PECB ISO-9001-Lead-Auditor - QMS ISO 9001:2015 Lead Auditor Exam

A first-party audit is an internal audit conducted by auditors who are employed by the organization being audited but who have no vested interest in the audit results of the area being audited1. The purpose of a first-party audit is to assess the conformity of the organization’s quality management system to the requirements of ISO 9001 and to identify opportunities for improvement2. Therefore, the two auditors who would not participate in a first-party audit are:

•A. An auditor employed by an external consultancy organization: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit (if the external consultancy organization is a customer or supplier of the organization being audited) or a third-party audit (if the external consultancy organization is a certification body or registrar).

•F. An auditor from a customer: This auditor is not employed by the organization being audited, and therefore does not qualify as a first-party auditor. This auditor may be hired to conduct a second-party audit, as a customer is an interested party that has specific requirements for the organization being audited.

The other options are not correct, as they could participate in a first-party audit, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited:

•B. An auditor from an interested party: This auditor could be a first-party auditor, as long as the interested party is within the organization being audited. For example, an auditor from the finance department could audit the production department, as long as they are not involved in the production process or affected by its outcomes.

•C. An auditor trained in-house: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The source of the auditor’s training is not relevant for determining the type of audit, as long as the auditor is competent and qualified to perform the audit.

•D. An auditor trained in the IRCA scheme: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. The IRCA scheme is a professional certification scheme for auditors of management systems, which provides recognition of the auditor’s competence and credibility3. However, being trained in the IRCA scheme does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

•E. An auditor certified by IRCA: This auditor could be a first-party auditor, as long as they are employed by the organization being audited and have no vested interest in the audit results of the area being audited. Being certified by IRCA means that the auditor has met the requirements of the IRCA scheme and has demonstrated their competence and credibility as an auditor of management systems3. However, being certified by IRCA does not determine the type of audit, as long as the auditor is competent and qualified to perform the audit.

Comprehensive and Detailed In-Depth Explanation:

ISO 9000:2015 defines quality as " the degree to which a set of inherent characteristics of an object fulfills requirements. "

Clause 3.6.2 (Quality) confirms this definition.

Quality is determined by how well an object (product, service, or process) meets defined requirements (customer, regulatory, or internal).

The other options do not align with the official ISO definition:

Option A refers to performance capability but does not define quality.

Option C describes work conditions, not quality.

Option D focuses on efficiency rather than fulfilling requirements.

Clause 8.2.4 of ISO 9001:2015 – Changes to Requirements for Products and Services:ISO 9001:2015 Clause 8.2.4 states that when changes to requirements for products or services are made, they must be communicated and agreed upon with relevant interested parties (in this case, the Health Trust). The lack of communication and agreement for substituting the cleaning chemical represents a clear violation of this clause.

Analysis of the Corrective Action Proposed:The organization proposed " obtaining a concession from the Health Trust for the use of the new chemical. " This action is reactive and assumes approval from the Health Trust without addressing the systemic issue: the lack of a defined change control process for managing contract changes.

Option Analysis:

A. The substitute chemical has not been used before in the Health Trust:Incorrect. While this may be a concern, it is not directly relevant to the root cause of the nonconformity, which is the absence of a process to handle contract changes.

B. The action assumes that the Health Trust will agree to the change:Incorrect. Although this is true, it is not the primary issue. The nonconformity lies in the lack of a structured approach to obtain agreement, not whether the Health Trust agrees.

C. Staff have not been trained in the use of the new chemical:Incorrect. This is a separate issue related to staff competence (Clause 7.2), but it is not the main reason why the corrective action is unacceptable under Clause 8.2.4.

D. The process for making changes to the contract has not been addressed:Correct. The fundamental issue is the organization ' s failure to follow or establish a change control process for amending contracts, including gaining formal agreement from the Health Trust. The proposed corrective action does not ensure that such issues will be systematically prevented in the future.

E. The substitute chemical may not be as effective as the original:Incorrect. The effectiveness of the substitute chemical is secondary to the primary issue, which is the lack of a change management process.

ISO 9001 References Supporting the Correct Answer:

Clause 8.2.4: Requires that changes to product/service requirements be reviewed, communicated, and agreed upon with the customer.

Clause 10.2 (Nonconformity and Corrective Action): Requires the organization to address the root cause of the nonconformity and take actions to ensure it does not recur. In this case, the root cause is the absence of a change control process.

Why D is the Best Answer:The core issue is that the organization did not have a formalized process for managing and agreeing upon changes to contract requirements. Addressing this process gap is essential to prevent recurrence of similar nonconformities. Merely seeking a concession from the Health Trust is a one-off solution that does not address the systemic issue.

The nonconformity was raised against ISO 9001:2015 Clause 8.5.1 – Control of production and service provision . This clause requires organisations to carry out production and service provision under controlled conditions , including:

the use of suitable infrastructure and equipment ,

the availability and use of appropriate monitoring and control , and

the prevention of nonconforming outputs being delivered to customers.

In this scenario, the evidence shows a systemic failure in operational control , not isolated human error.

Explanation of the selected evidence:

E. The organisation failed to control the laundry operations in 5 shops adequately.

Clause 8.5.1 requires consistent control of service provision. The fact that 80% of complaints come from five specific shops demonstrates a lack of effective operational control in those locations.

G. The organisation failed to maintain all of its equipment to an adequate standard.

Clause 8.5.1 requires suitable infrastructure for service provision. Management acknowledged that equipment in these shops is old and cannot currently be replaced, meaning it is not being maintained at a level necessary to ensure conformity of service.

H. Some equipment used was not suitable for the laundry process.

The poor cleaning outcomes and high complaint levels directly indicate that the equipment is not fit for purpose , which is a clear breach of the requirement to provide suitable resources for controlled service provision under Clause 8.5.1.

Explanation of why the other options are not appropriate evidence for Clause 8.5.1:

A relates to strategic planning and investment decisions, not directly to operational control.

B and C relate to inspection activities, which were not evidenced in the scenario.

D and F relate to complaint handling behaviour, which would align more closely with Clause 9.1.2 (customer satisfaction) or Clause 10.2 (nonconformity and corrective action), not Clause 8.5.1.

ISO-aligned conclusion:

The nonconformity is justified because the organisation is continuing to provide services using unsuitable and inadequately maintained equipment , resulting in repeated service failures in multiple locations. This demonstrates a clear failure to control service provision as required by ISO 9001:2015 Clause 8.5.1 , supported by evidence E, G and H .

In the context of ISO 9001:2015 audits, it is the audit team leader who holds the responsibility for assigning work to the audit team. According to ISO 19011:2018 (Guidelines for auditing management systems, which complements ISO 9001:2015), the audit team leader is responsible for the organization and direction of the audit, including assigning specific roles and responsibilities to audit team members. This includes preparation of the audit plan, leading the audit, and ensuring that each team member understands their tasks.

ISO 9001:2015 clause 8.2.3 requires the organisation to review requirements for products and services before committing to supply them to the customer. This review must include customer-specified requirements, applicable statutory and regulatory requirements, and confirmation that the organisation has the ability to meet the requirements.

In this case, the contract required Category A fire safety performance, but the Technical Director stated the order was never technically reviewed. Also, the organisation had never produced Category A cable before and had no Category A test results, meaning it accepted the order without confirming its ability to meet the customer and regulatory requirements.

Option C is supported because the order was not reviewed technically. Option E is supported because the organisation accepted the order without confirming it could meet the specified Category A requirements.

Options A, B, D and F are not the best answers because the scenario does not prove Category B fails national standards, does not require the customer to reissue the order, does not mainly concern missing documentation for Category A tests, and does not show failure to determine intended use.

===========

ISO/IEC 17021-1 is the standard that specifies requirements for bodies providing audit and certification of management systems. It includes provisions for determining audit time for third-party certification audits, ensuring that the audits are conducted in a consistent, comparable, and reliable manner, which can be applied to a variety of management systems, including ISO 9001.

The following table shows the possible matching of the records to the requirements of clause 8.4:

Table

Requirements

Records

Define product requirements

Product specification

Criteria for selection

List of requirements to be met by the external provider

Evaluation of potential external provider

External provider questionnaire

External provider selection

Approved external provider list

Communicate requirements

Purchase order

Monitoring of performance

External provider delivery times and quality issues

Comprehensive and Detailed Explanation: = According to clause 8.4 of ISO 9001:2015, the organization should ensure that externally provided processes, products, and services conform to the specified requirements. To do so, the organization should:

Define the product requirements that are relevant for the external provision, such as specifications, drawings, standards, codes, etc. These should be documented and communicated to the external provider. A record of the product specification can be used as evidence of this requirement.

Establish the criteria for the selection, evaluation, and re-evaluation of external providers, based on their ability to provide processes, products, and services in accordance with the requirements. The criteria should be documented and applied consistently. A record of the list of requirements to be met by the external provider can be used as evidence of this requirement.

Evaluate the potential external providers before selecting them, using the established criteria. The evaluation methods may include questionnaires, audits, references, samples, etc. The results of the evaluation should be documented and reviewed. A record of the external provider questionnaire can be used as evidence of this requirement.

Select the external providers that have demonstrated their competence and conformity to the requirements. The selection should be based on the evaluation results and the organization’s needs. The selection should be documented and approved. A record of the approved external provider list can be used as evidence of this requirement.

Communicate the requirements for the processes, products, and services to be provided by the external provider, including the verification and validation activities, the acceptance criteria, the documentation requirements, the changes control, etc. The communication methods may include purchase orders, contracts, agreements, etc. The communication should be clear, complete, and timely. A record of the purchase order can be used as evidence of this requirement.

Monitor the performance and conformity of the external provider, using the established criteria and methods. The monitoring methods may include inspections, tests, audits, feedback, complaints, etc. The monitoring results should be documented and analyzed. A record of the external provider delivery times and quality issues can be used as evidence of this requirement.