ISO-9001-Lead-Auditor Questions and Answers

According to the ISO 19011:2018 document, the audit plan should provide the basis for agreement regarding the conduct and scheduling of the audit activities. The amount of detail provided in the audit plan should reflect the scope and complexity of the audit, as well as the risk of not achieving the audit objectives1. The scope of the audit refers to the extent and boundaries of the audit, such as the audit criteria, the audit objectives, the organizational and functional units, and the processes to be audited1. The complexity of the audit refers to the degree of difficulty or intricacy of the audit, such as the number and diversity of the auditees, the audit criteria, the audit methods, and the audit team composition2. The risk of not achieving the audit objectives refers to the possibility that the audit may fail to provide reliable and sufficient audit evidence to support the audit conclusions and report1.

Therefore, the complete sentence is:

In the context of a third-party audit, the amount of detail provided in the audit plan should reflect the scope and complexity of the audit, as well as the risk of not achieving the audit objectives.

References: 1: ISO 19011:2018 - Guidelines for auditing management systems 2: Audit Complexity - an overview | ScienceDirect Topics

Nonconformity report

ISO 9001 Clause Number: 8.5.4 Nature of problem: Cleaning and sanitising records are not available for every batch. ISO 9001 requirement that has not been fulfilled: ISO 9001 - “The organization shall implement planned arrangements, at appropriate stages, to verify that the product requirements have been met.” Evidence: 40 cleaning records are available for 63 batches.

In a third-party certification audit, auditors are responsible for maintaining confidentiality as part of their professional duties. Here’s how they can demonstrate it:

A. Adhere to the CQI Professional Code of Conduct: The CQI (Chartered Quality Institute) Code of Conduct outlines ethical principles, including confidentiality. Auditors must adhere to professional standards, ensuring sensitive information is protected and not disclosed improperly.

B. Confirm the confidentiality arrangements with the auditee regarding the use of mobile devices/cameras: Before using mobile devices or cameras, auditors must seek explicit permission from the auditee and agree on confidentiality terms, preventing unauthorized recording or sharing of sensitive information.

Options C, D, and E involve breaching confidentiality and are not acceptable practices in an ISO 9001:2015 certification audit. Sharing sensitive information, removing evidence without consent, or discussing it with unauthorized parties violates audit principles and the standard's confidentiality requirements​.

Here is the correct matching of actions to the statements in the context of leading the internal audit:

If practicablecarry out a formal opening meeting

You should notaudit production (as you are a supervisor in that area, and this would compromise audit objectivity)

You need notchange the audit team (unless there is a specific reason, such as conflict of interest)

You mustraise audit findings if necessary (this is a key responsibility of an auditor when nonconformities are found)

You must notsend the audit report to the Quality Manager (the audit report must be reviewed first; it is typically part of the internal audit process to go through necessary channels before final submission)

You shouldsend the audit report to the Quality Manager (after appropriate reviews and approvals)

This reflects key principles of conducting an internal audit according to ISO 9001:2015, ensuring objectivity, proper documentation, and clear reporting procedures.

According to the definition in ISO 9000, a nonconformity is “non-fulfillment of a requirement”. There are three parts to a well-documented nonconformity: the audit evidence to support auditor findings; a record of the requirement against which the nonconformity is detected; and the statement of nonconformity1. In this case, the audit evidence is the dispatch records that show the same batch number of the product being delivered by two different trucks at different times. The requirement is the procedure P-02 Rev.3 that says that trucks should carry a complete batch. The statement of nonconformity is that the batch 33555 was delivered split in two different trucks (011 and 025), which does not conform to the procedure. Therefore, option C best describes the identified nonconformity, as it includes all three parts of a well-documented nonconformity. Option A is not correct, as it does not state the audit evidence or the requirement. Option B is not correct, as it does not specify the audit evidence or the statement of nonconformity. Option D is not correct, as it does not match the audit evidence or the requirement. References: 1: ISO 9001 Auditing Practices Group Guidance on Nonconformity - Documenting.

A first-party audit is an internal audit conducted by auditors who are employed by the organization being audited but who have no vested interest in the audit results of the area being audited1. The purpose of a first-party audit is to assess the conformity of the organization’s quality management system to the requirements of ISO 9001 and to identify opportunities for improvement2. Therefore, the two auditors who would not participate in a first-party audit are:

•A. An auditor employed by an external consultancy organization: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit (if the external consultancy organization is a customer or supplier of the organization being audited) or a third-party audit (if the external consultancy organization is a certification body or registrar).

•F. An auditor from a customer: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit, as a customer is an interested party that has specific requirements for the organization being audited.

The other options are not correct, as they could participate in a first-party audit, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited:

•B. An auditor from an interested party: This auditor could be a first-party auditor, as long as the interested party is within the organization being audited. For example, an auditor from the finance department could audit the production department, as long as they are not involved in the production process or affected by its outcomes.

•C. An auditor trained in-house: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The source of the auditor’s training is not relevant for determining the type of audit, as long as the auditor is competent and qualified to perform the audit.

•D. An auditor trained in the IRCA scheme: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The IRCA scheme is a professional certification scheme for auditors of management systems, which provides recognition of the auditor’s competence and credibility3. However, being trained in the IRCA scheme does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

•E. An auditor certified by IRCA: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. Being certified by IRCA means that the auditor has met the requirements of the IRCA scheme and has demonstrated their competence and credibility as an auditor of management systems3. However, being certified by IRCA does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

References: First Party Audits: The 5 Steps to Success - Sync Resource Inc, ISO 9001 Auditing Practices Group, IRCA - International Register of Certificated Auditors

Clause 8.2.4 of ISO 9001:2015 – Changes to Requirements for Products and Services:ISO 9001:2015 Clause 8.2.4 states that when changes to requirements for products or services are made, they must be communicated and agreed upon with relevant interested parties (in this case, the Health Trust). The lack of communication and agreement for substituting the cleaning chemical represents a clear violation of this clause.

Analysis of the Corrective Action Proposed:The organization proposed "obtaining a concession from the Health Trust for the use of the new chemical." This action is reactive and assumes approval from the Health Trust without addressing the systemic issue: the lack of a defined change control process for managing contract changes.

Option Analysis:

A. The substitute chemical has not been used before in the Health Trust:Incorrect. While this may be a concern, it is not directly relevant to the root cause of the nonconformity, which is the absence of a process to handle contract changes.

B. The action assumes that the Health Trust will agree to the change:Incorrect. Although this is true, it is not the primary issue. The nonconformity lies in the lack of a structured approach to obtain agreement, not whether the Health Trust agrees.

C. Staff have not been trained in the use of the new chemical:Incorrect. This is a separate issue related to staff competence (Clause 7.2), but it is not the main reason why the corrective action is unacceptable under Clause 8.2.4.

D. The process for making changes to the contract has not been addressed:Correct. The fundamental issue is the organization's failure to follow or establish a change control process for amending contracts, including gaining formal agreement from the Health Trust. The proposed corrective action does not ensure that such issues will be systematically prevented in the future.

E. The substitute chemical may not be as effective as the original:Incorrect. The effectiveness of the substitute chemical is secondary to the primary issue, which is the lack of a change management process.

ISO 9001 References Supporting the Correct Answer:

Clause 8.2.4: Requires that changes to product/service requirements be reviewed, communicated, and agreed upon with the customer.

Clause 10.2 (Nonconformity and Corrective Action): Requires the organization to address the root cause of the nonconformity and take actions to ensure it does not recur. In this case, the root cause is the absence of a change control process.

Why D is the Best Answer:The core issue is that the organization did not have a formalized process for managing and agreeing upon changes to contract requirements. Addressing this process gap is essential to prevent recurrence of similar nonconformities. Merely seeking a concession from the Health Trust is a one-off solution that does not address the systemic issue.

The audit team leader should deal with this situation in a professional and ethical manner, while maintaining the integrity and credibility of the audit process and the audit findings. The audit team leader should also try to resolve the conflict with the Quality Manager in a constructive and respectful way, without compromising the audit objectives or the audit team’s independence and impartiality. According to the ISO 9001 Lead Auditor Reference Materials guides and documents, the possible actions that the audit team leader might take are:

•A. Insist that the nonconformities must stand since they have been agreed by the team from other evidence gathered. This action is consistent with the principle of evidence-based approach, which states that the audit team should collect and verify information that is appropriate, sufficient, and reliable to support the audit findings and conclusions. The audit team leader should explain to the Quality Manager that the nonconformities are not based solely on the photographs, but on other audit evidence that corroborates them. The audit team leader should also remind the Quality Manager that the nonconformities are subject to review and approval by the certification body, and that any attempt to influence or interfere with the audit results would be considered a breach of the audit agreement and the certification rules.

•D. State that the auditor will take no further part in the audit and all his photographs will be deleted. This action is consistent with the principle of confidentiality, which states that the audit team should exercise discretion in the use and protection of information acquired during the audit. The audit team leader should acknowledge that the auditor’s behavior was inappropriate and unprofessional, and that he violated the audit rules and the auditee’s rights. The audit team leader should apologize for the inconvenience and the discomfort caused by the auditor, and assure the Quality Manager that the auditor will be removed from the audit team and that his photographs will be erased from his phone and any other device or media. The audit team leader should also inform the auditor of his misconduct and the consequences, and report the incident to the audit program manager and the certification body.

•F. Advise the Quality Manager that he, as audit team leader, needs to speak to the auditor about the situation and he will report back to the Quality Manager once this is done. This action is consistent with the principle of communication, which states that the audit team should exchange information with the auditee in a timely, open, honest, and respectful manner. The audit team leader should express his concern and his willingness to address the issue with the auditor, and ask for the Quality Manager’s patience and cooperation. The audit team leader should also explain that the audit process is not finished yet, and that the Closing meeting is an opportunity to present and discuss the audit findings and conclusions, and to seek feedback and clarification from the auditee. The audit team leader should then speak to the auditor privately, and follow the steps described in action D.

The other options are not appropriate or effective ways to deal with this situation, because they either:

•B. Delay the Closing meeting until the audit team leader has consulted his audit program manager at Head Office. This action would disrupt the audit schedule and the audit plan, and create unnecessary delays and costs for both the audit team and the auditee. It would also show a lack of leadership and decision-making skills from the audit team leader, and undermine his authority and credibility. The audit team leader should be able to handle the situation on site, and consult his audit program manager only if the situation escalates or becomes unmanageable.

•C. Advise the Quality Manager that the auditor will be reported to Head Office. This action would escalate the conflict and create a hostile and defensive atmosphere between the audit team and the auditee. It would also imply that the audit team leader is not capable or willing to resolve the issue himself, and that he is threatening or punishing the auditee for raising a legitimate concern. The audit team leader should try to defuse the tension and restore the trust and the rapport with the Quality Manager, and report the auditor to Head Office only after the audit is completed and the audit report is submitted.

•E. Apologise for the situation and ensure the Quality Manager that all photographs will be deleted during the Closing meeting. This action would not address the root cause of the problem, and would not prevent the auditor from taking more photographs or using them for other purposes. It would also expose the audit team and the auditee to unnecessary risks and liabilities, and compromise the confidentiality and the security of the audit information. The audit team leader should delete the photographs as soon as possible, and not wait until the Closing meeting.

References: ISO 9001:2015, ISO 19011:2018, PECB Certified ISO 9001 Lead Auditor, Common Audit Problems and How to Deal with Them, The Auditor’s Guide to Conflict Resolution, Conflict Resolution in your Audit Career, How to Be a Good Auditor as a Team Leader

Analyzing Each Statement:

A.Incorrect. The audit team leader must communicate concerns as they arise, not just during the closing meeting. Per ISO 19011:2018 Clause 6.4.9, significant concerns should be shared promptly with the auditee and audit client during the audit process to allow for immediate understanding and potential resolution.

B.Incorrect. The auditor or team leader is not specifically required to inform the general manager about uncontrolled documents. Instead, the issue is communicated within the framework of the audit findings to the audit client or auditee, as appropriate.

A Stage 1 audit is a preliminary assessment to evaluate the readiness of the organisation for the Stage 2 certification audit. The audit scope is defined by the audit client and the certification body based on the application and the contract. If the organisation wants to include a new work area that was not part of the original scope, the auditor should advise the Quality Manager that an extension of the scope is possible but will have to go through established procedures, such as submitting a formal request, providing relevant information, and paying additional fees. The auditor should also suggest that the Quality Manager will advise the programme manager, who is responsible for managing the audit programme, that the audit scope should be revised to include the new work area. The programme manager will then decide whether to approve or reject the request, and communicate the decision to the auditor and the Quality Manager. The auditor should not proceed with the audit of the new work area without the approval of the programme manager and the confirmation of the audit scope. 1234 References:

1: ISO 19011:2018 - Guidelines for auditing management systems

2: ISO 9001 Certification Audits | Stage 1 and Stage 2 - 9001. Simplified

3: What is the difference between Stage 1 and Stage 2 Audits? - ISO Update

4: Getting Certified to ISO 9001 - the Stage 1 Audit

The following table shows the possible matching of the records to the requirements of clause 8.4:

Table

Requirements

Records

Define product requirements

Product specification

Criteria for selection

List of requirements to be met by the external provider

Evaluation of potential external provider

External provider questionnaire

External provider selection

Approved external provider list

Communicate requirements

Purchase order

Monitoring of performance

External provider delivery times and quality issues

Comprehensive and Detailed Explanation: = According to clause 8.4 of ISO 9001:2015, the organization should ensure that externally provided processes, products, and services conform to the specified requirements. To do so, the organization should:

Define the product requirements that are relevant for the external provision, such as specifications, drawings, standards, codes, etc. These should be documented and communicated to the external provider. A record of the product specification can be used as evidence of this requirement.

Establish the criteria for the selection, evaluation, and re-evaluation of external providers, based on their ability to provide processes, products, and services in accordance with the requirements. The criteria should be documented and applied consistently. A record of the list of requirements to be met by the external provider can be used as evidence of this requirement.

Evaluate the potential external providers before selecting them, using the established criteria. The evaluation methods may include questionnaires, audits, references, samples, etc. The results of the evaluation should be documented and reviewed. A record of the external provider questionnaire can be used as evidence of this requirement.

Select the external providers that have demonstrated their competence and conformity to the requirements. The selection should be based on the evaluation results and the organization’s needs. The selection should be documented and approved. A record of the approved external provider list can be used as evidence of this requirement.

Communicate the requirements for the processes, products, and services to be provided by the external provider, including the verification and validation activities, the acceptance criteria, the documentation requirements, the changes control, etc. The communication methods may include purchase orders, contracts, agreements, etc. The communication should be clear, complete, and timely. A record of the purchase order can be used as evidence of this requirement.

Monitor the performance and conformity of the external provider, using the established criteria and methods. The monitoring methods may include inspections, tests, audits, feedback, complaints, etc. The monitoring results should be documented and analyzed. A record of the external provider delivery times and quality issues can be used as evidence of this requirement.

References: ISO 9001:2015, [ISO 9001 Auditing Practices Group Guidance on Scope], Mastering the Scope of ISO 9001 Quality Management Systems

According to ISO 9001:2015, clause 8.4, an organization is required to control the processes, products and services provided by external providers, including those that affect the quality of the organization’s own products and services. This includes determining the controls to be applied to the external provision of processes, products and services, as well as the information to be communicated to the external providers. The organization is also required to monitor, measure, and evaluate the performance of the external providers and retain documented information of these activities.

Therefore, in the scenario given, ABC Ltd is responsible for controlling the processes, products and services provided by Teak Ltd, as they affect the quality of ABC Ltd’s own products and services. This means that ABC Ltd should have established criteria and methods for evaluating the performance of Teak Ltd, as well as documented information of the results of such evaluation. ABC Ltd should also have defined the supply arrangements with Teak Ltd, including the specifications, requirements, and verification activities related to the products and services provided by Teak Ltd.

Hence, the best options to describe how to plan the audit of the interrelationship with Teak Ltd during the Stage 2 audit at ABC Ltd are A and D, as they are aligned with the requirements of ISO 9001:2015, clause 8.4. The other options are either irrelevant or beyond the scope of the audit, as they do not pertain to the control of external provision by ABC Ltd.

References:

ISO 9001:2015(en), Quality management systems — Requirements, clause 8.4

ISO 19011:2018(en), Guidelines for auditing management systems, clause 6.3.1 and 6.4.2

ISO 9001 Lead Auditor Training Course | IRCA Certified | BSI, section “Learning objectives”

ISO 9001 Lead Auditor Course Material | 3FOLD Education Centre, module 5 and 6

The table below shows the possible matching of the ISO 9001 Clause 8 extract to the audit evidence.

Table

Audit evidence

ISO 9001 Clause 8 extract

Four of the 10 pallets of stock sampled in the warehouse were not labelled.

“8.5.2 … shall use suitable means to identify outputs …”

A damaged pallet of stock seen in the quarantine area was leaking liquid onto the floor.

“8.7.1 … shall ensure that outputs that do not conform to their requirements are identified and controlled …”

One of the fork-lift truck drivers had no fork-lift truck driving licence.

“8.5.1 e … shall include, as applicable … the appointment of competent persons …”

There was no pest control provision in the warehouse.

“8.5.4 … shall preserve the outputs during production and service provision …”

Two pallets of temperature-sensitive stock items were being stored at ambient as the chilled storage facility was full.

“8.1 … shall plan, implement and control the processes …”

Questions no: 1 Verified Answer: = C, D, E Comprehensive But Short Explanation: = Potential threats to impartiality in an audit context include familiarity (having a close relationship with the auditee), intimidation (being coerced or feeling pressured), and self-audit (auditing one’s own work). These factors can compromise the auditor’s objectivity and the audit’s integrity. References: = The information is based on the ISO 9001 Auditing Practices Group documents which discuss threats to auditor impartiality and how they may compromise an auditor’s objectivity123.

In this scenario, the audit team leader must balance maintaining the integrity of the audit plan while considering the auditee’s request. The two best responses allow for flexibility without compromising the audit's rigor:

A. I could audit the other laboratories virtually at the end of this audit: Virtual audits can be a valid option, especially in multi-site audits. ISO 9001:2015 does not prohibit virtual audits, and in certain situations, they are practical for reviewing documentation or observing operations remotely.

C. I could try to revise the audit programme to see if I can audit all laboratories: Revising the audit programme to accommodate additional site visits is a reasonable compromise. ISO 9001:2015 audits are based on risk and sampling, but the audit team leader has the flexibility to adjust the audit scope if it fits within the audit duration and resources.

The other options, such as extending the audit duration (B, F) or strictly adhering to the original plan (D, E), may not be practical or necessary. Revising the plan to audit all laboratories or using virtual auditing ensures that the audit remains efficient while addressing the organization's concerns​.

To certify an organization's ISO 9001:2015-based Quality Management System (QMS) for the first time, the correct sequence of activities would be:

Establish the management system (already in place).

Supplier audit

Internal audit

Management review

Initial certification audit – stage 1

Initial certification audit – stage 2 (already in place).

This sequence follows the typical path for preparing and ensuring that a QMS is functioning as required, leading up to certification.

Sequence:

Stage 1 Audit

Stage 2 Opening Meeting

Interviews

Stage 2 Closing Meeting

Close-out of Stage 2 Audit Findings

Issue Certificate

Surveillance Audit

Follow-up Audit

To complete the sequence, you can drag and drop the options to the appropriate blank section.

Here is a brief explanation of each step:

Stage 1 Audit: This is the initial audit that aims to assess the readiness of the organization for the stage 2 audit. It involves reviewing the documentation of the quality management system, evaluating the scope and objectives of the audit, and identifying any major gaps or nonconformities34.

Stage 2 Opening Meeting: This is the meeting that marks the start of the stage 2 audit. It involves confirming the audit plan, the audit criteria, the audit scope, and the audit team. It also provides an opportunity for the auditee to ask any questions or raise any concerns34.

Interviews: This is the main activity of the stage 2 audit, where the audit team collects evidence by interviewing the personnel involved in the quality management system, observing the processes and activities, and examining the records and documents. The audit team uses various techniques, such as sampling, measurement, analysis, and evaluation, to verify the conformity and effectiveness of the quality management system345.

Stage 2 Closing Meeting: This is the meeting that marks the end of the stage 2 audit. It involves presenting the audit findings, the audit conclusions, and the audit report to the auditee. It also provides an opportunity for the auditee to provide feedback, ask questions, or dispute any findings34.

Close-out of Stage 2 Audit Findings: This is the process of verifying that the auditee has taken appropriate corrective actions to address any nonconformities or opportunities for improvement identified during the stage 2 audit. The audit team may request evidence or conduct a follow-up visit to confirm the effectiveness of the corrective actions34.

Issue Certificate: This is the process of issuing a certificate of conformity to the auditee, if the audit team is satisfied that the quality management system meets the requirements of the standard and that there are no major nonconformities or unresolved issues. The certificate is valid for a specified period, usually three years, and is subject to periodic surveillance audits34.

Surveillance Audit: This is the process of conducting periodic audits, usually once a year, to monitor the continued conformity and effectiveness of the quality management system. It involves reviewing the changes, improvements, and performance of the quality management system, and identifying any new nonconformities or opportunities for improvement34.

Follow-up Audit: This is the process of conducting an additional audit, usually in response to a significant change, a complaint, or a major nonconformity, to verify the impact and the corrective actions taken by the auditee. It may result in the suspension, withdrawal, or renewal of the certificate, depending on the outcome of the audit34.

In the context of ISO 9001:2015 audits, it is the audit team leader who holds the responsibility for assigning work to the audit team. According to ISO 19011:2018 (Guidelines for auditing management systems, which complements ISO 9001:2015), the audit team leader is responsible for the organization and direction of the audit, including assigning specific roles and responsibilities to audit team members. This includes preparation of the audit plan, leading the audit, and ensuring that each team member understands their tasks.

A screenshot of a chat Description automatically generated

According to the ISO 9000:2015 document, the seven quality management principles are:

Customer focus

Leadership

Engagement of people

Process approach

Improvement

Evidence-based decision making

Relationship management

For each principle, the document provides a statement, a rationale, key benefits, and actions you can take to apply the principle in your organization.

Based on the document, here is a possible way to match a potential benefit to each of the four quality management principles you mentioned:

Table

Quality management principle

Potential benefit

Customer focus

Increased revenue and market share

Engagement of people

Enhanced trust and collaboration throughout the organization

Improvement

Enhanced drive for innovation

Evidence-based decision making

Increased ability to demonstrate effectiveness of past actions

The tasks that are expected to be completed at the audit team meeting of a third-party audit team leader and his audit team in preparation for a Closing meeting for a four-day initial certification audit are:

•Option C: Final audit team meeting to agree findings and categories including clarification of any uncertainties. This option is correct because the audit team meeting is an opportunity for the audit team leader and the audit team members to review and consolidate the audit findings, to ensure that they are clear, accurate, objective, and supported by sufficient audit evidence. The audit team should also agree on the categories of the findings, such as nonconformity, observation, or opportunity for improvement, and resolve any uncertainties or disagreements among the audit team members.

•Option D: Agree the roles of each audit team member for the closing meeting. This option is correct because the audit team meeting is an opportunity for the audit team leader to assign the roles and responsibilities of each audit team member for the closing meeting, such as presenting the audit findings, answering questions, or taking notes. The audit team leader should also ensure that the audit team members are prepared and confident to perform their roles and to communicate effectively with the auditee.

•Option E: Audit team review any points raised by the auditee nominated representative. This option is correct because the audit team meeting is an opportunity for the audit team to review any points raised by the auditee nominated representative during the audit, such as requests for clarification, feedback, or complaints. The audit team should consider the validity and relevance of the points raised and decide how to address them in the closing meeting or in the audit report.

•Option F: Audit team agree final audit outcome recommendation. This option is correct because the audit team meeting is an opportunity for the audit team to agree on the final audit outcome recommendation, based on the audit findings and the audit criteria. The audit team should also consider the implications and consequences of the audit outcome recommendation for the auditee and the certification body, and ensure that the recommendation is consistent and justified.

•Option H: Audit team complete final version of their individual findings. This option is correct because the audit team meeting is an opportunity for the audit team to complete the final version of their individual findings, based on the agreement and feedback from the audit team meeting. The audit team should ensure that their individual findings are written in a clear, concise, and factual manner, and that they include the audit criteria, the audit evidence, and the audit conclusion. The audit team should also submit their individual findings to the audit team leader for review and approval.

•Option I: Re-audit corrective actions taken to correct findings found during the audit. This option is correct because the audit team meeting is an opportunity for the audit team to re-audit the corrective actions taken by the auditee to correct the findings found during the audit, if applicable and feasible. The audit team should verify the effectiveness and adequacy of the corrective actions and update the audit findings accordingly. The audit team should also document the results of the re-audit and communicate them to the auditee.

The following options are not correct:

•Option A: Audit team leader informs the individual(s) managing the audit programme that the closing meeting is ready to be held. This option is not correct because this task is not part of the audit team meeting, but part of the communication between the audit team leader and the individual(s) managing the audit programme. The audit team leader should inform the individual(s) managing the audit programme that the closing meeting is ready to be held after the audit team meeting, when the audit team has completed all the tasks and is ready to present the audit results to the auditee.

•Option B: Hold daily audit team meeting to review any timetable issues and potential findings and their impact on the audit for other team members. This option is not correct because this task is not part of the final audit team meeting, but part of the daily audit team meetings that are held during the audit. The daily audit team meetings are opportunities for the audit team to review the progress and performance of the audit, to identify and resolve any issues or problems, and to coordinate and adjust the audit plan and activities as needed.

•Option G: Audit team leader completes final report, including individual findings and certification recommendation. This option is not correct because this task is not part of the audit team meeting, but part of the audit reporting process. The audit team leader should complete the final report, including the individual findings and the certification recommendation, after the closing meeting, when the audit team has received and considered the feedback and comments from the auditee. The audit team leader should also ensure that the final report is reviewed and approved by the appropriate authorities before issuing it to the auditee and the certification body.

•Option J: Write the audit finding report out when detected and obtain signature of the auditee. This option is not correct because this task is not part of the audit team meeting, but part of the audit evidence collection and documentation process. The audit team should write the audit finding report out when detected and obtain the signature of the auditee during the audit, when the audit team has observed and verified the audit evidence and has communicated the audit finding to the auditee. The signature of the auditee does not indicate acceptance or agreement with the audit finding, but only acknowledgement of receipt.

References:

•ISO 19011:2018 Guidelines for auditing management systems, Clause 6.4.2: Conducting audit activities, Subclause i) and j)

•ISO 9001 Lead Auditor Course Material, Module 5: Conducting an Audit, Slide 19: Audit Team Meeting

•ISO 9001 Lead Auditor Training Course - IRCA Certified, Section 5.4: Audit Team Meeting

•Lead Auditor Exam Preparation Guide (EPG) Template - PECB, Section 3.2: Exam Content Outline, Subsection 3.2.1: Section 1 - Audit Fundamentals, Subsection 3.2.2: Section 2 - Audit Principles, Subsection 3.2.3: Section 3 - Audit Process, Subsection 3.2.4: Section 4 - Audit Competencies

The Stage 1 audit is a readiness review that verifies the organization’s ability to conduct the Stage 2 audit. It involves reviewing the documented information, evaluating the site-specific conditions, and having discussions with personnel. The auditor does not verify the degrees of customer satisfaction, the compliance with legal requirements, or the results of the last management review during the Stage 1 audit. These are done during the Stage 2 audit or later in the certification process. References:

ISO 9001 Lead Auditor Reference Materials

ISO 9001 Lead Auditor Candidate Handbook

ISO 9001 Lead Auditor Course Material

ISO 9001 Lead Auditor Training Course IRCA Certified

To demonstrate top management’s leadership and commitment with respect to the quality management system, the following four actions would be indicative:

B. Briefing staff on the development of an improvement culture: This shows that top management is actively involved in promoting a culture of continuous improvement, which is a key aspect of the quality management system1.

C. Chairing management review meetings: By leading these meetings, top management demonstrates their involvement in the quality management system’s ongoing performance and commitment to its continual improvement1.

E. Investing time and money in corrective actions arising from nonconformities: This indicates that top management is committed to addressing issues and ensuring that the quality management system is effective and continually improving1.

G. Promoting the importance of following procedures: When top management emphasizes the importance of adherence to procedures, it reinforces the significance of the quality management system and its processes1.

These actions align with the requirements of ISO 9001:2015, which emphasizes the need for top management to take accountability for the effectiveness of the quality management system and to promote a focus on continual improvement and customer satisfaction123. Approving company car budgets, conducting disciplinary meetings, and not attending the audit closing meeting do not directly demonstrate leadership and commitment to the quality management system1.

In the context of a third-party audit, the activities and the parties responsible can be matched as follows:

Review the organization’s processes: This is typically the responsibility of the audit team. They examine the processes to ensure they comply with the specified standards1.

Review the audit results: The audit team leader usually reviews the audit findings to ensure accuracy and completeness before they are finalized1.

Issue the certificate: The certification body is responsible for issuing the certificate if the audit is successful and the organization meets the required standards1.

Select the audit team: The individual(s) managing the audit programme are responsible for selecting the audit team. This ensures that the team has the appropriate skills and knowledge for the audit1.

These roles are essential to maintain the integrity and effectiveness of the audit process. The audit team conducts the actual audit, the team leader oversees the audit process, the certification body grants the certification, and the management of the audit program ensures that the right team is in place to conduct the audit1.

Based on the description of the image you’ve provided, here’s how the activities match with the responsible parties in the context of a third-party audit:

Review the organization’s processes: This activity is typically the responsibility of the Audit Team. They are tasked with examining the processes to ensure they meet the requirements of the standard being audited.

Review the audit results: The Audit Team Leader is usually responsible for this activity. They oversee the audit process and are in charge of reviewing the findings and ensuring that the audit objectives are met.

Issue the certificate: The Certification Body is responsible for issuing the certificate if the organization’s management system is found to be in compliance with the standard.

Select the audit team: The Individual(s) managing the audit programme are responsible for selecting the audit team. They ensure that the team has the appropriate competence and resources to effectively conduct the audit.

These roles are defined within the framework of ISO 9001:2015 and are essential for the proper conduct of a third-party audit. The audit team and its leader play a critical role in the operational aspects of the audit, while the certification body and those managing the audit programme have overarching responsibilities for the audit’s governance and integrity.

In this scenario, the time allocated by the audit team leader for the Human Resources audit is fixed, and as an auditor, you must work within that constraint. Although the sampling criteria suggests reviewing 25 personnel files, it is acceptable to adjust the sample size based on time and resource limitations. ISO 9001:2015 emphasizes risk-based thinking and practical resource management (Clause 7.1), so it is reasonable to review a smaller sample if the time is insufficient.

Option B is a pragmatic approach, allowing you to focus on quality over quantity by reviewing as many cases as time allows without compromising the audit schedule.

Options like extending the audit (A, C, D) are impractical in a structured audit environment, especially for second-party audits where maintaining the agreed schedule is important​​.

According to ISO 19011:2018, clause 6.3.3, the audit plan should be reviewed and revised as necessary to address changes that occur during the audit planning. The audit plan should be agreed upon, preferably in writing, by the audit team leader, the audit client and the auditee1. Therefore, if there is a significant change in the auditee’s situation, such as the cancellation of all orders for the next week, the audit plan should be reviewed and revised accordingly, with the agreement of all parties involved.

According to ISO/IEC 17021-1:2015, clause 9.1.4, the certification body should have a process to ensure that the audit team has the competence to achieve the audit objectives, and that the audit methods are appropriate for the scope and complexity of the audit. The certification body should also have a process to ensure that the audit is conducted under reasonable conditions and within a reasonable time frame2. Therefore, if there is a risk that the audit objectives cannot be achieved, or that the audit methods are not suitable, due to the change in the auditee’s situation, the certification body should be consulted and informed on how to proceed with the audit.

Therefore, the best action to take is B, ask the certification body you work for how to proceed with the audit. This action will ensure that the audit plan is revised and agreed upon by all parties, and that the audit team has the competence and the methods to conduct the audit effectively and efficiently. The other options are not correct, as they may compromise the quality and validity of the audit:

•A. Start the audit on Monday at ABC’s as planned, interviewing the functions that regularly work at the central office, and plan visits to ABC customers wherever they may be working during the following week: This action may not be feasible or acceptable, as it may extend the audit duration and cost beyond the agreed terms, and it may not provide sufficient and appropriate audit evidence to verify the conformity and effectiveness of the auditee’s processes. Moreover, this action may not be agreed upon by the audit client and the auditee, and it may not be approved by the certification body.

•C. Start the audit on Monday as planned, interviewing the functions that regularly work at the central office, and visit another customer’s premises they cleaned the week before: This action may not be relevant or reliable, as it may not reflect the current performance and condition of the auditee’s processes. The audit evidence collected from the previous customer may not be valid or representative of the audit criteria, and it may not address the risks and opportunities associated with the auditee’s context and objectives. Moreover, this action may not be agreed upon by the audit client and the auditee, and it may not be approved by the certification body.

•D. Complete the audit but ask the quality manager to clean some windows at the ABC’s office, simulating the process they carry out at customers’ premises: This action may not be objective or impartial, as it may introduce bias and influence in the audit process. The audit evidence collected from the simulated process may not be accurate or authentic, and it may not demonstrate the actual capability and effectiveness of the auditee’s processes. Moreover, this action may not be ethical or professional, as it may compromise the integrity and credibility of the audit and the certification.

References: ISO 19011:2018(en), Guidelines for auditing management systems, ISO/IEC 17021-1:2015(en), Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements

The actions that should be taken in the context of the audit are:

•Option B: Call the individual(s) managing the audit programme to explain the situation and recommend immediate suspension of certification to protect the integrity of the Certification Body. This option is correct because the auditor has found serious and significant gaps in the QMS processes that affect the health and safety of the patients, which is a major nonconformity that may warrant suspension of certification. The auditor should inform the individual(s) managing the audit programme of the situation and the audit findings, and recommend immediate suspension of certification to protect the integrity of the Certification Body and the credibility of the certification scheme. The auditor should also follow the Certification Body’s procedures and rules for suspension of certification and communicate the decision and the consequences to the auditee.

•Option C: Continue with the meeting, present the audit conclusions and inform the DCM that the organisation will receive the audit report in due course. This option is correct because the auditor should not terminate or postpone the closing meeting due to the absence of the Catering Manager, as the DCM is the auditee’s nominated representative for the audit. The auditor should continue with the meeting, present the audit conclusions and the audit findings, and inform the DCM that the organisation will receive the audit report in due course. The auditor should also explain the audit outcome recommendation and the suspension of certification, and request the DCM to acknowledge the receipt and understanding of the audit results.

The following options are not correct:

•Option A: Close the meeting immediately after the DCM’s response and advise that the issues will be addressed at the next surveillance visit. This option is not correct because the auditor should not close the meeting without presenting the audit conclusions and the audit findings, as this would violate the audit principles of fairness and transparency. The auditor should also not advise that the issues will be addressed at the next surveillance visit, as this would imply that the auditor is accepting the auditee’s delay and inaction, and that the auditor is not taking the major nonconformity seriously.

•Option D: Conclude the meeting early and advise that it will be rescheduled once the Catering Manager has returned to work. This option is not correct because the auditor should not conclude the meeting early or reschedule it due to the absence of the Catering Manager, as this would disrupt the audit process and the audit schedule. The auditor should also not wait for the Catering Manager to return to work, as this would delay the communication and resolution of the major nonconformity, and potentially compromise the health and safety of the patients.

•Option E: Recommend that all personnel should be given urgent in-depth training in the QMS. This option is not correct because the auditor should not recommend or prescribe specific corrective actions to the auditee, as this would violate the audit principles of independence and objectivity. The auditor should only report the audit findings and the audit outcome recommendation, and leave the responsibility and authority for determining and implementing the corrective actions to the auditee.

•Option F: Thank the DCM for his time and express an expectation that improvements will be made in the QMS. This option is not correct because the auditor should not thank the DCM for his time and express an expectation that improvements will be made in the QMS, as this would imply that the auditor is satisfied and optimistic with the auditee’s performance and response, and that the auditor is not taking the major nonconformity seriously. The auditor should instead express the concern and dissatisfaction with the auditee’s QMS processes and the impact on the health and safety of the patients, and communicate the suspension of certification and the need for urgent and effective corrective actions.

References:

•ISO 19011:2018 Guidelines for auditing management systems, Clause 6.4.2: Conducting audit activities, Subclause k) and l)

•ISO 9001 Lead Auditor Course Material, Module 5: Conducting an Audit, Slide 20: Closing Meeting

•ISO 9001 Lead Auditor Training Course - IRCA Certified, Section 5.5: Closing Meeting

•Lead Auditor Exam Preparation Guide (EPG) Template - PECB, Section 3.2: Exam Content Outline, Subsection 3.2.1: Section 1 - Audit Fundamentals, Subsection 3.2.2: Section 2 - Audit Principles, Subsection 3.2.3: Section 3 - Audit Process, Subsection 3.2.4: Section 4 - Audit Competencies

Establishing the audit programme objectives

Determining and evaluating the audit programme risks and opportunities

Establishing the audit programme

Initiating the audit

Preparing all audit activity

Conducting the audit activities

According to ISO 19011:2018, clause 5, the audit programme is a set of one or more audits planned for a specific time frame and directed towards a specific purpose. The audit programme includes all activities necessary to plan, organize, and conduct the audits. The audit programme management involves the following steps1:

Establishing the audit programme objectives: The audit programme objectives define the intended outcomes of the audit programme, such as verifying conformity, evaluating performance, identifying improvement opportunities, etc. The audit programme objectives should be aligned with the strategic direction and policies of the organization and the needs and expectations of the interested parties.

Determining and evaluating the audit programme risks and opportunities: The audit programme risks and opportunities are the factors that can affect the achievement of the audit programme objectives, such as changes in the internal or external context, availability of resources, competence of auditors, etc. The audit programme risks and opportunities should be identified, analyzed, and evaluated to determine the appropriate actions to address them.

Establishing the audit programme: The audit programme is established by defining the audit programme scope, criteria, methods, and resources. The audit programme scope defines the extent and boundaries of the audit programme, such as the processes, functions, sites, activities, etc. that will be audited. The audit programme criteria are the set of policies, procedures, or requirements used as a reference for the audits. The audit programme methods are the techniques used to conduct the audits, such as interviews, observations, document review, sampling, etc. The audit programme resources are the human, technical, and financial resources needed to implement the audit programme.

Initiating the audit: The audit initiation is the process of formally establishing the arrangements for an individual audit within the audit programme. The audit initiation involves contacting the auditee and the audit client, confirming the audit objectives, scope, and criteria, and obtaining the necessary information and access for the audit.

Preparing all audit activity: The audit preparation is the process of developing the audit plan and the audit work documents for an individual audit. The audit plan is a document that provides the basis for agreement regarding the conduct of the audit, such as the audit schedule, the audit team, the audit methods, the audit language, the audit report, etc. The audit work documents are the records that provide evidence of the audit activities, such as the audit checklist, the audit notes, the audit findings, etc.

Conducting the audit activities: The audit activities are the processes of collecting and verifying audit evidence and evaluating it against the audit criteria to make the audit conclusions. The audit activities include the opening meeting, the communication during the audit, the roles and responsibilities of the audit team and the auditee, the audit evidence collection and verification, the audit findings generation and recording, the closing meeting, and the audit report preparation and distribution.

References: ISO 19011:2018(en), Guidelines for auditing management systems