PECB ISO-9001-Lead-Auditor Dumps

According to the guidance on conducting the audit closing meeting1, the audit team leader should provide a summary of the audit findings and conclusions, invite discussions, and agree on timelines for any corrective actions. The audit team leader should also be respectful, constructive, and objective when presenting the nonconformities, and avoid any personal or emotional comments. The audit team leader should also consider the impact of the disruptive event (such as the Covid-19 pandemic) on the auditee’s context, interested parties, and risks2, and acknowledge any good practices or improvements observed during the audit. Therefore, option D is the best option, as it follows the best practices for the closing meeting and allows the auditee to understand the nonconformities and their implications, and to participate in the analysis and resolution of the issues. Option A is not correct, as it is not respectful, constructive, or objective, and it does not invite any discussion or feedback from the auditee. It also assumes that the audit team leader has the authority to recommend the removal of the supplier from the approved list, which may not be the case. Option B is not correct, as it does not provide enough information or explanation to the auditee, and it does not allow any discussion or feedback from the auditee. It also does not follow the best practices for the closing meeting, such as providing a summary of the audit, acknowledging any good practices, and agreeing on timelines for corrective actions. Option C is not correct, as it does not involve the other managers who are responsible for the functions or processes that were audited, and who may have valuable input or information to share. It also does not follow the best practices for the closing meeting, such as providing a summary of the audit, inviting discussions, and agreeing on timelines for corrective actions. References: 1: Conducting the Audit Closing Meeting: Sharing the Results2: Auditing ISO 9001:2015 in the Context of a Disruptive Event.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 19011:2018, Clause 5.2 (Audit Program Management):

The audit committee is responsible for establishing the internal audit program.

The audit schedule (A) is determined within the program, but it is not the main role of the committee.

Thus, C is the correct answer.

In this scenario, the organization has set a quality objective of achieving a 90% minimum exam pass rate for all courses. The auditor’s task is to assess whether this objective is being monitored effectively and if appropriate actions are taken when the objective is not met.

B. You would determine how the exam pass rate figures were analysed: ISO 9001:2015, particularly Clause 9.1 (Monitoring, measurement, analysis, and evaluation), requires organizations to evaluate performance data. The auditor should verify how the organization analyses the pass rate data to ensure trends are identified, and corrective actions are planned based on this analysis.

D. You would determine what corrective action was being taken to address the low pass rates: When performance falls short of the objective, as seen with Course 4 (where the pass rate is below 90% in all months), Clause 10.2 (Nonconformity and corrective action) requires organizations to take corrective actions to address issues. The auditor would need to check if corrective actions have been initiated to address consistently low pass rates.

Statements A, C, E, and F do not directly address the monitoring and corrective action required under ISO 9001:2015 in this context​​.

Comprehensive and Detailed In-Depth Explanation:

Before conducting an audit, the certification body must provide an audit offer, which outlines the audit scope, criteria, and duration.

Clause References:

ISO/IEC 17021-1:2015, Clause 9.1.2 – Audit Planning: Requires the certification body to communicate key audit details before finalizing the audit process.

Why is the Correct Answer C?

The audit offer includes scope, criteria, duration, and engagement limits before the certification agreement is signed.

The certification body sends this to the auditee before finalizing the contract.

Why are the Other Options Incorrect?

A (Certification Agreement) → This is the contract signed after the audit offer is accepted.

B (Audit Plan) → The audit plan details the day-to-day audit schedule and is created after the agreement.

D (Audit Mandate) → This is an internal document for the certification body.

Comprehensive and Detailed In-Depth Explanation:

Understanding Audit Stages Based on ISO/IEC 17021-1:2015

ISO certification audits consist of two main stages:

Stage 1 Audit (Readiness Review)

The organization’s documented information is reviewed to assess readiness for Stage 2.

This ensures that the QMS is developed, implemented, and prepared for full assessment.

Stage 2 Audit (On-Site Evaluation)

Auditors assess process implementation and effectiveness through interviews, observations, and evidence collection.

The audit team verifies if the organization meets ISO 9001 requirements in practice.

Why is the Correct Answer B?

The audit team reviewed ME’s documents, which is a Stage 1 activity.

The audit team performed interviews, sampling, and on-site verification, which is a Stage 2 activity.

There was no mention of an audit follow-up or a surveillance audit, which occur post-certification.

Why are the Other Options Incorrect?

A (Audit follow-up and Stage 1 Audit) → Follow-up audits occur after certification, which was not the case here.

C (Stage 2 Audit and Surveillance Audit) → Surveillance audits are post-certification audits and were not conducted yet.

In this scenario, the audit team leader must balance maintaining the integrity of the audit plan while considering the auditee’s request. The two best responses allow for flexibility without compromising the audit's rigor:

A. I could audit the other laboratories virtually at the end of this audit: Virtual audits can be a valid option, especially in multi-site audits. ISO 9001:2015 does not prohibit virtual audits, and in certain situations, they are practical for reviewing documentation or observing operations remotely.

C. I could try to revise the audit programme to see if I can audit all laboratories: Revising the audit programme to accommodate additional site visits is a reasonable compromise. ISO 9001:2015 audits are based on risk and sampling, but the audit team leader has the flexibility to adjust the audit scope if it fits within the audit duration and resources.

The other options, such as extending the audit duration (B, F) or strictly adhering to the original plan (D, E), may not be practical or necessary. Revising the plan to audit all laboratories or using virtual auditing ensures that the audit remains efficient while addressing the organization's concerns​.

Based on the scenario and the concept of an ‘audit trail’ within the context of ISO 9001, the three statements that apply would likely be:

A. Decisions on improvement action timescales not involving departmental managers. This indicates a lack of involvement and communication with those responsible for implementing the improvements, which is a key part of an effective audit trail1.

B. Evaluation of the results of the improvement action not always documented by the Quality Manager. Proper documentation is essential for an audit trail, as it provides evidence that actions have been evaluated and are effective1.

C. Limited knowledge of the content of Quality Improvement Requests by departmental staff. An audit trail should ensure that all relevant parties are aware of and understand the actions being taken, which is not the case here1.

These points suggest issues with the communication, documentation, and involvement of relevant personnel in the quality management system processes, which are crucial for maintaining an effective audit trail and, by extension, a robust quality management system.

According to the ISO 9001 Auditing Practices Group Guidance on Improvement Opportunities1, an improvement opportunity is a suggestion made by the auditor for the auditee to consider that, if implemented, may enhance the performance of the QMS. Improvement opportunities are not mandatory, but they should be based on objective evidence and aligned with the audit criteria and objectives. Improvement opportunities should also be realistic, feasible, and beneficial for the auditee. In this case, the evidence statements that represent acceptable improvement opportunities in the report are A, C, and E, because they address the potential causes and effects of the spelling errors in the print run, and propose possible actions that may improve the quality of the products and services, and the effectiveness of the QMS. These options are consistent with the requirements and principles of ISO 9001, such as clause 6.1 on actions to address risks and opportunities, clause 8.1 on operational planning and control, clause 8.5.1 on control of production and service provision, and clause 10.2 on nonconformity and corrective action. The other options are not appropriate improvement opportunities, because they are either irrelevant, unrealistic, or unhelpful for the auditee. For example, option B may contradict the audit objective and scope, option D may imply a lack of auditor competence or impartiality, option F may not address the root cause of the problem, option G may not be applicable or effective, and option H may not be feasible or justified. References: ISO 9001 Auditing Practices Group Guidance on Improvement Opportunities, ISO 9001:2015, ISO 9001 Auditing Practices Group Guidance on Audit Evidence

Sequence:

Stage 1 Audit

Stage 2 Opening Meeting

Interviews

Stage 2 Closing Meeting

Close-out of Stage 2 Audit Findings

Issue Certificate

Surveillance Audit

Follow-up Audit

To complete the sequence, you can drag and drop the options to the appropriate blank section.

Here is a brief explanation of each step:

Stage 1 Audit: This is the initial audit that aims to assess the readiness of the organization for the stage 2 audit. It involves reviewing the documentation of the quality management system, evaluating the scope and objectives of the audit, and identifying any major gaps or nonconformities34.

Stage 2 Opening Meeting: This is the meeting that marks the start of the stage 2 audit. It involves confirming the audit plan, the audit criteria, the audit scope, and the audit team. It also provides an opportunity for the auditee to ask any questions or raise any concerns34.

Interviews: This is the main activity of the stage 2 audit, where the audit team collects evidence by interviewing the personnel involved in the quality management system, observing the processes and activities, and examining the records and documents. The audit team uses various techniques, such as sampling, measurement, analysis, and evaluation, to verify the conformity and effectiveness of the quality management system345.

Stage 2 Closing Meeting: This is the meeting that marks the end of the stage 2 audit. It involves presenting the audit findings, the audit conclusions, and the audit report to the auditee. It also provides an opportunity for the auditee to provide feedback, ask questions, or dispute any findings34.

Close-out of Stage 2 Audit Findings: This is the process of verifying that the auditee has taken appropriate corrective actions to address any nonconformities or opportunities for improvement identified during the stage 2 audit. The audit team may request evidence or conduct a follow-up visit to confirm the effectiveness of the corrective actions34.

Issue Certificate: This is the process of issuing a certificate of conformity to the auditee, if the audit team is satisfied that the quality management system meets the requirements of the standard and that there are no major nonconformities or unresolved issues. The certificate is valid for a specified period, usually three years, and is subject to periodic surveillance audits34.

Surveillance Audit: This is the process of conducting periodic audits, usually once a year, to monitor the continued conformity and effectiveness of the quality management system. It involves reviewing the changes, improvements, and performance of the quality management system, and identifying any new nonconformities or opportunities for improvement34.

Follow-up Audit: This is the process of conducting an additional audit, usually in response to a significant change, a complaint, or a major nonconformity, to verify the impact and the corrective actions taken by the auditee. It may result in the suspension, withdrawal, or renewal of the certificate, depending on the outcome of the audit34.

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 requires organizations to ensure that auditors have the necessary competence and knowledge to conduct audits effectively.

Clause References:

ISO 19011:2018, Clause 7.2.1 – Determining Competence of Auditors: Auditors must have knowledge of applicable legal and regulatory requirements that affect the scope of the audit.

ISO/IEC 17021-1:2015, Clause 7.1.2 – Competence Requirements: Certification bodies must ensure that auditors assigned to the audit team possess relevant knowledge in areas such as legal and regulatory compliance.

Why is the Correct Answer C?

Each audit team member should have sufficient knowledge of relevant legal and regulatory requirements to ensure compliance.

This helps auditors identify gaps or nonconformities related to compliance obligations.

Having multiple team members with knowledge reduces reliance on a single expert and ensures a comprehensive assessment.

Why are the Other Options Incorrect?

A (Only one team member needs knowledge) → Incorrect because audits involve various aspects, and all auditors should have basic awareness of legal and regulatory requirements.

B (Legal knowledge is not necessary) → Incorrect because compliance is essential for QMS effectiveness.

D (Only the lead auditor needs legal knowledge) → Incorrect because ISO requires all auditors to be competent in applicable laws, not just the leader.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 9001:2015, Clause 9.2 (Internal Audit):

Internal audits can be conducted on an ongoing basis as part of continual improvement.

Audits consider both conformity and effectiveness (A is incorrect).

Thus, C is the correct answer.

In a third-party certification audit, auditors are responsible for maintaining confidentiality as part of their professional duties. Here’s how they can demonstrate it:

A. Adhere to the CQI Professional Code of Conduct: The CQI (Chartered Quality Institute) Code of Conduct outlines ethical principles, including confidentiality. Auditors must adhere to professional standards, ensuring sensitive information is protected and not disclosed improperly.

B. Confirm the confidentiality arrangements with the auditee regarding the use of mobile devices/cameras: Before using mobile devices or cameras, auditors must seek explicit permission from the auditee and agree on confidentiality terms, preventing unauthorized recording or sharing of sensitive information.

Options C, D, and E involve breaching confidentiality and are not acceptable practices in an ISO 9001:2015 certification audit. Sharing sensitive information, removing evidence without consent, or discussing it with unauthorized parties violates audit principles and the standard's confidentiality requirements​.

Comprehensive and Detailed In-Depth Explanation:

Before accepting an audit, the certification body must assess the integrity of the auditee and the nature of its operations to ensure compliance feasibility.

Clause References:

ISO/IEC 17021-1:2015, Clause 9.1.2 – Audit Planning:

The certification body must review the auditee’s background, reputation, and operational complexity before accepting the audit.

Why is the Correct Answer C?

The auditee’s integrity and reputation impact the credibility of certification.

The nature of operations determines audit complexity and resource allocation.

Why are the Other Options Incorrect?

A (Integrity and reputation only) → Correct but incomplete; nature of operations is equally important.

B (Nature of operations only) → Integrity is also a factor, not just operations.

D (No previous major nonconformities required) → Auditees with past major nonconformities can still be audited if corrective actions are taken.

The purpose of conducting a document review is to determine the conformity of the system, as far as documented, with audit criteria and to gather information to support the audit activities. A document review is a systematic and objective examination of the documented information that is relevant to the audit objectives and scope. It can help the auditor to verify if the documented information is complete, accurate, consistent, and up-to-date. It can also help the auditor to identify any gaps, errors, or nonconformities in the documented information that may affect the audit findings or conclusions.

The other options are not correct because they do not reflect the true purpose of a document review. Option A describes the purpose of an audit report, which is to communicate the audit results and recommendations to the management and other interested parties. Option B describes the purpose of an audit plan, which is to define the scope, objectives, criteria, methods, resources, and schedule of an audit. Option C describes the purpose of an audit evidence report, which is to provide evidence of nonconformities or opportunities for improvement identified during an audit. Option D describes the purpose of an audit decision report, which is to justify or explain why certain decisions were made during an audit.

I hope this answer helps you understand why option F is correct and why options A-C-D are incorrect. If you want to learn more about ISO 9001 Lead Auditor exam questions and answers, you can check out some of these resources:

ISO 9001 Lead Auditor Sample Exam Questions and Answers: This article provides some sample questions and answers for each section of the ISO 9001 Lead Auditor exam.

ISO 9001 (QMS) Lead Auditor Quiz Questions and Answers: This article provides some quiz questions and answers on various topics related to ISO 9001 QMS.

ISO 9001 Lead Auditor - Exam Practice Tests: This course offers practice tests with explanations for each question.

Irca Lead Auditor Exam Questions And Answers Pdf: This document contains some exam questions and answers in PDF format.

Comprehensive and Detailed Explanation From ISO 9001 / ISO 19011 Guidance:

ISO 9001:2015 requires audits to be planned and conducted objectively, but it refers auditors to ISO 19011 for detailed guidance on audit activities, including audit team meetings and preparation for closing meetings.

ISO 19011:2018 describes the purpose of the audit team meeting before the closing meeting as ensuring alignment, consistency, and clarity of audit conclusions and messages to the auditee.

Explanation of the selected tasks:

C. The audit team review any points raised by the auditee-nominated representative during the audit.

ISO 19011 requires the audit team to consider and evaluate information and concerns raised by the auditee to ensure audit findings are accurate, fair, and evidence-based before the closing meeting.

E. The audit team agrees on the audit opportunities for improvement to be presented to the supplier.

Before the closing meeting, the audit team must align on opportunities for improvement so that these are presented consistently and clearly, without contradiction between auditors.

F. The audit team agrees on the roles of each audit team member for the closing meeting.

ISO 19011 requires clear allocation of responsibilities within the audit team. Agreeing who will present findings, nonconformities, or conclusions is a normal and expected preparation activity.

G. The audit team leader writes all audit finding reports, taking into account the inputs provided by each auditor.

The audit team leader is responsible for consolidating audit inputs and ensuring consistency of reporting, even though individual auditors contribute evidence and findings.

H. Each audit team member completes the report of their individual findings.

ISO 19011 expects each auditor to document their findings and provide them to the audit team leader for consolidation into the final audit report.

J. The audit team agrees on the conformities and non-conformities to be included in the final audit report.

Before the closing meeting, the audit team must reach consensus on audit conclusions to ensure findings are clear, justified, and consistently communicated.

Explanation of why the other options are not selected:

A: Daily meetings with the auditee’s Quality Manager are not part of an internal audit team meeting and may compromise independence.

B: The final audit report is not completed and signed during the audit team meeting prior to the closing meeting.

D: Refusing to review corrective actions is inappropriate; however, corrective actions are normally reviewed after the audit, not during preparation for the closing meeting.

I: Informing the Procurement Manager is an administrative action, not a task of the audit team meeting.

ISO-aligned conclusion:

An audit team meeting prior to the closing meeting focuses on alignment, consolidation of findings, agreement on conclusions, and preparation for clear communication. The six correct tasks are therefore C, E, F, G, H, and J.

To certify an organization's ISO 9001:2015-based Quality Management System (QMS) for the first time, the correct sequence of activities would be:

Establish the management system (already in place).

Supplier audit

Internal audit

Management review

Initial certification audit – stage 1

Initial certification audit – stage 2 (already in place).

This sequence follows the typical path for preparing and ensuring that a QMS is functioning as required, leading up to certification.

Comprehensive and Detailed In-Depth Explanation:

The Stage 2 audit (ISO 17021-1:2015, Clause 9.3.1.3) is conducted to:

Verify whether the QMS is effectively implemented and operational.

Ensure compliance with ISO 9001 requirements in actual practice.

Identify nonconformities that may impact certification.

Reviewing documented information (Answer B) is part of Stage 1, and gathering scope information (Answer C) is done before the certification audit.

D. I would look for evidence that the actions resulting from the risk assessment had been taken.

According to ISO 9001:2015, Clause 6.1.2 requires the organization to plan actions to address risks and opportunities. The organization must integrate and implement these actions into its quality management system and evaluate their effectiveness. The auditor should seek evidence that the organization has assessed the risks and taken appropriate actions.

B. I would ask to audit the Technical Manager by phone.

As the Technical Manager is responsible for this process and is absent due to illness, it is reasonable to attempt to contact him to obtain accurate information. This ensures that the audit process is not unduly delayed and that the information is obtained from the appropriate person.

A. I would not accept the legal compliance expert answering the question.

While the legal compliance expert might not be the best source for technical details, outright rejecting their input is not appropriate. It is better to first verify if the expert can provide relevant information.

C. I would delay the audit until the return of the Technical Manager.

This would be an inefficient approach. Contacting the Technical Manager by phone is a more practical and reasonable option.

E. I would ask for a different guide instead of the legal compliance expert.

The guide's role is not necessarily to answer technical questions but to facilitate the audit. Since Jack is already familiar with the situation, replacing him may not add value.

F. I would ask the consultant to leave the meeting since he is not an employee of the organization.

This is inappropriate and could disrupt the audit process. There is no rule in ISO 9001 preventing a consultant from assisting in the audit if authorized by the organization.

Why Not the Other Options:

According to the ISO - Management system standards page, the key benefits of an effective management system include improved operational effectiveness and efficiency, improved risk management and protection of people and the environment, and enhanced drive for innovation. The Integrated Use of Management System Standards (IUMSS) handbook also states that the purpose and objectives of management system standards are to help organizations improve their performance by specifying repeatable steps that organizations consciously implement to achieve their goals and objectives.

Therefore, the complete sentence is:

“The purpose of a management system standard is to improve the performance of an organisation.”

B. Control of externally provided processes, products, and services: This is relevant because the organization has outsourced the manufacture of its own brand products to a supplier. According to ISO 9001, the organization must ensure that externally provided processes remain within the control of its quality management system.

C. Design and development of products and services: Even though the organization no longer manufactures in-house, it still needs to control the design and development of its products, especially since they are now being produced by an external provider.

F. Organisation roles and responsibilities: The change in strategy has led to a significant reduction in staff, which would have an impact on the roles and responsibilities within the organization. It is important to audit how these changes have been managed and communicated within the organization to ensure continued effectiveness of the quality management system.

These audit trails are aligned with the requirements of ISO 9001:2015, which emphasizes the importance of controlling externally provided processes and products, managing design and development, and clearly defining roles and responsibilities within the quality management system.

Top management is responsible for establishing, implementing, and maintaining the quality policy. The quality policy provides a framework for setting quality objectives and must be compatible with the context of the organization and support its strategic direction. It should also provide a commitment to satisfy applicable requirements and to continuous improvement.

Comprehensive and Detailed In-Depth Explanation:

Clause 5.1.1 of ISO 9001:2015 – Leadership and Commitment – specifically mandates that top management must take accountability for the effectiveness of the QMS. They are also responsible for ensuring:

Integration of the QMS into business processes (5.1.1 c)

Promotion of customer focus and continual improvement (5.1.1 d, i)

Availability of necessary resources (5.1.1 e)

That the QMS achieves its intended results (5.1.1 g)

Let’s analyze the selected options:

✅ A. Top management is not accountable for the effectiveness of the QMS.

This directly violates clause 5.1.1 a, which explicitly requires top management to take accountability for the effectiveness of the QMS. Delegating this to a middle-level Quality Manager, as described in the scenario, constitutes a nonconformity.

✅ F. The Quality Manager does not have access to the resources needed for the QMS.

According to clause 5.1.1 e, top management must ensure the availability of required resources for maintaining and improving the QMS. If the Quality Manager is resource-constrained, it indicates top management has failed to meet this requirement.

Now, why the other options are incorrect in terms of direct clause 5.1.1 nonconformity:

❌ B. Avoiding giving improvement actions to the Chief Executive – While this may reflect poor communication, it is not, by itself, a clear breach of 5.1.1 unless linked directly to top management’s lack of accountability or commitment.

❌ C. Chief Executive never attending meetings – ISO 9001 does not require physical attendance of the Chief Executive at management reviews. What matters is whether top management is fulfilling their roles, not how.

❌ D. Completing only half of improvement actions – This indicates performance issues but does not necessarily indicate top management’s lack of accountability, unless they failed to monitor progress entirely.

❌ E. Reporting to one designated senior manager – This is not inherently nonconforming unless that senior manager does not fulfill top management’s responsibilities under 5.1.1.

Relevant ISO 9001:2015 Reference:

Clause 5.1.1 a, e, g, h:

"Top management shall demonstrate leadership and commitment with respect to the quality management system by:

a) taking accountability for the effectiveness of the quality management system;

e) ensuring that the resources needed for the quality management system are available..."

In the context of a third-party certification audit, match the roles with the following responsibilities:

Responsibilities:

Conduct the audit to the assigned area.= Auditors

Assist the auditors in identifying personnel to participate in the audit.= Guide

Assign each team member’s responsibility for the audit.= Audit team leader

Respond to questions and provide evidence to the auditor.= Auditee

According to ISO 19011:2018, clause 3, the definitions of the roles are as follows1:

Auditors: persons with the competence to conduct an audit

Guide: person appointed by the auditee to assist the audit team

Auditee: organization being audited

Audit team leader: member of an audit team appointed to manage the audit or an audit team

Therefore, the roles can be matched to the responsibilities based on these definitions and the description of the audit process in clause 6 of the standard1.

According to the ISO 9001:2015 standard, clause 8.7 requires that an organization identify and control any nonconforming outputs that do not conform to the requirements of the customer or other relevant requirements. Nonconforming outputs are any outputs from the process, product or service that do not meet the specified quality criteria. Nonconforming outputs must be dealt with in one or more of the following ways:

Correction of the nonconformity

Segregation, containment, return or suspension of provision of products and services

Informing the customer

Authorisation for acceptance under concession

The organization must also retain documented information on the description of the nonconformity, the actions taken, any concessions obtained, and the identification of the authority deciding the action to resolve the nonconformity.

In this scenario, you have interviewed a line supervisor who is responsible for managing a manual picking line where operators are removing contaminant materials from incoming products. The supervisor has explained that these plastic items are rejected at this stage because they do not meet their processing standards and they can damage their machinery and compromise their quality standards. The supervisor has also mentioned that some of these rejected items are melted down in another process later on and some are disposed of as waste products that cannot be recycled.

Based on this information, you can investigate further by taking two actions:

A. Check the process for handling nonconforming items: You can verify whether there is a documented procedure for identifying, segregating, containing, returning or suspending provision of nonconforming items at this stage. You can also check whether there is a system for informing customers about any nonconforming items that may affect their satisfaction or expectations.

D. Determine what happens to the waste products: You can verify whether there is a documented procedure for disposing of waste products that cannot be recycled as per environmental regulations and customer requirements.

These two actions would help you to determine whether there are any nonconforming outputs at this stage and how they are controlled by the organization.

Non-Conformity Report:

ISO 9001 Clause Number

Nature of Problem

ISO 9001 Requirement That Has Not Been Fulfilled

6.1.1

Several risks and opportunities have not been determined.

"The organization shall consider the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed."

6.1.2 (a)

Actions to address risks and opportunities not planned.

"The organization shall plan actions to address risks and opportunities."

Step-by-Step Reasoning:

Clause 6.1.1 - Determining Risks and Opportunities:

Requirement: The organization must determine risks and opportunities that are relevant to its Quality Management System (QMS). This ensures that the QMS achieves intended results and prevents undesired effects.

Problem Identified: While some risks and opportunities were discussed, the organization did not perform a systematic evaluation of all risks (e.g., health and safety legislation changes, retiring trainers).

Clause 6.1.2 (a) - Planning Actions for Risks and Opportunities:

Requirement: The organization must plan actions to address identified risks and opportunities. These actions should be integrated into the QMS processes to ensure continuous improvement.

Problem Identified: The Quality Systems Manager confirmed that no plans were made to address the risks and opportunities because the Managing Director deemed it unnecessary. This violates the requirement to plan actions.

Correct Options Selected:

Clause 6.1.1 with the nature of the problem as: "Several risks and opportunities have not been determined."

Clause 6.1.2 (a) with the nature of the problem as: "Actions to address risks and opportunities not planned."

ISO 9001 Requirements Not Fulfilled:

For 6.1.1:"The organization shall consider the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed."

For 6.1.2 (a):"The organization shall plan actions to address risks and opportunities."

Comprehensive and Detailed In-Depth Explanation:

During communication with top management, the auditor should discuss:

The quality policy (ISO 9001:2015, Clause 5.2.1), ensuring that it is established, communicated, and understood.

Internal audits (ISO 9001:2015, Clause 9.2), verifying that they are planned and effectively implemented.

These discussions help assess leadership commitment and the effectiveness of the QMS.

According to ISO 9001:2015, clause 9.2.2.e, the organization is required to retain documented information as evidence of the implementation of the audit programme and the audit results. This includes the records of the nonconformities identified during the internal audits and the corrective actions taken to address them. The organization is also required to verify the effectiveness of the corrective actions, as per clause 10.2.2.

Therefore, in the scenario given, the Quality Manager’s decision to automatically close any nonconformance over 3 years old without obtaining any confirmation from the relevant departments or verifying the effectiveness of the corrective actions is a clear violation of the requirements of clause 9.2.2.e. This indicates a lack of control and follow-up of the internal audit process, as well as a potential risk of recurrence or occurrence of the nonconformities in other areas. This also undermines the credibility and value of the internal audit programme, as well as the risk-based approach claimed by the Quality Manager.

Hence, the best course of action to take is D, to raise a nonconformance report against clause 9.2.2.e of ISO 9001, and to communicate the audit findings to the relevant management. The other options are either insufficient or irrelevant to address the issue, as they do not directly relate to the noncompliance with clause 9.2.2.e.

ISO 9001:2015 requires organisations to understand their context and to use this understanding as an input to planning the quality management system. Tools such as PESTLE are acceptable methods, but auditors must verify how the outputs are used, not simply that the analysis exists.

Relevant ISO 9001 requirements:

Clause 4.1 – Understanding the organisation and its contextThe organisation shall determine external and internal issues that are relevant to its purpose and strategic direction and that affect its ability to achieve the intended results of the QMS.

Clause 6.1 – Actions to address risks and opportunitiesThe organisation shall plan actions to address risks and opportunities identified from context analysis and integrate these actions into the QMS processes.

Explanation of the correct audit trails:

C. What actions have been taken to address the risks and opportunities from the PESTLE analysis?

This audit trail directly links PESTLE outputs to Clause 6.1. It allows the auditor to determine whether the organisation has translated identified political, economic, social, technological, legal, and environmental issues into concrete actions within planning, operational control, or resource allocation. Without actions, the PESTLE analysis has no impact on QMS planning.

E. How has the PESTLE analysis contributed to the improvement of the QMS?

ISO 9001 requires context analysis to support improvement and strategic alignment of the QMS. This audit trail confirms whether PESTLE outputs are used as inputs to improvement activities, management review, or changes to processes, supporting Clauses 4.1, 6.1, and 10.3.

Explanation of why the other options are not selected:

A: Review by a specific manager is not a requirement of ISO 9001 and does not demonstrate impact on QMS planning.

B: PESTLE does not require consultation with external interested parties; that relates to Clause 4.2, not planning impact.

D: Training in SWOT is irrelevant, as ISO 9001 does not mandate any specific analysis tool.

F: Sharing information with external interested parties relates to communication, not to how PESTLE affects QMS planning.

ISO-aligned conclusion:

To determine how PESTLE analysis affects planning of a QMS, the auditor must follow audit trails that demonstrate:

Conversion of identified issues into risk-based actions, and

Use of those outputs to improve and adapt the QMS.

Therefore, the correct answers are C and E.

In this scenario, the organisation A has two plants, A1 and A2, but the production in A2 was discontinued due to the COVID-19 pandemic and the plant was rented to another organisation B. There are no A employees working in A2, and the organisation A expects to reassume production in A2 as soon as possible. Therefore, the appropriate action to plan the internal audit of A’s quality management system is:

•Interview the A2 plant manager, now working in Plant A1: This action involves interviewing the person who is responsible for the management and operation of the plant A2, and who is currently working in the plant A1. The interview should aim to gather information about the status and condition of the plant A2, the impact of the COVID-19 pandemic on the quality management system, the arrangements and agreements with the organisation B, and the plans and actions to resume production in the plant A25 . This action is relevant and necessary for the internal audit, as it can help to assess the readiness and effectiveness of the quality management system, and to identify any gaps or nonconformities that need to be addressed.

The other options are not appropriate actions to plan the internal audit of A’s quality management system, according to the web search results from my internal tool. They are:

•Visit Plant A2 to interview personnel of company B: This action involves visiting the plant A2 and interviewing the personnel of the organisation B, who are not related to the organisation A and who are not part of the quality management system. This action is irrelevant and unnecessary for the internal audit, as it can not provide any evidence or information about the conformity and improvement of the quality management system of the organisation A5 .

•Visit Plant A2 to interview B’s quality manager: This action involves visiting the plant A2 and interviewing the quality manager of the organisation B, who is not related to the organisation A and who is not part of the quality management system. This action is irrelevant and unnecessary for the internal audit, as it can not provide any evidence or information about the conformity and improvement of the quality management system of the organisation A5 .

•Visit Plant A2 to interview A’s security personnel and B’s maintenance department: This action involves visiting the plant A2 and interviewing the security personnel of the organisation A and the maintenance department of the organisation B, who are not directly involved in the quality management system. This action is irrelevant and unnecessary for the internal audit, as it can not provide any evidence or information about the conformity and improvement of the quality management system of the organisation A5 .

Therefore, the correct answer is D.

Here is the correct matching of the activities with the responsible parties in the context of a second-party audit:

Define the audit scope: Customer

Develop the audit plan: Audit team leader

Respond to the audit findings: External provider

Conduct the audit: Audit team

This reflects the typical division of responsibilities in a second-party audit, where the customer (the party commissioning the audit) sets the scope, the audit team leader manages the planning, the external provider responds to findings, and the audit team carries out the audit.

Comprehensive and Detailed In-Depth Explanation:

Audit evidence includes information collected through different methods to assess compliance with ISO 9001:2015 requirements.

Clause References:

ISO 19011:2018, Clause 6.4.6 – Audit Evidence: Audit evidence must be objective, verifiable, and based on facts.

ISO 9001:2015, Clause 9.1.1 – Monitoring, Measurement, Analysis, and Evaluation: Requires organizations to collect and analyze data from multiple sources to verify effectiveness.

Types of Audit Evidence Collected in Scenario 3:

Verbal Evidence – Employee interviews regarding training and awareness sessions.

Documentary Evidence – Organizational charts, job descriptions, training records.

Physical Evidence – Workplace observations to assess working conditions.

Why is the Correct Answer B?

The audit team used a combination of verbal (interviews), documentary (records), and physical (site observations) evidence.

This triangulation approach enhances audit reliability and ensures compliance verification.

Why are the Other Options Incorrect?

A (Confirmative evidence) → Not a formal audit term in ISO 9001 or ISO 19011.

C (Analytical evidence) → Incorrect, as analysis was not a primary method used.

D (Qualitative evidence only) → Incorrect because the audit involved both qualitative (interviews) and quantitative (documents, physical) evidence.

The table below shows the possible matching of the ISO 9001 Clause 8 extract to the audit evidence.

Table

Audit evidence

ISO 9001 Clause 8 extract

Four of the 10 pallets of stock sampled in the warehouse were not labelled.

“8.5.2 … shall use suitable means to identify outputs …”

A damaged pallet of stock seen in the quarantine area was leaking liquid onto the floor.

“8.7.1 … shall ensure that outputs that do not conform to their requirements are identified and controlled …”

One of the fork-lift truck drivers had no fork-lift truck driving licence.

“8.5.1 e … shall include, as applicable … the appointment of competent persons …”

There was no pest control provision in the warehouse.

“8.5.4 … shall preserve the outputs during production and service provision …”

Two pallets of temperature-sensitive stock items were being stored at ambient as the chilled storage facility was full.

“8.1 … shall plan, implement and control the processes …”

 Clause Reference – ISO 9001:2015 Clause 8.6 (Release of Products and Services):

ISO 9001 requires that products and services are not released to the customer until:

All planned verification activities have been completed.

Acceptance criteria have been met.

Any necessary approvals have been obtained.

In this scenario:

The sacrificial anodes for Project DK were shipped before the galvanic efficiency test results were analyzed.

This constitutes a nonconformity against Clause 8.6 because the products were released without completing the required tests.

 Option Analysis:

A. A retrospective concession was not sought from the customer once the test results had been approved by the Quality Manager:Incorrect. While obtaining a concession might mitigate the situation, the nonconformity pertains to the process failure of releasing the products without completing required tests, not the absence of a concession.

B. Release of the product without acceptable test results has been accepted by the customer for Project DK:Incorrect. The customer was not informed before the release, and there is no indication that this was accepted beforehand. Furthermore, ISO 9001 requires planned processes to be followed, regardless of later acceptance.

C. Products for Project DK have been released before product approval through the quality control process:Correct. This description accurately reflects the nonconformity. The quality control process required test results to be analyzed and verified before release, which did not happen.

D. The untested product was not recalled until the galvanic efficiency of the anodes was verified:Incorrect. The issue is not about recalling the product but about releasing it without completing the required tests. Recalling the product is not mentioned in the scenario.

 Why C is Correct:

The nonconformity is a clear breach of Clause 8.6, where the products were released without meeting the planned verification requirements.

This demonstrates a failure in adhering to quality control processes, which is a critical aspect of ISO 9001 compliance.

 Key ISO 9001 Reference:

Clause 8.6: Products and services shall not be released to the customer until all planned activities (e.g., testing) have been satisfactorily completed, or the customer has approved the release with knowledge of deviations.

When conducting a third-party audit to ISO 9001, especially in the context of training and corrective actions taken due to customer complaints, the most appropriate audit trails to follow would be:

A. Ask if customer complaints had ceased since the multi-skilled training finished. This audit trail is relevant because it directly relates to the effectiveness of the corrective action taken. If customer complaints have decreased or ceased, it could indicate that the additional training was effective1.

F. Review records to assess if all planned training has been completed. This trail is important to ensure that the training plan has been fully implemented and to verify that all staff members have received the necessary training. It also helps in assessing the adequacy of the training in terms of content, frequency, and outcomes1.

These two trails, A and F, are closely linked to the issue of customer complaints and the organization’s response to them. They provide insight into whether the actions taken were suitable and whether they have led to improvements in staff performance and customer satisfaction1. The other options, while potentially useful, do not directly address the immediate concern of the effectiveness of the corrective actions taken in response to the customer complaints1.

Nonconformity report

ISO 9001 Clause Number: 9.3.1 Nature of problem: Management review has not been conducted at the defined frequency. ISO 9001 requirement that has not been fulfilled: ISO 9001 - “Top management shall review the organization’s quality management system at planned intervals.” Evidence: The last management review took place nine months ago, and the previous one took place one year before the latest review. The planned interval is six months.

The appropriate response in this situation would be:

C. I will raise it as a minor nonconformity; you have the option to appeal to our Certification Body.

This response acknowledges the restaurant manager’s point that the shortage of some hamburgers may not constitute a management system failure. However, the fact remains that the menu was not updated to reflect the current availability of products, which led to customer dissatisfaction. This is a deviation from the ISO 9001 standard, which requires that the organization ensures the availability of resources needed to provide products and services as promised1. Raising it as a minor nonconformity allows the organization to address the issue within a specified timeframe and provides an opportunity for appeal if the organization disagrees with the auditor’s decision2.

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 Clause 5.1.1 (Leadership and Commitment) states that top management must demonstrate leadership and commitment to the QMS by actively participating in QMS implementation, integration, and effectiveness.

In scenario 2, top management refused to be directly involved in the QMS implementation team, which violates Clause 5.1.1 because leadership involvement is essential for the system’s success.

Other options do not indicate nonconformance:

Option A (Middle managers in the QMS team) is acceptable.

Option C (Leslie assigning roles) is valid if competence is ensured (Clause 5.3 – Organizational Roles, Responsibilities, and Authorities).

Option D (Team reviewing the policy before approval) aligns with best practices.

Comprehensive and Detailed Explanation: = According to the web search results from my internal tool, a witness audit is a technique used during an accreditation audit, where the accreditation body observes the performance and competence of the certification body auditors in conducting an audit12. A witness audit can also be used by a certification body to monitor and evaluate its own auditors3. During a witness audit, the following roles can be defined:

•An auditor: This is the person who is being witnessed by the accreditation body or the certification body. The auditor is responsible for conducting the audit according to the audit plan, criteria, and standards, and for providing audit evidence and findings123.

•An assessor for the accreditation body: This is the person who witnesses the auditor on behalf of the accreditation body. The assessor is responsible for evaluating the auditor’s performance and competence, and for providing feedback and recommendations to the accreditation body123.

The other options are not defined as witnesses during a witness audit, according to the web search results from my internal tool. They are:

•Someone with a qualification from the certification body: This is not a specific role in a witness audit, as anyone who is involved in the audit process should have a qualification from the certification body. Moreover, having a qualification does not necessarily mean that the person is a witness or an auditor4.

•An existing member of the audit team: This is not a specific role in a witness audit, as the audit team consists of the auditors who are conducting the audit, not the ones who are witnessing it. The witness audit is a separate activity from the audit itself, and the witness should not interfere with the audit process or influence the audit outcome123.

Therefore, the correct answer is B and D.

Non-conformity Report

ISO 9001 Clause Number:

7.2

Nature of problem:

Documented information is not retained on the necessary competence of consultants with respect to relevant regulatory and ISO 9001 requirements.

ISO 9001 requirement that has not been fulfilled:

ISO 9001 – “The organization shall retain appropriate documented information as evidence of competence.”

ISO 9001:2015 places a clear requirement on organisations to ensure that persons doing work under its control that affects performance and conformity are competent, and that this competence is demonstrated and evidenced.

Relevant ISO 9001 requirements

Clause 7.2 – Competence requires the organisation to:

determine the necessary competence of persons doing work under its control,

ensure that these persons are competent on the basis of appropriate education, training, or experience, and

retain appropriate documented information as evidence of competence.

In the scenario:

Competence decisions are entirely delegated to a subcontracted lead consultant.

No documented information is retained to demonstrate individual consultant competence.

A recent event could not be resolved specifically due to the absence of documented competence records, which directly confirms non-fulfilment of Clause 7.2.

Reliance on customer satisfaction results or the personal judgement of a consultant does not replace the ISO 9001 requirement for objective evidence.

Why other clauses are not applicable:

Clause 7.1 relates to provision of resources, not evidence of competence.

Clause 7.3 relates to awareness of quality objectives, not competence records.

Statements such as “consultants are not aware of customer satisfaction objectives” or “persons necessary are not determined” are not supported by the scenario evidence.

ISO-aligned conclusion:

The organisation has failed to retain documented information as evidence of competence for consultants providing ISO 9001 and regulatory consultancy services. This is a clear and justified nonconformity against ISO 9001:2015 Clause 7.2.

Related Activity

Correct Quality Management Principle

Communicate client needs and expectations throughout the organisation.

Customer focus

Encourage an organisation-wide commitment to quality.

Leadership

Empower staff to determine constraints to performance and to take the initiative without fear.

Engagement of people

Establish authority, responsibility, and accountability for managing processes.

Process approach

Continuously educate and train people at all levels on how to apply basic tools and methodologies to achieve objectives.

Improvement

Determine, measure, and monitor key indicators to demonstrate the organisation’s performance.

Evidence-based decision making

Determine relevant interested parties (such as providers, partners, customers, investors, employees, or society as a whole) and their connection with the organisation.

Relationship management

1. Customer focus

ISO 9001 states that organizations must understand and consistently meet customer needs and expectations.

➡ Communicating client needs throughout the organization ensures alignment and customer satisfaction.

Comprehensive and Detailed In-Depth Explanation:

A horizontal audit examines one process across multiple departments to assess consistency.

Thus, A is the correct answer.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 19011:2018, Clause 6.2.2 (Audit Planning):

The audit team leader is responsible for planning the audit and assigning roles.

Top management (A) does not plan the audit, but they provide resources.

While team members may provide input, the leader has the final authority.

Thus, B is the correct answer.

Approve Certification Body: Accreditation Body

Award certification: Certification Body

Recommend certification: Audit Team Leader

Maintain certification:

Comprehensive Detailed Explanation

In the context of a third-party ISO 9001 audit, different entities play specific roles in the certification process. Here's a detailed explanation of the responsibilities:

Approve Certification Body: Accreditation BodyThe Accreditation Body is responsible for approving Certification Bodies. Accreditation Bodies are independent entities that evaluate the competence of Certification Bodies, ensuring they meet international standards like ISO/IEC 17021, which sets out the criteria for bodies providing audit and certification of management systems. In this role, they confirm that the Certification Body is capable of conducting ISO 9001 audits and granting certifications in accordance with international guidelines.

Award Certification: Certification BodyThe Certification Body is the entity that ultimately awards the certification to an organization after verifying that it meets the ISO 9001 standards. Certification Bodies conduct audits, either directly or through a team of auditors, and based on the audit outcomes, they issue the certification, indicating that the organization complies with ISO 9001.

Recommend Certification: Audit Team LeaderThe Audit Team Leader is responsible for leading the audit and making a recommendation to the Certification Body. This recommendation is based on the audit findings—whether the organization meets the ISO 9001 requirements or if there are areas of non-compliance that need corrective action. The final decision on certification is not made by the Audit Team Leader but by the Certification Body.

Maintain Certification: Certification BodyMaintaining certification refers to the ongoing process of ensuring that an organization continues to comply with ISO 9001 requirements. The Certification Body conducts regular surveillance audits (e.g., annually) and may also perform recertification audits (typically every three years). This ongoing monitoring ensures that the certified organization continues to adhere to the quality management standards over time.

This breakdown clearly assigns responsibility based on the defined roles of Accreditation Bodies, Certification Bodies, and Audit Teams in the ISO 9001 certification process.

Clause 8.2.4 of ISO 9001:2015 – Changes to Requirements for Products and Services:ISO 9001:2015 Clause 8.2.4 states that when changes to requirements for products or services are made, they must be communicated and agreed upon with relevant interested parties (in this case, the Health Trust). The lack of communication and agreement for substituting the cleaning chemical represents a clear violation of this clause.

Analysis of the Corrective Action Proposed:The organization proposed "obtaining a concession from the Health Trust for the use of the new chemical." This action is reactive and assumes approval from the Health Trust without addressing the systemic issue: the lack of a defined change control process for managing contract changes.

Option Analysis:

A. The substitute chemical has not been used before in the Health Trust:Incorrect. While this may be a concern, it is not directly relevant to the root cause of the nonconformity, which is the absence of a process to handle contract changes.

B. The action assumes that the Health Trust will agree to the change:Incorrect. Although this is true, it is not the primary issue. The nonconformity lies in the lack of a structured approach to obtain agreement, not whether the Health Trust agrees.

C. Staff have not been trained in the use of the new chemical:Incorrect. This is a separate issue related to staff competence (Clause 7.2), but it is not the main reason why the corrective action is unacceptable under Clause 8.2.4.

D. The process for making changes to the contract has not been addressed:Correct. The fundamental issue is the organization's failure to follow or establish a change control process for amending contracts, including gaining formal agreement from the Health Trust. The proposed corrective action does not ensure that such issues will be systematically prevented in the future.

E. The substitute chemical may not be as effective as the original:Incorrect. The effectiveness of the substitute chemical is secondary to the primary issue, which is the lack of a change management process.

ISO 9001 References Supporting the Correct Answer:

Clause 8.2.4: Requires that changes to product/service requirements be reviewed, communicated, and agreed upon with the customer.

Clause 10.2 (Nonconformity and Corrective Action): Requires the organization to address the root cause of the nonconformity and take actions to ensure it does not recur. In this case, the root cause is the absence of a change control process.

Why D is the Best Answer:The core issue is that the organization did not have a formalized process for managing and agreeing upon changes to contract requirements. Addressing this process gap is essential to prevent recurrence of similar nonconformities. Merely seeking a concession from the Health Trust is a one-off solution that does not address the systemic issue.

The key expected results of a quality management system that conforms to the requirements of ISO 9001:2015 are stated in clause 0.1 of the standard, which says: “The adoption of a quality management system is a strategic decision for an organization that can help to improve its overall performance and provide a sound basis for sustainable development initiatives. The potential benefits to an organization of implementing a quality management system based on this International Standard are: a) the ability to consistently provide products and services that meet customer and applicable statutory and regulatory requirements; b) facilitating opportunities to enhance customer satisfaction; c) addressing risks and opportunities associated with its context and objectives; d) the ability to demonstrate conformity to specified quality management system requirements.” Therefore, the two options that best match these benefits are A and E, as they directly relate to providing products and services that meet customer requirements and enhancing customer satisfaction. The other options are not explicitly mentioned as key expected results, although they may be possible outcomes of implementing a quality management system. References: ISO 9001:2015 - Quality management systems — Requirements, Key Elements of an ISO 9001:2015 Quality Management System, What is ISO 9001 2015 as a Quality Management Systems?

Comprehensive and Detailed In-Depth Explanation:

According to ISO 19011:2018, Clause 5.5 (Determining Audit Team Competence), technical experts:

Provide specialized knowledge in an audit.

Must operate under the supervision of an auditor to ensure compliance with audit protocols.

Cannot work independently or under the auditee’s supervision, as they are not responsible for the audit's findings.

The audit team leader has overall responsibility, but technical experts are supervised by an auditor during the audit process.

Comprehensive and Detailed In-Depth Explanation:

The PDCA (Plan-Do-Check-Act) cycle is a continuous improvement model used in ISO 9001:2015. The "Check" phase involves monitoring, measuring, and analyzing the results to assess if the planned actions have been effective.

In scenario 1, AL-TAX tested the effectiveness of the intended actions, which aligns with the Check stage of the PDCA cycle. Clause 9.1.1 (Monitoring, Measurement, Analysis, and Evaluation) requires organizations to evaluate their QMS and determine whether improvements are necessary.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 9001:2015, Clause 7.5.2 (Creating and Updating Documented Information), the criteria for reviewing documented information include:

Content – The accuracy and relevance of the information.

Format – Ensuring readability and proper structuring (e.g., language, versioning).

Procedure for managing documented information – Ensuring control, access, and updates.

Other options, such as internal audit reports and client feedback, are important for overall QMS evaluation but are not the main criteria for reviewing documented information.

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 requires organizations to assess both internal and external issues that could impact the effectiveness of their Quality Management System (QMS).

Clause Reference:

Clause 4.1 – Understanding the Organization and Its Context states that organizations must determine external and internal issues that affect their ability to achieve intended results.

Internal issues include:

Knowledge within the organization (documented or undocumented)

Organizational culture

Resource availability

Technological advancements

Infrastructure and capabilities

Why is the Correct Answer C?

Knowledge (Clause 7.1.6) is a critical internal factor that directly affects the implementation and maintenance of a QMS.

Organizations must identify, maintain, and make available the necessary knowledge to achieve quality objectives and meet customer requirements.

Why are the Other Options Incorrect?

A (Social and economic environments) → These are considered external issues rather than internal.

B (Competitive environment) → Competition is external, not an internal issue affecting the QMS.

D (Expectations of suppliers) → Supplier expectations relate to external interested parties, covered under Clause 4.2 (Understanding the Needs and Expectations of Interested Parties).

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015, Clause 5.1.2 (Customer Focus) states that top management must ensure customer satisfaction by monitoring customer perceptions.

In scenario 2, top management initiated customer surveys, demonstrating their commitment to customer focus as required by Clause 5.1.2.

ISO 9001:2015 makes it clear that an organisation remains responsible for conformity to requirements even when processes are outsourced. Certification audits must therefore evaluate not only the organisation’s internal activities, but also the control and effectiveness of externally provided processes.

ISO 9001:2015, Clause 8.4.1 requires that the organisation ensure externally provided processes, products and services conform to requirements. The organisation must determine controls to be applied to those outsourced processes.

ISO 9001:2015, Clause 4.4.1 further requires the organisation to determine processes needed for the quality management system and their application throughout the organisation, including outsourced processes.

For a third-party certification audit, sufficient objective evidence must be obtained to demonstrate that:

Outsourced processes are effectively controlled

The organisation’s quality management system achieves its intended results

Why option C is the best decision:

Proceeding with the audit in Bolivia and including all ABC personnel and all outsourced processes ensures that the certification audit:

Covers the full scope of the QMS, including outsourced production, maintenance, procurement, and HR activities

Allows direct evaluation of how ABC controls and manages its external providers in the location where those processes are actually performed

Provides sufficient objective evidence to support a valid certification decision

Reviewing only internal audits or auditing only planning activities would not provide adequate assurance of conformity for a high-risk, core operational activity such as lithium extraction.

Why the other options are not acceptable:

A: Auditing only the Planning function would exclude core operational and support processes that are within the scope of the QMS.

B: Reviewing internal audit results alone is insufficient for a third-party certification audit and does not replace direct assessment of outsourced processes.

D: ISO 9001 explicitly allows outsourcing of processes; the organisation remains responsible for control, not prohibited from outsourcing.

ISO-aligned conclusion:

In a third-party ISO 9001 certification audit, outsourced processes that are within scope must be audited, either directly or through appropriate controls. In this scenario, auditing the outsourced processes in Bolivia is necessary to ensure a complete, credible, and compliant certification audit.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 9000:2015, which provides definitions for terms used in ISO 9001:2015, a management system is defined as a set of interrelated or interacting elements of an organization to establish policies, objectives, and processes to achieve those objectives.

A Quality Management System (QMS) is a type of management system that ensures organizations meet customer and regulatory requirements while improving performance.

Clause 3.5.3 of ISO 9000:2015 clearly defines "management system" and aligns with this question. The other options do not fit the definition:

Standard refers to an established norm or requirement.

Organization scope defines the boundaries of a QMS but is not a system itself.

Quality manual is a document (optional under ISO 9001:2015) that describes a QMS but is not the system itself.

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 requires organizations to identify and control nonconforming outputs to prevent unintended use or delivery.

Clause References:

Clause 8.7 (Control of Nonconforming Outputs): Organizations must ensure that nonconforming outputs are identified and controlled to prevent unintended use or delivery.

Clause 10.2 (Nonconformity and Corrective Action): Requires organizations to take appropriate actions when nonconformities are found, including during or after service provision.

Why is the Correct Answer C?

If nonconforming products or services are identified after delivery or during service, organizations must take corrective actions to protect customers and stakeholders.

Actions may include recalls, rework, customer notifications, compensation, or process improvements.

This approach aligns with ISO 9001:2015, ensuring that products/services consistently meet requirements.

Why are the Other Options Incorrect?

A (Retaining documentation only) → While documentation is required, it alone does not ensure proper handling of nonconforming outputs.

B (Verifying conformity before correction) → While verification is good practice, ISO 9001 prioritizes corrective action over mere verification.

D (Allowing employees to handle nonconformities without structure) → ISO 9001 requires documented procedures for handling nonconformities (Clause 8.7).

Comprehensive and Detailed In-Depth Explanation:

Certification bodies must remain independent and impartial. If a certification body (ABC-CERT) provides consulting services to an organization through its subsidiary (Consultancy ABC), it cannot later certify the same organization.

Clause References:

ISO/IEC 17021-1:2015, Clause 5.2.5 – Impartiality Requirements:

A certification body must not certify an organization to which it has provided consultancy services.

ISO/IEC 17021-1:2015, Clause 5.2.6:

Subsidiaries of certification bodies must not provide consulting services to prevent conflicts of interest.

Why is the Correct Answer C?

Certifying a client after providing consultancy creates a conflict of interest and violates ISO/IEC 17021-1:2015 impartiality rules.

The certification body (ABC-CERT) and consultancy firm (Consultancy ABC) are related entities, making it impossible to remain objective and independent.

Why are the Other Options Incorrect?

A (Waiting two years) → ISO does not specify a time frame; the issue is impartiality, not just time.

B (Signing an agreement to ensure objectivity) → Conflicts of interest cannot be resolved through an agreement; independence is required.

The following table shows the possible matching of the records to the requirements of clause 8.4:

Table

Requirements

Records

Define product requirements

Product specification

Criteria for selection

List of requirements to be met by the external provider

Evaluation of potential external provider

External provider questionnaire

External provider selection

Approved external provider list

Communicate requirements

Purchase order

Monitoring of performance

External provider delivery times and quality issues

Comprehensive and Detailed Explanation: = According to clause 8.4 of ISO 9001:2015, the organization should ensure that externally provided processes, products, and services conform to the specified requirements. To do so, the organization should:

Define the product requirements that are relevant for the external provision, such as specifications, drawings, standards, codes, etc. These should be documented and communicated to the external provider. A record of the product specification can be used as evidence of this requirement.

Establish the criteria for the selection, evaluation, and re-evaluation of external providers, based on their ability to provide processes, products, and services in accordance with the requirements. The criteria should be documented and applied consistently. A record of the list of requirements to be met by the external provider can be used as evidence of this requirement.

Evaluate the potential external providers before selecting them, using the established criteria. The evaluation methods may include questionnaires, audits, references, samples, etc. The results of the evaluation should be documented and reviewed. A record of the external provider questionnaire can be used as evidence of this requirement.

Select the external providers that have demonstrated their competence and conformity to the requirements. The selection should be based on the evaluation results and the organization’s needs. The selection should be documented and approved. A record of the approved external provider list can be used as evidence of this requirement.

Communicate the requirements for the processes, products, and services to be provided by the external provider, including the verification and validation activities, the acceptance criteria, the documentation requirements, the changes control, etc. The communication methods may include purchase orders, contracts, agreements, etc. The communication should be clear, complete, and timely. A record of the purchase order can be used as evidence of this requirement.

Monitor the performance and conformity of the external provider, using the established criteria and methods. The monitoring methods may include inspections, tests, audits, feedback, complaints, etc. The monitoring results should be documented and analyzed. A record of the external provider delivery times and quality issues can be used as evidence of this requirement.

According to ISO 19011:2018, clause 6.3.3, the audit plan should be reviewed and revised as necessary to address changes that occur during the audit planning. The audit plan should be agreed upon, preferably in writing, by the audit team leader, the audit client and the auditee1. Therefore, if there is a significant change in the auditee’s situation, such as the cancellation of all orders for the next week, the audit plan should be reviewed and revised accordingly, with the agreement of all parties involved.

According to ISO/IEC 17021-1:2015, clause 9.1.4, the certification body should have a process to ensure that the audit team has the competence to achieve the audit objectives, and that the audit methods are appropriate for the scope and complexity of the audit. The certification body should also have a process to ensure that the audit is conducted under reasonable conditions and within a reasonable time frame2. Therefore, if there is a risk that the audit objectives cannot be achieved, or that the audit methods are not suitable, due to the change in the auditee’s situation, the certification body should be consulted and informed on how to proceed with the audit.

Therefore, the best action to take is B, ask the certification body you work for how to proceed with the audit. This action will ensure that the audit plan is revised and agreed upon by all parties, and that the audit team has the competence and the methods to conduct the audit effectively and efficiently. The other options are not correct, as they may compromise the quality and validity of the audit:

•A. Start the audit on Monday at ABC’s as planned, interviewing the functions that regularly work at the central office, and plan visits to ABC customers wherever they may be working during the following week: This action may not be feasible or acceptable, as it may extend the audit duration and cost beyond the agreed terms, and it may not provide sufficient and appropriate audit evidence to verify the conformity and effectiveness of the auditee’s processes. Moreover, this action may not be agreed upon by the audit client and the auditee, and it may not be approved by the certification body.

•C. Start the audit on Monday as planned, interviewing the functions that regularly work at the central office, and visit another customer’s premises they cleaned the week before: This action may not be relevant or reliable, as it may not reflect the current performance and condition of the auditee’s processes. The audit evidence collected from the previous customer may not be valid or representative of the audit criteria, and it may not address the risks and opportunities associated with the auditee’s context and objectives. Moreover, this action may not be agreed upon by the audit client and the auditee, and it may not be approved by the certification body.

•D. Complete the audit but ask the quality manager to clean some windows at the ABC’s office, simulating the process they carry out at customers’ premises: This action may not be objective or impartial, as it may introduce bias and influence in the audit process. The audit evidence collected from the simulated process may not be accurate or authentic, and it may not demonstrate the actual capability and effectiveness of the auditee’s processes. Moreover, this action may not be ethical or professional, as it may compromise the integrity and credibility of the audit and the certification.

Quality management principles:

Customer focus = Increased revenue and market share

Engagement of people = Enhanced trust and collaboration throughout the organisation

Improvement = Enhanced drive for innovation

Evidence-based decision-making = Increased ability to demonstrate effectiveness of past actions

According to the Quality management principles document published by ISO, each quality management principle has a statement, a rationale, key benefits, and actions you can take to apply it. Based on these descriptions, the potential benefits can be matched to the corresponding principles as follows:

Customer focus: The primary focus of quality management is to meet customer requirements and to strive to exceed customer expectations. The key benefits of this principle include increased customer value, customer satisfaction, customer loyalty, repeat business, reputation, customer base, revenue and market share.

Engagement of people: Competent, empowered and engaged people at all levels throughout the organization are essential to enhance its capability to create and deliver value. The key benefits of this principle include improved understanding of the organization’s objectives and values, increased involvement in improvement activities, enhanced personal development, increased motivation and empowerment, enhanced trust and collaboration, and increased recognition and rewards.

Improvement: Successful organizations have an ongoing focus on improvement. The key benefits of this principle include improved organizational capabilities, alignment of improvement activities at all levels, increased ability to anticipate and react to opportunities and threats, enhanced drive for innovation, and increased levels of satisfaction.

Evidence-based decision-making: Decisions based on the analysis and evaluation of data and information are more likely to produce desired results. The key benefits of this principle include improved decision-making processes, increased ability to demonstrate the effectiveness of past decisions, increased ability to review, challenge and change opinions and decisions, and increased ability to improve performance.

Comprehensive and Detailed Explanation From Exact Extract:

Correct Option B – “Communicate a policy commitment to continual improvement”

This aligns directly with Clause 5.2.1(d) of ISO 9001:2015, which states that the quality policy shall include a commitment to continual improvement of the QMS:

“Top management shall establish, implement and maintain a quality policy that... includes a commitment to continual improvement of the quality management system.”

A clearly communicated policy sets expectations and a strategic direction that cascades throughout the organization, promoting a culture that values ongoing enhancement.

Correct Option F – “Use the management review process to identify improvements”

This is based on Clause 9.3.3 of ISO 9001:2015, which specifies that outputs of management reviews must include decisions and actions related to:

“a) opportunities for improvement;

b) any need for changes to the quality management system;

c) resource needs.”

The management review process is a structured mechanism to analyze data, monitor performance, assess risks and opportunities, and drive continual improvement initiatives.

Why the Other Options Are Incorrect:

A (Appoint external consultants to train staff): While training may help improve competence, ISO 9001 emphasizes internal process evaluation and strategic improvement. This option is not directly aligned with the systematic improvement of the QMS.

C (Require higher standards): Higher standards alone don’t ensure continual improvement unless supported by a structured QMS approach involving evaluation, planning, and measurement.

D (Require fewer mistakes): Unrealistic or unqualified demands like "make fewer mistakes" don’t support structured process-based improvement and may conflict with ISO’s emphasis on risk-based thinking and root cause analysis.

E (Send Chief Executive on a course): While leadership involvement is vital (Clause 5), this action by itself does not constitute a continual improvement mechanism for the QMS.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 17021-1:2015 (Conformity Assessment – Requirements for Certification Bodies), Clause 9.3.1.2, the Stage 1 Audit typically consumes around 30% of the total audit time.

This time is allocated to:

Reviewing documented information.

Assessing the readiness for Stage 2.

Identifying potential nonconformities.

A 20% allocation (Answer A) is too low, and 40% (Answer C) is excessive, as the majority of the audit should be spent on Stage 2 (on-site verification).

According to ISO 19011:2018, clause 6.3.2, an audit plan should include the following information:

The audit objectives, scope, and criteria

The audit team members and their roles and responsibilities

The audit schedule, including the sequence and timings of audit activities, such as opening meeting, document review, interviews, observations, closing meeting, etc.

The expected time and duration of each audit activity and location

The name and contact details of the auditee’s representative and other relevant parties

The allocation of appropriate resources to support the audit activities

The audit methods and techniques to be used, such as interviews, observations, sampling, etc.

The audit documents and records to be prepared and retained

The audit language and communication methods

The audit risks and opportunities and how to address them

The audit follow-up arrangements, if applicable

Therefore, the correct answer is D and F, as they are essential elements of an audit plan. The other options are either irrelevant or optional for an audit plan. References:

ISO 19011:2018(en), Guidelines for auditing management systems, clause 6.3.2

ISO 19011: Guidelines for Auditing Management Systems | ASQ, section “Making audit arrangements”

ISO 19011 Management Systems Audit Checklist | Process Street, task 6.3.2

A screenshot of a computer AI-generated content may be incorrect.

Clause 8.5.3 – Property Belonging to Customers or External Providers:This clause requires the organization to care for customer property while it is under their control. If there is damage, they must inform the customer and retain documented information. Thus, informing customers of the reason for laundry damage relates directly to this clause.???? Reference: ISO 9001:2015 Clause 8.5.3

Clause 7.1.3 b – Infrastructure:It refers to the provision and maintenance of infrastructure necessary for the operation of processes. This includes equipment. If resources are not allocated for outdated equipment, it directly breaches this clause.???? Reference: ISO 9001:2015 Clause 7.1.3 b

Clause 10.2.1 b – Corrective Action:This clause covers actions to eliminate the causes of nonconformities to prevent recurrence, including evaluating and correcting customer complaints.???? Reference: ISO 9001:2015 Clause 10.2.1 b

Clause 5.1.2 b – Customer Focus (Top Management):Top management must ensure risks to customer satisfaction, including property damage, are addressed. This aligns with addressing the risk of damaging customer laundry.???? Reference: ISO 9001:2015 Clause 5.1.2 b

Clause 6.2 – Quality Objectives and Planning to Achieve Them:Setting objectives for reducing customer complaints (like those about laundry damage) falls under this clause.???? Reference: ISO 9001:2015 Clause 6.2

A first-party audit is an internal audit conducted by auditors who are employed by the organization being audited but who have no vested interest in the audit results of the area being audited1. The purpose of a first-party audit is to assess the conformity of the organization’s quality management system to the requirements of ISO 9001 and to identify opportunities for improvement2. Therefore, the two auditors who would not participate in a first-party audit are:

•A. An auditor employed by an external consultancy organization: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit (if the external consultancy organization is a customer or supplier of the organization being audited) or a third-party audit (if the external consultancy organization is a certification body or registrar).

•F. An auditor from a customer: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit, as a customer is an interested party that has specific requirements for the organization being audited.

The other options are not correct, as they could participate in a first-party audit, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited:

•B. An auditor from an interested party: This auditor could be a first-party auditor, as long as the interested party is within the organization being audited. For example, an auditor from the finance department could audit the production department, as long as they are not involved in the production process or affected by its outcomes.

•C. An auditor trained in-house: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The source of the auditor’s training is not relevant for determining the type of audit, as long as the auditor is competent and qualified to perform the audit.

•D. An auditor trained in the IRCA scheme: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The IRCA scheme is a professional certification scheme for auditors of management systems, which provides recognition of the auditor’s competence and credibility3. However, being trained in the IRCA scheme does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

•E. An auditor certified by IRCA: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. Being certified by IRCA means that the auditor has met the requirements of the IRCA scheme and has demonstrated their competence and credibility as an auditor of management systems3. However, being certified by IRCA does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

According to clause 8.4 of ISO 9001:2015, the organization should ensure that externally provided processes, products, and services conform to the specified requirements. To do so, the organization should:

•Establish the criteria for the selection, evaluation, and re-evaluation of external providers, based on their ability to provide processes, products, and services in accordance with the requirements. The criteria should be documented and applied consistently.

•Evaluate the potential external providers before selecting them, using the established criteria. The evaluation methods may include questionnaires, audits, references, samples, etc. The results of the evaluation should be documented and reviewed.

•Select the external providers that have demonstrated their competence and conformity to the requirements. The selection should be based on the evaluation results and the organization’s needs. The selection should be documented and approved.

•Communicate the requirements for the processes, products, and services to be provided by the external provider, including the verification and validation activities, the acceptance criteria, the documentation requirements, the changes control, etc. The communication methods may include purchase orders, contracts, agreements, etc. The communication should be clear, complete, and timely.

•Monitor the performance and conformity of the external provider, using the established criteria and methods. The monitoring methods may include inspections, tests, audits, feedback, complaints, etc. The monitoring results should be documented and analyzed.

In this case, the evidence statements that demonstrate a nonconformity with clause 8.4 are A and C, because they show that the organization did not retain documented information of the selection and evaluation of the external provider, and the monitoring of the external provider’s performance. These are requirements of the standard and essential for ensuring the quality of the externally provided processes, products, and services. The other options are not directly related to clause 8.4, although they may indicate other nonconformities or weaknesses in the organization’s QMS. For example, option B may relate to clause 7.1.3 on contingency planning, option D may relate to clause 8.2.3 on review of requirements, option E may relate to clause 8.6 on release of products and services, and option F may relate to clause 5.1.1 on leadership and commitment. References: ISO 9001:2015, [ISO 9001 Auditing Practices Group Guidance on Scope], Mastering the Scope of ISO 9001 Quality Management Systems

Comprehensive and Detailed In-Depth Explanation:

According to ISO 9001:2015, Clause 9.2 (Internal Audit):

Internal audits are conducted by employees of the company who are trained as auditors.

External auditors are not mandatory unless required by the organization.

Thus, A is the correct answer.

Comprehensive and Detailed In-Depth Explanation:

A technical expert is someone with specialized knowledge that helps the audit team understand specific technical aspects of the auditee’s processes.

Clause References:

ISO 19011:2018, Clause 7.3.4 – Use of Technical Experts:

Technical experts support the audit team with specialized knowledge but do not perform the audit themselves.

Why is the Correct Answer B?

A technical expert is needed when auditors lack deep expertise in specific areas, such as engineering, software, or medical devices.

They assist in interpreting complex technical requirements but do not act as auditors.

Why are the Other Options Incorrect?

A (Observer) → Observers do not contribute expertise; they only watch the audit (e.g., trainees).

C (Guide) → Guides help with logistics but do not provide technical expertise.

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 is based on seven quality management principles, one of which is Relationship Management. This principle emphasizes the importance of maintaining open communication and collaboration with interested parties, including suppliers and customers.

Clause 7.4 (Communication) requires organizations to determine what, when, with whom, and how communication should take place. Since AL-TAX failed to ensure clear communication channels, it did not adhere to this principle. Effective relationship management helps improve supply chain performance, customer satisfaction, and overall QMS effectiveness.