I85PREP
⌘ K
SGS study materials
SGS study resources

SGS practice questions

One question at a time. Build your SGS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Management system standards and normative requirements

In the ISO/IEC Directives, the verbal form "shall" is used in a standard to indicate:

  1. a permission
  2. a recommendation
  3. a possibility or capability
  4. a requirement Correct answer.

Explanation

The ISO/IEC Directives reserve "shall" for requirements that must be met in order to claim conformity. "Should" marks a recommendation, "may" a permission, and "can" a statement of possibility or capability.

Question 2Management system standards and normative requirements

In the harmonized structure (Annex SL) used by most ISO management system standards, clause 6 is titled:

  1. Support
  2. Planning Correct answer.
  3. Performance evaluation
  4. Leadership

Explanation

The harmonized structure runs: 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Question 3Management system standards and normative requirements

In standards that use the term "documented information", information that must be "retained" corresponds most closely to which older concept?

  1. Procedures
  2. Work instructions
  3. Quality manual
  4. Records Correct answer.

Explanation

"Documented information" covers both documents and records: "maintain" relates to documents that communicate information, while "retain" relates to evidence of results achieved. Retained information therefore corresponds to what earlier editions called records.

Question 4Management system standards and normative requirements

In the PDCA cycle applied to management system standards, clause 9 (Performance evaluation) corresponds most closely to which element?

  1. Plan
  2. Act
  3. Do
  4. Check Correct answer.

Explanation

Plan corresponds to clause 6 (planning), Do to clauses 7 and 8 (support and operation), Check to clause 9 (performance evaluation) and Act to clause 10 (improvement).

Question 5Management system standards and normative requirements

A management system is best described as:

  1. A software platform for recording audit findings and corrective actions
  2. A register of legal and other requirements applicable to the organization
  3. A collection of documented procedures that is issued and controlled by the certification body
  4. A set of interrelated elements used to establish policies and objectives Correct answer.

Explanation

In management system standards vocabulary, a management system is a set of interrelated or interacting elements of an organization used to establish policies and objectives, and processes to achieve those objectives.

Question 6Management system standards and normative requirements

ISO 14001:2015 requires an organization to determine and have access to its:

  1. legal registers maintained by its suppliers
  2. compliance obligations Correct answer.
  3. environmental permits issued to its contractors
  4. customer contracts and purchase orders

Explanation

Clause 6.1.3 requires the organization to determine and have access to compliance obligations, which include legal requirements and other requirements it chooses to comply with, and to determine how these apply to the organization.

Question 7Management system standards and normative requirements

ISO 45001:2018 requires the organization to establish processes for which of the following?

  1. Selection and procurement of personal protective equipment
  2. Consultation and participation of workers Correct answer.
  3. Delegation of OH&S duties to contractors
  4. Publication of an annual sustainability report

Explanation

Clause 5.4 requires processes for consultation and participation of workers at all applicable levels and functions, together with the necessary resources and mechanisms. Non-managerial workers must be consulted on and able to participate in matters such as hazard identification and incident investigation.

Question 8Management system standards and normative requirements

Which ISO management system standard specifies requirements for an energy management system?

  1. ISO 45001
  2. ISO 50001 Correct answer.
  3. ISO 27001
  4. ISO 14001

Explanation

ISO 50001 specifies requirements for establishing, implementing, maintaining and improving an energy management system. ISO 14001 addresses environmental management, ISO 45001 occupational health and safety, and ISO/IEC 27001 information security.

Question 9Management system standards and normative requirements

ISO 9001:2015 requires the organization to determine risks and opportunities. Which statement best reflects this requirement?

  1. Only risks to product conformity need to be considered
  2. No formal risk register or risk method is required Correct answer.
  3. All identified risks must be eliminated before certification
  4. A formal risk register with scored entries is mandatory

Explanation

Clause 6.1 requires the organization to determine the risks and opportunities that need to be addressed and to plan actions to address them. It does not prescribe a risk management methodology or require a documented risk register.

Question 10Management system standards and normative requirements

ISO 19011:2018 sets out principles of auditing. Which principle was added in the 2018 edition?

  1. Value for money
  2. Confidentiality
  3. Risk-based approach Correct answer.
  4. Due professional care

Explanation

The 2018 edition of ISO 19011 added a risk-based approach to the existing principles of integrity, fair presentation, due professional care, confidentiality, independence and evidence-based approach. Auditors are expected to consider risks and opportunities affecting the audit programme and the audit itself.

Question 11Management system standards and normative requirements

ISO 9001:2015 requires internal audits to be conducted:

  1. at planned intervals Correct answer.
  2. only when a customer raises a complaint
  3. annually by an external certification body
  4. after every nonconformity is identified

Explanation

Clause 9.2 requires internal audits at planned intervals to provide information on whether the quality management system conforms to requirements and is effectively implemented and maintained. The organization defines the frequency, methods and criteria.

Question 12Management system standards and normative requirements

Which of the following is a required output of management review under ISO 9001:2015?

  1. A list of approved external providers
  2. Decisions and actions on improvement and change Correct answer.
  3. The internal audit programme for the following year
  4. A signed copy of the quality manual

Explanation

Clause 9.3 requires management review to produce decisions and actions related to opportunities for improvement and any need for changes to the quality management system. There is no requirement for a quality manual or for the review to approve audit programmes or supplier lists.

Question 13Management system standards and normative requirements

Under ISO/IEC 17021-1, a management system certificate is normally issued for:

  1. one year, renewed by desk review
  2. indefinitely, until a complaint is received
  3. three years with surveillance audits Correct answer.
  4. five years without surveillance

Explanation

Certification is granted for a cycle of three years, subject to surveillance audits at least once a calendar year and to recertification before expiry. The recertification audit must be completed before the expiry date for the certificate to remain valid.

Question 14Management system standards and normative requirements

ISO 9001:2015 clause 8.4 sets out requirements for the control of:

  1. design and development inputs and review outputs
  2. customer property received for use or incorporation into the product
  3. externally provided processes, products and services Correct answer.
  4. monitoring and measuring resources and their traceability

Explanation

Clause 8.4 addresses control of externally provided processes, products and services, including evaluation and selection of providers and the type and extent of controls applied. Customer property is addressed in clause 8.5.3 and measuring resources in clause 7.1.5.

Question 15Management system standards and normative requirements

Under ISO 9001:2015, the organization must determine the interested parties relevant to the quality management system and:

  1. their suppliers' certification status
  2. their relevant requirements Correct answer.
  3. their internal audit results
  4. their financial statements

Explanation

Clause 4.2 requires the organization to determine the interested parties relevant to the quality management system and the requirements of those parties that are relevant. It then determines which of those requirements will be addressed within the system.

Question 16Management system standards and normative requirements

When controlling documented information, ISO 9001:2015 requires that it is:

  1. Retained for a minimum of ten years
  2. Approved personally by top management
  3. Available where needed and protected from loss of integrity Correct answer.
  4. Kept in paper form in a central archive

Explanation

Clause 7.5.3 requires documented information to be available and suitable for use where and when it is needed, and to be protected from loss of integrity, improper use or loss of confidentiality. The medium of storage and retention periods are for the organization to determine.

Question 17Management system standards and normative requirements

When a nonconformity occurs, ISO 9001:2015 requires the organization to:

  1. re-issue every document that is affected by the process
  2. revoke the authorization of the process owner and the audit team
  3. react and evaluate the need to eliminate the cause Correct answer.
  4. report it to the certification body within 24 hours

Explanation

Clause 10.2 requires the organization to react to the nonconformity, evaluate the need for action to eliminate the cause, implement the action, review its effectiveness, update risks and make changes to the system if necessary. Records of the nonconformity and of the actions taken must be retained.

Question 18Management system standards and normative requirements

ISO 50001:2018 requires the organization to establish an energy baseline that is:

  1. used as a reference for comparing performance Correct answer.
  2. approved in advance by the certification body before use
  3. updated every month using current data
  4. calculated only from design specifications

Explanation

The energy baseline is a quantitative reference providing a basis for comparison of energy performance, established using data from a defined period. It must be reviewed and adjusted where significant changes occur or where the energy performance indicators are no longer relevant.

Question 19Management system standards and normative requirements

ISO/IEC 27001 requires a Statement of Applicability that includes:

  1. the results of the most recent penetration test
  2. a list of employees holding security clearances
  3. the necessary controls and the justification for inclusion or exclusion Correct answer.
  4. a copy of every security policy that has been issued by the organization

Explanation

The Statement of Applicability lists the controls the organization has determined as necessary, with justification for their inclusion or exclusion, and records whether each is implemented. It accompanies the risk treatment plan as part of the information security management system documentation.

Question 20Management system standards and normative requirements

Integration of several management system standards is mainly facilitated by:

  1. the common harmonized structure shared by the standards Correct answer.
  2. the use of a single external auditor for all standards
  3. combining every procedure into a single controlled document
  4. reducing the scope to a single standard

Explanation

Because most ISO management system standards follow the same harmonized structure, with identical core text and common terms, their requirements can be mapped and managed within one integrated system. Integration concerns alignment of processes and governance, not the number of auditors or documents.

Question 21Management system standards and normative requirements

In an ISO management system standard, an annex labelled "normative":

  1. provides guidance only and is optional for the user
  2. lists terms and definitions used in the standard
  3. contains requirements that are part of the standard Correct answer.
  4. gives the history of previous editions

Explanation

Annexes designated "normative" contain requirements or provisions that form part of the standard and must be met for conformity. Annexes designated "informative" provide additional guidance that is not mandatory.

Question 22Management system standards and normative requirements

In the ISO/IEC 17000 vocabulary, accreditation is:

  1. a contractual arrangement between the certification body and its client
  2. first-party attestation carried out by the organization's own internal audit team
  3. third-party attestation that a product, process or system fulfils specified requirements
  4. third-party attestation of a conformity assessment body's competence Correct answer.

Explanation

Accreditation is third-party attestation relating to a conformity assessment body, conveying formal demonstration of its competence to carry out specific conformity assessment tasks. Certification relates to products, processes, systems or persons.

Question 23Management system standards and normative requirements

Which concept in ISO 9001:2015 replaced the separate preventive action clause of the 2008 edition?

  1. Risk-based thinking in planning Correct answer.
  2. A documented preventive maintenance programme
  3. Contingency planning requirements in clause 8
  4. Corrective action extended to all processes

Explanation

The 2015 revision removed the separate clause and the documented procedure for preventive action, replacing them with risk-based thinking embedded in planning (clause 6.1) and applied throughout the standard. Organizations may still use preventive actions as part of addressing risks.

Question 24Management system standards and normative requirements

ISO 14001:2015 requires the organization, when determining environmental aspects, to consider:

  1. the environmental performance of competitors
  2. only emissions regulated by permit
  3. a life cycle perspective Correct answer.
  4. only activities carried out on site

Explanation

Clause 6.1.2 requires the organization to consider a life cycle perspective when determining environmental aspects, covering activities, products and services it controls or influences, from raw material acquisition to end-of-life. This does not require a detailed life cycle assessment.

Question 25Management system standards and normative requirements

ISO 45001:2018 requires the use of a hierarchy of controls. Which sequence runs from most to least effective?

  1. Provide PPE; then administrative controls; then engineering controls; then substitution; then elimination
  2. Use administrative controls; then eliminate; then PPE; then substitution; then engineering controls
  3. Substitute; then eliminate; then PPE; then engineering controls; then administrative controls
  4. Eliminate; substitute; engineering controls; administrative controls; PPE Correct answer.

Explanation

Clause 8.1.2 requires the organization to establish a process for reducing OH&S risks using the hierarchy of controls: eliminate the hazard, substitute with less hazardous processes or materials, use engineering controls and reorganization of work, use administrative controls, and finally provide PPE. PPE is the least effective level and is used as a last resort.

Question 26Management system standards and normative requirements

Which document in the ISO/IEC Directives framework contains the consolidated procedures specifically for the technical work of ISO and IEC committees?

  1. ISO/IEC Directives, Part 2
  2. ISO/IEC Guide 2
  3. ISO/IEC 17000
  4. ISO/IEC Directives, Part 1 Correct answer.

Explanation

The ISO/IEC Directives are published in parts: Part 1 covers procedures for the technical work, while Part 2 sets out the rules for the structure and drafting of International Standards. Committees follow Part 1 when developing deliverables.

Question 27Management system standards and normative requirements

A management system standard is classified as a 'Type A' MSS in the ISO MSS structure. What does this designation indicate?

  1. It addresses a single industry sector exclusively
  2. It specifies requirements and is intended for conformity assessment Correct answer.
  3. It contains only guidance and no auditable requirements
  4. It is restricted to use by certification bodies only

Explanation

In the ISO classification, Type A management system standards contain requirements against which conformity can be assessed, typically through certification. Type B standards contain guidance, and Type C standards give sector-specific requirements or guidance.

Question 28Management system standards and normative requirements

Which element is common to the high-level structure used by current ISO management system standards?

  1. A mandatory clause on financial planning
  2. A requirement for third-party certification
  3. A prescribed set of documented procedures
  4. A clause on performance evaluation Correct answer.

Explanation

The harmonized high-level structure shares identical core clauses, including context of the organization, leadership, planning, support, operation, performance evaluation and improvement. Performance evaluation therefore appears in every standard built on this structure.

Question 29Management system standards and normative requirements

Clause 4 of a management system standard built on the high-level structure deals primarily with which subject?

  1. Context of the organization Correct answer.
  2. Support and resources
  3. Improvement actions
  4. Leadership and commitment

Explanation

Clause 4 addresses the context of the organization, including understanding the organization and its context, interested parties, and the scope of the management system. Leadership and support appear in clauses 5 and 7 respectively.

Question 30Management system standards and normative requirements

Under the harmonized structure, an organization must maintain documented information as evidence of the suitability of its management system and its effective operation. Which clause principally establishes this requirement?

  1. Clause 7, support Correct answer.
  2. Clause 8, operation
  3. Clause 6, planning
  4. Clause 9, performance evaluation

Explanation

Clause 7 on support contains the requirements for documented information, including creating and updating it and controlling it, covering evidence of suitability and effective operation. Operational control under clause 8 generates records, but the general requirement sits in clause 7.

Question 31Management system standards and normative requirements

In the ISO/IEC Directives, which verb form is used to express a requirement that must be met to claim conformity?

  1. May
  2. Should
  3. Shall Correct answer.
  4. Can

Explanation

The directives define 'shall' as the verbal form for expressing requirements, while 'should' indicates a recommendation and 'may' or 'can' indicate permission or possibility. Getting these verbs right is essential when reading normative text.

Question 32Management system standards and normative requirements

A clause in a management system standard is prefaced with the words 'The organization shall determine...' and the organization simply records a decision without any further action. How should an auditor interpret this requirement?

  1. The requirement applies only to certified organizations
  2. The clause is guidance and cannot generate a finding
  3. Determination alone satisfies the clause because no output is specified
  4. Determination implies a process and the organization must be able to show how it was carried out Correct answer.

Explanation

Where a standard requires an organization to determine something, the organization must apply a process and retain sufficient evidence of that process. Merely asserting a conclusion without a demonstrable method is normally insufficient.

Question 33Management system standards and normative requirements

Annex SL of the ISO/IEC Directives provides which of the following?

  1. Sector-specific requirements for automotive suppliers
  2. The template for management system standards, including common text and structure Correct answer.
  3. The rules for accreditation body competence
  4. A list of accredited certification schemes

Explanation

Annex SL supplies the standardized framework, common terms and core text used when drafting or revising management system standards. This is what makes the high-level structure and much common wording consistent across disciplines.

Question 34Management system standards and normative requirements

A certification body audits an organization against an ISO management system standard and finds that the organization has fully outsourced a process that the standard requires it to control. What is the correct interpretation?

  1. Outsourcing removes the requirement from the scope of the audit
  2. The outsourced provider must hold its own certificate first
  3. The auditor must exclude the process from the audit programme
  4. The organization remains responsible for ensuring the process is controlled Correct answer.

Explanation

Management system standards consistently place responsibility for conformity on the organization itself, including for processes it outsources. Outsourcing transfers activity but not accountability, so controls must still be established and verified.

Question 35Management system standards and normative requirements

In a management system standard, the scope statement in clause 1 primarily serves to:

  1. List the documented procedures the organization must write
  2. Identify the certification body that issued the standard
  3. Prescribe the audit duration for certification
  4. State the intended outcome and applicability of the standard Correct answer.

Explanation

Clause 1 sets out what the standard covers and the results it is intended to enable, which guides the reader on applicability. It does not impose procedural detail or certification rules.

Question 36Management system standards and normative requirements

Which of the following best describes the status of the 'terms and definitions' clause in a management system standard?

  1. It only applies to accreditation bodies
  2. It is informative and may be ignored
  3. It is optional for organizations using the standard voluntarily
  4. It is normative and defines how terms are to be understood in that standard Correct answer.

Explanation

The terms and definitions clause is normative: the meanings given govern interpretation of the requirements elsewhere in the standard. Common terms are often shared from the high-level structure, with additions specific to the discipline.

Question 37Management system standards and normative requirements

An organization cites an informative annex of a management system standard as justification for a particular method. What is the correct interpretation of that annex's status?

  1. It has the same status as a 'shall' clause
  2. It supersedes the main body requirements
  3. It is mandatory and the organization is nonconforming if it deviates
  4. It provides guidance or examples and conformity is not assessed against it Correct answer.

Explanation

Informative annexes provide guidance, illustrations or clarification and are not audited as requirements. Only normative content, including normative annexes, can form the basis for a conformity finding.

Question 38Management system standards and normative requirements

Which of the following is a principle of standardization reflected in the ISO/IEC Directives rather than a conformity assessment principle?

  1. Confidentiality
  2. Consensus Correct answer.
  3. Impartiality
  4. Competence

Explanation

Consensus is a foundational principle of the standards development process, along with coherence, openness and transparency. The other listed items are conformity assessment principles found in ISO/IEC 17021-1.

Question 39Management system standards and normative requirements

A certification body's client wants the certificate scope to cover a site that the audit team did not visit and that performs a core activity. How should the body respond under the normative requirements governing certification activities?

  1. Include the site because sampling of sites is always permitted
  2. Add the site if the client signs a declaration of conformity
  3. Add the site only after obtaining audit evidence covering its activities Correct answer.
  4. Include the site indefinitely provided the central function was audited

Explanation

Certificate scope must be supported by audit evidence, and sampling cannot be applied blindly to core activities or to sites with significantly different processes. A site may only be included once sufficient evidence of conformity has been obtained.

Question 40Management system standards and normative requirements

Where a management system standard requires the organization to 'maintain' documented information, the organization is expected at minimum to:

  1. Publish it on a public website
  2. Keep it available and suitable for use where needed Correct answer.
  3. Translate it into all working languages
  4. Submit it annually to its certification body

Explanation

Maintaining documented information means keeping it current, available and usable for the purpose it serves. There is no general requirement to submit, translate or publish documentation.

Question 41Audit principles, ethics and impartiality

Which audit principle requires auditors to perform their work honestly and with responsibility?

  1. Confidentiality
  2. Evidence-based approach
  3. Integrity Correct answer.
  4. Independence

Explanation

Integrity is the foundation principle requiring auditors to be honest, truthful and responsible in their work. It underpins credible audit conclusions and public trust in the audit process.

Question 42Audit principles, ethics and impartiality

During an audit, an auditor learns about a client's confidential process. Under the confidentiality principle, what should the auditor do with that information?

  1. Include it in a public audit summary
  2. Discuss it with other clients as a benchmark
  3. Keep it secure and not disclose it without proper authority Correct answer.
  4. Share it with colleagues outside the audit team to gather technical advice

Explanation

Confidentiality requires auditors to protect information obtained during an audit and not disclose it without proper authority or a legal duty. Information should be used only for audit purposes.

Question 43Audit principles, ethics and impartiality

Independence in auditing is best described as:

  1. Working only for government-approved bodies
  2. Having no personal opinion about the organization
  3. Never accepting any payment from the client
  4. Being free from conditions that could bias audit conclusions Correct answer.

Explanation

Independence means the auditor is free from conditions that could compromise objectivity and lead to biased conclusions. It is about freedom from pressures and relationships that affect judgment.

Question 44Audit principles, ethics and impartiality

The evidence-based approach principle requires that audit findings and conclusions are:

  1. Based on the auditor's professional intuition
  2. Reached from verifiable information sampled during the audit Correct answer.
  3. Aligned with the client's business objectives
  4. Supported by management's verbal assurances

Explanation

The evidence-based approach requires conclusions to be based on verifiable information obtained through sampling and examination. Intuition, assurances and business alignment do not replace audit evidence.

Question 45Audit principles, ethics and impartiality

An auditor discovers a significant obstacle during an audit that limits the scope. Under fair presentation, what should happen?

  1. Omit the obstacle to avoid alarming the client
  2. Shorten the audit without documenting the obstacle
  3. Report the obstacle and its effect on conclusions Correct answer.
  4. Report only positive results

Explanation

Fair presentation requires auditors to report significant obstacles encountered and their effect on audit conclusions. Concealing limitations would mislead report users.

Question 46Audit principles, ethics and impartiality

Due professional care in auditing means auditors should:

  1. Complete audits as quickly as possible
  2. Follow the client's instructions without independent judgment
  3. Exercise the care and judgment expected of a competent auditor Correct answer.
  4. Guarantee that no nonconformity is missed

Explanation

Due professional care means applying the diligence, skill and judgment expected of a competent auditor in the circumstances. It does not guarantee that every nonconformity will be found.

Question 47Audit principles, ethics and impartiality

Before accepting an audit assignment, an auditor discovers a close family member is the client's finance director. What is the most appropriate action?

  1. Declare the relationship and decline or remove the conflict Correct answer.
  2. Ask the family member to keep it confidential
  3. Proceed because family relationships are private
  4. Proceed but avoid auditing the finance department

Explanation

A close family relationship with a key client manager creates a conflict of interest that must be declared and addressed. Declining the assignment or removing the conflict protects impartiality.

Question 48Audit principles, ethics and impartiality

Impartiality in certification auditing means:

  1. Always agreeing with the client's management
  2. Making unbiased decisions toward any interested party Correct answer.
  3. Treating every client identically regardless of risk
  4. Avoiding contact with the client outside audits

Explanation

Impartiality means that certification decisions are not biased toward any interested party, including the client. It is about the absence of bias in decisions, not superficial uniformity or avoidance of contact.

Question 49Audit principles, ethics and impartiality

An auditor is asked to audit a management system that he personally designed two years ago. Which threat to impartiality does this create?

  1. Intimidation threat
  2. Familiarity threat
  3. Self-review threat Correct answer.
  4. Advocacy threat

Explanation

A self-review threat arises when an auditor evaluates work that he or she previously performed or designed. Objectivity is compromised because the auditor may be reluctant to identify deficiencies in his or her own work.

Question 50Audit principles, ethics and impartiality

An auditor has audited the same client for ten years and considers the managers close friends. Which threat to impartiality is most relevant?

  1. Self-review threat
  2. Self-interest threat
  3. Familiarity threat Correct answer.
  4. Intimidation threat

Explanation

A familiarity threat arises when long-standing or close relationships make an auditor too sympathetic to the client. The auditor may become reluctant to report unfavorable findings.