PECB ISO-9001-Lead-Auditor - QMS ISO 9001:2015 Lead Auditor Exam

Relevant ISO 9001 Requirement

Clause 7.3 – Awareness states that persons doing work under the organisation’s control shall be aware of:

The quality policy;

Relevant quality objectives;

Their contribution to the effectiveness of the QMS;

The implications of not conforming with QMS requirements.

A critical point is that ISO 9001 uses the phrase:

“persons doing work under the organisation ' s control”

This includes:

Employees,

Temporary personnel,

Agency personnel,

Subcontractors performing work on behalf of the organisation.

Why Option B is Correct

In the scenario:

The refrigeration engineers performing the actual maintenance and repair services are all subcontractors.

The Managing Director states that these subcontractors have not been informed of:

the Quality Policy,

quality objectives,

plans to address risks and opportunities.

The justification given is that the subcontractors themselves have ISO 9001-certified management systems.

However, ISO 9001 certification of a subcontractor does not remove the organisation ' s responsibility to ensure persons working under its control are aware of the organisation ' s own QMS requirements.

Therefore, the organisation has failed to demonstrate compliance with Clause 7.3 Awareness .

Why the Other Options Are Incorrect

A. Clause 7.4 – Communication

The scenario does not primarily indicate a failure of communication processes.

The issue is not whether communication methods exist, but whether the subcontractors have the required awareness.

C. Clause 7.2 – Competence

The Managing Director explicitly states that competence requirements are applied to both full-time staff and subcontractors.

No evidence is presented that competence has not been determined or evaluated.

Therefore, a competence failure is not the strongest conclusion.

D. Clause 7.5 – Documented Information

The scenario indicates documented information exists and was reviewed by the auditor.

No evidence suggests documented information is missing, uncontrolled, or unavailable.

Therefore, Clause 7.5 is not the most likely issue.

ISO-Aligned Conclusion

The organisation relies entirely on subcontracted refrigeration engineers to deliver its certified services. Because these personnel perform work under the organisation ' s control, ISO 9001 requires them to be aware of the organisation ' s quality policy, objectives, and relevant QMS requirements.

The evidence shows this awareness has not been established.

Answer: B. 7.3 Awareness

===========

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 promotes the process approach, which allows organizations to structure their activities into interrelated processes. This approach helps ensure that processes effectively achieve intended results.

Clause 0.3.1 (Process Approach) states that " The application of the process approach in a quality management system enables understanding and consistency in meeting requirements, considering processes in terms of added value, and achieving effective process performance. "

This aligns directly with option C, making it the correct answer. The other options are either partially correct or do not fully capture the purpose of the process approach:

Option A (Improvement based on interested parties) is a benefit but does not define the main goal.

Option B (Financial value) is not the primary focus of the process approach.

Option D (Reduction of resource consumption) may be an indirect benefit but is not a core objective.

Comprehensive and Detailed In-Depth Explanation:

Toning down (or de-escalation) is a conflict resolution technique where:

Common agreements are emphasized to reduce tension.

Disagreements are addressed with a rational and constructive approach.

Option A describes compromise, and Option B describes authoritative resolution, which are different conflict resolution techniques.

According to ISO 19011:2018, clause 6.7, the audit follow-up is the process of verifying the completion and effectiveness of corrective actions taken by the auditee as a result of an audit. The audit follow-up can include two main activities:

Verifying the effectiveness of the implemented corrective actions: this means checking whether the actions taken by the auditee have addressed the root causes of the nonconformities and prevented their recurrence or occurrence in other areas. The verification can be done by reviewing documents, records, data, or other evidence provided by the auditee, or by conducting a follow-up audit on site or remotely.

Verifying corrections taken to fix the reported non-conformities: this means checking whether the auditee has corrected the nonconformities identified during the audit and eliminated their immediate effects. The verification can be done by reviewing documents, records, data, or other evidence provided by the auditee, or by conducting a follow-up audit on site or remotely.

The audit follow-up can be conducted as a separate audit or as part of a subsequent audit, depending on the audit programme, the audit objectives, the audit criteria, the audit scope, the audit risks, and the audit findings. The audit follow-up should be planned and conducted in accordance with the same principles and processes as the initial audit, and the results should be documented and reported accordingly. References:

ISO 19011:2018(en), Guidelines for auditing management systems, clause 6.7

ISO 19011 Management Systems Audit Checklist | Process Street, task 6.7.1 and 6.7.2

Conducting the Audit Follow-Up: When to Verify - The Auditor, section “Conducting the audit follow-up”

According to the ISO - Management system standards page, the key benefits of an effective management system include improved operational effectiveness and efficiency, improved risk management and protection of people and the environment, and enhanced drive for innovation. The Integrated Use of Management System Standards (IUMSS) handbook also states that the purpose and objectives of management system standards are to help organizations improve their performance by specifying repeatable steps that organizations consciously implement to achieve their goals and objectives.

Therefore, the complete sentence is:

“The purpose of a management system standard is to improve the performance of an organisation.”

Comprehensive and Detailed In-Depth Explanation:

According to ISO 19011:2018, Clause 6.4.9 (Audit Conclusions & Reporting):

One consolidated audit report should be drafted based on all team members’ findings.

Each auditor does not draft separate reports (B) unless explicitly required.

Thus, A is the correct answer.

Comprehensive and Detailed In-Depth Explanation:

Minor nonconformities are isolated issues that do not significantly impact the QMS but still require correction.

Failure to close nonconformities on time (Answer A) is a procedural issue and is considered minor unless it leads to repeated failures.

Major nonconformities include:

Lack of top management commitment (Answer B), which affects leadership and strategic direction.

Failure to take corrective actions for recurrent issues (Answer C), which indicates systemic failure.

Comprehensive and Detailed In-Depth Explanation:

Auditors must focus on key processes that impact QMS effectiveness to ensure audit risks are minimized.

Clause References:

ISO 19011:2018, Clause 6.3 – Managing Audit Risk: Auditors should prioritize critical processes to obtain reasonable assurance.

Why is the Correct Answer A?

Some processes are critical (e.g., production quality, customer complaints handling).

If these material processes fail, the QMS could collapse.

Why are the Other Options Incorrect?

B (Needs of internal parties) → Important, but not the primary focus for reducing audit risk.

C (Previous audit results) → Useful for improvement but does not directly reduce current audit risks.

D (Financial risks) → ISO 9001 focuses on quality risks, not financial risks.

According to ISO 19011:2018, clause 6.3.2, the audit plan is a document that provides the basis for agreement regarding the conduct of the audit. The audit plan should include the following information1:

•the audit objectives, scope and criteria

•the audit team members and their roles and responsibilities

•the audit schedule, including the date, time and location of each audit activity

•the expected time and duration of meetings and interviews

•the allocation of appropriate resources to critical areas of the audit

•the identification of the audit client and the auditee

•the identification of the guides and observers, if any

•the documents and records to be reviewed before and during the audit

•the audit methods and tools to be used

•the audit language and terminology

•the audit report content, format, distribution and expected completion date

•the risk to achieving audit objectives and the contingency plan, if any

Therefore, the issue which is not expected to be included in the audit plan is C, expectations of the organisation’s management. This issue is not relevant to the conduct of the audit, as the audit is based on the audit criteria, not on the management’s expectations. The management’s expectations may be considered during the audit initiation or the audit programme management, but they are not part of the audit plan.

ISO 9001:2015 makes it clear that an organisation remains responsible for conformity to requirements even when processes are outsourced . Certification audits must therefore evaluate not only the organisation’s internal activities, but also the control and effectiveness of externally provided processes .

ISO 9001:2015, Clause 8.4.1 requires that the organisation ensure externally provided processes, products and services conform to requirements. The organisation must determine controls to be applied to those outsourced processes.

ISO 9001:2015, Clause 4.4.1 further requires the organisation to determine processes needed for the quality management system and their application throughout the organisation, including outsourced processes.

For a third-party certification audit , sufficient objective evidence must be obtained to demonstrate that:

Outsourced processes are effectively controlled

The organisation’s quality management system achieves its intended results

Why option C is the best decision:

Proceeding with the audit in Bolivia and including all ABC personnel and all outsourced processes ensures that the certification audit:

Covers the full scope of the QMS , including outsourced production, maintenance, procurement, and HR activities

Allows direct evaluation of how ABC controls and manages its external providers in the location where those processes are actually performed

Provides sufficient objective evidence to support a valid certification decision

Reviewing only internal audits or auditing only planning activities would not provide adequate assurance of conformity for a high-risk, core operational activity such as lithium extraction.

Why the other options are not acceptable:

A : Auditing only the Planning function would exclude core operational and support processes that are within the scope of the QMS.

B : Reviewing internal audit results alone is insufficient for a third-party certification audit and does not replace direct assessment of outsourced processes.

D : ISO 9001 explicitly allows outsourcing of processes; the organisation remains responsible for control, not prohibited from outsourcing.

ISO-aligned conclusion:

In a third-party ISO 9001 certification audit, outsourced processes that are within scope must be audited , either directly or through appropriate controls. In this scenario, auditing the outsourced processes in Bolivia is necessary to ensure a complete, credible, and compliant certification audit.