Free PECB ISO-9001-Lead-Auditor Practice Exam with Questions & Answers | Set: 4

Documented information is a means by which an organization demonstrates compliance. It communicates what we do and how we do things, it communicates what happened and what results were achieved. It is, essentially, a tool for communication. ISO 9001:2015 allows an organization flexibility in the way it chooses to document its quality management system (QMS). This enables each individual organization to determine the correct amount of documented information needed in order to demonstrate the effective planning, operation and control of its processes and the implementation and continual improvement of the effectiveness of its QMS. The standard states that the organization shall maintain documented information to the extent necessary to support the operation of processes and retain documented information to the extent necessary to have confidence that the processes are being carried out as planned. Therefore, the purpose of retaining documented information is to support the operation of the processes of the QMS, not to facilitate auditing, provide confidence or safeguard integrity, which are secondary benefits of documented information. References: Guidance on the requirements for Documented Information of ISO 9001:2015, ISO 9001:2015 documented information | CQI | IRCA, Documented Information Required by ISO 9001:2015 - 9000 Store

B. Control of externally provided processes, products, and services: This is relevant because the organization has outsourced the manufacture of its own brand products to a supplier. According to ISO 9001, the organization must ensure that externally provided processes remain within the control of its quality management system.

C. Design and development of products and services: Even though the organization no longer manufactures in-house, it still needs to control the design and development of its products, especially since they are now being produced by an external provider.

F. Organisation roles and responsibilities: The change in strategy has led to a significant reduction in staff, which would have an impact on the roles and responsibilities within the organization. It is important to audit how these changes have been managed and communicated within the organization to ensure continued effectiveness of the quality management system.

These audit trails are aligned with the requirements of ISO 9001:2015, which emphasizes the importance of controlling externally provided processes and products, managing design and development, and clearly defining roles and responsibilities within the quality management system.

According to the ISO 9001:2015 standard, clause 6.2.1 requires organizations to establish quality objectives at relevant functions, levels, and processes needed for the quality management system. The quality objectives must be consistent with the quality policy and the strategic direction of the organization. The quality objectives must also be measurable, monitored, communicated, and updated as appropriate.

In this scenario, the Quality Manager of XYZ Corporation has set quality objectives for every employee in the organization except top management. This has created a lot of resistance to the QMS, and the Chief Executive is asking questions about the cost and the method of setting objectives. The Quality Manager asks for your opinion as an auditor on whether this is the correct method of setting objectives.

As an auditor, you cannot provide advice to the organization on how it should operate its QMS. Your role is to assess the conformity and effectiveness of the QMS against the requirements of the standard and the organization’s own policies and objectives. Therefore, you should respond with the following options:

B. Advise the Quality Manager to read the ISO 9001 standard and interpret in relation to the organization’s requirements: You can suggest that the Quality Manager should familiarize himself with the requirements of clause 6.2.1 and understand how they apply to his organization. He should also consider the context and the needs and expectations of interested parties when setting quality objectives. He should ensure that the quality objectives are aligned with the quality policy and the strategic direction of the organization.

C. Advise the Quality Manager that you will raise an opportunity for improvement if the quality objectives are not addressed properly: You can inform the Quality Manager that you will evaluate the quality objectives during the audit and check whether they meet the requirements of clause 6.2.1. If you find any gaps or weaknesses in the quality objectives, you will raise an opportunity for improvement to help the organization improve its QMS. You will also verify whether the quality objectives are monitored, communicated, and updated as appropriate.

D. Inform the Quality Manager that you will comment on the subject in your audit report: You can inform the Quality Manager that you will document your findings and observations on the quality objectives in your audit report. You will also provide a summary of the audit results and any recommendations for improvement. You will also indicate the level of conformity and effectiveness of the QMS.

These three options would help you to maintain your impartiality and professionalism as an auditor and to provide constructive feedback to the organization

Table

Statement

First-party audits

Second-party audits

Third-party audits

The audit scope is typically determined by the organisation being audited.

Yes

No

No

The outcome of the audit is typically certification to a recognised standard.

No

No

Yes

The audit scope is typically confined to service/product provision capability.

No

Yes

No

Here is a brief explanation of each statement:

The audit scope is typically determined by the organisation being audited: This statement applies to first-party audits, also known as internal audits, where the organisation audits its own processes and activities to ensure conformity and improvement1. The organisation can decide the scope of the audit based on its own needs and objectives2. This statement does not apply to second-party audits, where the customer audits the supplier, or third-party audits, where an independent body audits the organisation. In these cases, the audit scope is determined by the customer or the certification body, respectively34.

The outcome of the audit is typically certification to a recognised standard: This statement applies to third-party audits, where an independent body audits the organisation to verify that it meets the requirements of a specific standard, such as ISO 9001, and issues a certificate of conformity if the audit is successful34. This statement does not apply to first-party audits or second-party audits, where the outcome of the audit is not certification, but rather self-improvement or supplier qualification13.

The audit scope is typically confined to service/product provision capability: This statement applies to second-party audits, where the customer audits the supplier to ensure that they are meeting the requirements specified in the contract, such as service or product quality, delivery, or performance34. The audit scope is usually focused on the specific aspects of the service or product that are of interest to the customer3. This statement does not apply to first-party audits or third-party audits, where the audit scope is broader and covers the entire quality management system or the relevant clauses of the standard14.

A first-party audit is an internal audit conducted by auditors who are employed by the organization being audited but who have no vested interest in the audit results of the area being audited1. The purpose of a first-party audit is to assess the conformity of the organization’s quality management system to the requirements of ISO 9001 and to identify opportunities for improvement2. Therefore, the two auditors who would not participate in a first-party audit are:

•A. An auditor employed by an external consultancy organization: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit (if the external consultancy organization is a customer or supplier of the organization being audited) or a third-party audit (if the external consultancy organization is a certification body or registrar).

•F. An auditor from a customer: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit, as a customer is an interested party that has specific requirements for the organization being audited.

The other options are not correct, as they could participate in a first-party audit, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited:

•B. An auditor from an interested party: This auditor could be a first-party auditor, as long as the interested party is within the organization being audited. For example, an auditor from the finance department could audit the production department, as long as they are not involved in the production process or affected by its outcomes.

•C. An auditor trained in-house: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The source of the auditor’s training is not relevant for determining the type of audit, as long as the auditor is competent and qualified to perform the audit.

•D. An auditor trained in the IRCA scheme: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The IRCA scheme is a professional certification scheme for auditors of management systems, which provides recognition of the auditor’s competence and credibility3. However, being trained in the IRCA scheme does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

•E. An auditor certified by IRCA: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. Being certified by IRCA means that the auditor has met the requirements of the IRCA scheme and has demonstrated their competence and credibility as an auditor of management systems3. However, being certified by IRCA does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

Non-Conformity Report:

ISO 9001 Clause Number

Nature of Problem

ISO 9001 Requirement That Has Not Been Fulfilled

6.1.1

Several risks and opportunities have not been determined.

"The organization shall consider the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed."

6.1.2 (a)

Actions to address risks and opportunities not planned.

"The organization shall plan actions to address risks and opportunities."

Step-by-Step Reasoning:

Clause 6.1.1 - Determining Risks and Opportunities:

Requirement: The organization must determine risks and opportunities that are relevant to its Quality Management System (QMS). This ensures that the QMS achieves intended results and prevents undesired effects.

Problem Identified: While some risks and opportunities were discussed, the organization did not perform a systematic evaluation of all risks (e.g., health and safety legislation changes, retiring trainers).

Clause 6.1.2 (a) - Planning Actions for Risks and Opportunities:

Requirement: The organization must plan actions to address identified risks and opportunities. These actions should be integrated into the QMS processes to ensure continuous improvement.

Problem Identified: The Quality Systems Manager confirmed that no plans were made to address the risks and opportunities because the Managing Director deemed it unnecessary. This violates the requirement to plan actions.

Correct Options Selected:

Clause 6.1.1 with the nature of the problem as: "Several risks and opportunities have not been determined."

Clause 6.1.2 (a) with the nature of the problem as: "Actions to address risks and opportunities not planned."

ISO 9001 Requirements Not Fulfilled:

For 6.1.1:"The organization shall consider the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed."

For 6.1.2 (a):"The organization shall plan actions to address risks and opportunities."

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 promotes the process approach, which allows organizations to structure their activities into interrelated processes. This approach helps ensure that processes effectively achieve intended results.

Clause 0.3.1 (Process Approach) states that "The application of the process approach in a quality management system enables understanding and consistency in meeting requirements, considering processes in terms of added value, and achieving effective process performance."

This aligns directly with option C, making it the correct answer. The other options are either partially correct or do not fully capture the purpose of the process approach:

Option A (Improvement based on interested parties) is a benefit but does not define the main goal.

Option B (Financial value) is not the primary focus of the process approach.

Option D (Reduction of resource consumption) may be an indirect benefit but is not a core objective.

Comprehensive and Detailed Explanation From Exact Extract:

According to ISO 19011:2018 – Guidelines for Auditing Management Systems, which is referenced in ISO 9001 Lead Auditor training and practice, auditor competence is defined by a combination of knowledge, skills, and personal attributes. Here's how each selected option aligns:

D. Determining what evidence to gather: This activity is rooted in knowledge of audit principles, criteria, and risk-based thinking. It requires an understanding of which types of evidence (documents, records, interviews, observations) are necessary to evaluate conformity to the audit criteria (Clause 7.2.3 of ISO 19011:2018).

E. Evaluate proposals of corrective actions: This task involves applying knowledge of ISO 9001 requirements, root cause analysis methods, and risk controls to assess whether proposed actions are suitable to prevent recurrence. It demands comprehension of quality management principles and corrective action methodologies, linking it firmly to knowledge.

Other options such as A (Communicate with auditee) and B (Conduct audit meetings) are predominantly skills-based, requiring interpersonal and communication abilities, not theoretical or regulatory knowledge.

C (Determine how to seek evidence) and F (Identify findings) involve both knowledge and skill but are more action-oriented and tied to situational judgment and auditor behavior.

Nonconformity report

ISO 9001 Clause Number: 8.5.4 Nature of problem: Cleaning and sanitising records are not available for every batch. ISO 9001 requirement that has not been fulfilled: ISO 9001 - “The organization shall implement planned arrangements, at appropriate stages, to verify that the product requirements have been met.” Evidence: 40 cleaning records are available for 63 batches.