The table below shows the possible matching of the ISO 9001 Clause 8.3 extract to the audit evidence.

Table

Audit evidence

ISO 9001 Clause 8.3 extract

Half of all new products launched in the past 12 months were late. The NPD Manager explains he has not got enough people on his team to cope with the demand for new products.

“8.3.2 e) … internal … resource needs for the design and development of products …”

The NPD Manager explains many changes are made to cosmetic formulations during product development owing to retailer feedback. Only when confirmed by the retailer is the agreed formulation documented on SWIFT.

“8.3.5 … retain documented information …”

The NPD Manager explains that the customer confirms their approval to proceed with a new formulation by email. These emails are kept on SWIFT.

“8.3.6 … retain documented information …”

The NPD Manager shows you evidence of consumer trials that are carried out for some new products prior to full-scale launch.

“8.3.4 d) … conducted to ensure that the resulting products and services meet the requirements …”

The NPD Manager explains that an approved external laboratory is used to perform shelf-life stability trials on some formulations during product development.

“8.3.2 e) … external … resource needs for the design and development of products …”

According to the ISO 19011:2018 document, the audit plan should provide the basis for agreement regarding the conduct and scheduling of the audit activities. The amount of detail provided in the audit plan should reflect the scope and complexity of the audit, as well as the risk of not achieving the audit objectives1. The scope of the audit refers to the extent and boundaries of the audit, such as the audit criteria, the audit objectives, the organizational and functional units, and the processes to be audited1. The complexity of the audit refers to the degree of difficulty or intricacy of the audit, such as the number and diversity of the auditees, the audit criteria, the audit methods, and the audit team composition2. The risk of not achieving the audit objectives refers to the possibility that the audit may fail to provide reliable and sufficient audit evidence to support the audit conclusions and report1.

Therefore, the complete sentence is:

In the context of a third-party audit, the amount of detail provided in the audit plan should reflect the scope and complexity of the audit, as well as the risk of not achieving the audit objectives.

Understanding Clause 6.2 of ISO 9001:2015:Clause 6.2 (Quality Objectives and Planning to Achieve Them) specifies that organizations must:

Establish measurable and relevant quality objectives consistent with the quality policy (Clause 6.2.1).

Include objectives applicable to product/service conformity and customer satisfaction.

Document these objectives and their planning as documented information (Clause 6.2.1 & 6.2.2).

Plan how to achieve the objectives, including defining actions, resources, responsibilities, timelines, and methods for evaluation.

Analysis of Options:

A. Quality objectives are not being implemented by the organisation's personnel:Incorrect. While implementation is critical, this relates more to operational aspects rather than the direct requirements of Clause 6.2. Implementation issues would typically raise concerns under Clause 9.1 (Performance Evaluation).

B. The consultant has not interpreted ISO 9001 correctly:Incorrect. The consultant's interpretation of ISO 9001 is irrelevant in terms of Clause 6.2 compliance. The focus is on whether the organization aligns with the requirements, not the consultant's role.

C. Establishing quality objectives did not include top management:Incorrect. While top management involvement is vital for QMS effectiveness (Clause 5.1), this is not a direct requirement of Clause 6.2. Top management alignment is implied but not explicitly mandated for establishing quality objectives.

D. Quality objectives were not established in alignment with the organisation's quality policy:Correct. Clause 6.2.1 requires that quality objectives be consistent with the organization’s quality policy, ensuring they reflect its purpose, strategic direction, and commitment to continual improvement. Misalignment would constitute a nonconformity.

E. The organisation cannot afford to undertake quality objectives all at once:Incorrect. Financial constraints are not directly addressed in Clause 6.2. The clause focuses on planning to achieve objectives, which includes defining the necessary resources but does not demand achieving all objectives simultaneously.

F. Quality objectives are not maintained as documented information:Correct. Clause 6.2.1 specifically requires that quality objectives be maintained as documented information. Failure to document the objectives is a direct violation of this clause.

Why Options D and F Are Correct:

D: Misalignment between the quality objectives and the quality policy directly violates Clause 6.2.1, which mandates that objectives support the strategic direction of the organization.

F: Lack of documentation for quality objectives breaches the requirement to maintain them as documented information under Clause 6.2.1.

Relevant References:

Clause 6.2.1: Establishing quality objectives aligned with the quality policy.

Clause 6.2.2: Maintaining documented information for quality objectives and planning to achieve them.

Clause 5.1.1: Top management's responsibility to ensure alignment between the QMS and strategic direction.

Comprehensive and Detailed Explanation From Exact Extract:

Clause 9.1.1 – Monitoring, measurement, analysis and evaluation (General) requires the organization to:

“Determine what needs to be monitored and measured, the methods for monitoring, measurement, analysis and evaluation needed to ensure valid results, and when results shall be analyzed and evaluated.”

The goal is to ensure valid, reliable, and consistent measurement of process and product performance. Here's how each correct option supports compliance:

✅ B. Analysis of the results of sensory tests

This directly aligns with the requirement for analysis and evaluation of monitoring results. Clause 9.1.3 also supports the use of such data for evaluating product conformity and process effectiveness.

✅ G. Sensory testing results are recorded

This supports documented evidence of monitoring results, as required under 9.1.1(e), to verify that quality checks (such as flavor and aroma assessments) are being done consistently.

✅ H. The Hedonic Method is used to monitor the quality of the product

Use of a standardized measurement method like the Hedonic Scale aligns with 9.1.1(b), which requires defined methods to ensure valid and reproducible results.

Why the Other Options Are Incorrect or Less Relevant:

A. University degrees → Related to competence (Clause 7.2), not monitoring and measurement (Clause 9.1.1).

C. Independent expert review → Not part of regular monitoring unless it’s built into the process.

D. Respiratory testing → Irrelevant to product quality monitoring.

E. Outsourcing → Would shift responsibility but doesn’t demonstrate internal conformance.

F. Safe disposal → Pertains to Clause 8.5.4 (Preservation), not Clause 9.1.1.

•

Reviews the client’s management system documented information: This activity involves checking the documentation of the quality management system, such as the quality policy, the quality objectives, the scope, the processes, and the procedures, to ensure that they meet the requirements of ISO 9001:2015123. The audit team also evaluates the client’s understanding and implementation of the standard, and identifies any gaps or nonconformities that need to be addressed before the Stage 2 audit123.

•Reviews the processes with high level of risk: This activity involves assessing the processes that have a significant impact on the quality of the products or services, or that pose a high risk of nonconformity or customer dissatisfaction123. The audit team also verifies the client’s risk management approach, and evaluates the effectiveness of the controls and actions taken to mitigate the risks123.

The other options are not statements that are true for the Stage 1 audit, according to the web search results from my internal tool. They may be related to other stages or types of audits, but they are not the focus of the Stage 1 audit.

Therefore, the correct answer is D and G.

D. I would look for evidence that the actions resulting from the risk assessment had been taken.

According to ISO 9001:2015, Clause 6.1.2 requires the organization to plan actions to address risks and opportunities. The organization must integrate and implement these actions into its quality management system and evaluate their effectiveness. The auditor should seek evidence that the organization has assessed the risks and taken appropriate actions.

B. I would ask to audit the Technical Manager by phone.

As the Technical Manager is responsible for this process and is absent due to illness, it is reasonable to attempt to contact him to obtain accurate information. This ensures that the audit process is not unduly delayed and that the information is obtained from the appropriate person.

A. I would not accept the legal compliance expert answering the question.

While the legal compliance expert might not be the best source for technical details, outright rejecting their input is not appropriate. It is better to first verify if the expert can provide relevant information.

C. I would delay the audit until the return of the Technical Manager.

This would be an inefficient approach. Contacting the Technical Manager by phone is a more practical and reasonable option.

E. I would ask for a different guide instead of the legal compliance expert.

The guide's role is not necessarily to answer technical questions but to facilitate the audit. Since Jack is already familiar with the situation, replacing him may not add value.

F. I would ask the consultant to leave the meeting since he is not an employee of the organization.

This is inappropriate and could disrupt the audit process. There is no rule in ISO 9001 preventing a consultant from assisting in the audit if authorized by the organization.

Why Not the Other Options:

In ISO 9001:2015, the responsibility for managing the audit program lies with those overseeing the entire audit process rather than the Audit Team Leader. During the planning stage, before involving the Audit Team Leader, key actions for managing the audit program include:

1. Providing the Resources Needed: According to clause 7.1 (Resources), the audit program manager must ensure that the necessary resources are in place to conduct the audit effectively. This encompasses logistical support, personnel, and other required resources for the audit to proceed smoothly.

2. Reviewing Reports of Previous Audits: As per clause 9.2.2 (Internal Audit), it is essential to consider the results of previous audits to plan effectively for the upcoming audit. This helps identify areas that require particular attention, ensuring continuity and focusing on recurring issues or improvements since the last audit.

These actions ensure that the audit is thoroughly prepared and that there is continuity and focus on any areas that might need closer inspection. The other options, such as preparing the audit plan, assigning responsibilities, preparing checklists, and selecting the audit team members, generally fall under the duties of the Audit Team Leader once they are appointed and engaged in the planning process.

The activities that are specifically required by ISO 17021-1 as part of third-party (Certification Body) surveillance audit processes are:

•Option A: Audit use of certification marks on marketing materials. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to audit the client’s use of marks and/or any other reference to certification, as applicable, to ensure conformity with the certification requirements.

•Option B: Review changes to the QMS since last visit. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review any changes affecting the client’s quality management system and its ability to continue to fulfil the requirements of the standard used for certification.

•Option C: Confirm effectiveness of internal audit and management review. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to confirm the continuing effectiveness of the client’s quality management system, including the effectiveness of the internal audit and management review processes.

•Option F: Review the status of previously raised findings and audit effectiveness of any outstanding findings. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review the status of findings and any corrective actions taken by the client in response to previous audits, and to verify the effectiveness of the implemented corrective actions.

•Option H: Verify legal compliance. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to verify the client’s compliance with applicable statutory and regulatory requirements related to the scope of certification.

•Option I: Handling of customer complaints since last visit. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review the client’s handling of customer complaints related to the certified activities since the last audit.

The following options are not correct:

•Option D: Complete a full document review of the quality management system. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to complete a full document review of the quality management system during surveillance audits. A full document review is only required during the initial certification audit or when there are significant changes to the quality management system or the certification requirements.

•Option E: Failing to meet financial responsibilities. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to audit the client’s financial responsibilities during surveillance audits. The certification body may have contractual arrangements with the client regarding the payment of fees, but this is not part of the surveillance audit process.

•Option G: Review the calibration status of the instrumentation. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to review the calibration status of the instrumentation during surveillance audits. The certification body may audit the client’s monitoring and measuring resources as part of the quality management system requirements, but this is not a specific activity required by ISO 17021-1.

•Option J: Conduct a minimum number of annual surveillance audits during the certification period. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to conduct a minimum number of annual surveillance audits during the certification period. The certification body may determine the frequency and duration of surveillance audits based on the risk and performance of the client, but this is not a specific activity required by ISO 17021-1.

According to ISO 19011:2018, clause 6.7, the audit follow-up is the process of verifying the completion and effectiveness of corrective actions taken by the auditee as a result of an audit. The audit follow-up can include two main activities:

Verifying the effectiveness of the implemented corrective actions: this means checking whether the actions taken by the auditee have addressed the root causes of the nonconformities and prevented their recurrence or occurrence in other areas. The verification can be done by reviewing documents, records, data, or other evidence provided by the auditee, or by conducting a follow-up audit on site or remotely.

Verifying corrections taken to fix the reported non-conformities: this means checking whether the auditee has corrected the nonconformities identified during the audit and eliminated their immediate effects. The verification can be done by reviewing documents, records, data, or other evidence provided by the auditee, or by conducting a follow-up audit on site or remotely.

The audit follow-up can be conducted as a separate audit or as part of a subsequent audit, depending on the audit programme, the audit objectives, the audit criteria, the audit scope, the audit risks, and the audit findings. The audit follow-up should be planned and conducted in accordance with the same principles and processes as the initial audit, and the results should be documented and reported accordingly. References:

ISO 19011:2018(en), Guidelines for auditing management systems, clause 6.7

ISO 19011 Management Systems Audit Checklist | Process Street, task 6.7.1 and 6.7.2

Conducting the Audit Follow-Up: When to Verify - The Auditor, section “Conducting the audit follow-up”

According to the ISO 9001:2015 document, the organisation must continually improve the suitability, adequacy, and effectiveness of the quality management system1. However, among the six options given, only effectiveness is directly mentioned as an aspect of the quality management system that must be continually improved. Therefore, C is one of the correct answers.

Efficiency, on the other hand, is not explicitly stated as an aspect of the quality management system that must be continually improved, but it is implied by the quality management principle of improvement, which states that successful organisations have an ongoing focus on improvement2. One of the key benefits of applying this principle is improving operational effectiveness and efficiency2. Therefore, E is another correct answer.

Suitability, adaptability, responsiveness, and applicability are not aspects of the quality management system that must be continually improved, according to the ISO 9001:2015 document. They may be related to the quality management system, but they are not the focus of continual improvement.

Therefore, the correct answer is C and E.

Comprehensive and Detailed Explanation: = According to the web search results from my internal tool, a witness audit is a technique used during an accreditation audit, where the accreditation body observes the performance and competence of the certification body auditors in conducting an audit12. A witness audit can also be used by a certification body to monitor and evaluate its own auditors3. During a witness audit, the following roles can be defined:

•An auditor: This is the person who is being witnessed by the accreditation body or the certification body. The auditor is responsible for conducting the audit according to the audit plan, criteria, and standards, and for providing audit evidence and findings123.

•An assessor for the accreditation body: This is the person who witnesses the auditor on behalf of the accreditation body. The assessor is responsible for evaluating the auditor’s performance and competence, and for providing feedback and recommendations to the accreditation body123.

The other options are not defined as witnesses during a witness audit, according to the web search results from my internal tool. They are:

•Someone with a qualification from the certification body: This is not a specific role in a witness audit, as anyone who is involved in the audit process should have a qualification from the certification body. Moreover, having a qualification does not necessarily mean that the person is a witness or an auditor4.

•An existing member of the audit team: This is not a specific role in a witness audit, as the audit team consists of the auditors who are conducting the audit, not the ones who are witnessing it. The witness audit is a separate activity from the audit itself, and the witness should not interfere with the audit process or influence the audit outcome123.

Therefore, the correct answer is B and D.

The quality system failed to control the laundry services provided for customers in five shops. The equipment used was not capable of consistently producing the required service.

According to ISO 19011:2018, clause 3.2, audit criteria are a set of policies, procedures or requirements used as a reference against which objective evidence is compared. Audit criteria are usually selected by the audit client or by agreement between the audit client and the auditee, and they should be appropriate for the audit scope and objectives1. Audit criteria may include, but are not limited to, the following sources2:

•ISO management system standards, such as ISO 9001, ISO 14001, ISO 45001, etc.

•Verbal statements by the general manager or other top management, as long as they are consistent with the documented policies and objectives of the organisation

•Verbal agreements with interested parties, such as customers, suppliers, regulators, etc., as long as they are documented and approved by the relevant authorities

•Health and safety notices, such as posters, signs, labels, etc., that communicate the organisation’s legal obligations, policies, or procedures

•Written agreements with interested parties, such as contracts, orders, specifications, etc., that define the requirements and expectations of the parties involved

•Organisation’s documented information, such as policies, procedures, manuals, records, etc., that describe the organisation’s management system and its processes

•Commitment to follow principles issued by an NGO, such as the United Nations Global Compact, the International Labour Organization, etc., as long as they are relevant to the organisation’s context and objectives

•Environmental aspects register, such as a list of the environmental impacts and risks associated with the organisation’s activities, products, and services

Therefore, the two options that are not potential audit criteria are F and H, as they are not reliable or verifiable sources of information, and they may not reflect the actual performance or conformity of the organisation’s management system. Commercial advertisements and claims made on the organisation’s website are forms of marketing communication that may be exaggerated, misleading, or inaccurate, and they are not subject to the same level of scrutiny or approval as the other sources of audit criteria.

A first-party audit is an internal audit conducted by auditors who are employed by the organization being audited but who have no vested interest in the audit results of the area being audited1. The purpose of a first-party audit is to assess the conformity of the organization’s quality management system to the requirements of ISO 9001 and to identify opportunities for improvement2. Therefore, the two auditors who would not participate in a first-party audit are:

•A. An auditor employed by an external consultancy organization: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit (if the external consultancy organization is a customer or supplier of the organization being audited) or a third-party audit (if the external consultancy organization is a certification body or registrar).

•F. An auditor from a customer: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit, as a customer is an interested party that has specific requirements for the organization being audited.

The other options are not correct, as they could participate in a first-party audit, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited:

•B. An auditor from an interested party: This auditor could be a first-party auditor, as long as the interested party is within the organization being audited. For example, an auditor from the finance department could audit the production department, as long as they are not involved in the production process or affected by its outcomes.

•C. An auditor trained in-house: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The source of the auditor’s training is not relevant for determining the type of audit, as long as the auditor is competent and qualified to perform the audit.

•D. An auditor trained in the IRCA scheme: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The IRCA scheme is a professional certification scheme for auditors of management systems, which provides recognition of the auditor’s competence and credibility3. However, being trained in the IRCA scheme does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

•E. An auditor certified by IRCA: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. Being certified by IRCA means that the auditor has met the requirements of the IRCA scheme and has demonstrated their competence and credibility as an auditor of management systems3. However, being certified by IRCA does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

Here is the correct matching of the ISO 9001 Clause 8 extracts to the audit evidence:

Audit evidence: Three subcontract trainers who had delivered training were not approved as defined in procedure SA1 Supplier Approval revision 3.ISO 9001 Clause 8 extract: 8.4.1 ...shall apply criteria for ... external providers...(This clause requires the organization to control external providers, including ensuring their approval and competence.)

Audit evidence: A training programme for a customer was not documented as required in procedure TD 2 Training revision 2.ISO 9001 Clause 8 extract: 8.3.5 ...shall retain documented information on design and development outputs.(This clause addresses the need to retain documented information related to design and development outputs, such as a training programme.)

Audit evidence: One trainer had not recorded the damage to a customer’s training room wall caused by using sticky tape to hang training aids, as required in procedure TD 2 Training revision 2.ISO 9001 Clause 8 extract: 8.5.3 ...shall retain documented information on what has occurred.(This clause relates to retaining documented information on activities and outcomes, including records of damage or issues encountered.)

Audit evidence: Five sales orders had no record of having been reviewed to verify the ability to provide these courses.ISO 9001 Clause 8 extract: 8.2.3.1 ...shall conduct a review before committing...(This clause specifies the requirement to review and verify the organization's ability to meet customer requirements before accepting sales orders.)

These mappings reflect the specific requirements of ISO 9001:2015 for managing external providers, retaining documented information, and reviewing contracts.

Match the process descriptions below to the process names:

The process by which the accuracy of test equipment is checked against a known standard. = Calibration

The process by which a product or service is visually examined to determine conformity to requirements. = Evaluation

The process by which data is examined in detail to reach a specific answer or answers. = Analysis

The process by which a parameter of a product or service is examined to determine a specific value. = Measurement

According to the ISO 9000:2015 - Quality management systems — Fundamentals and vocabulary, the definitions of the process names are as follows:

Calibration: operation that, under specified conditions, in a first step, establishes a relation between the quantity values with measurement uncertainties provided by measurement standards and corresponding indications with associated measurement uncertainties and, in a second step, uses this information to establish a relation for obtaining a measurement result from an indication.

Evaluation: determination of the suitability, adequacy or effectiveness of an object to achieve established objectives.

Analysis: detailed examination of the elements or structure of something.

Measurement: process to experimentally obtain one or more quantity values that can reasonably be attributed to a quantity.

Therefore, the process descriptions can be matched to the process names based on these definitions.

The tasks that are expected to be completed at the audit team meeting of a third-party audit team leader and his audit team in preparation for a Closing meeting for a four-day initial certification audit are:

•Option C: Final audit team meeting to agree findings and categories including clarification of any uncertainties. This option is correct because the audit team meeting is an opportunity for the audit team leader and the audit team members to review and consolidate the audit findings, to ensure that they are clear, accurate, objective, and supported by sufficient audit evidence. The audit team should also agree on the categories of the findings, such as nonconformity, observation, or opportunity for improvement, and resolve any uncertainties or disagreements among the audit team members.

•Option D: Agree the roles of each audit team member for the closing meeting. This option is correct because the audit team meeting is an opportunity for the audit team leader to assign the roles and responsibilities of each audit team member for the closing meeting, such as presenting the audit findings, answering questions, or taking notes. The audit team leader should also ensure that the audit team members are prepared and confident to perform their roles and to communicate effectively with the auditee.

•Option E: Audit team review any points raised by the auditee nominated representative. This option is correct because the audit team meeting is an opportunity for the audit team to review any points raised by the auditee nominated representative during the audit, such as requests for clarification, feedback, or complaints. The audit team should consider the validity and relevance of the points raised and decide how to address them in the closing meeting or in the audit report.

•Option F: Audit team agree final audit outcome recommendation. This option is correct because the audit team meeting is an opportunity for the audit team to agree on the final audit outcome recommendation, based on the audit findings and the audit criteria. The audit team should also consider the implications and consequences of the audit outcome recommendation for the auditee and the certification body, and ensure that the recommendation is consistent and justified.

•Option H: Audit team complete final version of their individual findings. This option is correct because the audit team meeting is an opportunity for the audit team to complete the final version of their individual findings, based on the agreement and feedback from the audit team meeting. The audit team should ensure that their individual findings are written in a clear, concise, and factual manner, and that they include the audit criteria, the audit evidence, and the audit conclusion. The audit team should also submit their individual findings to the audit team leader for review and approval.

•Option I: Re-audit corrective actions taken to correct findings found during the audit. This option is correct because the audit team meeting is an opportunity for the audit team to re-audit the corrective actions taken by the auditee to correct the findings found during the audit, if applicable and feasible. The audit team should verify the effectiveness and adequacy of the corrective actions and update the audit findings accordingly. The audit team should also document the results of the re-audit and communicate them to the auditee.

The following options are not correct:

•Option A: Audit team leader informs the individual(s) managing the audit programme that the closing meeting is ready to be held. This option is not correct because this task is not part of the audit team meeting, but part of the communication between the audit team leader and the individual(s) managing the audit programme. The audit team leader should inform the individual(s) managing the audit programme that the closing meeting is ready to be held after the audit team meeting, when the audit team has completed all the tasks and is ready to present the audit results to the auditee.

•Option B: Hold daily audit team meeting to review any timetable issues and potential findings and their impact on the audit for other team members. This option is not correct because this task is not part of the final audit team meeting, but part of the daily audit team meetings that are held during the audit. The daily audit team meetings are opportunities for the audit team to review the progress and performance of the audit, to identify and resolve any issues or problems, and to coordinate and adjust the audit plan and activities as needed.

•Option G: Audit team leader completes final report, including individual findings and certification recommendation. This option is not correct because this task is not part of the audit team meeting, but part of the audit reporting process. The audit team leader should complete the final report, including the individual findings and the certification recommendation, after the closing meeting, when the audit team has received and considered the feedback and comments from the auditee. The audit team leader should also ensure that the final report is reviewed and approved by the appropriate authorities before issuing it to the auditee and the certification body.

•Option J: Write the audit finding report out when detected and obtain signature of the auditee. This option is not correct because this task is not part of the audit team meeting, but part of the audit evidence collection and documentation process. The audit team should write the audit finding report out when detected and obtain the signature of the auditee during the audit, when the audit team has observed and verified the audit evidence and has communicated the audit finding to the auditee. The signature of the auditee does not indicate acceptance or agreement with the audit finding, but only acknowledgement of receipt.

Identifying the source of information

Sampling available data

Gathering audit evidence

Verifying objective evidence

Evaluating evidence against the audit criteria

Making audit conclusions

Evaluating against the audit criteria

According to ISO 19011:2018, clause 6.4, the process of collecting and verifying information during an audit involves the following steps1:

Identifying the source of information: The audit team should identify the sources of information that are relevant to the audit objectives, scope and criteria. These sources may include documents, records, personnel, processes, activities, facilities, equipment, etc. The audit team should also determine the methods and tools for accessing and collecting the information, such as interviews, observations, document review, sampling, etc.

Sampling available data: The audit team should select a representative sample of the available data to verify the conformity and effectiveness of the management system. The sample size and selection method should be based on the audit objectives, scope and criteria, as well as the level of confidence and risk. The audit team should also consider the validity, reliability, relevance and sufficiency of the data.

Gathering audit evidence: The audit team should use the methods and tools identified in the previous step to collect audit evidence, which is the records, statements of fact or other information that are relevant to the audit criteria and verifiable. The audit team should record the audit evidence in a clear, concise and objective manner, using notes, checklists, photographs, audio or video recordings, etc.

Verifying objective evidence: The audit team should verify the accuracy, completeness and authenticity of the audit evidence collected. This may involve cross-checking different sources of information, confirming the identity and authority of the persons providing the information, examining the original documents or records, etc. The audit team should also identify any discrepancies, inconsistencies or gaps in the audit evidence.

Evaluating evidence against the audit criteria: The audit team should compare the audit evidence with the audit criteria to determine the extent of conformity and nonconformity. The audit team should also identify any opportunities for improvement, best practices, positive aspects or potential risks. The audit team should use professional judgement and apply the principles of auditing when evaluating the audit evidence.

Making audit conclusions: The audit team should consolidate the audit findings and evaluate the overall performance and effectiveness of the management system. The audit team should also consider the audit objectives, scope and criteria, as well as the context and expectations of the auditee and other interested parties. The audit team should provide a clear, concise and objective statement of the audit conclusions, which may include the degree of conformity, the achievement of the intended outcomes, the need for corrective actions, the suitability for certification, etc.

Evaluating against the audit criteria: The audit team should review the audit conclusions and ensure that they are consistent with the audit criteria and supported by sufficient and appropriate audit evidence. The audit team should also ensure that the audit conclusions are communicated to the auditee and other relevant parties in a timely and effective manner, using the agreed audit report format and distribution method.

ISO 9001:2015 requires organisations to take corrective action to eliminate the cause of a nonconformity in order to prevent recurrence, not merely to contain or correct individual instances.

Relevant ISO 9001 requirements

Clause 10.2.1 – Nonconformity and corrective actionThe organisation shall react to the nonconformity, evaluate the need for action to eliminate the cause(s), and implement actions to prevent recurrence.

Clause 8.5.1 – Control of production and service provisionProduction shall be carried out under controlled conditions, including suitable infrastructure and environmental conditions.

Explanation of the correct corrective actions:

D. Redesign the factory layout to better handle finished products

This addresses a systemic cause of the problem by improving how finished products are handled after ejection, reducing the likelihood of products falling to the floor. This is a true corrective action aligned with Clause 10.2.

E. Set up a system of regular inspection of the floor condition

The dirty and wet floor is a contributing cause to product rejection. Establishing regular inspection and maintenance of floor conditions addresses the environmental conditions for production, as required by Clause 8.5.1, and helps prevent recurrence.

G. Install guides at the point of ejection to better direct products into the baskets

This directly eliminates the root cause of products missing the collection baskets by improving equipment control. It is an effective corrective action that prevents the nonconformity from happening again.

Explanation of why the other options are not corrective actions:

A: Recording nonconformities is detection, not prevention.

B: Placing a worker is a temporary containment action, not elimination of the root cause.

C: Asking customers to accept dirty products is unacceptable and contrary to ISO 9001.

F: Awareness alone does not remove the cause of the problem.

H: Cleaning products before release is correction, not corrective action, and does not prevent recurrence.

ISO-aligned conclusion:

Corrective actions must remove the root causes of nonconformities. In this scenario, improving product handling design, controlling environmental conditions, and modifying equipment to ensure correct ejection are the only actions that effectively prevent the recurrence of rejected products. Therefore, the correct answers are D, E and G.

Approve Certification Body: Accreditation Body

Award certification: Certification Body

Recommend certification: Audit Team Leader

Maintain certification:

Comprehensive Detailed Explanation

In the context of a third-party ISO 9001 audit, different entities play specific roles in the certification process. Here's a detailed explanation of the responsibilities:

Approve Certification Body: Accreditation BodyThe Accreditation Body is responsible for approving Certification Bodies. Accreditation Bodies are independent entities that evaluate the competence of Certification Bodies, ensuring they meet international standards like ISO/IEC 17021, which sets out the criteria for bodies providing audit and certification of management systems. In this role, they confirm that the Certification Body is capable of conducting ISO 9001 audits and granting certifications in accordance with international guidelines.

Award Certification: Certification BodyThe Certification Body is the entity that ultimately awards the certification to an organization after verifying that it meets the ISO 9001 standards. Certification Bodies conduct audits, either directly or through a team of auditors, and based on the audit outcomes, they issue the certification, indicating that the organization complies with ISO 9001.

Recommend Certification: Audit Team LeaderThe Audit Team Leader is responsible for leading the audit and making a recommendation to the Certification Body. This recommendation is based on the audit findings—whether the organization meets the ISO 9001 requirements or if there are areas of non-compliance that need corrective action. The final decision on certification is not made by the Audit Team Leader but by the Certification Body.

Maintain Certification: Certification BodyMaintaining certification refers to the ongoing process of ensuring that an organization continues to comply with ISO 9001 requirements. The Certification Body conducts regular surveillance audits (e.g., annually) and may also perform recertification audits (typically every three years). This ongoing monitoring ensures that the certified organization continues to adhere to the quality management standards over time.

This breakdown clearly assigns responsibility based on the defined roles of Accreditation Bodies, Certification Bodies, and Audit Teams in the ISO 9001 certification process.

According to ISO 9001:2015, clause 6.2.1, the organization is required to establish quality objectives at relevant functions, levels, and processes for the quality management system (QMS). The quality objectives must be consistent with the quality policy, measurable, monitored, communicated, and updated as appropriate. The organization is also required to maintain documented information on the quality objectives, as per clause 7.5.1.

Therefore, in the scenario given, the quality objectives defined by the external consultant are not in alignment with the organization’s quality policy, as they are based on those of a competitor, rather than the organization’s own purpose, strategic direction, and customer requirements. This creates a mismatch between the organization’s vision and goals, and the quality objectives that are supposed to guide and measure the QMS performance. Moreover, the quality objectives are not maintained as documented information, which makes it difficult to communicate, monitor, and update them, as well as to demonstrate evidence of their implementation and achievement.

Hence, the circumstances in which a nonconformity against clause 6.2 of ISO 9001 could be raised are B and C, as they indicate a failure to comply with the requirements of clause 6.2.1. The other options are either irrelevant or not directly related to clause 6.2, as they do not pertain to the establishment and documentation of quality objectives.

Potential threats to impartiality in an audit context include familiarity (having a close relationship with the auditee), intimidation (being coerced or feeling pressured), and self-audit (auditing one’s own work). These factors can compromise the auditor’s objectivity and the audit’s integrity. References: = The information is based on the ISO 9001 Auditing Practices Group documents which discuss threats to auditor impartiality and how they may compromise an auditor’s objectivity123.

A white background with black text Description automatically generated

Here is the correct matching of the activities with the responsible parties in the context of a second-party audit:

Define the audit scope: Customer

Develop the audit plan: Audit team leader

Respond to the audit findings: External provider

Conduct the audit: Audit team

This reflects the typical division of responsibilities in a second-party audit, where the customer (the party commissioning the audit) sets the scope, the audit team leader manages the planning, the external provider responds to findings, and the audit team carries out the audit.

ISO 9001:2015 requires organisations to understand their context and to use this understanding as an input to planning the quality management system. Tools such as PESTLE are acceptable methods, but auditors must verify how the outputs are used, not simply that the analysis exists.

Relevant ISO 9001 requirements:

Clause 4.1 – Understanding the organisation and its contextThe organisation shall determine external and internal issues that are relevant to its purpose and strategic direction and that affect its ability to achieve the intended results of the QMS.

Clause 6.1 – Actions to address risks and opportunitiesThe organisation shall plan actions to address risks and opportunities identified from context analysis and integrate these actions into the QMS processes.

Explanation of the correct audit trails:

C. What actions have been taken to address the risks and opportunities from the PESTLE analysis?

This audit trail directly links PESTLE outputs to Clause 6.1. It allows the auditor to determine whether the organisation has translated identified political, economic, social, technological, legal, and environmental issues into concrete actions within planning, operational control, or resource allocation. Without actions, the PESTLE analysis has no impact on QMS planning.

E. How has the PESTLE analysis contributed to the improvement of the QMS?

ISO 9001 requires context analysis to support improvement and strategic alignment of the QMS. This audit trail confirms whether PESTLE outputs are used as inputs to improvement activities, management review, or changes to processes, supporting Clauses 4.1, 6.1, and 10.3.

Explanation of why the other options are not selected:

A: Review by a specific manager is not a requirement of ISO 9001 and does not demonstrate impact on QMS planning.

B: PESTLE does not require consultation with external interested parties; that relates to Clause 4.2, not planning impact.

D: Training in SWOT is irrelevant, as ISO 9001 does not mandate any specific analysis tool.

F: Sharing information with external interested parties relates to communication, not to how PESTLE affects QMS planning.

ISO-aligned conclusion:

To determine how PESTLE analysis affects planning of a QMS, the auditor must follow audit trails that demonstrate:

Conversion of identified issues into risk-based actions, and

Use of those outputs to improve and adapt the QMS.

Therefore, the correct answers are C and E.

According to ISO 19011:2018, clause 6.3, the audit plan is a document that provides the basis for agreement regarding the conduct of the audit. The audit plan should include the information listed in my previous response, such as the audit objectives, scope, criteria, schedule, team, methods, report, etc. The audit plan should be prepared and completed prior to the on-site audit, and should be communicated to the audit team and the auditee1.

According to ISO 19011:2018, clause 6.4.3, the checklist / prompts are documents that list the questions or topics that need to be covered during an audit. The checklist / prompts can help the auditor to collect and verify information relevant to the audit criteria, and to ensure the consistency and completeness of the audit. The checklist / prompts should be prepared and completed prior to the on-site audit, and should be based on the audit plan and the audit scope and objectives1.

Therefore, the two documents that an auditor needs to prepare and complete prior to the on-site audit are B and D, as they are essential for planning and conducting the audit. The other options are not correct, as they are either prepared or completed after the on-site audit, or not required by the standard:

•A. Audit Report: The audit report is a document that provides a complete, accurate, concise, and clear record of the audit. The audit report should include the information listed in my previous response, such as the audit objectives, scope, criteria, findings, conclusions, etc. The audit report should be prepared and completed after the on-site audit, and should be distributed to the audit client and the auditee1.

•C. Procedures: Procedures are documents that specify the way activities are to be performed. Procedures may be part of the audit criteria, if they are part of the organization’s management system, or part of the audit programme, if they are part of the certification body’s or registrar’s requirements. Procedures are not prepared or completed by the auditor prior to the on-site audit, but rather reviewed or followed by the auditor during the audit1.

•E. Risk Matrices: Risk matrices are tools that help to assess and prioritize the risks and opportunities associated with the audit programme or the audit. Risk matrices may be part of the audit programme management, if they are used to determine and evaluate the audit programme risks and opportunities, or part of the audit preparation, if they are used to determine and evaluate the audit risks and opportunities. Risk matrices are not prepared or completed by the auditor prior to the on-site audit, but rather used or updated by the auditor during the audit programme management or the audit preparation1.

•F. Findings: Findings are the results of the evaluation of the collected audit evidence against the audit criteria. Findings can indicate either conformity or nonconformity, as well as positive aspects or opportunities for improvement. Findings are not prepared or completed by the auditor prior to the on-site audit, but rather generated and recorded by the auditor during the audit activities1.

Comprehensive and Detailed Explanation From Exact Extract:

Correct Option B – “Communicate a policy commitment to continual improvement”

This aligns directly with Clause 5.2.1(d) of ISO 9001:2015, which states that the quality policy shall include a commitment to continual improvement of the QMS:

“Top management shall establish, implement and maintain a quality policy that... includes a commitment to continual improvement of the quality management system.”

A clearly communicated policy sets expectations and a strategic direction that cascades throughout the organization, promoting a culture that values ongoing enhancement.

Correct Option F – “Use the management review process to identify improvements”

This is based on Clause 9.3.3 of ISO 9001:2015, which specifies that outputs of management reviews must include decisions and actions related to:

“a) opportunities for improvement;

b) any need for changes to the quality management system;

c) resource needs.”

The management review process is a structured mechanism to analyze data, monitor performance, assess risks and opportunities, and drive continual improvement initiatives.

Why the Other Options Are Incorrect:

A (Appoint external consultants to train staff): While training may help improve competence, ISO 9001 emphasizes internal process evaluation and strategic improvement. This option is not directly aligned with the systematic improvement of the QMS.

C (Require higher standards): Higher standards alone don’t ensure continual improvement unless supported by a structured QMS approach involving evaluation, planning, and measurement.

D (Require fewer mistakes): Unrealistic or unqualified demands like "make fewer mistakes" don’t support structured process-based improvement and may conflict with ISO’s emphasis on risk-based thinking and root cause analysis.

E (Send Chief Executive on a course): While leadership involvement is vital (Clause 5), this action by itself does not constitute a continual improvement mechanism for the QMS.

Comprehensive and Detailed In-Depth Explanation:

Clause 5.1.1 of ISO 9001:2015 – Leadership and Commitment – specifically mandates that top management must take accountability for the effectiveness of the QMS. They are also responsible for ensuring:

Integration of the QMS into business processes (5.1.1 c)

Promotion of customer focus and continual improvement (5.1.1 d, i)

Availability of necessary resources (5.1.1 e)

That the QMS achieves its intended results (5.1.1 g)

Let’s analyze the selected options:

✅ A. Top management is not accountable for the effectiveness of the QMS.

This directly violates clause 5.1.1 a, which explicitly requires top management to take accountability for the effectiveness of the QMS. Delegating this to a middle-level Quality Manager, as described in the scenario, constitutes a nonconformity.

✅ F. The Quality Manager does not have access to the resources needed for the QMS.

According to clause 5.1.1 e, top management must ensure the availability of required resources for maintaining and improving the QMS. If the Quality Manager is resource-constrained, it indicates top management has failed to meet this requirement.

Now, why the other options are incorrect in terms of direct clause 5.1.1 nonconformity:

❌ B. Avoiding giving improvement actions to the Chief Executive – While this may reflect poor communication, it is not, by itself, a clear breach of 5.1.1 unless linked directly to top management’s lack of accountability or commitment.

❌ C. Chief Executive never attending meetings – ISO 9001 does not require physical attendance of the Chief Executive at management reviews. What matters is whether top management is fulfilling their roles, not how.

❌ D. Completing only half of improvement actions – This indicates performance issues but does not necessarily indicate top management’s lack of accountability, unless they failed to monitor progress entirely.

❌ E. Reporting to one designated senior manager – This is not inherently nonconforming unless that senior manager does not fulfill top management’s responsibilities under 5.1.1.

Relevant ISO 9001:2015 Reference:

Clause 5.1.1 a, e, g, h:

"Top management shall demonstrate leadership and commitment with respect to the quality management system by:

a) taking accountability for the effectiveness of the quality management system;

e) ensuring that the resources needed for the quality management system are available..."

B. Applicable procedure: SP-701

D. Identification number of the washing machine

H. The concentration of the cleaning liquid used vs the concentration fixed in SP-701

I. The planned duration of the process vs the minimum time required in SP-701

J. Weight of linen being washed vs the maximum weight required in SP-701

C. Competence record of the machine operator

According to ISO 9001:2015, clause 8.4, an organization is required to control the processes, products and services provided by external providers, including those that affect the quality of the organization’s own products and services. This includes determining the controls to be applied to the external provision of processes, products and services, as well as the information to be communicated to the external providers. The organization is also required to monitor, measure, and evaluate the performance of the external providers and retain documented information of these activities.

Therefore, in the scenario given, ABC Ltd is responsible for controlling the processes, products and services provided by Teak Ltd, as they affect the quality of ABC Ltd’s own products and services. This means that ABC Ltd should have established criteria and methods for evaluating the performance of Teak Ltd, as well as documented information of the results of such evaluation. ABC Ltd should also have defined the supply arrangements with Teak Ltd, including the specifications, requirements, and verification activities related to the products and services provided by Teak Ltd.

Hence, the best options to describe how to plan the audit of the interrelationship with Teak Ltd during the Stage 2 audit at ABC Ltd are A and D, as they are aligned with the requirements of ISO 9001:2015, clause 8.4. The other options are either irrelevant or beyond the scope of the audit, as they do not pertain to the control of external provision by ABC Ltd.

ISO 9001:2015 requires organisations to determine external and internal issues relevant to their purpose and strategic direction and to use this understanding to support planning and achievement of intended QMS results.

The key requirement is Clause 4.1 – Understanding the organisation and its context, supported by Clause 4.2 – Understanding the needs and expectations of interested parties.

Explanation of the correct audit trails:

A. Establish how the organisation determines its relevant interested parties

Clause 4.2 requires the organisation to determine interested parties that are relevant to the QMS and their requirements. Understanding interested parties is essential to identifying external and internal issues that influence strategic direction and QMS outcomes.

C. Establish how the organisation documents its external and internal issues

Clause 4.1 requires the organisation to determine relevant external and internal issues. While documented information is not explicitly mandated, auditors must verify how these issues are identified and captured to demonstrate systematic application and use in planning.

D. Establish how the organisation reviews information about external and internal issues

Clause 4.1 also requires the organisation to monitor and review information relating to external and internal issues. This audit trail confirms that context analysis is not static and is actively used to support QMS planning and intended results.

Explanation of why the other options are not selected:

B: Determining scope (Clause 4.3) uses context as an input, but does not itself demonstrate how issues are determined and used.

E and G: Trainer competence relates to Clause 7.2, not to determination and use of organisational context.

F: Maintaining training products relates to operational control, not context analysis.

H: Training room structure is an operational detail unrelated to external and internal issues.

ISO-aligned conclusion:

To explore how external and internal issues are determined and used to achieve intended QMS results, the auditor must follow audit trails that confirm:

Identification of relevant interested parties,

Determination and capture of issues affecting the organisation, and

Ongoing review of those issues to support planning and performance.