ISO-9001-Lead-Auditor Practice Questions

Identifying the source of information

Sampling available data

Gathering audit evidence

Verifying objective evidence

Evaluating evidence against the audit criteria

Making audit conclusions

Evaluating against the audit criteria

According to ISO 19011:2018, clause 6.4, the process of collecting and verifying information during an audit involves the following steps1:

Identifying the source of information: The audit team should identify the sources of information that are relevant to the audit objectives, scope and criteria. These sources may include documents, records, personnel, processes, activities, facilities, equipment, etc. The audit team should also determine the methods and tools for accessing and collecting the information, such as interviews, observations, document review, sampling, etc.

Sampling available data: The audit team should select a representative sample of the available data to verify the conformity and effectiveness of the management system. The sample size and selection method should be based on the audit objectives, scope and criteria, as well as the level of confidence and risk. The audit team should also consider the validity, reliability, relevance and sufficiency of the data.

Gathering audit evidence: The audit team should use the methods and tools identified in the previous step to collect audit evidence, which is the records, statements of fact or other information that are relevant to the audit criteria and verifiable. The audit team should record the audit evidence in a clear, concise and objective manner, using notes, checklists, photographs, audio or video recordings, etc.

Verifying objective evidence: The audit team should verify the accuracy, completeness and authenticity of the audit evidence collected. This may involve cross-checking different sources of information, confirming the identity and authority of the persons providing the information, examining the original documents or records, etc. The audit team should also identify any discrepancies, inconsistencies or gaps in the audit evidence.

Evaluating evidence against the audit criteria: The audit team should compare the audit evidence with the audit criteria to determine the extent of conformity and nonconformity. The audit team should also identify any opportunities for improvement, best practices, positive aspects or potential risks. The audit team should use professional judgement and apply the principles of auditing when evaluating the audit evidence.

Making audit conclusions: The audit team should consolidate the audit findings and evaluate the overall performance and effectiveness of the management system. The audit team should also consider the audit objectives, scope and criteria, as well as the context and expectations of the auditee and other interested parties. The audit team should provide a clear, concise and objective statement of the audit conclusions, which may include the degree of conformity, the achievement of the intended outcomes, the need for corrective actions, the suitability for certification, etc.

Evaluating against the audit criteria: The audit team should review the audit conclusions and ensure that they are consistent with the audit criteria and supported by sufficient and appropriate audit evidence. The audit team should also ensure that the audit conclusions are communicated to the auditee and other relevant parties in a timely and effective manner, using the agreed audit report format and distribution method.

The activities that are specifically required by ISO 17021-1 as part of third-party (Certification Body) surveillance audit processes are:

•Option A: Audit use of certification marks on marketing materials. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to audit the client’s use of marks and/or any other reference to certification, as applicable, to ensure conformity with the certification requirements.

•Option B: Review changes to the QMS since last visit. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review any changes affecting the client’s quality management system and its ability to continue to fulfil the requirements of the standard used for certification.

•Option C: Confirm effectiveness of internal audit and management review. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to confirm the continuing effectiveness of the client’s quality management system, including the effectiveness of the internal audit and management review processes.

•Option F: Review the status of previously raised findings and audit effectiveness of any outstanding findings. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review the status of findings and any corrective actions taken by the client in response to previous audits, and to verify the effectiveness of the implemented corrective actions.

•Option H: Verify legal compliance. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to verify the client’s compliance with applicable statutory and regulatory requirements related to the scope of certification.

•Option I: Handling of customer complaints since last visit. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review the client’s handling of customer complaints related to the certified activities since the last audit.

The following options are not correct:

•Option D: Complete a full document review of the quality management system. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to complete a full document review of the quality management system during surveillance audits. A full document review is only required during the initial certification audit or when there are significant changes to the quality management system or the certification requirements.

•Option E: Failing to meet financial responsibilities. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to audit the client’s financial responsibilities during surveillance audits. The certification body may have contractual arrangements with the client regarding the payment of fees, but this is not part of the surveillance audit process.

•Option G: Review the calibration status of the instrumentation. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to review the calibration status of the instrumentation during surveillance audits. The certification body may audit the client’s monitoring and measuring resources as part of the quality management system requirements, but this is not a specific activity required by ISO 17021-1.

•Option J: Conduct a minimum number of annual surveillance audits during the certification period. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to conduct a minimum number of annual surveillance audits during the certification period. The certification body may determine the frequency and duration of surveillance audits based on the risk and performance of the client, but this is not a specific activity required by ISO 17021-1.

Non-Conformity Report:

ISO 9001 Clause Number

Nature of Problem

ISO 9001 Requirement That Has Not Been Fulfilled

6.1.1

Several risks and opportunities have not been determined.

" The organization shall consider the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed. "

6.1.2 (a)

Actions to address risks and opportunities not planned.

" The organization shall plan actions to address risks and opportunities. "

Step-by-Step Reasoning:

Clause 6.1.1 - Determining Risks and Opportunities:

Requirement: The organization must determine risks and opportunities that are relevant to its Quality Management System (QMS). This ensures that the QMS achieves intended results and prevents undesired effects.

Problem Identified: While some risks and opportunities were discussed, the organization did not perform a systematic evaluation of all risks (e.g., health and safety legislation changes, retiring trainers).

Clause 6.1.2 (a) - Planning Actions for Risks and Opportunities:

Requirement: The organization must plan actions to address identified risks and opportunities. These actions should be integrated into the QMS processes to ensure continuous improvement.

Problem Identified: The Quality Systems Manager confirmed that no plans were made to address the risks and opportunities because the Managing Director deemed it unnecessary. This violates the requirement to plan actions.

Correct Options Selected:

Clause 6.1.1 with the nature of the problem as: " Several risks and opportunities have not been determined. "

Clause 6.1.2 (a) with the nature of the problem as: " Actions to address risks and opportunities not planned. "

ISO 9001 Requirements Not Fulfilled:

For 6.1.1: " The organization shall consider the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed. "

For 6.1.2 (a): " The organization shall plan actions to address risks and opportunities. "

As the audit team leader, it is crucial to manage differing opinions constructively and ensure that the correct clause is selected for the nonconformity based on solid evidence. Here’s how the situation should be handled:

E.  

F.  

H. Try to obtain a consensus between you and the second auditor after a discussion of the different opinions: Consensus-building is a crucial skill for an audit team leader. Achieving agreement ensures the nonconformity is addressed accurately and with full team support.

Options such as overruling immediately (D) or deferring the decision without full discussion (B) could undermine team dynamics and the audit process. Consulting the quality manager (A) or selecting an entirely different clause (G) is unnecessary, as the team should resolve the issue internally​​.

ISO 9001:2015 requires that nonconformities be objective, evidence-based, and referenced against defined requirements , not personal, prescriptive, or solution-driven.

When a nonconformity is raised, it must clearly show what requirement was not met and what objective evidence demonstrates this failure .

✅ Why D (Audit criteria) is required

A nonconformity must reference the requirement that was not fulfilled (e.g., ISO 9001 clause, procedure, contract, or legal requirement).

ISO 9001 defines nonconformity as “non-fulfilment of a requirement” .

Without audit criteria, there is no basis for declaring a nonconformity.

???? Supported by:

Clause 9.2.2 – Internal audits must determine whether the QMS conforms to requirements

Clause 10.2.2 – Documented information shall describe the nature of the nonconformity

✅ Why E (Relevant audit evidence) is required

ISO 9001 requires decisions and conclusions (including audit findings) to be based on evidence .

Audit evidence ensures objectivity and prevents subjective or opinion-based findings.

???? Supported by:

Clause 9.1.3 – Analysis and evaluation shall be based on data and information

Clause 9.2.2 – Audit results must demonstrate conformity or nonconformity based on evidence

❌ Why the other options are NOT correct

A (Name of person responsible) ISO 9001 focuses on system and process failures , not blaming individuals.

B (Target time for corrective action) This is part of corrective action planning , not the nonconformity statement itself (Clause 10.2).

C (Name of technical expert) ISO 9001 does not require identifying auditors or experts in the nonconformity statement.

F (Action to eliminate the nonconformity) Auditors must not prescribe solutions . The auditee determines corrective actions (Clause 10.2).

Nonconformity report

ISO 9001 Clause Number: 8.5.4 Nature of problem: Cleaning and sanitising records are not available for every batch. ISO 9001 requirement that has not been fulfilled: ISO 9001 - “The organization shall implement planned arrangements, at appropriate stages, to verify that the product requirements have been met.” Evidence: 40 cleaning records are available for 63 batches.

B.  

D.  

H. The concentration of the cleaning liquid used vs the concentration fixed in SP-701

I. The planned duration of the process vs the minimum time required in SP-701

J. Weight of linen being washed vs the maximum weight required in SP-701

C.  

In this scenario, the audit team leader must balance maintaining the integrity of the audit plan while considering the auditee’s request. The two best responses allow for flexibility without compromising the audit ' s rigor:

A.  

C.  

The other options, such as extending the audit duration (B, F) or strictly adhering to the original plan (D, E), may not be practical or necessary. Revising the plan to audit all laboratories or using virtual auditing ensures that the audit remains efficient while addressing the organization ' s concerns​.

Here is the correct matching of ISO 9001:2015 clauses to the steps mentioned in the change management process:

We identified risks and opportunities and fed these into our risk management processes.

Clause 6.1 (Actions to address risks and opportunities)

We found a suitable supplier.

Clause 8.4 (Control of externally provided processes, products, and services)

We monitored customer feedback and noticed an increase in negative feedback about lead times.

Clause 9.1.2 (Customer satisfaction)

We put together a plan for implementation.

Clause 6.2.2 (Planning to achieve quality objectives)

We monitored the performance of the new supplier.

Clause 8.4.2 (Type and extent of control of external providers)

We noticed that productivity targets were being missed.

Clause 9.1.1 (Monitoring, measurement, analysis, and evaluation)

We communicated the plan internally.

Clause 7.4 (Communication)

We looked at the data at the management review and decided we needed to do something different.

Clause 9.3.2 (Management review inputs)

We reorganised the staffing and implemented redundancies.

Clause 7.1.2 (People)

We set an objective to effectively implement the transition and outsource manufacturing.

Clause 6.2.1 (Quality objectives and planning to achieve them)

This aligns the steps of the change process with relevant ISO 9001:2015 clauses related to risk, planning, communication, and monitoring.