ISO-9001-Lead-Auditor QMS ISO 9001:2015 Lead Auditor Exam Questions and Answers

Reduced incoming inspection → A. Quality

Improved communication with suppliers → B. Procurement

Purchased materials received on time → C. Logistics

Reduced variability within processes → D. Production

According to ISO 9001:2015, Clause 8.4 - Control of externally provided processes, products and services, organisations are required to ensure that externally provided products and services conform to specified requirements. When an organisation sources from ISO 9001 certified suppliers, there is greater assurance of consistency in quality, delivery, and communication. This enhances internal operations across various functions:

Reduced incoming inspection (Quality): ISO 9001 certified suppliers have robust quality controls (Clause 8.4.2), reducing the need for repeated inspections upon receipt. This aligns with Quality’s responsibility for incoming inspection and verification.

Improved communication with suppliers (Procurement): Clause 8.4.3 emphasizes the communication of detailed requirements to external providers. Procurement plays a key role in ensuring these requirements are understood and met.

Purchased materials received on time (Logistics): Timely deliveries are often a result of structured supplier evaluation and selection (Clause 8.4.1). Logistics benefits through fewer delays and better scheduling of internal processes.

Reduced variability within processes (Production): Consistency of supplied materials supports stable and predictable production processes, which is a key aspect of Clause 8.5 – Production and service provision.

Non-Conformity Report:

ISO 9001 Clause Number

Nature of Problem

ISO 9001 Requirement That Has Not Been Fulfilled

6.1.1

Several risks and opportunities have not been determined.

" The organization shall consider the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed. "

6.1.2 (a)

Actions to address risks and opportunities not planned.

" The organization shall plan actions to address risks and opportunities. "

Step-by-Step Reasoning:

Clause 6.1.1 - Determining Risks and Opportunities:

Requirement: The organization must determine risks and opportunities that are relevant to its Quality Management System (QMS). This ensures that the QMS achieves intended results and prevents undesired effects.

Problem Identified: While some risks and opportunities were discussed, the organization did not perform a systematic evaluation of all risks (e.g., health and safety legislation changes, retiring trainers).

Clause 6.1.2 (a) - Planning Actions for Risks and Opportunities:

Requirement: The organization must plan actions to address identified risks and opportunities. These actions should be integrated into the QMS processes to ensure continuous improvement.

Problem Identified: The Quality Systems Manager confirmed that no plans were made to address the risks and opportunities because the Managing Director deemed it unnecessary. This violates the requirement to plan actions.

Correct Options Selected:

Clause 6.1.1 with the nature of the problem as: " Several risks and opportunities have not been determined. "

Clause 6.1.2 (a) with the nature of the problem as: " Actions to address risks and opportunities not planned. "

ISO 9001 Requirements Not Fulfilled:

For 6.1.1: " The organization shall consider the requirements referred to in 4.2 and determine the risks and opportunities that need to be addressed. "

For 6.1.2 (a): " The organization shall plan actions to address risks and opportunities. "

According to the ISO 19011:2018 document, the audit plan should provide the basis for agreement regarding the conduct and scheduling of the audit activities. The amount of detail provided in the audit plan should reflect the scope and complexity of the audit, as well as the risk of not achieving the audit objectives1. The scope of the audit refers to the extent and boundaries of the audit, such as the audit criteria, the audit objectives, the organizational and functional units, and the processes to be audited1. The complexity of the audit refers to the degree of difficulty or intricacy of the audit, such as the number and diversity of the auditees, the audit criteria, the audit methods, and the audit team composition2. The risk of not achieving the audit objectives refers to the possibility that the audit may fail to provide reliable and sufficient audit evidence to support the audit conclusions and report1.

Therefore, the complete sentence is:

In the context of a third-party audit, the amount of detail provided in the audit plan should reflect the scope and complexity of the audit, as well as the risk of not achieving the audit objectives.

According to ISO 19011:2018, clause 6.3, the audit plan is a document that provides the basis for agreement regarding the conduct of the audit. The audit plan should include the information listed in my previous response, such as the audit objectives, scope, criteria, schedule, team, methods, report, etc. The audit plan should be prepared and completed prior to the on-site audit, and should be communicated to the audit team and the auditee1.

According to ISO 19011:2018, clause 6.4.3, the checklist / prompts are documents that list the questions or topics that need to be covered during an audit. The checklist / prompts can help the auditor to collect and verify information relevant to the audit criteria, and to ensure the consistency and completeness of the audit. The checklist / prompts should be prepared and completed prior to the on-site audit, and should be based on the audit plan and the audit scope and objectives1.

Therefore, the two documents that an auditor needs to prepare and complete prior to the on-site audit are B and D, as they are essential for planning and conducting the audit. The other options are not correct, as they are either prepared or completed after the on-site audit, or not required by the standard:

•A. Audit Report: The audit report is a document that provides a complete, accurate, concise, and clear record of the audit. The audit report should include the information listed in my previous response, such as the audit objectives, scope, criteria, findings, conclusions, etc. The audit report should be prepared and completed after the on-site audit, and should be distributed to the audit client and the auditee1.

•C. Procedures: Procedures are documents that specify the way activities are to be performed. Procedures may be part of the audit criteria, if they are part of the organization’s management system, or part of the audit programme, if they are part of the certification body’s or registrar’s requirements. Procedures are not prepared or completed by the auditor prior to the on-site audit, but rather reviewed or followed by the auditor during the audit1.

•E. Risk Matrices: Risk matrices are tools that help to assess and prioritize the risks and opportunities associated with the audit programme or the audit. Risk matrices may be part of the audit programme management, if they are used to determine and evaluate the audit programme risks and opportunities, or part of the audit preparation, if they are used to determine and evaluate the audit risks and opportunities. Risk matrices are not prepared or completed by the auditor prior to the on-site audit, but rather used or updated by the auditor during the audit programme management or the audit preparation1.

•F. Findings: Findings are the results of the evaluation of the collected audit evidence against the audit criteria. Findings can indicate either conformity or nonconformity, as well as positive aspects or opportunities for improvement. Findings are not prepared or completed by the auditor prior to the on-site audit, but rather generated and recorded by the auditor during the audit activities1.

ISO 9001:2015 clearly distinguishes between management review inputs and management review outputs .

Relevant ISO 9001 requirement

Clause 9.3.2 – Management review inputs Management review shall consider information on, among other things:

customer satisfaction and feedback from relevant interested parties;

the extent to which quality objectives have been met;

the effectiveness of actions taken to address risks and opportunities.

Explanation of the correct answers:

B. Updates to the risk register

This represents information on risks and opportunities and the effectiveness of actions taken to address them , which is an explicit management review input under Clause 9.3.2.

C. Positive and negative customer comments

Customer feedback is a direct input to management review, supporting evaluation of customer satisfaction , as required by Clause 9.3.2 and Clause 9.1.2.

D. Report of performance of quality objectives in the last year

This provides evidence of the extent to which quality objectives have been met , which is a mandatory management review input under Clause 9.3.2.

Explanation of why the other options are not inputs:

A. Revisions required to the quality system documentation These are typically outputs of management review (decisions on changes to the QMS), not inputs.

E. Procurement of a laser measuring tool This is a specific operational or resource decision, not a required management review input.

F. Actions for quality system improvement Actions for improvement are management review outputs , covered under Clause 9.3.3, not inputs.

ISO-aligned conclusion:

Management review inputs are performance data and information used by top management to make decisions. In this scenario, the correct input audit evidence is:

updates to risks and opportunities,

customer feedback, and

performance against quality objectives.

In the context of a third-party audit, the activities and the parties responsible can be matched as follows:

Review the organization’s processes: This is typically the responsibility of the audit team. They examine the processes to ensure they comply with the specified standards1.

Review the audit results: The audit team leader usually reviews the audit findings to ensure accuracy and completeness before they are finalized1.

Issue the certificate: The certification body is responsible for issuing the certificate if the audit is successful and the organization meets the required standards1.

Select the audit team: The individual(s) managing the audit programme are responsible for selecting the audit team. This ensures that the team has the appropriate skills and knowledge for the audit1.

These roles are essential to maintain the integrity and effectiveness of the audit process. The audit team conducts the actual audit, the team leader oversees the audit process, the certification body grants the certification, and the management of the audit program ensures that the right team is in place to conduct the audit1.

Based on the description of the image you’ve provided, here’s how the activities match with the responsible parties in the context of a third-party audit:

Review the organization’s processes: This activity is typically the responsibility of the Audit Team. They are tasked with examining the processes to ensure they meet the requirements of the standard being audited.

Review the audit results: The Audit Team Leader is usually responsible for this activity. They oversee the audit process and are in charge of reviewing the findings and ensuring that the audit objectives are met.

Issue the certificate: The Certification Body is responsible for issuing the certificate if the organization’s management system is found to be in compliance with the standard.

Select the audit team: The Individual(s) managing the audit programme are responsible for selecting the audit team. They ensure that the team has the appropriate competence and resources to effectively conduct the audit.

These roles are defined within the framework of ISO 9001:2015 and are essential for the proper conduct of a third-party audit. The audit team and its leader play a critical role in the operational aspects of the audit, while the certification body and those managing the audit programme have overarching responsibilities for the audit’s governance and integrity.

According to the definition in ISO 9000, a nonconformity is “non-fulfillment of a requirement”. There are three parts to a well-documented nonconformity: the audit evidence to support auditor findings; a record of the requirement against which the nonconformity is detected; and the statement of nonconformity1. In this case, the audit evidence is the dispatch records that show the same batch number of the product being delivered by two different trucks at different times. The requirement is the procedure P-02 Rev.3 that says that trucks should carry a complete batch. The statement of nonconformity is that the batch 33555 was delivered split in two different trucks (011 and 025), which does not conform to the procedure. Therefore, option C best describes the identified nonconformity, as it includes all three parts of a well-documented nonconformity. Option A is not correct, as it does not state the audit evidence or the requirement. Option B is not correct, as it does not specify the audit evidence or the statement of nonconformity. Option D is not correct, as it does not match the audit evidence or the requirement. References: 1: ISO 9001 Auditing Practices Group Guidance on Nonconformity - Documenting.

Audit Evidence and Applicable ISO 9001:2015 Clause 8.3 Extracts

Half of all new products launched in the past 12 months were late. The Product Development Manager explains he has not got enough people on his team to cope with the demand for new products. → ISO 9001 Clause 8.3.2 e) – “…internal resource needs for the design and development of products and services…”

The Product Development Manager explains many changes are made to cosmetic formulations during product development owing to retailer feedback. Only when confirmed by the retailer is the agreed formulation documented on SWIFT. → ISO 9001 Clause 8.3.5 – “…retain documented information on design and development changes…”

The Product Development Manager explains that the customer confirms their approval to proceed with a new formulation by email. These emails are kept on SWIFT. → ISO 9001 Clause 8.3.6 – “…retain documented information on design and development outputs…”

The Product Development Manager shows you evidence of consumer trials that are carried out for some new products before a full-scale launch. → ISO 9001 Clause 8.3.4 d) – “…conducted to ensure that the resulting products and services meet the requirements…”

The Product Development Manager explains that an approved external laboratory is used to perform shelf-life stability trials on some formulations during product development. → ISO 9001 Clause 8.3.2 e) – “…external resource needs for the design and development of products and services…”

ISO 9001:2015 Clause 8.3 (Design and development of products and services) requires organisations to plan, control, review, verify, validate, and document design and development activities to ensure products meet requirements.

Explanation of clause alignment:

Clause 8.3.2 e) requires the organisation to determine both internal and external resource needs . Lack of personnel causing late launches directly evidences internal resource shortfalls, while the use of an external laboratory demonstrates control of external resources.

Clause 8.3.5 requires organisations to control design and development changes and retain documented information describing those changes, which is demonstrated by controlled updates in SWIFT following retailer confirmation.

Clause 8.3.6 requires retention of documented information on design and development outputs , including customer approvals, which are evidenced by stored emails in SWIFT.

Clause 8.3.4 d) requires design and development activities such as verification and validation , ensuring outputs meet requirements. Consumer trials prior to launch clearly meet this requirement.

ISO-aligned conclusion:

The evidence provided demonstrates structured control of product design and development, including planning, resourcing, change management, validation, and retention of documented information, all mapped directly to ISO 9001:2015 Clause 8.3 requirements .

Here is the correct matching of the activities with the responsible parties in the context of a second-party audit:

Define the audit scope: Customer

Develop the audit plan: Audit team leader

Respond to the audit findings: External provider

Conduct the audit: Audit team

This reflects the typical division of responsibilities in a second-party audit, where the customer (the party commissioning the audit) sets the scope, the audit team leader manages the planning, the external provider responds to findings, and the audit team carries out the audit.

ISO 9001:2015 requires audit findings, including non-conformities, to be based on objective evidence and to be clearly described , stating exactly what requirement was not met and where .

A non-conformity statement must:

Reference the specific requirement (procedure or ISO clause), and

Describe the objective evidence observed , without assumptions, generalisations, or conclusions about causes.

In this scenario:

The requirement is clearly stated in Procedure P-02 Rev.3 , which requires samples sent to the laboratory to include reference to the raw meat batch number to ensure traceability.

The objective evidence observed by Auditor 1 is that samples from PL2 did not include the raw meat batch reference , while samples from PL1 did.

Why option C is correct:

C. “Samples of hamburgers sent to the HMB’s laboratory for analysis by PL2 did not refer to the raw meat batch number as required by P-02 Rev.3.”

This statement:

Accurately reflects what was observed,

Clearly identifies the affected process (PL2),

Directly references the unmet requirement (P-02 Rev.3), and

Is factual, specific, and evidence-based.

Why the other options are not the best description of evidence:

A is a generalised conclusion and does not describe the specific evidence observed.

B assumes a lack of awareness, which was not evidenced during the audit.

D refers to product identification for delivery to the client, which is not what was observed (the issue was laboratory sample identification).

ISO-aligned conclusion:

The correct way to describe audit evidence is to state precisely what was observed against the requirement , without interpretation or assumption. Therefore, the statement that best describes the identified evidence is Option C .

According to the ISO 9001:2015 standard, clause 8.7 requires that an organization identify and control any nonconforming outputs that do not conform to the requirements of the customer or other relevant requirements. Nonconforming outputs are any outputs from the process, product or service that do not meet the specified quality criteria. Nonconforming outputs must be dealt with in one or more of the following ways:

Correction of the nonconformity

Segregation, containment, return or suspension of provision of products and services

Informing the customer

Authorisation for acceptance under concession

The organization must also retain documented information on the description of the nonconformity, the actions taken, any concessions obtained, and the identification of the authority deciding the action to resolve the nonconformity.

In this scenario, you have interviewed a line supervisor who is responsible for managing a manual picking line where operators are removing contaminant materials from incoming products. The supervisor has explained that these plastic items are rejected at this stage because they do not meet their processing standards and they can damage their machinery and compromise their quality standards. The supervisor has also mentioned that some of these rejected items are melted down in another process later on and some are disposed of as waste products that cannot be recycled.

Based on this information, you can investigate further by taking two actions:

A. Check the process for handling nonconforming items: You can verify whether there is a documented procedure for identifying, segregating, containing, returning or suspending provision of nonconforming items at this stage. You can also check whether there is a system for informing customers about any nonconforming items that may affect their satisfaction or expectations.

D. Determine what happens to the waste products: You can verify whether there is a documented procedure for disposing of waste products that cannot be recycled as per environmental regulations and customer requirements.

These two actions would help you to determine whether there are any nonconforming outputs at this stage and how they are controlled by the organization.

According to the ISO - Management system standards page, the key benefits of an effective management system include improved operational effectiveness and efficiency, improved risk management and protection of people and the environment, and enhanced drive for innovation. The Integrated Use of Management System Standards (IUMSS) handbook also states that the purpose and objectives of management system standards are to help organizations improve their performance by specifying repeatable steps that organizations consciously implement to achieve their goals and objectives.

Therefore, the complete sentence is:

“The purpose of a management system standard is to improve the performance of an organisation.”

A Stage 1 audit is a preliminary assessment to evaluate the readiness of the organisation for the Stage 2 certification audit. The audit scope is defined by the audit client and the certification body based on the application and the contract. If the organisation wants to include a new work area that was not part of the original scope, the auditor should advise the Quality Manager that an extension of the scope is possible but will have to go through established procedures, such as submitting a formal request, providing relevant information, and paying additional fees. The auditor should also suggest that the Quality Manager will advise the programme manager, who is responsible for managing the audit programme, that the audit scope should be revised to include the new work area. The programme manager will then decide whether to approve or reject the request, and communicate the decision to the auditor and the Quality Manager. The auditor should not proceed with the audit of the new work area without the approval of the programme manager and the confirmation of the audit scope. 1234 References:

1: ISO 19011:2018 - Guidelines for auditing management systems

2: ISO 9001 Certification Audits | Stage 1 and Stage 2 - 9001. Simplified

3: What is the difference between Stage 1 and Stage 2 Audits? - ISO Update

4: Getting Certified to ISO 9001 - the Stage 1 Audit

Comprehensive and Detailed In-Depth Explanation:

According to ISO 17021-1:2015, Clause 9.4.8 (Audit Reporting):

The audit report must be submitted to the certification body regardless of corrective actions.

Corrective actions are reviewed after the audit, but the audit process should not be delayed.

Certification decisions should be made based on the audit findings and evidence, not pending corrective actions.

Thus, delaying audit activities until corrective actions are submitted is not acceptable.

Comprehensive and Detailed In-Depth Explanation:

Group interviews allow auditors to gather more information in less time by:

Obtaining input from multiple participants simultaneously.

Encouraging discussions that might highlight inconsistencies.

Reducing the number of individual interviews needed.

While auditors strive for fairness, equal time for each interviewee is not guaranteed, and paying attention to each individual is more difficult in a group setting.

ISO 9001:2015 Clause 7.5 – Documented Information establishes requirements for the creation, updating, and control of documented information within the Quality Management System (QMS).

Relevant ISO 9001 Requirements

Clause 7.5.2 – Creating and Updating

When creating and updating documented information, the organization shall ensure appropriate:

Identification and description (e.g., title, date, author, reference number)

Format and media

Review and approval for suitability and adequacy

This supports the requirement that documented information be identifiable .

Clause 7.5.3 – Control of Documented Information

Documented information required by the QMS and by ISO 9001 shall be controlled to ensure:

It is available and suitable for use where and when it is needed

It is adequately protected

Control activities include:

Distribution, access, retrieval and use

Storage and preservation

Control of changes (version control)

Retention and disposition

These requirements support:

Retrievable → Required by Clause 7.5.3

Under change control → Required by Clause 7.5.3

Identifiable → Required by Clause 7.5.2

Why " Translatable to Other Languages " is Incorrect

ISO 9001:2015 does not require documented information to be translated into other languages.

An organization may choose to translate documents where necessary for operational effectiveness, multinational operations, or legal requirements, but this is not a requirement of Clause 7.5 .

Therefore, being translatable to other languages is not a characteristic that documented information must demonstrate to conform to ISO 9001.

Evaluation of Each Option

Option

Required by ISO 9001 Clause 7.5?

Retrievable

Yes

Under change control

Yes

Translatable to other languages

No

Identifiable

Yes

ISO-Aligned Conclusion

Clause 7.5 requires documented information to be identifiable , retrievable , and controlled against unauthorized or uncontrolled changes . There is no ISO 9001 requirement that documented information be translatable into other languages .

Answer: C

===========

A second-party audit is typically performed by an organization (often a customer) on an external provider (supplier) to evaluate their capability and performance—i.e., to determine whether they can consistently meet requirements.

ISO 9001:2015 supports this purpose through its requirements for control of externally provided processes, products and services , where the organization must evaluate and monitor external providers :

ISO 9001 requires the organization to “ determine and apply criteria for the evaluation, selection, monitoring of performance and re-evaluation of external providers based on their ability to provide processes or products and services in accordance with requirements.” ➜ This aligns directly with Option B (evaluate an external provider’s management system) , because evaluating a provider’s system/process controls is a primary way to confirm their ability to meet requirements.

ISO 9001 also requires analysis/evaluation of data including “ the performance of external providers .” ➜ This reinforces that ISO 9001 expects organizations to evaluate suppliers , which is the practical purpose of a second-party audit.

Why the other options are not correct under ISO 9001 context:

A (certify) is not the purpose of a second-party audit; certification is done by an independent third-party certification body , not by a customer/supplier relationship.

C (inspect products) can be one control activity, but ISO 9001’s requirement is broader— evaluate/monitor/re-evaluate the provider’s capability and performance, not only inspect output.

D (approve processes) may occur as a result of evaluation, but ISO 9001 explicitly emphasizes evaluation and monitoring , making B the best definition.

According to ISO 19011:2018, clause 6.7, the audit follow-up is the process of verifying the completion and effectiveness of corrective actions taken by the auditee as a result of an audit. The audit follow-up can include two main activities:

Verifying the effectiveness of the implemented corrective actions: this means checking whether the actions taken by the auditee have addressed the root causes of the nonconformities and prevented their recurrence or occurrence in other areas. The verification can be done by reviewing documents, records, data, or other evidence provided by the auditee, or by conducting a follow-up audit on site or remotely.

Verifying corrections taken to fix the reported non-conformities: this means checking whether the auditee has corrected the nonconformities identified during the audit and eliminated their immediate effects. The verification can be done by reviewing documents, records, data, or other evidence provided by the auditee, or by conducting a follow-up audit on site or remotely.

The audit follow-up can be conducted as a separate audit or as part of a subsequent audit, depending on the audit programme, the audit objectives, the audit criteria, the audit scope, the audit risks, and the audit findings. The audit follow-up should be planned and conducted in accordance with the same principles and processes as the initial audit, and the results should be documented and reported accordingly. References:

ISO 19011:2018(en), Guidelines for auditing management systems, clause 6.7

ISO 19011 Management Systems Audit Checklist | Process Street, task 6.7.1 and 6.7.2

Conducting the Audit Follow-Up: When to Verify - The Auditor, section “Conducting the audit follow-up”

The quality system failed to control the laundry services provided for customers in five shops. The equipment used was not capable of consistently producing the required service.

Comprehensive and Detailed In-Depth Explanation:

Clause 5.1.1 of ISO 9001:2015 – Leadership and Commitment – specifically mandates that top management must take accountability for the effectiveness of the QMS. They are also responsible for ensuring:

Integration of the QMS into business processes (5.1.1 c)

Promotion of customer focus and continual improvement (5.1.1 d, i)

Availability of necessary resources (5.1.1 e)

That the QMS achieves its intended results (5.1.1 g)

Let’s analyze the selected options:

✅ A. Top management is not accountable for the effectiveness of the QMS.

This directly violates clause 5.1.1 a, which explicitly requires top management to take accountability for the effectiveness of the QMS. Delegating this to a middle-level Quality Manager, as described in the scenario, constitutes a nonconformity.

✅ F. The Quality Manager does not have access to the resources needed for the QMS.

According to clause 5.1.1 e, top management must ensure the availability of required resources for maintaining and improving the QMS. If the Quality Manager is resource-constrained, it indicates top management has failed to meet this requirement.

Now, why the other options are incorrect in terms of direct clause 5.1.1 nonconformity:

❌ B. Avoiding giving improvement actions to the Chief Executive – While this may reflect poor communication, it is not, by itself, a clear breach of 5.1.1 unless linked directly to top management’s lack of accountability or commitment.

❌ C. Chief Executive never attending meetings – ISO 9001 does not require physical attendance of the Chief Executive at management reviews. What matters is whether top management is fulfilling their roles, not how.

❌ D. Completing only half of improvement actions – This indicates performance issues but does not necessarily indicate top management’s lack of accountability, unless they failed to monitor progress entirely.

❌ E. Reporting to one designated senior manager – This is not inherently nonconforming unless that senior manager does not fulfill top management’s responsibilities under 5.1.1.

Relevant ISO 9001:2015 Reference:

Clause 5.1.1 a, e, g, h:

" Top management shall demonstrate leadership and commitment with respect to the quality management system by:

a) taking accountability for the effectiveness of the quality management system;

e) ensuring that the resources needed for the quality management system are available... "

The table below shows the possible matching of the ISO 9001 Clause 8.3 extract to the audit evidence.

Table

Audit evidence

ISO 9001 Clause 8.3 extract

Half of all new products launched in the past 12 months were late. The NPD Manager explains he has not got enough people on his team to cope with the demand for new products.

“8.3.2 e) … internal … resource needs for the design and development of products …”

The NPD Manager explains many changes are made to cosmetic formulations during product development owing to retailer feedback. Only when confirmed by the retailer is the agreed formulation documented on SWIFT.

“8.3.5 … retain documented information …”

The NPD Manager explains that the customer confirms their approval to proceed with a new formulation by email. These emails are kept on SWIFT.

“8.3.6 … retain documented information …”

The NPD Manager shows you evidence of consumer trials that are carried out for some new products prior to full-scale launch.

“8.3.4 d) … conducted to ensure that the resulting products and services meet the requirements …”

The NPD Manager explains that an approved external laboratory is used to perform shelf-life stability trials on some formulations during product development.

“8.3.2 e) … external … resource needs for the design and development of products …”

According to the ISO 9001:2015 standard, clause 10.2.1 defines nonconformity as the non-fulfilment of a requirement. A requirement can be related to the quality management system, the products and services, the customer expectations, or the applicable statutory and regulatory requirements. Nonconformities can be detected through various sources, such as audits, inspections, tests, customer complaints, or internal reviews. Nonconformities must be addressed by taking appropriate actions to correct them and prevent their recurrence.

In this scenario, the auditee has shown several issues that indicate nonconformities in their quality management system. Two statements that apply to the term nonconformity are:

A. No quality objectives planned for the top management team: According to ISO 9001, clause 6.2.1, the organization must establish quality objectives at relevant functions, levels, and processes. The quality objectives must be consistent with the quality policy and the strategic direction of the organization. The top management team is responsible for providing leadership and direction for the quality management system and ensuring its alignment with the organization’s purpose and context. Therefore, the absence of quality objectives for the top management team is a nonconformity as it violates the requirement of clause 6.2.1.

E. Quality improvements not aligning with the quality policy: According to ISO 9001, clause 5.2.1, the quality policy is a statement of the organization’s intentions and direction regarding quality, as formally expressed by top management. The quality policy must provide a framework for setting quality objectives and be compatible with the context and strategic direction of the organization. The quality policy must also be communicated, understood, and applied within the organization. Therefore, if the quality improvements are not aligned with the quality policy, it is a nonconformity as it violates the requirement of clause 5.2.1.

Nonconformity report

ISO 9001 Clause Number: 9.3.1 Nature of problem: Management review has not been conducted at the defined frequency. ISO 9001 requirement that has not been fulfilled: ISO 9001 - “Top management shall review the organization’s quality management system at planned intervals.” Evidence: The last management review took place nine months ago, and the previous one took place one year before the latest review. The planned interval is six months.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 19011:2018, Clause 5.3.2 (Access to Information), internal auditors must have unrestricted access to:

Employees and executives for interviews and observations.

Documented information to verify compliance with ISO 9001.

This ensures a transparent and objective audit process. The CEO’s approval (B) is not required unless restricted information is involved.

Comprehensive and Detailed In-Depth Explanation:

A technical expert is someone with specialized knowledge that helps the audit team understand specific technical aspects of the auditee’s processes.

Clause References:

ISO 19011:2018, Clause 7.3.4 – Use of Technical Experts:

Technical experts support the audit team with specialized knowledge but do not perform the audit themselves.

Why is the Correct Answer B?

A technical expert is needed when auditors lack deep expertise in specific areas, such as engineering, software, or medical devices.

They assist in interpreting complex technical requirements but do not act as auditors.

Why are the Other Options Incorrect?

A (Observer) → Observers do not contribute expertise; they only watch the audit (e.g., trainees).

C (Guide) → Guides help with logistics but do not provide technical expertise.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 17021-1:2015, Clause 9.5.1 (Certification Decision):

Auditors who conduct the audit cannot be involved in the certification decision to ensure impartiality.

The certification body alone is responsible for making the certification decision based on the audit report and findings.

The audit team leader (Eva) must not take part in the certification decision.

Thus, C is the correct answer.

The auditor could raise the following nonconformities to ISO 9001 based on the scenario:

•Option A: 10.3 - The organisation did not continuously improve. Reject rates were unchanged. This option is correct because ISO 9001:2015 clause 10.3 requires the organization to improve the suitability, adequacy and effectiveness of the quality management system. The organization did not demonstrate any improvement in reducing the reject rate of the finished product, which was a stated objective of top management. The corrective action taken by the organization was not effective in addressing the root cause of the problem and preventing its recurrence.

•Option B: 7.1.4 - The factory environment is not suitably maintained to prevent dirty products. This option is correct because ISO 9001:2015 clause 7.1.4 requires the organization to determine, provide and maintain the environment necessary for the operation of its processes and to achieve conformity of products and services. The organization did not ensure that the factory floor was clean and dry, which affected the quality of the products and increased the risk of nonconformity.

•Option C: 7.1.1 - The organization failed to provide the required resources to prevent nonconforming products. This option is correct because ISO 9001:2015 clause 7.1.1 requires the organization to determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the quality management system. The organization did not provide adequate collection baskets for the products ejecting from the moulding machines, which resulted in products falling onto the factory floor and becoming nonconforming.

The following options are not correct:

•Option D: 9.2.2 - Report IA202 contained a poorly worded nonconformity (NC 3). This option is not correct because ISO 9001:2015 clause 9.2.2 does not specify the requirements for the wording of nonconformities in internal audit reports. The nonconformity (NC 3) stated by the internal auditor was clear and relevant to the audit criteria and audit evidence. The issue is not with the report, but with the corrective action taken by the organization.

•Option E: 8.6 - Dirty products were released to the customer. This option is not correct because ISO 9001:2015 clause 8.6 requires the organization to implement planned arrangements, at appropriate stages, to verify that the product and service requirements have been met. The scenario does not indicate that the dirty products were released to the customer, but that they were recalled and repaired then returned to the customers. The issue is not with the release, but with the production process and the environment.

•Option F: 7.3 - Staff were not aware that products were falling onto the factory floor. This option is not correct because ISO 9001:2015 clause 7.3 requires the organization to ensure that the persons doing work under its control are aware of the quality policy, relevant quality objectives, their contribution to the effectiveness of the quality management system, and the implications of not conforming with the quality management system requirements. The scenario does not indicate that the staff were not aware of these aspects, but that the management did not provide adequate resources and environment for the staff to perform their work. The issue is not with the awareness, but with the management responsibility and resource provision.

•Option G: 10.2.1 - Conduct of an investigation was not sufficient to understand the cause of the nonconformity. This option is not correct because ISO 9001:2015 clause 10.2.1 requires the organization to react to the nonconformity and, as applicable, take action to control and correct it and deal with the consequences. The scenario indicates that the Quality Manager conducted an investigation into the reject rates and identified the cause of the nonconformity. The issue is not with the investigation, but with the corrective action taken by the management.

•Option H: 8.5.1 - Production operations were not properly controlled to avoid reject products. This option is not correct because ISO 9001:2015 clause 8.5.1 requires the organization to implement production and service provision under controlled conditions. The scenario indicates that the production operations were controlled by the moulding machines, which ejected the products into the collection baskets. The issue is not with the production operations, but with the size of the collection baskets and the condition of the factory floor.

ISO 9001:2015 clause 9.1.1 requires the organisation to determine what needs to be monitored and measured, the methods needed to ensure valid results, when monitoring and measurement shall be performed, and when results shall be analysed and evaluated.

B is correct because recorded sensory testing results provide evidence of monitoring and measurement results.

C is correct because use of the Hedonic Scale shows a defined method for monitoring product quality.

D is correct because clause 9.1.1 requires monitoring and measurement results to be analysed and evaluated.

A relates more to competence under clause 7.2. E, F, G and H may be useful in some contexts, but they are not direct evidence of conformity with clause 9.1.1 in this scenario.

===========

The purpose of a Stage 1 third-party audit is to determine an organization’s readiness for their Stage 2 Certification Audit. During the Stage 1, the auditor will review the organization’s management system documented information, evaluate the site-specific conditions, and have discussions with personnel. The objective is to assess the alignment of the organization’s design with ISO 9001 requirements and to identify any areas of concern that could be classified as a nonconformance during the Stage 2 Audit. The auditor will also use the Stage 1 Audit to complete Stage 2 Audit planning, including a review of the allocation of resources and details for the next phase of the audit. Therefore, the option that best describes the purpose of a Stage 1 third-party audit is A, to determine the auditees understanding of ISO 9001. The other options are not correct, as they are not the main focus of a Stage 1 audit:

•B. To get to know the organization’s customers: This is not the purpose of a Stage 1 audit, as the auditor is not interested in the specific details of the organization’s customers, but rather in the organization’s ability to meet customer and applicable statutory and regulatory requirements.

•C. To learn about the organization’s procurement processes: This is not the purpose of a Stage 1 audit, as the auditor is not interested in the specific details of the organization’s procurement processes, but rather in the organization’s ability to control externally provided processes, products and services.

•D. To introduce the audit team to the client: This is not the purpose of a Stage 1 audit, as the auditor is not there to make introductions, but rather to conduct a preliminary examination of the organization’s compliance with ISO 9001 standards.

Comprehensive and Detailed In-Depth Explanation:

Minor nonconformities are isolated issues that do not significantly impact the QMS but still require correction.

Failure to close nonconformities on time (Answer A) is a procedural issue and is considered minor unless it leads to repeated failures.

Major nonconformities include:

Lack of top management commitment (Answer B), which affects leadership and strategic direction.

Failure to take corrective actions for recurrent issues (Answer C), which indicates systemic failure.

Understanding Clause 7.1.5.2 – Measurement Traceability:ISO 9001:2015 requires organizations to ensure that measuring equipment (e.g., spectrometers) is calibrated and traceable to recognized standards. The failure to maintain calibration within valid dates directly violates this clause and raises concerns about the reliability of the measurement results.

Root Cause of the Nonconformity:The organization failed to plan for the possibility that the calibration service provider (X-TECH) might become unavailable, leading to expired calibration. This indicates inadequate risk-based thinking, which is required under Clause 6.1 of ISO 9001:2015.

Option Analysis:

A. Select one sample for external lab analysis to use as an internal standard:Incorrect. While using an internal standard could provide short-term verification of results, this action does not address the root cause (failure to consider risks associated with external providers).

B. Look for a local company to provide this service:Incorrect. While finding a new local service provider resolves the immediate calibration issue, it does not address the risk of future provider unavailability.

C. Double-check one out of ten samples externally:Incorrect. This corrective action ensures some quality assurance for batch release but does not resolve the nonconformance related to expired calibration.

D. Add this issue to the external issue register, assess its associated risk, and plan action to address that risk:Correct. This approach directly addresses the root cause (failure to anticipate the calibration provider leaving) and ensures proper risk management. ISO 9001:2015 emphasizes risk-based thinking under Clause 6.1, requiring organizations to identify risks and opportunities and implement plans to mitigate them.

Why D is the Best Option:

By adding the issue to the external issue register, the organization ensures it is monitored and tracked.

Assessing the risk ensures proactive measures are in place for similar issues in the future.

Planning actions to address the risk ensures a sustainable solution is implemented, such as identifying multiple service providers or ensuring backup plans for calibration services.

ISO 9001 References:

Clause 6.1 (Actions to Address Risks and Opportunities): Requires organizations to consider risks and opportunities that could affect the intended results of the QMS.

Clause 7.1.5.2 (Measurement Traceability): Mandates that measuring equipment must be calibrated and traceable to ensure valid results.

Clause 10.2 (Nonconformity and Corrective Action): Requires organizations to determine the root cause of nonconformities and take actions to ensure they do not recur.

B. Applicable procedure: SP-701

D. Identification number of the washing machine

H. The concentration of the cleaning liquid used vs the concentration fixed in SP-701

I. The planned duration of the process vs the minimum time required in SP-701

J. Weight of linen being washed vs the maximum weight required in SP-701

C. Competence record of the machine operator

In the context of ISO 9001:2015 audits, it is the audit team leader who holds the responsibility for assigning work to the audit team. According to ISO 19011:2018 (Guidelines for auditing management systems, which complements ISO 9001:2015), the audit team leader is responsible for the organization and direction of the audit, including assigning specific roles and responsibilities to audit team members. This includes preparation of the audit plan, leading the audit, and ensuring that each team member understands their tasks.

ISO 9001:2015 requires top management to review the quality management system at planned intervals to ensure its continuing suitability, adequacy, effectiveness, and alignment with the strategic direction of the organisation . The auditor’s focus, especially during a surveillance audit covering improvement actions , must therefore be on evidence that management review is being carried out correctly and that it results in QMS-related decisions and changes .

Relevant ISO 9001 clauses include:

Clause 9.3.1 – Management review (General) Top management shall review the organisation’s quality management system at planned intervals.

Clause 9.3.3 – Management review outputs The outputs of management review shall include decisions and actions related to opportunities for improvement and any need for changes to the QMS.

Explanation of the correct options:

A. The date of the most recent management review meeting

This is directly relevant because ISO 9001 requires management reviews to occur at planned intervals . The auditor must confirm that the review has taken place and that it is current, especially during a surveillance audit.

E. Changes made to the quality system by the new Quality Manager

This is directly linked to management review outputs and improvement actions . Since a new Quality Manager has been appointed, the auditor must verify whether changes to the QMS were reviewed, approved, and monitored through management review in line with Clauses 9.3.3 and 10.3.

Explanation of why the other options are not relevant:

B : Workforce redundancies are a human resources or business decision unless they directly affect QMS effectiveness, which is not indicated here.

C : Increased profitability is a business outcome, not a required management review input or output under ISO 9001.

D : Pension scheme improvements are unrelated to QMS performance or improvement.

F : A bonus scheme may relate to productivity, but unless it directly affects QMS objectives or process performance reviewed in management review, it is not a required checklist item.

ISO-aligned conclusion:

For an audit focusing on improvement actions and management review , the auditor’s checklist should confirm:

That management review has been conducted as required, and

That QMS-related changes and improvements (especially under a new Quality Manager) are being reviewed and controlled.

Clause 8.3.4.d of ISO 9001:2015 requires that design and development validation be performed to ensure that the resulting products or services meet the requirements for their specified application or intended use. Validation is critical to confirm that the product works as intended in real-world conditions.

In this case, Noitol omitted the design validation step approximately 50% of the time, which is a direct violation of Clause 8.3.4.d. Although they collect feedback after the fact, this is not a substitute for formal validation before the product is released. The nonconformity arises because the process of validation was neglected, not the recording of improvements or feedback.

Other options, such as documenting improvements (A) or issues with planning verification (B), are important but do not directly address the primary concern: the lack of consistent design validation before product release. Option D (8.6) concerns product release, but this nonconformity focuses on the validation stage, not just approval for release​.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 19011:2018, Clause 5.5 (Determining Audit Team Competence), technical experts:

Provide specialized knowledge in an audit.

Must operate under the supervision of an auditor to ensure compliance with audit protocols.

Cannot work independently or under the auditee’s supervision, as they are not responsible for the audit ' s findings.

The audit team leader has overall responsibility, but technical experts are supervised by an auditor during the audit process.

Comprehensive and Detailed Explanation From Exact Extract:

Correct Option B – “Communicate a policy commitment to continual improvement”

This aligns directly with Clause 5.2.1(d) of ISO 9001:2015, which states that the quality policy shall include a commitment to continual improvement of the QMS:

“Top management shall establish, implement and maintain a quality policy that... includes a commitment to continual improvement of the quality management system.”

A clearly communicated policy sets expectations and a strategic direction that cascades throughout the organization, promoting a culture that values ongoing enhancement.

Correct Option F – “Use the management review process to identify improvements”

This is based on Clause 9.3.3 of ISO 9001:2015, which specifies that outputs of management reviews must include decisions and actions related to:

“a) opportunities for improvement;

b) any need for changes to the quality management system;

c) resource needs.”

The management review process is a structured mechanism to analyze data, monitor performance, assess risks and opportunities, and drive continual improvement initiatives.

Why the Other Options Are Incorrect:

A (Appoint external consultants to train staff): While training may help improve competence, ISO 9001 emphasizes internal process evaluation and strategic improvement. This option is not directly aligned with the systematic improvement of the QMS.

C (Require higher standards): Higher standards alone don’t ensure continual improvement unless supported by a structured QMS approach involving evaluation, planning, and measurement.

D (Require fewer mistakes): Unrealistic or unqualified demands like " make fewer mistakes " don’t support structured process-based improvement and may conflict with ISO’s emphasis on risk-based thinking and root cause analysis.

E (Send Chief Executive on a course): While leadership involvement is vital (Clause 5), this action by itself does not constitute a continual improvement mechanism for the QMS.

Comprehensive and Detailed In-Depth Explanation:

As per ISO 9001:2015, Clause 10.2 (Nonconformity and Corrective Action), all identified nonconformities, including minor ones, must be documented and communicated to the auditee.

Minor nonconformities can lead to major issues if left unaddressed. The auditor must inform the organization before moving to the next audit phase so that corrective actions can be taken. Clause 9.2.2 (Internal Audit) states that audit findings should be reported without undue delay.

Since Li Na did not report the minor nonconformities immediately, her decision was incorrect. Minor nonconformities should always be documented and communicated before proceeding to the next phase.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 17021-1:2015 (Conformity Assessment – Requirements for Certification Bodies), Clause 9.3.1.2, the Stage 1 Audit typically consumes around 30% of the total audit time.

This time is allocated to:

Reviewing documented information.

Assessing the readiness for Stage 2.

Identifying potential nonconformities.

A 20% allocation (Answer A) is too low, and 40% (Answer C) is excessive, as the majority of the audit should be spent on Stage 2 (on-site verification).

According to ISO 9001:2015, clause 4.1, the organisation must determine the external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended results of its quality management system. The organisation must also monitor and review the information about these issues. SWOT analysis is a tool that can help the organisation to identify its strengths, weaknesses, opportunities, and threats. However, the SWOT analysis alone is not sufficient to comply with the requirement, as the organisation also needs to review the information periodically and update it as necessary. Therefore, one audit trail would be to establish how the organisation reviews information about external and internal issues, such as how often, by whom, using what criteria, and with what results. 123

According to ISO 9001:2015, clause 10.3, the organisation must continually improve the suitability, adequacy, and effectiveness of the quality management system. The organisation must also consider the results of analysis and evaluation, and the outputs from management review, to determine if there are any needs or opportunities for improvement. SWOT analysis can help the organisation to identify the areas where improvement is needed or possible, such as addressing the weaknesses and threats, or exploiting the strengths and opportunities. However, the SWOT analysis alone is not sufficient to comply with the requirement, as the organisation also needs to take actions to implement the improvement, such as setting objectives, allocating resources, assigning responsibilities, and evaluating the effectiveness. Therefore, another audit trail would be to establish what actions were taken to improve the QMS, such as what, when, by whom, how, and with what results. 124 References:

1: ISO 9001:2015 - Quality management systems — Requirements

2: Advisera, “Context of the organization in ISO 9001:2015 explained”, https://advisera.com/9001academy/knowledgebase/how-to-identify-the-context-of-the-organization-in-iso-90012015/

3: ISO Templates, “ISO 9001 - Clause 4: Context of the organisation explained”, https://resources.iso-templates.com/blog/iso-9001-clause-4-context-of-the-organisation-explained

4: Advisera, “How to implement continual improvement in ISO 9001”, https://advisera.com/9001academy/knowledgebase/how-to-implement-continual-improvement-in-iso-9001/

The table below shows the possible matching of the ISO 9001 Clause 8 extract to the audit evidence.

Table

Audit evidence

ISO 9001 Clause 8 extract

Four of the 10 pallets of stock sampled in the warehouse were not labelled.

“8.5.2 … shall use suitable means to identify outputs …”

A damaged pallet of stock seen in the quarantine area was leaking liquid onto the floor.

“8.7.1 … shall ensure that outputs that do not conform to their requirements are identified and controlled …”

One of the fork-lift truck drivers had no fork-lift truck driving licence.

“8.5.1 e … shall include, as applicable … the appointment of competent persons …”

There was no pest control provision in the warehouse.

“8.5.4 … shall preserve the outputs during production and service provision …”

Two pallets of temperature-sensitive stock items were being stored at ambient as the chilled storage facility was full.

“8.1 … shall plan, implement and control the processes …”

Comprehensive and Detailed In-Depth Explanation:

According to ISO 9001:2015, Clause 9.2 (Internal Audit):

Internal audits can be conducted on an ongoing basis as part of continual improvement.

Audits consider both conformity and effectiveness (A is incorrect).

Thus, C is the correct answer.

A first-party audit is an internal audit conducted by auditors who are employed by the organization being audited but who have no vested interest in the audit results of the area being audited1. The purpose of a first-party audit is to assess the conformity of the organization’s quality management system to the requirements of ISO 9001 and to identify opportunities for improvement2. Therefore, the two auditors who would not participate in a first-party audit are:

•A. An auditor employed by an external consultancy organization: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit (if the external consultancy organization is a customer or supplier of the organization being audited) or a third-party audit (if the external consultancy organization is a certification body or registrar).

•F. An auditor from a customer: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit, as a customer is an interested party that has specific requirements for the organization being audited.

The other options are not correct, as they could participate in a first-party audit, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited:

•B. An auditor from an interested party: This auditor could be a first-party auditor, as long as the interested party is within the organization being audited. For example, an auditor from the finance department could audit the production department, as long as they are not involved in the production process or affected by its outcomes.

•C. An auditor trained in-house: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The source of the auditor’s training is not relevant for determining the type of audit, as long as the auditor is competent and qualified to perform the audit.

•D. An auditor trained in the IRCA scheme: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The IRCA scheme is a professional certification scheme for auditors of management systems, which provides recognition of the auditor’s competence and credibility3. However, being trained in the IRCA scheme does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

•E. An auditor certified by IRCA: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. Being certified by IRCA means that the auditor has met the requirements of the IRCA scheme and has demonstrated their competence and credibility as an auditor of management systems3. However, being certified by IRCA does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

Comprehensive and Detailed In-Depth Explanation:

Auditors must report findings truthfully and accurately to ensure an unbiased assessment of the QMS.

Clause References:

ISO 19011:2018, Clause 4 – Principles of Auditing:

Fair Presentation → Requires auditors to report truthfully and accurately, without bias or omission.

Integrity → Ensures auditors adhere to ethical conduct.

Why is the Correct Answer A?

The audit team reported findings truthfully, based on collected evidence.

Fair presentation ensures that both positive and negative findings are included in the audit report.

Objective evidence was gathered through interviews, document reviews, and observations.

Why are the Other Options Incorrect?

B (Integrity) → Related to ethics and professional conduct, but not specifically about presenting findings.

C (Confidentiality) → Important, but does not apply to the principle of reporting findings accurately.

D (Objectivity) → Ensures impartiality, but " fair presentation " directly addresses accurate reporting of findings.

ISO 9001:2015 requires auditors to base conclusions on objective evidence and to investigate potential issues before determining whether a nonconformity exists.

In this scenario, the auditor has observed:

A freezer temperature of -17.2 °C .

An understood storage requirement of less than -18.0 °C .

A statement from the supervisor regarding measurement uncertainty of ±1 °C .

Before raising a nonconformity, the auditor must verify:

The exact storage requirements and any permitted tolerances.

The validity and calibration status of the measuring equipment.

Why A is Correct

Ask to see the documented test method to determine if there is additional information on the limits for storage temperature.

The auditor must confirm:

The exact specification.

Whether tolerances or measurement uncertainty have been considered in the requirement.

Whether the storage criterion is truly a hard limit or includes allowable variation.

This follows the audit principle of obtaining sufficient objective evidence before reaching a conclusion.

Why B is Correct

Ask to see the calibration report for the measuring equipment.

ISO 9001 Clause 7.1.5 requires monitoring and measuring resources to be suitable and maintained to ensure valid results.

The supervisor has based his justification on measurement uncertainty. Therefore, the auditor should verify:

Calibration status,

Calibration validity,

Measurement uncertainty,

Traceability of calibration results.

Why the Other Options Are Incorrect

C. Raise a non-conformance immediately

At this point there is insufficient evidence. The auditor has not yet verified the specification or calibration records.

D. Ask to see competence records of supervisors of all terminals

This is not the immediate audit trail arising from the observation.

E. Immediately halt the vaccination process

Auditors do not normally have authority to stop operations except in exceptional circumstances defined by legal or contractual arrangements. The auditor must first gather evidence.

F. Accept the comment and proceed

Auditors must verify statements with objective evidence rather than accepting explanations without verification.

ISO-Aligned Conclusion

The next appropriate audit actions are to:

Verify the storage temperature requirements, and

Verify the calibration and uncertainty information of the measuring equipment.

Therefore, the correct answers are:

A. Ask to see the documented test method to determine if there is additional information on the limits for storage temperature.

B. Ask to see the calibration report for the measuring equipment.

===========

ISO 9001:2015 makes it clear that an organisation remains responsible for conformity to requirements even when processes are outsourced . Certification audits must therefore evaluate not only the organisation’s internal activities, but also the control and effectiveness of externally provided processes .

ISO 9001:2015, Clause 8.4.1 requires that the organisation ensure externally provided processes, products and services conform to requirements. The organisation must determine controls to be applied to those outsourced processes.

ISO 9001:2015, Clause 4.4.1 further requires the organisation to determine processes needed for the quality management system and their application throughout the organisation, including outsourced processes.

For a third-party certification audit , sufficient objective evidence must be obtained to demonstrate that:

Outsourced processes are effectively controlled

The organisation’s quality management system achieves its intended results

Why option C is the best decision:

Proceeding with the audit in Bolivia and including all ABC personnel and all outsourced processes ensures that the certification audit:

Covers the full scope of the QMS , including outsourced production, maintenance, procurement, and HR activities

Allows direct evaluation of how ABC controls and manages its external providers in the location where those processes are actually performed

Provides sufficient objective evidence to support a valid certification decision

Reviewing only internal audits or auditing only planning activities would not provide adequate assurance of conformity for a high-risk, core operational activity such as lithium extraction.

Why the other options are not acceptable:

A : Auditing only the Planning function would exclude core operational and support processes that are within the scope of the QMS.

B : Reviewing internal audit results alone is insufficient for a third-party certification audit and does not replace direct assessment of outsourced processes.

D : ISO 9001 explicitly allows outsourcing of processes; the organisation remains responsible for control, not prohibited from outsourcing.

ISO-aligned conclusion:

In a third-party ISO 9001 certification audit, outsourced processes that are within scope must be audited , either directly or through appropriate controls. In this scenario, auditing the outsourced processes in Bolivia is necessary to ensure a complete, credible, and compliant certification audit.

A second-party audit of a key supplier should focus on whether the supplier’s QMS is suitable, effective, and capable of meeting requirements. ISO 19011 recommends considering context, changes, prior audit results, interested-party concerns, and effectiveness of key QMS processes.

B is relevant because outsourced processes affecting conformity may need to be audited or otherwise controlled. C and F are relevant because audit planning should consider changes since previous audits and previous audit results. D is relevant because ISO 9001 requires relevant interested parties and their requirements to be considered. I is relevant because the QMS must remain suitable and aligned with context and strategic direction. J is relevant because internal audit and management review are key mechanisms for evaluating QMS effectiveness.

A is mainly relevant to certification-body controls, not a supplier second-party audit. E is too prescriptive; ISO 9001 does not require annual audits of all external providers. G may be useful depending on scope, but the stronger required audit trails here are B, C, D, F, I, and J. H is outside ISO 9001 QMS audit scope unless directly relevant to contractual or QMS risks.

===========

Related Activity

Correct Quality Management Principle

Communicate client needs and expectations throughout the organisation.

Customer focus

Encourage an organisation-wide commitment to quality.

Leadership

Empower staff to determine constraints to performance and to take the initiative without fear.

Engagement of people

Establish authority, responsibility, and accountability for managing processes.

Process approach

Continuously educate and train people at all levels on how to apply basic tools and methodologies to achieve objectives.

Improvement

Determine, measure, and monitor key indicators to demonstrate the organisation’s performance.

Evidence-based decision making

Determine relevant interested parties (such as providers, partners, customers, investors, employees, or society as a whole) and their connection with the organisation.

Relationship management

1. Customer focus

ISO 9001 states that organizations must understand and consistently meet customer needs and expectations.

➡ Communicating client needs throughout the organization ensures alignment and customer satisfaction.

According to ISO 19011:2018, clause 6.6.2, a nonconformity is the non-fulfilment of a requirement. A nonconformity can be classified as either major or minor, depending on the nature and extent of the deviation from the audit criteria. A major nonconformity is a nonconformity that affects the ability or the integrity of the organization’s management system to achieve the intended results. A minor nonconformity is a nonconformity that does not affect the ability or the integrity of the organization’s management system to achieve the intended results, but is a deviation from the audit criteria1.

According to ISO/IEC 17021-1:2015, clause 9.4.9, the organization is required to analyze the cause and describe the specific correction and corrective actions taken, or planned to be taken, to eliminate detected nonconformities, within a defined time. The organization is also required to provide the certification body with records and evidence of the implementation and effectiveness of the correction and corrective actions taken. The certification body will then verify the correction and corrective actions taken by the organization and decide on the certification status2.

Therefore, the two options of when the organization is required to act in response to reported findings are D and F, as they indicate the presence of nonconformities that need to be corrected and prevented from recurring. The other options are not correct, as they do not require the organization to act in response to reported findings:

•A. A recommendation is given in the report: A recommendation is a suggestion for improvement that is not related to a nonconformity. A recommendation is not binding for the organization and does not affect the certification status. The organization may choose to accept or reject the recommendation, but it is not required to act on it.

•B. A finding of good practice is reported: A finding of good practice is a positive observation that indicates a strength or a best practice of the organization’s management system. A finding of good practice is not related to a nonconformity and does not affect the certification status. The organization may choose to acknowledge or share the finding of good practice, but it is not required to act on it.

•C. An opportunity for improvement is raised: An opportunity for improvement is a potential area where the organization’s management system can be enhanced or optimized. An opportunity for improvement is not related to a nonconformity and does not affect the certification status. The organization may choose to pursue or ignore the opportunity for improvement, but it is not required to act on it.

•E. A finding of conformity is reported: A finding of conformity is a confirmation that the organization’s management system fulfils the audit criteria. A finding of conformity is not related to a nonconformity and does not affect the certification status. The organization may choose to celebrate or communicate the finding of conformity, but it is not required to act on it.

According to ISO 19011:2018, clause 6.3.2, the audit plan is a document that provides the basis for agreement regarding the conduct of the audit. The audit plan should include the following information1:

•the audit objectives, scope and criteria

•the audit team members and their roles and responsibilities

•the audit schedule, including the date, time and location of each audit activity

•the expected time and duration of meetings and interviews

•the allocation of appropriate resources to critical areas of the audit

•the identification of the audit client and the auditee

•the identification of the guides and observers, if any

•the documents and records to be reviewed before and during the audit

•the audit methods and tools to be used

•the audit language and terminology

•the audit report content, format, distribution and expected completion date

•the risk to achieving audit objectives and the contingency plan, if any

Therefore, the issue which is not expected to be included in the audit plan is C, expectations of the organisation’s management. This issue is not relevant to the conduct of the audit, as the audit is based on the audit criteria, not on the management’s expectations. The management’s expectations may be considered during the audit initiation or the audit programme management, but they are not part of the audit plan.

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 emphasizes risk-based thinking, which helps organizations identify factors that could prevent achieving planned results and take preventive action. Clause 6.1 (Actions to Address Risks and Opportunities) requires organizations to determine risks and opportunities and implement actions to mitigate potential negative impacts.

In the scenario, AL-TAX identified potential risks and implemented preventive actions, aligning with risk-based thinking. ISO 9001:2015 integrates risk management throughout the standard, ensuring processes are designed to minimize uncertainties.

The purpose of conducting a document review is to determine the conformity of the system, as far as documented, with audit criteria and to gather information to support the audit activities. A document review is a systematic and objective examination of the documented information that is relevant to the audit objectives and scope. It can help the auditor to verify if the documented information is complete, accurate, consistent, and up-to-date. It can also help the auditor to identify any gaps, errors, or nonconformities in the documented information that may affect the audit findings or conclusions.

The other options are not correct because they do not reflect the true purpose of a document review. Option A describes the purpose of an audit report, which is to communicate the audit results and recommendations to the management and other interested parties. Option B describes the purpose of an audit plan, which is to define the scope, objectives, criteria, methods, resources, and schedule of an audit. Option C describes the purpose of an audit evidence report, which is to provide evidence of nonconformities or opportunities for improvement identified during an audit. Option D describes the purpose of an audit decision report, which is to justify or explain why certain decisions were made during an audit.

I hope this answer helps you understand why option F is correct and why options A-C-D are incorrect. If you want to learn more about ISO 9001 Lead Auditor exam questions and answers, you can check out some of these resources:

ISO 9001 Lead Auditor Sample Exam Questions and Answers: This article provides some sample questions and answers for each section of the ISO 9001 Lead Auditor exam.

ISO 9001 (QMS) Lead Auditor Quiz Questions and Answers: This article provides some quiz questions and answers on various topics related to ISO 9001 QMS.

ISO 9001 Lead Auditor - Exam Practice Tests: This course offers practice tests with explanations for each question.

Irca Lead Auditor Exam Questions And Answers Pdf: This document contains some exam questions and answers in PDF format.

When conducting a third-party audit to ISO 9001, especially in the context of training and corrective actions taken due to customer complaints, the most appropriate audit trails to follow would be:

A. Ask if customer complaints had ceased since the multi-skilled training finished. This audit trail is relevant because it directly relates to the effectiveness of the corrective action taken. If customer complaints have decreased or ceased, it could indicate that the additional training was effective1.

F. Review records to assess if all planned training has been completed. This trail is important to ensure that the training plan has been fully implemented and to verify that all staff members have received the necessary training. It also helps in assessing the adequacy of the training in terms of content, frequency, and outcomes1.

These two trails, A and F, are closely linked to the issue of customer complaints and the organization’s response to them. They provide insight into whether the actions taken were suitable and whether they have led to improvements in staff performance and customer satisfaction1. The other options, while potentially useful, do not directly address the immediate concern of the effectiveness of the corrective actions taken in response to the customer complaints1.

A → 8.4.3.a

B → 7.2.b

C → 10.2.2

D → 10.2.1

E → 6.2

F → 5.2.2.c

8.4.3.a – No specification is issued to the suppliers of waste plastic:This clause refers to the information provided to external providers, including requirements for products and services. If no specification is issued, it means the organization is not complying with this clause, which states:

“The organization shall ensure that the requirements for the products and services to be provided are adequately defined prior to communication to the external provider.”

7.2.b – The picking operators have been trained:This falls under Competence requirements. Clause 7.2(b) requires that persons are competent on the basis of education, training, or experience:

“Ensure that these persons are competent on the basis of appropriate education, training, or experience.”

10.2.2 – No documentation is retained for rejected materials:This relates to corrective action documentation. Clause 10.2.2 requires organizations to retain documented information as evidence of nonconformities and actions taken:

“The organization shall retain documented information as evidence of: the nature of the nonconformities and any subsequent actions taken…”

10.2.1 – The rejected materials are segregated:This links to the treatment of nonconforming outputs. Clause 10.2.1 discusses actions such as containment or segregation for nonconforming outputs:

“Deal with nonconforming outputs in one or more of the following ways: correction; segregation, containment…”

6.2 – Management has set an objective for the level of recycling:This refers to quality objectives. Clause 6.2 requires that measurable quality objectives be established, and this includes setting performance targets:

“The organization shall establish quality objectives at relevant functions… The quality objectives shall be measurable…”

5.2.2.c – The quality policy appears in promotional material:Clause 5.2.2(c) requires the quality policy to be available to relevant interested parties. Using it in promotional material ensures that it is communicated externally:

“The quality policy shall be… available to relevant interested parties, as appropriate.”

A properly written nonconformity statement should contain:

A clear description of the objective evidence.

Reference to the audit criteria not fulfilled.

Identification of where and when the evidence was found.

Sufficient traceability to allow investigation and corrective action.

Classification/grade where required by the certification body ' s process.

Why B is Correct

If any of the ORANGE+ procedures for bottling and labelling products were not being met.

The nonconformity should reference the specific internal procedure or audit criterion that was not followed.

Why C is Correct

The grade of nonconformity (major or minor).

In certification audits, nonconformities are typically classified according to certification body rules.

Why D is Correct

The date on which the evidence was identified.

The audit record should identify when the evidence was observed.

Why F is Correct

Batch number audited.

The batch number provides traceability and allows the organisation to investigate the affected product.

Why H is Correct

The description of the ISO 9001:2015 requirement not being complied with and the clause number.

A nonconformity must reference the audit criterion that was not fulfilled.

Why I is Correct

The place where the bottles with the wrong label were found.

The location where the evidence was observed should be recorded as part of the objective evidence.

Why the Other Options Are Incorrect

A. The regulatory requirements that apply to the juice being bottled.

May be relevant background information, but it is not essential information required to complete the nonconformity statement.

E. Composition of both sugar and sugarless juices.

Not required to establish the nonconformity.

G. Name of the supervisor and of the workers who were responsible for the bottling process.

Auditors report system failures, not assign blame to individuals.

J. The signature of the M1’s supervisor accepting the non-conformity.

ISO 9001 and ISO 19011 do not require the auditee ' s signature to validate a nonconformity.

ISO-Aligned Conclusion

The six items that should be added to complete the nonconformity report are:

B. If any of the ORANGE+ procedures for bottling and labelling products were not being met.

C. The grade of nonconformity (major or minor).

D. The date on which the evidence was identified.

F. Batch number audited.

H. The description of the ISO 9001:2015 requirement not being complied with and the clause number.

I. The place where the bottles with the wrong label were found.

===========

According to the ISO 9001:2015 standard, clause 6.2.1 requires organizations to establish quality objectives at relevant functions, levels, and processes needed for the quality management system. The quality objectives must be consistent with the quality policy and the strategic direction of the organization. The quality objectives must also be measurable, monitored, communicated, and updated as appropriate.

In this scenario, the Quality Manager of XYZ Corporation has set quality objectives for every employee in the organization except top management. This has created a lot of resistance to the QMS, and the Chief Executive is asking questions about the cost and the method of setting objectives. The Quality Manager asks for your opinion as an auditor on whether this is the correct method of setting objectives.

As an auditor, you cannot provide advice to the organization on how it should operate its QMS. Your role is to assess the conformity and effectiveness of the QMS against the requirements of the standard and the organization’s own policies and objectives. Therefore, you should respond with the following options:

B. Advise the Quality Manager to read the ISO 9001 standard and interpret in relation to the organization’s requirements: You can suggest that the Quality Manager should familiarize himself with the requirements of clause 6.2.1 and understand how they apply to his organization. He should also consider the context and the needs and expectations of interested parties when setting quality objectives. He should ensure that the quality objectives are aligned with the quality policy and the strategic direction of the organization.

C. Advise the Quality Manager that you will raise an opportunity for improvement if the quality objectives are not addressed properly: You can inform the Quality Manager that you will evaluate the quality objectives during the audit and check whether they meet the requirements of clause 6.2.1. If you find any gaps or weaknesses in the quality objectives, you will raise an opportunity for improvement to help the organization improve its QMS. You will also verify whether the quality objectives are monitored, communicated, and updated as appropriate.

D. Inform the Quality Manager that you will comment on the subject in your audit report: You can inform the Quality Manager that you will document your findings and observations on the quality objectives in your audit report. You will also provide a summary of the audit results and any recommendations for improvement. You will also indicate the level of conformity and effectiveness of the QMS.

These three options would help you to maintain your impartiality and professionalism as an auditor and to provide constructive feedback to the organization

Identifying the source of information

Sampling available data

Gathering audit evidence

Verifying objective evidence

Evaluating evidence against the audit criteria

Making audit conclusions

Evaluating against the audit criteria

According to ISO 19011:2018, clause 6.4, the process of collecting and verifying information during an audit involves the following steps1:

Identifying the source of information: The audit team should identify the sources of information that are relevant to the audit objectives, scope and criteria. These sources may include documents, records, personnel, processes, activities, facilities, equipment, etc. The audit team should also determine the methods and tools for accessing and collecting the information, such as interviews, observations, document review, sampling, etc.

Sampling available data: The audit team should select a representative sample of the available data to verify the conformity and effectiveness of the management system. The sample size and selection method should be based on the audit objectives, scope and criteria, as well as the level of confidence and risk. The audit team should also consider the validity, reliability, relevance and sufficiency of the data.

Gathering audit evidence: The audit team should use the methods and tools identified in the previous step to collect audit evidence, which is the records, statements of fact or other information that are relevant to the audit criteria and verifiable. The audit team should record the audit evidence in a clear, concise and objective manner, using notes, checklists, photographs, audio or video recordings, etc.

Verifying objective evidence: The audit team should verify the accuracy, completeness and authenticity of the audit evidence collected. This may involve cross-checking different sources of information, confirming the identity and authority of the persons providing the information, examining the original documents or records, etc. The audit team should also identify any discrepancies, inconsistencies or gaps in the audit evidence.

Evaluating evidence against the audit criteria: The audit team should compare the audit evidence with the audit criteria to determine the extent of conformity and nonconformity. The audit team should also identify any opportunities for improvement, best practices, positive aspects or potential risks. The audit team should use professional judgement and apply the principles of auditing when evaluating the audit evidence.

Making audit conclusions: The audit team should consolidate the audit findings and evaluate the overall performance and effectiveness of the management system. The audit team should also consider the audit objectives, scope and criteria, as well as the context and expectations of the auditee and other interested parties. The audit team should provide a clear, concise and objective statement of the audit conclusions, which may include the degree of conformity, the achievement of the intended outcomes, the need for corrective actions, the suitability for certification, etc.

Evaluating against the audit criteria: The audit team should review the audit conclusions and ensure that they are consistent with the audit criteria and supported by sufficient and appropriate audit evidence. The audit team should also ensure that the audit conclusions are communicated to the auditee and other relevant parties in a timely and effective manner, using the agreed audit report format and distribution method.

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015, Clause 4.3 (Determining the Scope of the Quality Management System) states that when determining the QMS scope, an organization must consider:

External and internal issues (Clause 4.1)

The needs and expectations of interested parties (Clause 4.2)

The products and services provided by the organization

In the scenario, Bell only considered top management ' s input, which fails to address Clause 4.2 (interested parties ' expectations)—such as customers, suppliers, and regulatory authorities.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 9001:2015, Clause 7.5.2 (Creating and Updating Documented Information), the criteria for reviewing documented information include:

Content – The accuracy and relevance of the information.

Format – Ensuring readability and proper structuring (e.g., language, versioning).

Procedure for managing documented information – Ensuring control, access, and updates.

Other options, such as internal audit reports and client feedback, are important for overall QMS evaluation but are not the main criteria for reviewing documented information.

The ISO 9001 Lead Auditor exam requires the auditor to have a thorough understanding of the ISO 9001:2015 standard and its requirements, as well as the organization’s context, processes, risks, opportunities, and performance. Therefore, the auditor needs to ask for additional information that can help them verify these aspects during the audit planning stage. Some of the information that can be useful are:

A description of responsibilities and authorities of the key roles of XYZ: This can help the auditor to identify who is accountable for what in the organization and how they communicate with each other.

The number of personnel involved in activities related to the quality management system: This can help the auditor to assess if there are enough resources and competencies to support the QMS implementation and operation.

Information to understand XYZ’s operations: This can help the auditor to understand how XYZ produces or delivers its products or services and what are its main processes and inputs.

The results of XYZ’s last internal audit: This can help the auditor to evaluate if XYZ has implemented corrective actions based on previous audit findings and if it has maintained its QMS effectiveness.

The results of the last two management reviews: This can help the auditor to determine if XYZ has monitored its QMS performance against its objectives and if it has identified any significant changes or opportunities for improvement.

The quality manual (B) is not a required document for ISO 9001 certification, but it may be useful for internal reference or training purposes. It is not necessary for audit planning.

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 requires organizations to identify and control nonconforming outputs to prevent unintended use or delivery.

Clause References:

Clause 8.7 (Control of Nonconforming Outputs): Organizations must ensure that nonconforming outputs are identified and controlled to prevent unintended use or delivery.

Clause 10.2 (Nonconformity and Corrective Action): Requires organizations to take appropriate actions when nonconformities are found, including during or after service provision.

Why is the Correct Answer C?

If nonconforming products or services are identified after delivery or during service, organizations must take corrective actions to protect customers and stakeholders.

Actions may include recalls, rework, customer notifications, compensation, or process improvements.

This approach aligns with ISO 9001:2015, ensuring that products/services consistently meet requirements.

Why are the Other Options Incorrect?

A (Retaining documentation only) → While documentation is required, it alone does not ensure proper handling of nonconforming outputs.

B (Verifying conformity before correction) → While verification is good practice, ISO 9001 prioritizes corrective action over mere verification.

D (Allowing employees to handle nonconformities without structure) → ISO 9001 requires documented procedures for handling nonconformities (Clause 8.7).

Comprehensive and Detailed In-Depth Explanation:

During communication with top management, the auditor should discuss:

The quality policy (ISO 9001:2015, Clause 5.2.1), ensuring that it is established, communicated, and understood.

Internal audits (ISO 9001:2015, Clause 9.2), verifying that they are planned and effectively implemented.

These discussions help assess leadership commitment and the effectiveness of the QMS.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 9001:2015, Clause 9.2 (Internal Audit):

Internal audits are conducted by employees of the company who are trained as auditors.

External auditors are not mandatory unless required by the organization.

Thus, A is the correct answer.

Comprehensive and Detailed In-Depth Explanation:

The PDCA (Plan-Do-Check-Act) cycle is a continuous improvement model used in ISO 9001:2015. The " Check " phase involves monitoring, measuring, and analyzing the results to assess if the planned actions have been effective.

In scenario 1, AL-TAX tested the effectiveness of the intended actions, which aligns with the Check stage of the PDCA cycle. Clause 9.1.1 (Monitoring, Measurement, Analysis, and Evaluation) requires organizations to evaluate their QMS and determine whether improvements are necessary.

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 requires specific roles and responsibilities for audit leaders and certification bodies.

Clause References:

ISO 19011:2018, Clause 5.5 – Conducting the Audit: Defines audit team leader responsibilities.

ISO/IEC 17021-1:2015, Clause 9.1.2 – Audit Planning: Defines certification body responsibilities, including the certification agreement.

Why is the Correct Answer D?

The certification agreement is signed between the certification body and the auditee (TD Advertising).

Anne (audit team leader) does NOT have authority to sign the agreement—that is the responsibility of the certification body’s management.

Why are the Other Options Incorrect?

A (Establishing audit criteria and objectives) → Correct responsibility of the audit leader as per ISO 19011.

B (Determining audit feasibility) → Audit leaders assess feasibility but do not sign agreements.

C (Assigning responsibilities for the audit team) → This is part of the audit leader’s role in planning audits.

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 recognizes change management as essential for maintaining process integrity and preventing nonconformities.

Clause References:

Clause 6.3 (Planning of Changes) → Focuses on long-term changes that may impact QMS integrity.

Clause 8.5.6 (Control of Changes) → Focuses on changes occurring during production and service provision to ensure conformity.

Why is the Correct Answer A?

Clause 8.5.6 applies specifically to operational changes, ensuring that modifications in production or service processes do not compromise quality.

Organizations must document who approves changes, how they are controlled, and how they affect product/service conformity.

Why are the Other Options Incorrect?

B (Changes during design and development) → Covered under Clause 8.3 (Design and Development), not 8.5.6.

C (Changes to legal and regulatory requirements) → Addressed under Clause 4.2 (Interested Parties ' Requirements).

D (Leadership responsibilities) → Covered under Clause 5.1 (Leadership and Commitment), not 8.5.6.

According to the ISO 9001:2015 standard, clause 8.4.1 requires organizations to ensure that externally provided processes, products and services conform to requirements. Controls must be applied to externally provided processes, products and services when:

The products and services are intended for incorporation into the organization’s own products and services.

They are provided directly to customers by the external provider on behalf of the organization.

A process, or part of a process, is provided by an external provider as a result of a decision by the organization.

In this scenario, the auditee has chosen a supplier to manufacture their own brand products based on their design drawings, supplier questionnaire and trial batches. This means that the supplier is providing a process (manufacturing) as a result of a decision by the organization (the auditee). Therefore, clause 8.4.1 applies to this situation.

According to clause 10.2.1.b of ISO 9001:2015, the organization should evaluate the need for action to eliminate the causes of nonconformities, in order to prevent their recurrence. This means that the organization should identify and address the root causes and contributing factors of the nonconformities, and implement appropriate corrective actions that are effective and proportional to the impact of the nonconformities. In this case, the evidence statement that supports the finding of nonconformance is C, because it shows that the organization did not take effective actions to prevent the recurrence of the spelling errors in the print run, which resulted in repeated customer rejections and dissatisfaction. The other options are not directly related to clause 10.2.1.b, although they may indicate other nonconformities or weaknesses in the organization’s QMS. For example, option A may relate to clause 7.2 on competence, option B may relate to clause 8.6 on release of products and services, and option D may relate to clause 7.1 on resources. References: ISO 9001:2015, [ISO 9001 Auditing Practices Group Guidance on Nonconformity and Corrective Action], ISO 9001 Clause 10. Improvement - ISO-templates.com

The activities that are specifically required by ISO 17021-1 as part of third-party (Certification Body) surveillance audit processes are:

•Option A: Audit use of certification marks on marketing materials. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to audit the client’s use of marks and/or any other reference to certification, as applicable, to ensure conformity with the certification requirements.

•Option B: Review changes to the QMS since last visit. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review any changes affecting the client’s quality management system and its ability to continue to fulfil the requirements of the standard used for certification.

•Option C: Confirm effectiveness of internal audit and management review. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to confirm the continuing effectiveness of the client’s quality management system, including the effectiveness of the internal audit and management review processes.

•Option F: Review the status of previously raised findings and audit effectiveness of any outstanding findings. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review the status of findings and any corrective actions taken by the client in response to previous audits, and to verify the effectiveness of the implemented corrective actions.

•Option H: Verify legal compliance. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to verify the client’s compliance with applicable statutory and regulatory requirements related to the scope of certification.

•Option I: Handling of customer complaints since last visit. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review the client’s handling of customer complaints related to the certified activities since the last audit.

The following options are not correct:

•Option D: Complete a full document review of the quality management system. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to complete a full document review of the quality management system during surveillance audits. A full document review is only required during the initial certification audit or when there are significant changes to the quality management system or the certification requirements.

•Option E: Failing to meet financial responsibilities. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to audit the client’s financial responsibilities during surveillance audits. The certification body may have contractual arrangements with the client regarding the payment of fees, but this is not part of the surveillance audit process.

•Option G: Review the calibration status of the instrumentation. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to review the calibration status of the instrumentation during surveillance audits. The certification body may audit the client’s monitoring and measuring resources as part of the quality management system requirements, but this is not a specific activity required by ISO 17021-1.

•Option J: Conduct a minimum number of annual surveillance audits during the certification period. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to conduct a minimum number of annual surveillance audits during the certification period. The certification body may determine the frequency and duration of surveillance audits based on the risk and performance of the client, but this is not a specific activity required by ISO 17021-1.