PECB ISO-9001-Lead-Auditor QMS ISO 9001:2015 Lead Auditor Exam Exam Practice Test

According to the definition in ISO 9000, a nonconformity is “non-fulfillment of a requirement”. There are three parts to a well-documented nonconformity: the audit evidence to support auditor findings; a record of the requirement against which the nonconformity is detected; and the statement of nonconformity1. In this case, the audit evidence is the dispatch records that show the same batch number of the product being delivered by two different trucks at different times. The requirement is the procedure P-02 Rev.3 that says that trucks should carry a complete batch. The statement of nonconformity is that the batch 33555 was delivered split in two different trucks (011 and 025), which does not conform to the procedure. Therefore, option C best describes the identified nonconformity, as it includes all three parts of a well-documented nonconformity. Option A is not correct, as it does not state the audit evidence or the requirement. Option B is not correct, as it does not specify the audit evidence or the statement of nonconformity. Option D is not correct, as it does not match the audit evidence or the requirement. References: 1: ISO 9001 Auditing Practices Group Guidance on Nonconformity - Documenting.

According to ISO 9001:2015, clause 9.1.1, the organization is required to determine what needs to be monitored and measured, the methods for monitoring, measurement, analysis and evaluation, as applicable, to ensure valid results, and when the monitoring and measuring shall be performed. The organization is also required to retain appropriate documented information as evidence of the results.

Therefore, in the scenario given, the organization should have planned for monitoring and measuring the billet temperature, as it is a critical factor for the quality of the product and the process. The organization should also have established a procedure that provides instruction in taking billet temperature, using the pyrometer or other suitable methods, to ensure consistency and accuracy. The organization should also have performed periodic analysis of the results of temperature checks, to identify trends, problems, and opportunities for improvement.

Hence, the options that would provide evidence of conformance with clause 9.1.1 of ISO 9001 are A, E, and F, as they are aligned with the requirements of the clause. The other options are either irrelevant or not directly related to clause 9.1.1, as they do not pertain to the monitoring and measurement of the billet temperature.

References:

• ISO 9001:2015(en), Quality management systems — Requirements, clause 9.1.1
• ISO 19011:2018(en), Guidelines for auditing management systems, clause 6.4.4 and 6.7.2
• ISO 9001 Lead Auditor Training Course | IRCA Certified | BSI, section “Learning objectives”
• ISO 9001 Lead Auditor Course Material | 3FOLD Education Centre, module 5 and 6

According to ISO 9001:2015, clause 8.4, an organization is required to control the processes, products and services provided by external providers, including those that affect the quality of the organization’s own products and services. This includes determining the controls to be applied to the external provision of processes, products and services, as well as the information to be communicated to the external providers. The organization is also required to monitor, measure, and evaluate the performance of the external providers and retain documented information of these activities.

Therefore, in the scenario given, ABC Ltd is responsible for controlling the processes, products and services provided by Teak Ltd, as they affect the quality of ABC Ltd’s own products and services. This means that ABC Ltd should have established criteria and methods for evaluating the performance of Teak Ltd, as well as documented information of the results of such evaluation. ABC Ltd should also have defined the supply arrangements with Teak Ltd, including the specifications, requirements, and verification activities related to the products and services provided by Teak Ltd.

Hence, the best options to describe how to plan the audit of the interrelationship with Teak Ltd during the Stage 2 audit at ABC Ltd are A and D, as they are aligned with the requirements of ISO 9001:2015, clause 8.4. The other options are either irrelevant or beyond the scope of the audit, as they do not pertain to the control of external provision by ABC Ltd.

References:

• ISO 9001:2015(en), Quality management systems — Requirements, clause 8.4
• ISO 19011:2018(en), Guidelines for auditing management systems, clause 6.3.1 and 6.4.2
• ISO 9001 Lead Auditor Training Course | IRCA Certified | BSI, section “Learning objectives”
• ISO 9001 Lead Auditor Course Material | 3FOLD Education Centre, module 5 and 6

In this scenario, the organisation A has two plants, A1 and A2, but the production in A2 was discontinued due to the COVID-19 pandemic and the plant was rented to another organisation B. There are no A employees working in A2, and the organisation A expects to reassume production in A2 as soon as possible. Therefore, the appropriate action to plan the internal audit of A’s quality management system is:

•Interview the A2 plant manager, now working in Plant A1: This action involves interviewing the person who is responsible for the management and operation of the plant A2, and who is currently working in the plant A1. The interview should aim to gather information about the status and condition of the plant A2, the impact of the COVID-19 pandemic on the quality management system, the arrangements and agreements with the organisation B, and the plans and actions to resume production in the plant A25 . This action is relevant and necessary for the internal audit, as it can help to assess the readiness and effectiveness of the quality management system, and to identify any gaps or nonconformities that need to be addressed.

The other options are not appropriate actions to plan the internal audit of A’s quality management system, according to the web search results from my internal tool. They are:

•Visit Plant A2 to interview personnel of company B: This action involves visiting the plant A2 and interviewing the personnel of the organisation B, who are not related to the organisation A and who are not part of the quality management system. This action is irrelevant and unnecessary for the internal audit, as it can not provide any evidence or information about the conformity and improvement of the quality management system of the organisation A5 .

•Visit Plant A2 to interview B’s quality manager: This action involves visiting the plant A2 and interviewing the quality manager of the organisation B, who is not related to the organisation A and who is not part of the quality management system. This action is irrelevant and unnecessary for the internal audit, as it can not provide any evidence or information about the conformity and improvement of the quality management system of the organisation A5 .

•Visit Plant A2 to interview A’s security personnel and B’s maintenance department: This action involves visiting the plant A2 and interviewing the security personnel of the organisation A and the maintenance department of the organisation B, who are not directly involved in the quality management system. This action is irrelevant and unnecessary for the internal audit, as it can not provide any evidence or information about the conformity and improvement of the quality management system of the organisation A5 .

Therefore, the correct answer is D.

References: 1: Quality audit - Wikipedia 2: A step-by-step guide to internal quality audits 3: ISO 9001:2015 - Quality management systems — Requirements 4: ISO 19011:2018 - Guidelines for auditing management systems 5: Audit Process | Flowchart | Summary - Accountinguide : What are the Stages of the Auditing Process & Why it is Important …

A white background with black text Description automatically generated

• Establishing the audit programme objectives
• Determining and evaluating the audit programme risks and opportunities
• Establishing the audit programme
• Initiating the audit
• Preparing all audit activity
• Conducting the audit activities

According to ISO 19011:2018, clause 5, the audit programme is a set of one or more audits planned for a specific time frame and directed towards a specific purpose. The audit programme includes all activities necessary to plan, organize, and conduct the audits. The audit programme management involves the following steps1:

• Establishing the audit programme objectives: The audit programme objectives define the intended outcomes of the audit programme, such as verifying conformity, evaluating performance, identifying improvement opportunities, etc. The audit programme objectives should be aligned with the strategic direction and policies of the organization and the needs and expectations of the interested parties.
• Determining and evaluating the audit programme risks and opportunities: The audit programme risks and opportunities are the factors that can affect the achievement of the audit programme objectives, such as changes in the internal or external context, availability of resources, competence of auditors, etc. The audit programme risks and opportunities should be identified, analyzed, and evaluated to determine the appropriate actions to address them.
• Establishing the audit programme: The audit programme is established by defining the audit programme scope, criteria, methods, and resources. The audit programme scope defines the extent and boundaries of the audit programme, such as the processes, functions, sites, activities, etc. that will be audited. The audit programme criteria are the set of policies, procedures, or requirements used as a reference for the audits. The audit programme methods are the techniques used to conduct the audits, such as interviews, observations, document review, sampling, etc. The audit programme resources are the human, technical, and financial resources needed to implement the audit programme.
• Initiating the audit: The audit initiation is the process of formally establishing the arrangements for an individual audit within the audit programme. The audit initiation involves contacting the auditee and the audit client, confirming the audit objectives, scope, and criteria, and obtaining the necessary information and access for the audit.
• Preparing all audit activity: The audit preparation is the process of developing the audit plan and the audit work documents for an individual audit. The audit plan is a document that provides the basis for agreement regarding the conduct of the audit, such as the audit schedule, the audit team, the audit methods, the audit language, the audit report, etc. The audit work documents are the records that provide evidence of the audit activities, such as the audit checklist, the audit notes, the audit findings, etc.
• Conducting the audit activities: The audit activities are the processes of collecting and verifying audit evidence and evaluating it against the audit criteria to make the audit conclusions. The audit activities include the opening meeting, the communication during the audit, the roles and responsibilities of the audit team and the auditee, the audit evidence collection and verification, the audit findings generation and recording, the closing meeting, and the audit report preparation and distribution.

References: ISO 19011:2018(en), Guidelines for auditing management systems

•

Reviews the client’s management system documented information: This activity involves checking the documentation of the quality management system, such as the quality policy, the quality objectives, the scope, the processes, and the procedures, to ensure that they meet the requirements of ISO 9001:2015123. The audit team also evaluates the client’s understanding and implementation of the standard, and identifies any gaps or nonconformities that need to be addressed before the Stage 2 audit123.

•Reviews the processes with high level of risk: This activity involves assessing the processes that have a significant impact on the quality of the products or services, or that pose a high risk of nonconformity or customer dissatisfaction123. The audit team also verifies the client’s risk management approach, and evaluates the effectiveness of the controls and actions taken to mitigate the risks123.

The other options are not statements that are true for the Stage 1 audit, according to the web search results from my internal tool. They may be related to other stages or types of audits, but they are not the focus of the Stage 1 audit.

Therefore, the correct answer is D and G.

References: 1: ISO 9001 Certification Audits | Stage 1 and Stage 2 - 9001. Simplified 2: Stage 1 of your Audit | NQA Blog 3: Getting Certified to ISO 9001 - the Stage 1 Audit

According to the guidance on conducting the audit closing meeting1, the audit team leader should provide a summary of the audit findings and conclusions, invite discussions, and agree on timelines for any corrective actions. The audit team leader should also be respectful, constructive, and objective when presenting the nonconformities, and avoid any personal or emotional comments. The audit team leader should also consider the impact of the disruptive event (such as the Covid-19 pandemic) on the auditee’s context, interested parties, and risks2, and acknowledge any good practices or improvements observed during the audit. Therefore, option D is the best option, as it follows the best practices for the closing meeting and allows the auditee to understand the nonconformities and their implications, and to participate in the analysis and resolution of the issues. Option A is not correct, as it is not respectful, constructive, or objective, and it does not invite any discussion or feedback from the auditee. It also assumes that the audit team leader has the authority to recommend the removal of the supplier from the approved list, which may not be the case. Option B is not correct, as it does not provide enough information or explanation to the auditee, and it does not allow any discussion or feedback from the auditee. It also does not follow the best practices for the closing meeting, such as providing a summary of the audit, acknowledging any good practices, and agreeing on timelines for corrective actions. Option C is not correct, as it does not involve the other managers who are responsible for the functions or processes that were audited, and who may have valuable input or information to share. It also does not follow the best practices for the closing meeting, such as providing a summary of the audit, inviting discussions, and agreeing on timelines for corrective actions. References: 1: Conducting the Audit Closing Meeting: Sharing the Results2: Auditing ISO 9001:2015 in the Context of a Disruptive Event.

The auditor could raise the following nonconformities to ISO 9001 based on the scenario:

•Option A: 10.3 - The organisation did not continuously improve. Reject rates were unchanged. This option is correct because ISO 9001:2015 clause 10.3 requires the organization to improve the suitability, adequacy and effectiveness of the quality management system. The organization did not demonstrate any improvement in reducing the reject rate of the finished product, which was a stated objective of top management. The corrective action taken by the organization was not effective in addressing the root cause of the problem and preventing its recurrence.

•Option B: 7.1.4 - The factory environment is not suitably maintained to prevent dirty products. This option is correct because ISO 9001:2015 clause 7.1.4 requires the organization to determine, provide and maintain the environment necessary for the operation of its processes and to achieve conformity of products and services. The organization did not ensure that the factory floor was clean and dry, which affected the quality of the products and increased the risk of nonconformity.

•Option C: 7.1.1 - The organization failed to provide the required resources to prevent nonconforming products. This option is correct because ISO 9001:2015 clause 7.1.1 requires the organization to determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the quality management system. The organization did not provide adequate collection baskets for the products ejecting from the moulding machines, which resulted in products falling onto the factory floor and becoming nonconforming.

The following options are not correct:

•Option D: 9.2.2 - Report IA202 contained a poorly worded nonconformity (NC 3). This option is not correct because ISO 9001:2015 clause 9.2.2 does not specify the requirements for the wording of nonconformities in internal audit reports. The nonconformity (NC 3) stated by the internal auditor was clear and relevant to the audit criteria and audit evidence. The issue is not with the report, but with the corrective action taken by the organization.

•Option E: 8.6 - Dirty products were released to the customer. This option is not correct because ISO 9001:2015 clause 8.6 requires the organization to implement planned arrangements, at appropriate stages, to verify that the product and service requirements have been met. The scenario does not indicate that the dirty products were released to the customer, but that they were recalled and repaired then returned to the customers. The issue is not with the release, but with the production process and the environment.

•Option F: 7.3 - Staff were not aware that products were falling onto the factory floor. This option is not correct because ISO 9001:2015 clause 7.3 requires the organization to ensure that the persons doing work under its control are aware of the quality policy, relevant quality objectives, their contribution to the effectiveness of the quality management system, and the implications of not conforming with the quality management system requirements. The scenario does not indicate that the staff were not aware of these aspects, but that the management did not provide adequate resources and environment for the staff to perform their work. The issue is not with the awareness, but with the management responsibility and resource provision.

•Option G: 10.2.1 - Conduct of an investigation was not sufficient to understand the cause of the nonconformity. This option is not correct because ISO 9001:2015 clause 10.2.1 requires the organization to react to the nonconformity and, as applicable, take action to control and correct it and deal with the consequences. The scenario indicates that the Quality Manager conducted an investigation into the reject rates and identified the cause of the nonconformity. The issue is not with the investigation, but with the corrective action taken by the management.

•Option H: 8.5.1 - Production operations were not properly controlled to avoid reject products. This option is not correct because ISO 9001:2015 clause 8.5.1 requires the organization to implement production and service provision under controlled conditions. The scenario indicates that the production operations were controlled by the moulding machines, which ejected the products into the collection baskets. The issue is not with the production operations, but with the size of the collection baskets and the condition of the factory floor.

References:

•ISO 9001:2015 Quality management systems - Requirements

•ISO 9001 Lead Auditor Course Material, Module 6: Reporting Audit Findings, Slide 14: Writing Nonconformity Statements

•ISO 9001 Lead Auditor Training Course - IRCA Certified, Section 6.2: Reporting Audit Findings

•Lead Auditor Exam Preparation Guide (EPG) Template - PECB, Section 3.2: Exam Content Outline, Subsection 3.2.1: Section 1 - Audit Fundamentals, Subsection 3.2.2: Section 2 - Audit Principles, Subsection 3.2.3: Section 3 - Audit Process, Subsection 3.2.4: Section 4 - Audit Competencies

The audit team leader should deal with this situation in a professional and ethical manner, while maintaining the integrity and credibility of the audit process and the audit findings. The audit team leader should also try to resolve the conflict with the Quality Manager in a constructive and respectful way, without compromising the audit objectives or the audit team’s independence and impartiality. According to the ISO 9001 Lead Auditor Reference Materials guides and documents, the possible actions that the audit team leader might take are:

•A. Insist that the nonconformities must stand since they have been agreed by the team from other evidence gathered. This action is consistent with the principle of evidence-based approach, which states that the audit team should collect and verify information that is appropriate, sufficient, and reliable to support the audit findings and conclusions. The audit team leader should explain to the Quality Manager that the nonconformities are not based solely on the photographs, but on other audit evidence that corroborates them. The audit team leader should also remind the Quality Manager that the nonconformities are subject to review and approval by the certification body, and that any attempt to influence or interfere with the audit results would be considered a breach of the audit agreement and the certification rules.

•D. State that the auditor will take no further part in the audit and all his photographs will be deleted. This action is consistent with the principle of confidentiality, which states that the audit team should exercise discretion in the use and protection of information acquired during the audit. The audit team leader should acknowledge that the auditor’s behavior was inappropriate and unprofessional, and that he violated the audit rules and the auditee’s rights. The audit team leader should apologize for the inconvenience and the discomfort caused by the auditor, and assure the Quality Manager that the auditor will be removed from the audit team and that his photographs will be erased from his phone and any other device or media. The audit team leader should also inform the auditor of his misconduct and the consequences, and report the incident to the audit program manager and the certification body.

•F. Advise the Quality Manager that he, as audit team leader, needs to speak to the auditor about the situation and he will report back to the Quality Manager once this is done. This action is consistent with the principle of communication, which states that the audit team should exchange information with the auditee in a timely, open, honest, and respectful manner. The audit team leader should express his concern and his willingness to address the issue with the auditor, and ask for the Quality Manager’s patience and cooperation. The audit team leader should also explain that the audit process is not finished yet, and that the Closing meeting is an opportunity to present and discuss the audit findings and conclusions, and to seek feedback and clarification from the auditee. The audit team leader should then speak to the auditor privately, and follow the steps described in action D.

The other options are not appropriate or effective ways to deal with this situation, because they either:

•B. Delay the Closing meeting until the audit team leader has consulted his audit program manager at Head Office. This action would disrupt the audit schedule and the audit plan, and create unnecessary delays and costs for both the audit team and the auditee. It would also show a lack of leadership and decision-making skills from the audit team leader, and undermine his authority and credibility. The audit team leader should be able to handle the situation on site, and consult his audit program manager only if the situation escalates or becomes unmanageable.

•C. Advise the Quality Manager that the auditor will be reported to Head Office. This action would escalate the conflict and create a hostile and defensive atmosphere between the audit team and the auditee. It would also imply that the audit team leader is not capable or willing to resolve the issue himself, and that he is threatening or punishing the auditee for raising a legitimate concern. The audit team leader should try to defuse the tension and restore the trust and the rapport with the Quality Manager, and report the auditor to Head Office only after the audit is completed and the audit report is submitted.

•E. Apologise for the situation and ensure the Quality Manager that all photographs will be deleted during the Closing meeting. This action would not address the root cause of the problem, and would not prevent the auditor from taking more photographs or using them for other purposes. It would also expose the audit team and the auditee to unnecessary risks and liabilities, and compromise the confidentiality and the security of the audit information. The audit team leader should delete the photographs as soon as possible, and not wait until the Closing meeting.

References: ISO 9001:2015, ISO 19011:2018, PECB Certified ISO 9001 Lead Auditor, Common Audit Problems and How to Deal with Them, The Auditor’s Guide to Conflict Resolution, Conflict Resolution in your Audit Career, How to Be a Good Auditor as a Team Leader

According to clause 8.3 of ISO 9001:2015, the organization should establish, implement, and maintain a design and development process that is appropriate to ensure the subsequent provision of products and services. The design and development process should include the following activities:

•Determining the requirements for the products and services to be designed and developed, considering the intended use, the statutory and regulatory requirements, the customer and other relevant interested parties’ needs and expectations, and the potential risks and opportunities.

•Defining the design and development objectives, stages, responsibilities, and authorities, and ensuring the availability of adequate resources and competence.

•Implementing design and development controls, such as reviews, verification, and validation, to ensure that the design and development outputs meet the design and development inputs, and to identify and resolve any problems or errors.

•Maintaining documented information on the design and development inputs, outputs, reviews, verification, validation, and changes, and ensuring the traceability and conformity of the products and services to the requirements.

•Managing the design and development changes, by identifying, reviewing, and controlling them, and evaluating their effects on the products and services and the QMS.

In this case, the evidence statements that provide a meaningful audit trail for the design and development process are B, E, and F, because they relate to the design and development controls, the documented information, and the verification activities that are required by the standard. These options can help the auditor to assess the effectiveness and conformity of the design and development process, and to identify any nonconformities or opportunities for improvement. The other options are not directly related to clause 8.3, although they may be relevant for other aspects of the QMS, such as clause 7.2 on competence, clause 7.3 on awareness, clause 7.4 on communication, clause 8.2 on requirements for products and services, clause 8.4 on externally provided processes, products, and services, and clause 8.7 on control of nonconforming outputs. References: ISO 9001:2015, ISO 9001 Auditing Practices Group Guidance on Design and Development, ISO 9001 Clause 8.3 Design and development of products and services

According to ISO 19011:2018, clause 6.3.2, the audit plan is a document that provides the basis for agreement regarding the conduct of the audit. The audit plan should include the following information1:

•the audit objectives, scope and criteria

•the audit team members and their roles and responsibilities

•the audit schedule, including the date, time and location of each audit activity

•the expected time and duration of meetings and interviews

•the allocation of appropriate resources to critical areas of the audit

•the identification of the audit client and the auditee

•the identification of the guides and observers, if any

•the documents and records to be reviewed before and during the audit

•the audit methods and tools to be used

•the audit language and terminology

•the audit report content, format, distribution and expected completion date

•the risk to achieving audit objectives and the contingency plan, if any

Therefore, the issue which is not expected to be included in the audit plan is C, expectations of the organisation’s management. This issue is not relevant to the conduct of the audit, as the audit is based on the audit criteria, not on the management’s expectations. The management’s expectations may be considered during the audit initiation or the audit programme management, but they are not part of the audit plan.

References: ISO 19011:2018(en), Guidelines for auditing management systems, How to create an ISO 9001 internal audit plan - Advisera

Evaluate the effectiveness of the management system: This objective involves verifying that the quality management system meets the requirements of a specific standard, such as ISO 9001:2015, and that it achieves the intended results and outcomes. The audit team will collect and analyse audit evidence to determine the degree of conformity and performance of the quality management system23.

•Evaluate the capability of the management system to establish and achieve objectives: This objective involves verifying that the quality management system supports the strategic direction and policies of the organization, and that it addresses the needs and expectations of the interested parties. The audit team will assess the suitability, adequacy, and alignment of the quality management system objectives, and the effectiveness of the planning and implementation processes to achieve them23.

The other options are not the most relevant objectives of a third-party audit, according to the web search results from my internal tool. They may be related to other aspects or types of audits, but they are not the focus of a third-party audit.

Therefore, the correct answer is B and D.

References: 1: Safeguarding Your Business: The Power of Third-Party Security Audits 2: ISO 19011:2018 - Guidelines for auditing management systems 3: Third Party Audit – QMSGurus.com

The activities that are specifically required by ISO 17021-1 as part of third-party (Certification Body) surveillance audit processes are:

•Option A: Audit use of certification marks on marketing materials. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to audit the client’s use of marks and/or any other reference to certification, as applicable, to ensure conformity with the certification requirements.

•Option B: Review changes to the QMS since last visit. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review any changes affecting the client’s quality management system and its ability to continue to fulfil the requirements of the standard used for certification.

•Option C: Confirm effectiveness of internal audit and management review. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to confirm the continuing effectiveness of the client’s quality management system, including the effectiveness of the internal audit and management review processes.

•Option F: Review the status of previously raised findings and audit effectiveness of any outstanding findings. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review the status of findings and any corrective actions taken by the client in response to previous audits, and to verify the effectiveness of the implemented corrective actions.

•Option H: Verify legal compliance. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to verify the client’s compliance with applicable statutory and regulatory requirements related to the scope of certification.

•Option I: Handling of customer complaints since last visit. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review the client’s handling of customer complaints related to the certified activities since the last audit.

The following options are not correct:

•Option D: Complete a full document review of the quality management system. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to complete a full document review of the quality management system during surveillance audits. A full document review is only required during the initial certification audit or when there are significant changes to the quality management system or the certification requirements.

•Option E: Failing to meet financial responsibilities. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to audit the client’s financial responsibilities during surveillance audits. The certification body may have contractual arrangements with the client regarding the payment of fees, but this is not part of the surveillance audit process.

•Option G: Review the calibration status of the instrumentation. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to review the calibration status of the instrumentation during surveillance audits. The certification body may audit the client’s monitoring and measuring resources as part of the quality management system requirements, but this is not a specific activity required by ISO 17021-1.

•Option J: Conduct a minimum number of annual surveillance audits during the certification period. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to conduct a minimum number of annual surveillance audits during the certification period. The certification body may determine the frequency and duration of surveillance audits based on the risk and performance of the client, but this is not a specific activity required by ISO 17021-1.

References:

•ISO 17021-1:2015 Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 1: Requirements

•ISO 9001 Lead Auditor Course Material, Module 7: Audit Follow-up and Surveillance, Slide 8: Surveillance Audit

•ISO 9001 Lead Auditor Training Course - IRCA Certified, Section 7.2: Audit Follow-up and Surveillance

•Lead Auditor Exam Preparation Guide (EPG) Template - PECB, Section 3.2: Exam Content Outline, Subsection 3.2.1: Section 1 - Audit Fundamentals, Subsection 3.2.2: Section 2 - Audit Principles, Subsection 3.2.3: Section 3 - Audit Process, Subsection 3.2.4: Section 4 - Audit Competencies

According to the ISO 9000:2015 - Quality management systems — Fundamentals and vocabulary, correction is defined as “action to eliminate a detected nonconformity”. A nonconformity is defined as “non-fulfilment of a requirement”. Therefore, the process of modifying a non-conforming product to bring it within acceptance criteria is a correction, as it eliminates the non-fulfilment of the product specification. The other options are not correct, as they have different definitions and purposes:

•Concession: permission to release or use a nonconforming product, service or process

•Corrective action: action to eliminate the cause of a nonconformity and to prevent recurrence

•Preventive action: action to eliminate the cause of a potential nonconformity or other undesirable potential situation

References: ISO 9000:2015 - Quality management systems — Fundamentals and vocabulary, ISO 9001 nonconforming product: How to understand dispositions - Advisera

According to clause 4.1 of ISO 9001:2015, the organization should determine external and internal issues that are relevant to its purpose and its strategic direction and that affect its ability to achieve the intended results of its quality management system. The organization should monitor and review these issues and update them as necessary. Although the standard does not explicitly require documented information of these issues, it does require documented information as evidence of the implementation of the actions taken to address risks and opportunities, as per clause 6.1. The organization should also retain documented information as evidence of the results of the monitoring, measurement, analysis and evaluation of its QMS, as per clause 9.1. Therefore, the auditor should not accept the legal compliance expert answering the question, as he is not the person responsible for the process and may not have the necessary competence or knowledge of the QMS. The auditor should also look for evidence that the actions resulting from the risk assessment had been taken, as this is a requirement of the standard and a way to verify the effectiveness of the QMS. The other options are not appropriate courses of action for the auditor, because they do not address the audit objective or criteria, or they may compromise the audit integrity or impartiality. For example, option B may not be feasible or reliable, as the Technical Manager may not be available or able to provide the necessary evidence by phone. Option C may cause unnecessary delay and inconvenience for the audit process and the auditee. Option E may not solve the problem, as the guide is not the main source of evidence or information for the audit. Option F may be disrespectful or unprofessional, as the consultant may have a legitimate role or interest in the audit. References: ISO 9001:2015, ISO 9001 Auditing Practices Group Guidance on Context of the Organization, ISO 9001 Auditing Practices Group Guidance on Audit Evidence