PECB ISO-9001-Lead-Auditor - QMS ISO 9001:2015 Lead Auditor Exam

Comprehensive and Detailed In-Depth Explanation:

According to ISO 17021-1:2015, Clause 9.6.2 (Surveillance Activities):

The certification body is responsible for planning and conducting surveillance audits to ensure continued compliance.

The auditee’s top management (A) does not develop surveillance activities, but they must participate.

The audit team leader (C) conducts the surveillance audit, but they do not develop the program.

Thus, B is the correct answer.

According to ISO 19011:2018, clause 6.6.2, a nonconformity is the non-fulfilment of a requirement. A nonconformity can be classified as either major or minor, depending on the nature and extent of the deviation from the audit criteria. A major nonconformity is a nonconformity that affects the ability or the integrity of the organization’s management system to achieve the intended results. A minor nonconformity is a nonconformity that does not affect the ability or the integrity of the organization’s management system to achieve the intended results, but is a deviation from the audit criteria1.

According to ISO/IEC 17021-1:2015, clause 9.4.9, the organization is required to analyze the cause and describe the specific correction and corrective actions taken, or planned to be taken, to eliminate detected nonconformities, within a defined time. The organization is also required to provide the certification body with records and evidence of the implementation and effectiveness of the correction and corrective actions taken. The certification body will then verify the correction and corrective actions taken by the organization and decide on the certification status2.

Therefore, the two options of when the organization is required to act in response to reported findings are D and F, as they indicate the presence of nonconformities that need to be corrected and prevented from recurring. The other options are not correct, as they do not require the organization to act in response to reported findings:

•A. A recommendation is given in the report: A recommendation is a suggestion for improvement that is not related to a nonconformity. A recommendation is not binding for the organization and does not affect the certification status. The organization may choose to accept or reject the recommendation, but it is not required to act on it.

•B. A finding of good practice is reported: A finding of good practice is a positive observation that indicates a strength or a best practice of the organization’s management system. A finding of good practice is not related to a nonconformity and does not affect the certification status. The organization may choose to acknowledge or share the finding of good practice, but it is not required to act on it.

•C. An opportunity for improvement is raised: An opportunity for improvement is a potential area where the organization’s management system can be enhanced or optimized. An opportunity for improvement is not related to a nonconformity and does not affect the certification status. The organization may choose to pursue or ignore the opportunity for improvement, but it is not required to act on it.

•E. A finding of conformity is reported: A finding of conformity is a confirmation that the organization’s management system fulfils the audit criteria. A finding of conformity is not related to a nonconformity and does not affect the certification status. The organization may choose to celebrate or communicate the finding of conformity, but it is not required to act on it.

In this scenario, the time allocated by the audit team leader for the Human Resources audit is fixed, and as an auditor, you must work within that constraint. Although the sampling criteria suggests reviewing 25 personnel files, it is acceptable to adjust the sample size based on time and resource limitations. ISO 9001:2015 emphasizes risk-based thinking and practical resource management (Clause 7.1), so it is reasonable to review a smaller sample if the time is insufficient.

Option B is a pragmatic approach, allowing you to focus on quality over quantity by reviewing as many cases as time allows without compromising the audit schedule.

Options like extending the audit (A, C, D) are impractical in a structured audit environment, especially for second-party audits where maintaining the agreed schedule is important​​.

According to the ISO 9001:2015 document, the organisation must continually improve the suitability, adequacy, and effectiveness of the quality management system1. However, among the six options given, only effectiveness is directly mentioned as an aspect of the quality management system that must be continually improved. Therefore, C is one of the correct answers.

Efficiency, on the other hand, is not explicitly stated as an aspect of the quality management system that must be continually improved, but it is implied by the quality management principle of improvement, which states that successful organisations have an ongoing focus on improvement2. One of the key benefits of applying this principle is improving operational effectiveness and efficiency2. Therefore, E is another correct answer.

Suitability, adaptability, responsiveness, and applicability are not aspects of the quality management system that must be continually improved, according to the ISO 9001:2015 document. They may be related to the quality management system, but they are not the focus of continual improvement.

Therefore, the correct answer is C and E.

ISO 9001:2015 requires that nonconformities be objective, evidence-based, and referenced against defined requirements, not personal, prescriptive, or solution-driven.

When a nonconformity is raised, it must clearly show what requirement was not met and what objective evidence demonstrates this failure.

✅ Why D (Audit criteria) is required

A nonconformity must reference the requirement that was not fulfilled (e.g., ISO 9001 clause, procedure, contract, or legal requirement).

ISO 9001 defines nonconformity as “non-fulfilment of a requirement”.

Without audit criteria, there is no basis for declaring a nonconformity.

📌 Supported by:

Clause 9.2.2 – Internal audits must determine whether the QMS conforms to requirements

Clause 10.2.2 – Documented information shall describe the nature of the nonconformity

✅ Why E (Relevant audit evidence) is required

ISO 9001 requires decisions and conclusions (including audit findings) to be based on evidence.

Audit evidence ensures objectivity and prevents subjective or opinion-based findings.

📌 Supported by:

Clause 9.1.3 – Analysis and evaluation shall be based on data and information

Clause 9.2.2 – Audit results must demonstrate conformity or nonconformity based on evidence

❌ Why the other options are NOT correct

A (Name of person responsible)ISO 9001 focuses on system and process failures, not blaming individuals.

B (Target time for corrective action)This is part of corrective action planning, not the nonconformity statement itself (Clause 10.2).

C (Name of technical expert)ISO 9001 does not require identifying auditors or experts in the nonconformity statement.

F (Action to eliminate the nonconformity)Auditors must not prescribe solutions. The auditee determines corrective actions (Clause 10.2).

The correct answer is:

Event

Selecting audit team = Individual(s) managing the audit programme

Conducting the audit = Audit team

Preparing the audit plan = Audit team leader

Requesting the audit = Audit client

To complete the table, click on the blank section you want to complete so that it is highlighted in red, and then click on the applicable text from the options below. Alternatively, drag and drop each option to the appropriate blank section. Responsibility:- Individual(s) managing the audit programme

Audit team

Audit team leader

Audit client

According to ISO 19011:2018, clause 5.3, the individual(s) managing the audit programme are responsible for selecting the audit team, taking into account the competence and availability of the auditors and any experts needed. 1

According to clause 6.2, the audit team is responsible for conducting the audit, which includes collecting and verifying audit evidence, evaluating audit findings, and preparing the audit report. 1

According to clause 6.1, the audit team leader is responsible for preparing the audit plan, which includes defining the audit objectives, scope, criteria, and duration, as well as assigning roles and responsibilities to the audit team members. 1

According to clause 5.2, the audit client is the person or organization that requests the audit, which can be the auditee (the person or organization being audited) or any other person or organization that has an interest in the audit results. 1

The table below shows the possible matching of the ISO 9001 Clause 8 extract to the audit evidence.

Table

Audit evidence

ISO 9001 Clause 8 extract

Four of the 10 pallets of stock sampled in the warehouse were not labelled.

“8.5.2 … shall use suitable means to identify outputs …”

A damaged pallet of stock seen in the quarantine area was leaking liquid onto the floor.

“8.7.1 … shall ensure that outputs that do not conform to their requirements are identified and controlled …”

One of the fork-lift truck drivers had no fork-lift truck driving licence.

“8.5.1 e … shall include, as applicable … the appointment of competent persons …”

There was no pest control provision in the warehouse.

“8.5.4 … shall preserve the outputs during production and service provision …”

Two pallets of temperature-sensitive stock items were being stored at ambient as the chilled storage facility was full.

“8.1 … shall plan, implement and control the processes …”

Comprehensive and Detailed In-Depth Explanation:

ISO 9001:2015 emphasizes risk-based thinking, which helps organizations identify factors that could prevent achieving planned results and take preventive action. Clause 6.1 (Actions to Address Risks and Opportunities) requires organizations to determine risks and opportunities and implement actions to mitigate potential negative impacts.

In the scenario, AL-TAX identified potential risks and implemented preventive actions, aligning with risk-based thinking. ISO 9001:2015 integrates risk management throughout the standard, ensuring processes are designed to minimize uncertainties.

When an organization wishes to extend the scope of their current certification to include new services or activities, such as the printing and compilation of computer documentation packages, it requires an extension to the scope of the audit. This involves a formal application process with the certification body to ensure that the new activities are included in the audit plan and that the organization’s quality management system encompasses these new processes12. References: = The answer is based on the ISO 9001 Auditing Practices Group guidance on scope and applicability, which outlines the need for a formal application process when there is a change in the scope of the quality management system that affects the certification1. Additionally, the UKAS guide on the extension to scope (ETS) process provides information on how changes to the scope, including the addition of new services, require a formal application2.