Auditor Qualification Examination common mistakes
Auditor Qualification Examination · Understand the traps and how to avoid them.
When asked to classify a nonconformity, the candidate cites the clause number from memory (for example '7.1.5') without quoting the requirement text or explaining how the objective evidence fails to meet it, so the answer names a clause but never establishes the gap.
Candidates memorise the clause architecture of ISO 9001 as a numbering scheme and treat correct numbering as the answer, because revision courses and internal audits often emphasise 'finding the right clause' rather than building the evidence-to-requirement argument.
What to do instead
Practise writing findings in a fixed three-part structure: (1) the requirement, quoted or closely paraphrased with its clause number; (2) the objective evidence observed, stated factually with what was sampled; (3) the gap, one sentence explaining why the evidence does not satisfy the requirement. Do ten of these per domain against real or invented scenarios until the structure is automatic.
The candidate writes a nonconformity for a missing record when the organisation has an effective alternative, or conversely accepts 'we do it informally' as conformity, without checking whether the standard actually mandates a documented record at that point.
ISO 9001:2015 deliberately reduced mandatory documented procedures and uses 'documented information' selectively; candidates trained on the 2008 version, or on internal procedures that over-document, confuse 'our procedure says so' with 'the standard requires so'.
What to do instead
Build a personal table of every clause in ISO 9001 that explicitly requires 'documented information' (retain or maintain) versus clauses that only require the activity to be planned and controlled. Audit against the standard first, then against the organisation's own documented information as a second step, and state clearly which of the two is the basis of any finding.
The candidate treats top management interview answers as sufficient evidence of leadership and commitment, recording 'management is committed' without tracing commitment to decisions, resources, or the outputs of management review.
Leadership (clause 5) is the least concrete requirement in ISO 9001, and candidates default to interviewing the most senior available person and accepting assertions, because pressing for evidence feels confrontational and the requirement is hard to observe directly.
What to do instead
Convert clause 5 into observable evidence: minutes and decision records from management review, resource allocation decisions (budget, headcount, training), the quality policy's actual communication and availability, assignment of roles and responsibilities, and actions taken on audit results. Ask 'show me a decision that changed something because of this system' and record the artefact, not the assurance.
The candidate accepts a risk and opportunity register as proof that clause 6.1 is satisfied, without testing whether the identified risks are actually addressed in operational planning or whether the register connects to anything the organisation does.
Risk-based thinking has no prescribed format, so organisations produce a matrix or register as a visible deliverable, and candidates stop at the document because there is no clause-specific checklist to compare it against.
What to do instead
Trace forward: pick two or three entries from the risk register and follow them into operational controls, objectives, or process changes, asking who owns each and what changed. Trace backward: pick a recent incident or process change and ask which risk assessment drove it. A register that cannot be traced in either direction is a finding against 6.1 and 6.2.
When evaluating worker consultation and participation, the candidate asks management whether workers are consulted and records 'yes', or interviews only the safety manager, never sampling workers themselves or checking records of participation in hazard identification and incident investigation.
ISO 45001 clause 5.4 requires consultation and participation as an active process with specific triggers, but candidates treat it as a culture question and default to the most accessible and articulate interviewee, who is usually management.
What to do instead
Prepare a worker interview script of five questions covering: how you raise a hazard, what happened last time you did, whether you were involved in the risk assessment for your task, whether you have seen the incident investigation results, and what you can stop work over. Sample across shifts, contractors, and the least powerful roles. Corroborate answers against consultation records and the outcomes of the most recent risk assessments.
The candidate audits hazard identification by reviewing the risk assessment document for completeness of format, rather than testing whether the hazards identified match the actual work observed on site, including non-routine tasks, contractors, and emergency situations.
Risk assessments are documents that look auditable, and desk review is faster and less uncomfortable than walking the site; candidates also lack confidence in their own technical judgement about hazards in unfamiliar industries.
What to do instead
Always pair the document review with a walkthrough of the same area. For each task observed, check whether the hazard appears in the assessment, and pick at least one non-routine activity (maintenance, changeover, cleaning, emergency drill) and one contractor activity. Ask the worker performing the task to describe the controls they rely on and compare with the documented hierarchy of controls.
The candidate records an incident-rate statistic or a low lost-time injury frequency as evidence of conformity with ISO 45001 clause 9.1, or treats a high rate as a nonconformity, without examining the monitoring, measurement, analysis and evaluation process that produced it.
Lagging indicators are the numbers management presents, and candidates mistake a favourable outcome for a conforming process; ISO 45001 explicitly requires evaluation of performance, not achievement of a particular number.
What to do instead
Audit the measurement process: what is monitored, how it is measured, the method and criteria for evaluation, when it is analysed, and who acts on the results. Ask what the organisation learned from the last three incidents and what changed. Treat the statistic as a lead to the process, never as the finding itself.
The candidate evaluates legal compliance by confirming that a legal register exists and that someone says it is up to date, without sampling whether the register covers the actual activities, whether changes in legislation were captured, or whether compliance was evaluated against each obligation.
The legal register is a single document that appears to satisfy clauses 6.1.3 and 9.1.2, and candidates are often not confident in the environmental legislation of the jurisdiction, so they avoid testing content and accept existence.
What to do instead
Sample three obligations from the register and three activities from the site, and test both directions: does each sampled activity have a corresponding obligation, and does each sampled obligation have an evaluation record with a date, method, and conclusion? Ask how the organisation learns about legislative change and see the evidence of the last update. Where jurisdiction-specific law is outside your competence, record the limitation rather than accepting the register.
The candidate audits the environmental management system only inside the fence line, missing indirect and lifecycle aspects such as procurement, contractor activities, transport, and end-of-life of products, and does not test clause 8.1's lifecycle perspective at all.
Lifecycle perspective is the most conceptually demanding addition in ISO 14001:2015, and candidates gravitate to what is visible and controlled on site because the boundary of influence is ambiguous and uncomfortable to audit.
What to do instead
Prepare a lifecycle prompt list for the organisation's sector before the audit: upstream (purchased goods, supplier selection criteria), own operations (processes, energy, waste), downstream (distribution, use, end-of-life, product design). For each, ask what aspects were identified, what significance was assigned, and what control or influence exists. Sample at least one procurement decision and one contractor engagement as evidence.
In a food safety audit the candidate reviews the HACCP plan as a document and confirms that critical control points and critical limits are written down, without verifying that the limits are validated, that monitoring actually happens at the stated frequency, and that corrective actions were taken when deviations occurred.
HACCP documentation is dense and looks authoritative, and candidates without a food science background are reluctant to question the technical basis of a hazard analysis, so they verify existence and format rather than operation and validation.
What to do instead
Audit the CCP as a live control: observe monitoring being performed, compare the record against the stated frequency and the critical limit, and pull the last three deviation records to see the corrective action, product disposition, and whether the hazard analysis was revisited. Ask for the validation evidence behind each critical limit and the scientific or regulatory basis cited. Where you cannot judge the science, test the process that established it.