Auditor Qualification Examination cheat sheet

ISO 9001:2015 has 10 clauses: 1 Scope, 2 Normative references, 3 Terms and definitions, 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement; clauses 4-10 contain auditable requirements.

Only clauses 4-10 are auditable requirements; clauses 1-3 are informational. Audit evidence must be recorded against a specific requirement of clauses 4-10.

Seven quality management principles: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision-making, relationship management.

Documented information is the only retained-document term in the 2015 edition; 'records' and 'documents' as separate categories were replaced. Two rules apply: maintain (procedures) and retain (records).

Risk-based thinking is implicit across the standard, not a separate clause; clause 6.1 requires determining risks and opportunities and planning actions, with evaluation of effectiveness in 9.3.2.

Process approach audit trail: identify process inputs/outputs, sequence and interaction (4.4), performance indicators, resources, and assigned responsibility and authority.

Nonconformity grading: major = systemic failure or absence of an effective control; minor = isolated lapse not indicating system breakdown. Both require correction, root-cause analysis, and corrective action (10.2).

Audit sampling rule: sample size is a judgement based on risk, complexity, and prior performance; no fixed numeric sample is mandated by ISO 9001 or ISO 19011.

Certification audit sequence under ISO/IEC 17021-1: Stage 1 (readiness, documentation, context) then Stage 2 (implementation effectiveness); surveillance at least once per calendar year, recertification before expiry.

ISO 45001:2018 replaced OHSAS 18001; it uses the Annex SL high-level structure with clauses 4-10 auditable, and requires top management accountability for OH&S performance.

Hierarchy of controls (clause 8.1.2): eliminate the hazard, substitute, engineering controls and reorganization of work, administrative controls including training, then PPE. PPE is the last resort.

Worker participation and consultation (clause 5.4) is a mandatory auditable requirement: workers must be consulted on hazard identification, risk assessment, incident investigation, and OH&S decisions.

Hazard identification (6.1.2.1) must consider routine and non-routine activities, emergency situations, human factors, past incidents, and work organization, social factors, and leadership.

Legal and other requirements (6.1.3) must be determined, accessible, and evaluated for compliance; compliance evaluation results are a required input to management review (9.3).

Incident, nonconformity and corrective action (10.2) requires reporting, investigating, and acting on incidents and near misses, with timeliness and worker involvement.

Emergency preparedness (8.2) requires planned response, testing of planned responses, and evaluation and revision after tests or actual events.

Contractor and outsourcing control (8.1.4): the organization must coordinate with contractors and ensure outsourced processes meet OH&S requirements; control is retained by the organization.

Audit evidence for OH&S must include operational control observations, not just documents: permits to work, isolation/lockout, PPE use, and emergency drills.

ISO 14001:2015 structure: clauses 4-10 auditable; environmental management is built on the plan-do-check-act cycle and requires a documented environmental policy (5.2).

Environmental aspects (6.1.2): determine aspects and associated impacts from activities, products, and services that the organization can control or influence, considering life-cycle perspective.

Compliance obligations (6.1.3) replaces 'legal and other requirements'; the organization must determine and have access to compliance obligations and evaluate fulfilment (9.1.2).

Significant environmental aspects must be communicated within the organization and, where appropriate, to interested parties; they drive operational controls (8.1) and monitoring (9.1).

Life-cycle perspective (6.1.2 and 8.1) requires consideration of raw material acquisition, design, production, transport/delivery, use, end-of-life treatment, and final disposal, proportionate to the organization's control and influence.

Emergency preparedness and response (8.2): identify potential emergency situations, plan responses, test them, and review after tests or incidents.

Monitoring and measurement (9.1.1) requires calibrated or verified monitoring equipment, documented evidence of calibration, and evaluation of environmental performance.

Nonconformity and corrective action (10.2) must address the environmental impact of the nonconformity and evaluate the need to prevent recurrence; records retained as documented information.

Auditor competence for 14001 includes knowledge of environmental aspects/impacts, legal frameworks, and sector-specific significant aspects; ISO 19011 governs audit programme management.

ISO 22000:2018 applies the high-level structure and the PDCA cycle at two levels: the management system and the operational food safety (HACCP) level.

Prerequisite programmes (PRPs) are selected and implemented per ISO/TS 22002-1 for food manufacturing; PRPs provide the hygienic base before HACCP controls.

HACCP steps in ISO 22000: assemble the food safety team, describe product and intended use, construct flow diagrams, verify flow diagrams on site, analyse hazards, determine control measures, and establish OPRPs and CCPs.

Two control categories: OPRP = control measure applied to prevent significant food safety hazard contamination or proliferation, without a critical limit; CCP = control measure with a critical limit and a validated critical limit.

Critical limits must be measurable and validated; monitoring at CCPs must be continuous or at a defined frequency, and corrective action must be taken when a critical limit is exceeded.

Food safety hazard analysis (8.5.2) must consider biological, chemical, and physical hazards, plus allergens and radiological hazards, and the intended use and vulnerable groups.

Verification (8.8) confirms that PRPs and HACCP plan are implemented and effective; validation (8.5.3) confirms that control measures are capable of achieving the intended hazard control before implementation.

Withdrawal and recall (8.9.5): the organization must have a documented procedure, test it at least annually or as specified, and retain records of withdrawals and recalls.

Traceability (8.3) requires a system to identify lots and link raw materials to finished product and distribution; records must be retained for the shelf-life period plus a defined retention period.

ISO 9001:2015 has 10 clauses: 1 Scope, 2 Normative references, 3 Terms and definitions, 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement; clauses 4-10 contain auditable requirements.

Only clauses 4-10 are auditable requirements; clauses 1-3 are informational. Audit evidence must be recorded against a specific requirement of clauses 4-10.

Seven quality management principles: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision-making, relationship management.

Documented information is the only retained-document term in the 2015 edition; 'records' and 'documents' as separate categories were replaced. Two rules apply: maintain (procedures) and retain (records).

Risk-based thinking is implicit across the standard, not a separate clause; clause 6.1 requires determining risks and opportunities and planning actions, with evaluation of effectiveness in 9.3.2.

Process approach audit trail: identify process inputs/outputs, sequence and interaction (4.4), performance indicators, resources, and assigned responsibility and authority.

Nonconformity grading: major = systemic failure or absence of an effective control; minor = isolated lapse not indicating system breakdown. Both require correction, root-cause analysis, and corrective action (10.2).

Audit sampling rule: sample size is a judgement based on risk, complexity, and prior performance; no fixed numeric sample is mandated by ISO 9001 or ISO 19011.

Certification audit sequence under ISO/IEC 17021-1: Stage 1 (readiness, documentation, context) then Stage 2 (implementation effectiveness); surveillance at least once per calendar year, recertification before expiry.