Auditing, Inspection, and Compliance
What the exam tests
Audit types and principles, nonconformity writing, evidence rules, inspector independence, and the compliance record trail.
Core rules
- Audit types: first party (internal), second party (supplier), third party (certification). Product, process and system audits answer different questions; do not substitute one for another.
- ISO 19011 principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach. Auditors must not audit their own work.
- A nonconformity statement has three parts: the requirement (standard clause, procedure, or regulation), the objective evidence (what was seen, where, how many, with identifiers), and the resulting statement of failure. Classification: major (system breakdown or product risk) versus minor (isolated lapse) versus observation or opportunity for improvement.
- Audit sampling is judgmental, not statistical; a clean sample does not prove conformity. Follow-up must verify that previous corrective actions remain effective.
Worked example
Finding: three of twelve gauges on Line 2 had calibration labels expired 40 and 60 days prior (record gauge IDs and dates). Requirement: ISO 9001:2015 clause 7.1.5.2. Statement: the organization failed to ensure measuring equipment is calibrated at defined intervals. This is written as a minor if the recall system otherwise functions, and escalated to major if the recall list is absent. "The operator was careless" is not a finding; it names no requirement and gives no evidence.
Traps that cost marks
Citing an internal procedure when the standard clause is the requirement. Writing opinions instead of verifiable evidence. Consulting: proposing the fix destroys auditor independence. Skipping verification of the previous audit's corrective actions. Assuming a small sample proves compliance. Overlooking records retention and traceability requirements for regulated products.