampling basis (e.g. 'of 12 purchase orders sampled, 3 were traced to receiving records'); treat interviews as pointers only, never as the finding itself.
Misgrading findings: raising every nonconformity as major, or conversely recording a systemic breakdown (the same failure across several processes or a total absence of a required activity) as minor with no rationale.
Candidates look for a numerical rule ('three minors make a major') that does not exist, and grading requires judgement about the effect on the management system, which is harder than spotting the issue.
What to do instead
Anchor grading on the consequence, not the count: major where the requirement is not implemented at all, where the system fails to ensure the conformity of outputs or the intended results, or where there is doubt that effective correction is possible; minor where it is an isolated lapse within a working system - and always write one sentence of justification next to the grade.
Closing a nonconformity by confirming that the correction was made (the document was re-issued, the batch re-inspected) and treating that as verification of corrective action, or accepting 'operator error, retrained the operator' as the completed root-cause analysis.
Correction is visible and easy to evidence, while effectiveness takes time and a second look; 'human error' is the most commonly offered cause and the easiest to accept.
What to do instead
For each nonconformity ask two separate questions - 'has the correction removed the specific problem?' and 'what evidence shows the cause was eliminated and the problem has not recurred?' - and challenge any cause statement that stops at the person by asking what in the process allowed the error to occur and go undetected.
Treating the audit programme and the audit plan as the same thing, or assuming a fixed rule such as 'one full internal audit of all clauses every year' and ignoring risk, change, performance data and auditor competence when scheduling.
In everyday language both are called 'the audit', and the belief in a mandated annual full-scope audit is widespread (it derives from older practice, not from clause 9.2).
What to do instead
Keep the two-level picture explicit - programme = objectives, extent, frequency, methods, auditor competence and resources over time, reviewed and improved; plan = the logistics of one audit - and be able to state three inputs that should change frequency or scope: process risk and importance, changes, and results of previous audits and monitoring data.