PECB ISO-9001 Lead Auditor QMS ISO 9001:2015 Lead Auditor Online Training

Question #31

In the context of a third-party audit, select the issue which is not expected to be included in the audit plan.

A . Number of sites to be audited
B . Risk to achieving audit objectives
C . Expectations of the organisation’s management
D . Scope of the audit

Question #32

In a third-party audit to ISO 9001, select two options of when the organisation is required to act in response to reported findings.

A . A recommendation is given in the report.
B . A finding of good practice is reported.
C . An opportunity for improvement is raised.
D . A major non-conformity is raised.
E . A finding of conformity is reported.
F . A minor non-conformity is raised.

Reveal Solution Hide Solution

Correct Answer: D,F
D,F

Explanation:

According to ISO 19011:2018, clause 6.6.2, a nonconformity is the non-fulfilment of a requirement. A nonconformity can be classified as either major or minor, depending on the nature and extent of the deviation from the audit criteria. A major nonconformity is a nonconformity that affects the ability or the integrity of the organization’s management system to achieve the intended results. A minor nonconformity is a nonconformity that does not affect the ability or the integrity of the organization’s management system to achieve the intended results, but is a deviation from the audit criteria1.

According to ISO/IEC 17021-1:2015, clause 9.4.9, the organization is required to analyze the cause and describe the specific correction and corrective actions taken, or planned to be taken, to eliminate detected nonconformities, within a defined time. The organization is also required to provide the certification body with records and evidence of the implementation and effectiveness of the correction and corrective actions taken. The certification body will then verify the correction and corrective actions taken by the organization and decide on the certification status2.

Therefore, the two options of when the organization is required to act in response to reported findings are D and F, as they indicate the presence of nonconformities that need to be corrected and prevented from recurring.

The other options are not correct, as they do not require the organization to act in response to reported findings:

• A. A recommendation is given in the report: A recommendation is a suggestion for improvement that is not related to a nonconformity. A recommendation is not binding for the organization and does not affect the certification status. The organization may choose to accept or reject the recommendation, but it is not required to act on it.

• B. A finding of good practice is reported: A finding of good practice is a positive observation that indicates a strength or a best practice of the organization’s management system. A finding of good practice is not related to a nonconformity and does not affect the certification status. The organization may choose to acknowledge or share the finding of good practice, but it is not required to act on it.

• C. An opportunity for improvement is raised: An opportunity for improvement is a potential area where the organization’s management system can be enhanced or optimized. An opportunity for improvement is not related to a nonconformity and does not affect the certification status. The

organization may choose to pursue or ignore the opportunity for improvement, but it is not required to act on it.

• E. A finding of conformity is reported: A finding of conformity is a confirmation that the organization’s management system fulfils the audit criteria. A finding of conformity is not related to a nonconformity and does not affect the certification status. The organization may choose to celebrate or communicate the finding of conformity, but it is not required to act on it.

Reference: ISO 19011:2018(en), Guidelines for auditing management systems, ISO/IEC 17021-

1:2015(en), Conformity assessment ― Requirements for bodies providing audit and certification of

management systems ― Part 1: Requirements

Question #33

DRAG DROP

The following are stages of an audit, put them in the order they would be conducted.

The first and last stages have been done for you

To complete the sequence click on the bank section you want to complete so it is highlighted in red and then click on the applicable text from the options below.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Establishing the audit programme objectives

Determining and evaluating the audit programme risks and opportunities

Establishing the audit programme

Initiating the audit

Preparing all audit activity

Conducting the audit activities

According to ISO 19011:2018, clause 5, the audit programme is a set of one or more audits planned for a specific time frame and directed towards a specific purpose. The audit programme includes all activities necessary to plan, organize, and conduct the audits. The audit programme management involves the following steps1:

Establishing the audit programme objectives: The audit programme objectives define the intended outcomes of the audit programme, such as verifying conformity, evaluating performance, identifying improvement opportunities, etc. The audit programme objectives should be aligned with the strategic direction and policies of the organization and the needs and expectations of the interested parties.

Determining and evaluating the audit programme risks and opportunities: The audit programme

risks and opportunities are the factors that can affect the achievement of the audit programme objectives, such as changes in the internal or external context, availability of resources, competence of auditors, etc. The audit programme risks and opportunities should be identified, analyzed, and evaluated to determine the appropriate actions to address them.

Establishing the audit programme: The audit programme is established by defining the audit programme scope, criteria, methods, and resources. The audit programme scope defines the extent and boundaries of the audit programme, such as the processes, functions, sites, activities, etc. that will be audited. The audit programme criteria are the set of policies, procedures, or requirements used as a reference for the audits. The audit programme methods are the techniques used to conduct the audits, such as interviews, observations, document review, sampling, etc. The audit programme resources are the human, technical, and financial resources needed to implement the audit programme.

Initiating the audit: The audit initiation is the process of formally establishing the arrangements for an individual audit within the audit programme. The audit initiation involves contacting the auditee and the audit client, confirming the audit objectives, scope, and criteria, and obtaining the necessary information and access for the audit.

Preparing all audit activity: The audit preparation is the process of developing the audit plan and the audit work documents for an individual audit. The audit plan is a document that provides the basis for agreement regarding the conduct of the audit, such as the audit schedule, the audit team, the audit methods, the audit language, the audit report, etc. The audit work documents are the records that provide evidence of the audit activities, such as the audit checklist, the audit notes, the audit findings, etc.

Conducting the audit activities: The audit activities are the processes of collecting and verifying audit evidence and evaluating it against the audit criteria to make the audit conclusions. The audit activities include the opening meeting, the communication during the audit, the roles and responsibilities of the audit team and the auditee, the audit evidence collection and verification, the audit findings generation and recording, the closing meeting, and the audit report preparation and distribution.

Reference: ISO 19011:2018(en), Guidelines for auditing management systems

Question #34

Audit criteria are a set of requirements used as a reference against which objective evidence is compared.

Which two of the following are not potential audit criteria?

A . ISO management system standards
B . Verbal statements by the general manager
C . Verbal agreements with interested parties
D . Health and safety notices
E . Written agreements with interested parties
F . Commercial advertisements
G . Organisation’s documented information
H . Claims made on the organisation’s website
I . Commitment to follow principles issued by an NGO
J . Environmental aspects register

Reveal Solution Hide Solution

Correct Answer: F,H
F,H

Explanation:

According to ISO 19011:2018, clause 3.2, audit criteria are a set of policies, procedures or requirements used as a reference against which objective evidence is compared. Audit criteria are usually selected by the audit client or by agreement between the audit client and the auditee, and they should be appropriate for the audit scope and objectives1.

Audit criteria may include, but are not limited to, the following sources2:

• ISO management system standards, such as ISO 9001, ISO 14001, ISO 45001, etc.

• Verbal statements by the general manager or other top management, as long as they are consistent with the documented policies and objectives of the organisation

• Verbal agreements with interested parties, such as customers, suppliers, regulators, etc., as long as they are documented and approved by the relevant authorities

• Health and safety notices, such as posters, signs, labels, etc., that communicate the organisation’s legal obligations, policies, or procedures

• Written agreements with interested parties, such as contracts, orders, specifications, etc., that define the requirements and expectations of the parties involved

• Organisation’s documented information, such as policies, procedures, manuals, records, etc., that describe the organisation’s management system and its processes

• Commitment to follow principles issued by an NGO, such as the United Nations Global Compact, the International Labour Organization, etc., as long as they are relevant to the organisation’s context and objectives

• Environmental aspects register, such as a list of the environmental impacts and risks associated with the organisation’s activities, products, and services

Therefore, the two options that are not potential audit criteria are F and H, as they are not reliable or verifiable sources of information, and they may not reflect the actual performance or conformity of the organisation’s management system. Commercial advertisements and claims made on the organisation’s website are forms of marketing communication that may be exaggerated, misleading, or inaccurate, and they are not subject to the same level of scrutiny or approval as the other sources of audit criteria.

Reference: ISO 19011:2018(en), Guidelines for auditing management systems, What are audit criteria? – ISO Update

Question #35

Which of the following two documents does an auditor need to prepare and complete prior to the on-site audit?

A . Audit Report
B . Audit Plan
C . Procedures
D . Checklist / Prompts
E . Risk Matrices
F . Findings

Reveal Solution Hide Solution

Correct Answer: B,D
B,D

Explanation:

According to ISO 19011:2018, clause 6.3, the audit plan is a document that provides the basis for agreement regarding the conduct of the audit. The audit plan should include the information listed in my previous response, such as the audit objectives, scope, criteria, schedule, team, methods, report, etc. The audit plan should be prepared and completed prior to the on-site audit, and should be communicated to the audit team and the auditee1.

According to ISO 19011:2018, clause 6.4.3, the checklist / prompts are documents that list the questions or topics that need to be covered during an audit. The checklist / prompts can help the auditor to collect and verify information relevant to the audit criteria, and to ensure the consistency and completeness of the audit. The checklist / prompts should be prepared and completed prior to the on-site audit, and should be based on the audit plan and the audit scope and objectives1. Therefore, the two documents that an auditor needs to prepare and complete prior to the on-site audit are B and D, as they are essential for planning and conducting the audit. The other options are not correct, as they are either prepared or completed after the on-site audit, or not required by the standard:

• A. Audit Report: The audit report is a document that provides a complete, accurate, concise, and clear record of the audit. The audit report should include the information listed in my previous response, such as the audit objectives, scope, criteria, findings, conclusions, etc. The audit report should be prepared and completed after the on-site audit, and should be distributed to the audit client and the auditee1.

• C. Procedures: Procedures are documents that specify the way activities are to be performed. Procedures may be part of the audit criteria, if they are part of the organization’s management system, or part of the audit programme, if they are part of the certification body’s or registrar’s requirements. Procedures are not prepared or completed by the auditor prior to the on-site audit, but rather reviewed or followed by the auditor during the audit1.

• E. Risk Matrices: Risk matrices are tools that help to assess and prioritize the risks and opportunities associated with the audit programme or the audit. Risk matrices may be part of the audit programme management, if they are used to determine and evaluate the audit programme risks and opportunities, or part of the audit preparation, if they are used to determine and evaluate the audit risks and opportunities. Risk matrices are not prepared or completed by the auditor prior to the on-site audit, but rather used or updated by the auditor during the audit programme management or the audit preparation1.

• F. Findings: Findings are the results of the evaluation of the collected audit evidence against the audit criteria. Findings can indicate either conformity or nonconformity, as well as positive aspects or opportunities for improvement. Findings are not prepared or completed by the auditor prior to the on-site audit, but rather generated and recorded by the auditor during the audit activities1.

Reference: ISO 19011:2018(en), Guidelines for auditing management systems

Question #36

You will lead a third-party audit next Monday on ABC, an organisation that provides services for cleaning windows from the outside of tall buildings. They work on demand, and usually have 4-5 orders per week. All documented information on these activities is kept at the central office.

On Friday evening, before the audit, you are informed by mail that customers cancelled all orders for the next week; therefore, the auditors will not have the chance to see them working at the customer’s premises, but the field supervisors will be available at the ABC offices.

You have prepared the audit plan and the checklist. Choose the best action you would take:

A . Start the audit on Monday at ABC’s as planned, interviewing the functions that regularly work at the central office, and plan visits to ABC customers wherever they may be working during the following week.
B . Ask the Certification Body you work for how to proceed with the audit.
C . Start the audit on Monday as planned, interviewing the functions that regularly work at the central office, and visit another customer’s premises they cleaned the week before.
D . Complete the audit but ask the quality manager to clean some windows at the ABC’s office, simulating the process they carry out at customers’ premises.

Reveal Solution Hide Solution

Correct Answer: B
B

Explanation:

According to ISO 19011:2018, clause 6.3.3, the audit plan should be reviewed and revised as necessary to address changes that occur during the audit planning. The audit plan should be agreed upon, preferably in writing, by the audit team leader, the audit client and the auditee1. Therefore, if there is a significant change in the auditee’s situation, such as the cancellation of all orders for the next week, the audit plan should be reviewed and revised accordingly, with the agreement of all parties involved.

According to ISO/IEC 17021-1:2015, clause 9.1.4, the certification body should have a process to ensure that the audit team has the competence to achieve the audit objectives, and that the audit methods are appropriate for the scope and complexity of the audit. The certification body should also have a process to ensure that the audit is conducted under reasonable conditions and within a reasonable time frame2. Therefore, if there is a risk that the audit objectives cannot be achieved, or that the audit methods are not suitable, due to the change in the auditee’s situation, the certification body should be consulted and informed on how to proceed with the audit.

Therefore, the best action to take is B, ask the certification body you work for how to proceed with the audit. This action will ensure that the audit plan is revised and agreed upon by all parties, and that the audit team has the competence and the methods to conduct the audit effectively and efficiently. The other options are not correct, as they may compromise the quality and validity of the audit:

• A. Start the audit on Monday at ABC’s as planned, interviewing the functions that regularly work at the central office, and plan visits to ABC customers wherever they may be working during the following week: This action may not be feasible or acceptable, as it may extend the audit duration and cost beyond the agreed terms, and it may not provide sufficient and appropriate audit evidence to verify the conformity and effectiveness of the auditee’s processes. Moreover, this action may not be agreed upon by the audit client and the auditee, and it may not be approved by the certification body.

• C. Start the audit on Monday as planned, interviewing the functions that regularly work at the central office, and visit another customer’s premises they cleaned the week before: This action may not be relevant or reliable, as it may not reflect the current performance and condition of the auditee’s processes. The audit evidence collected from the previous customer may not be valid or representative of the audit criteria, and it may not address the risks and opportunities associated with the auditee’s context and objectives. Moreover, this action may not be agreed upon by the audit client and the auditee, and it may not be approved by the certification body.

• D. Complete the audit but ask the quality manager to clean some windows at the ABC’s office, simulating the process they carry out at customers’ premises: This action may not be objective or impartial, as it may introduce bias and influence in the audit process. The audit evidence collected from the simulated process may not be accurate or authentic, and it may not demonstrate the actual capability and effectiveness of the auditee’s processes. Moreover, this action may not be ethical or professional, as it may compromise the integrity and credibility of the audit and the certification.

Reference: ISO 19011:2018(en), Guidelines for auditing management systems, ISO/IEC 17021-1:2015(en), Conformity assessment ― Requirements for bodies providing audit and certification of management systems ― Part 1: Requirements

Question #37

Select which one of the following statements is true.

A . The team leader shall be an auditor that is qualified in the scheme.
B . An audit team can include non-qualified auditors.
C . A technical expert can replace a qualified auditor on an audit team.
D . Audits leading to auditor qualification are undertaken annually.

Reveal Solution Hide Solution

Question #38

Select one option that must be considered when determining the scope of a QMS to ISO 9001.

A . Business improvement
B . Performance of business processes
C . External issues of the organisation’s context
D . Competence of top management

Reveal Solution Hide Solution

Question #39

DRAG DROP

The following list gives examples of records that may be evidence of how an organisation has fulfilled the requirements of clause 8.4 of ISO 9001. Match the records to the appropriate requirement of clause 8.4.

To complete the table click on the blank section you want to complete so it is highlighted in red and then click on the appropriate record from the option listed. Alternatively, drag and drop the appropriate record to the requirement of clause 8.4 that applies.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

The following table shows the possible matching of the records to the requirements of clause 8.4:

Table

Requirements

Records

Define product requirements

Product specification

Criteria for selection

List of requirements to be met by the external provider

Evaluation of potential external provider

External provider questionnaire

External provider selection

Approved external provider list

Communicate requirements

Purchase order

Monitoring of performance

External provider delivery times and quality issues

Comprehensive and Detailed = According to clause 8.4 of ISO 9001:2015, the organization should ensure that externally provided processes, products, and services conform to the specified requirements. To do so, the organization should:

Define the product requirements that are relevant for the external provision, such as specifications, drawings, standards, codes, etc. These should be documented and communicated to the external provider. A record of the product specification can be used as evidence of this requirement. Establish the criteria for the selection, evaluation, and re-evaluation of external providers, based on their ability to provide processes, products, and services in accordance with the requirements. The criteria should be documented and applied consistently. A record of the list of requirements to be met by the external provider can be used as evidence o this requirement.

Evaluate the potential external providers before selecting them, using the established criteria. The evaluation methods may include questionnaires, audits, references, samples, etc. The results of the evaluation should be documented and reviewed. A record of the external provider questionnaire can be used as evidence of this requirement.

Select the external providers that have demonstrated their competence and conformity to the requirements. The selection should be based on the evaluation results and the organization’s needs. The selection should be documented and approved. A record of the approved external provider list can be used as evidence of this requirement.

Communicate the requirements for the processes, products, and services to be provided by the external provider, including the verification and validation activities, the acceptance criteria, the documentation requirements, the changes control, etc. The communication methods may include purchase orders, contracts, agreements, etc. The communication should be clear, complete, and timely. A record of the purchase order can be used as evidence of this requirement.

Monitor the performance and conformity of the external provider, using the established criteria and methods. The monitoring methods may include inspections, tests, audits, feedback, complaints, etc. The monitoring results should be documented and analyzed. A record of the external provider delivery times and quality issues can be used as evidence of this requirement.

Reference: ISO 9001:2015, [ISO 9001 Auditing Practices Group Guidance on Scope], Mastering the Scope of ISO 9001 Quality Management Systems

Question #40

An audit team leader arrives at a printing organisation to carry out a Stage 2 audit for a certification body. At a meeting with the Quality Manager, she is told that they have won their biggest contract from a computer manufacturer to print and compile computer documentation packages. They have leased the unit next door for space reasons but have never worked in this sector before. The Quality Manager wants the ISO 9001 certificate to cover the new contract.

During the audit, a team member finds that a number of print jobs have been rejected by several clients over a number of months due to spelling errors in the print run. The Print Manager blames the new employees they had to take on because of a big contract. The auditor raises a nonconformance against clause 10.2.1.b of ISO 9001.

Which one of the evidence statements would support this finding?

A . There was no record that the organisation evaluated the effectiveness of the training given to new
employees.
B . There was no evidence that a check of spelling took place before the release of printing to the client.
C . The actions taken to deal with customer complaints did not prevent recurrence of the problem.
D . The organisation did not provide the correct resources to prevent nonconformity.

Reveal Solution Hide Solution