PECB Certified Management Systems Internal Auditor case studies
PECB Certified Management Systems Internal Auditor · Put your knowledge to work in context.
The PECB Certified Management Systems Internal Auditor credential is aimed at people who audit their own organisation's management system from the inside, rather than at external certification auditors. In PECB's own navigation it sits under Governance, Risk, and Compliance alongside ISO 31000, ISO 37001, ISO 37301 and ISO/IEC 38500, and it is listed as "MS Internal Auditor" - a generic, discipline-neutral qualification rather than one tied to a single standard such as ISO 9001 or ISO/IEC 27001. The PECB Certified Management Systems Internal Auditor case studies are 5 cases and about 4,136 words.
1The distribution centre that sits outside the QMS scope
A regional logistics company operates a 6 000 m² distribution centre 30 km from head office. The centre is leased, staffed by 42 company employees who work under company SOPs and company IT systems; only forklift maintenance is contracted out to the lessor.
843 words, about 4 min2Independence, corridor pressure and a retrospectively signed record
A 600-bed hospital runs an internal audit programme for its integrated QMS/EMS. Three auditors are available: Auditor A, a nurse manager who transferred out of the central sterilisation department (CSD) five months ago and whose spouse is still a shift leader there; Auditor B, a biomedical engineer with no sterilisation experience; and Auditor C, newly qualified and never having audited a clinical process.
829 words, about 4 min3Forty audit days, three sites and two auditors with conflicts
A food manufacturer has three production sites (A, B, C) and a head office, and is certified to ISO 9001 and ISO 22000. The 2026 internal audit programme must be built from 40 audit days: Auditor 1 contributes 25 days and Auditor 2 contributes 15.
863 words, about 4 min4A helpful guide, a suspected systemic gap and a propped door
You are auditing the incident management process of a 300-person SaaS provider against ISO/IEC 27001. The audit plan allows 90 minutes for the process, and you have 30 minutes left when you find that three of the eight sampled P1 incidents (INC-1042, INC-1077 and INC-1103) have no post-incident review record, although the procedure requires one within five working days.
802 words, about 4 min5A contested finding, a group-wide distribution list and a closed CAPA
You have led a two-day internal audit of the mixing department at a coatings plant. Your draft report contains this finding: 'Document control is inadequate in production.' The evidence: 3 of the 15 work instructions checked at line 2 were at revision 3 while the master list showed revision 4; two operators said revision 4 was never distributed; the change altered the solvent ratio.
799 words, about 4 min