PECB ISO-9001-Lead-Auditor - QMS ISO 9001:2015 Lead Auditor Exam

Questions no: 1 Verified Answer: = C, D, E Comprehensive But Short Explanation: = Potential threats to impartiality in an audit context include familiarity (having a close relationship with the auditee), intimidation (being coerced or feeling pressured), and self-audit (auditing one’s own work). These factors can compromise the auditor’s objectivity and the audit’s integrity. References: = The information is based on the ISO 9001 Auditing Practices Group documents which discuss threats to auditor impartiality and how they may compromise an auditor’s objectivity123.

Comprehensive and Detailed In-Depth Explanation:

According to ISO 17021-1:2015 (Conformity Assessment – Requirements for Certification Bodies), Clause 9.3.1.2, the Stage 1 Audit typically consumes around 30% of the total audit time.

This time is allocated to:

Reviewing documented information.

Assessing the readiness for Stage 2.

Identifying potential nonconformities.

A 20% allocation (Answer A) is too low, and 40% (Answer C) is excessive, as the majority of the audit should be spent on Stage 2 (on-site verification).

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 emphasizes continual improvement as a fundamental requirement of an effective Quality Management System (QMS).

Clause Reference:

Clause 4.4.1 (Quality Management System and Its Processes) states that organizations must:

Determine processes needed for the QMS

Establish criteria and methods for process effectiveness

Ensure continual improvement of the system

Why is the Correct Answer C?

Continual improvement is a core principle of ISO 9001.

Organizations must regularly assess and enhance their QMS to adapt to new challenges and maintain effectiveness.

Why are the Other Options Incorrect?

A (To change the QMS quarterly) → ISO 9001 does not mandate a specific frequency for system changes.

B (To review the QMS annually) → QMS reviews must be conducted as needed, not strictly annually.

D (To conduct a QMS gap analysis every two years) → Gap analysis is useful but is not a mandatory requirement under Clause 4.4.

Comprehensive and Detailed In-Depth Explanation:

ISO 9000:2015 defines quality as "the degree to which a set of inherent characteristics of an object fulfills requirements."

Clause 3.6.2 (Quality) confirms this definition.

Quality is determined by how well an object (product, service, or process) meets defined requirements (customer, regulatory, or internal).

The other options do not align with the official ISO definition:

Option A refers to performance capability but does not define quality.

Option C describes work conditions, not quality.

Option D focuses on efficiency rather than fulfilling requirements.

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 requires collaboration between the auditee (TD Advertising), the certification body, and the audit leader when making changes to audit scope.

Clause References:

ISO/IEC 17021-1:2015, Clause 9.2.3 – Conducting the Audit: Any change in audit scope must be agreed upon by all parties before proceeding.

Why is the Correct Answer C?

TD cannot unilaterally change the scope without agreement from the certification body and audit leader.

The certification body must ensure the scope remains relevant and that resources are allocated properly.

Why are the Other Options Incorrect?

A (Anne cannot withdraw) → Incorrect, Anne CAN withdraw if the changes make the audit unfeasible, but she must consult with the certification body first.

B (TD cannot change the scope) → Incorrect, scope changes are allowed but must be formally approved.

D (Anne has full authority to reject scope changes) → Incorrect, scope changes require mutual agreement among all parties.

According to ISO 19011:2018, clause 6.3, the audit plan is a document that provides the basis for agreement regarding the conduct of the audit. The audit plan should include the information listed in my previous response, such as the audit objectives, scope, criteria, schedule, team, methods, report, etc. The audit plan should be prepared and completed prior to the on-site audit, and should be communicated to the audit team and the auditee1.

According to ISO 19011:2018, clause 6.4.3, the checklist / prompts are documents that list the questions or topics that need to be covered during an audit. The checklist / prompts can help the auditor to collect and verify information relevant to the audit criteria, and to ensure the consistency and completeness of the audit. The checklist / prompts should be prepared and completed prior to the on-site audit, and should be based on the audit plan and the audit scope and objectives1.

Therefore, the two documents that an auditor needs to prepare and complete prior to the on-site audit are B and D, as they are essential for planning and conducting the audit. The other options are not correct, as they are either prepared or completed after the on-site audit, or not required by the standard:

•A. Audit Report: The audit report is a document that provides a complete, accurate, concise, and clear record of the audit. The audit report should include the information listed in my previous response, such as the audit objectives, scope, criteria, findings, conclusions, etc. The audit report should be prepared and completed after the on-site audit, and should be distributed to the audit client and the auditee1.

•C. Procedures: Procedures are documents that specify the way activities are to be performed. Procedures may be part of the audit criteria, if they are part of the organization’s management system, or part of the audit programme, if they are part of the certification body’s or registrar’s requirements. Procedures are not prepared or completed by the auditor prior to the on-site audit, but rather reviewed or followed by the auditor during the audit1.

•E. Risk Matrices: Risk matrices are tools that help to assess and prioritize the risks and opportunities associated with the audit programme or the audit. Risk matrices may be part of the audit programme management, if they are used to determine and evaluate the audit programme risks and opportunities, or part of the audit preparation, if they are used to determine and evaluate the audit risks and opportunities. Risk matrices are not prepared or completed by the auditor prior to the on-site audit, but rather used or updated by the auditor during the audit programme management or the audit preparation1.

•F. Findings: Findings are the results of the evaluation of the collected audit evidence against the audit criteria. Findings can indicate either conformity or nonconformity, as well as positive aspects or opportunities for improvement. Findings are not prepared or completed by the auditor prior to the on-site audit, but rather generated and recorded by the auditor during the audit activities1.

Comprehensive and Detailed In-Depth Explanation:

Understanding Audit Stages Based on ISO/IEC 17021-1:2015

ISO certification audits consist of two main stages:

Stage 1 Audit (Readiness Review)

The organization’s documented information is reviewed to assess readiness for Stage 2.

This ensures that the QMS is developed, implemented, and prepared for full assessment.

Stage 2 Audit (On-Site Evaluation)

Auditors assess process implementation and effectiveness through interviews, observations, and evidence collection.

The audit team verifies if the organization meets ISO 9001 requirements in practice.

Why is the Correct Answer B?

The audit team reviewed ME’s documents, which is a Stage 1 activity.

The audit team performed interviews, sampling, and on-site verification, which is a Stage 2 activity.

There was no mention of an audit follow-up or a surveillance audit, which occur post-certification.

Why are the Other Options Incorrect?

A (Audit follow-up and Stage 1 Audit) → Follow-up audits occur after certification, which was not the case here.

C (Stage 2 Audit and Surveillance Audit) → Surveillance audits are post-certification audits and were not conducted yet.

 First-party Management System audit → All members of an audited organisation

 Second-party Management System audit → Interested parties of an organisation

According to ISO 19011:2018 (Guidelines for Auditing Management Systems) and as reinforced in ISO 9001 Lead Auditor training materials, audit types are defined as:

First-party audit – conducted by the organization itself, or on its behalf (internal audit).✅ The audit client is all members of the audited organisation, because the audit is internal, involving all functional areas under the organization’s control.

Second-party audit – conducted by a customer or other person on behalf of a customer (external but not by a certification body).✅ The audit client includes interested parties of an organisation, such as customers who want to verify if their suppliers meet contractual or regulatory requirements.

These definitions are directly aligned with ISO 19011:2018, Clause 3.13 – Types of audits.

Why Other Options Are Incorrect:

Certification body / Accreditation body → These relate to third-party audits, not first or second.

Top management / Functions of an audited organisation → Refer to auditees or audit participants, not the audit client itself.

Comprehensive and Detailed In-Depth Explanation:

A technical expert is someone with specialized knowledge that helps the audit team understand specific technical aspects of the auditee’s processes.

Clause References:

ISO 19011:2018, Clause 7.3.4 – Use of Technical Experts:

Technical experts support the audit team with specialized knowledge but do not perform the audit themselves.

Why is the Correct Answer B?

A technical expert is needed when auditors lack deep expertise in specific areas, such as engineering, software, or medical devices.

They assist in interpreting complex technical requirements but do not act as auditors.

Why are the Other Options Incorrect?

A (Observer) → Observers do not contribute expertise; they only watch the audit (e.g., trainees).

C (Guide) → Guides help with logistics but do not provide technical expertise.