Online ISO-9001-Lead-Auditor Questions Video

Based on the scenario and the concept of an ‘audit trail’ within the context of ISO 9001, the three statements that apply would likely be:

A. Decisions on improvement action timescales not involving departmental managers. This indicates a lack of involvement and communication with those responsible for implementing the improvements, which is a key part of an effective audit trail1.

B. Evaluation of the results of the improvement action not always documented by the Quality Manager. Proper documentation is essential for an audit trail, as it provides evidence that actions have been evaluated and are effective1.

C. Limited knowledge of the content of Quality Improvement Requests by departmental staff. An audit trail should ensure that all relevant parties are aware of and understand the actions being taken, which is not the case here1.

These points suggest issues with the communication, documentation, and involvement of relevant personnel in the quality management system processes, which are crucial for maintaining an effective audit trail and, by extension, a robust quality management system.

Here is the correct matching of the activities with the responsible parties in the context of a second-party audit:

Define the audit scope: Customer

Develop the audit plan: Audit team leader

Respond to the audit findings: External provider

Conduct the audit: Audit team

This reflects the typical division of responsibilities in a second-party audit, where the customer (the party commissioning the audit) sets the scope, the audit team leader manages the planning, the external provider responds to findings, and the audit team carries out the audit.

The ISO 9001 Lead Auditor exam requires the auditor to have a thorough understanding of the ISO 9001:2015 standard and its requirements, as well as the organization’s context, processes, risks, opportunities, and performance. Therefore, the auditor needs to ask for additional information that can help them verify these aspects during the audit planning stage. Some of the information that can be useful are:

A description of responsibilities and authorities of the key roles of XYZ: This can help the auditor to identify who is accountable for what in the organization and how they communicate with each other.

The number of personnel involved in activities related to the quality management system: This can help the auditor to assess if there are enough resources and competencies to support the QMS implementation and operation.

Information to understand XYZ’s operations: This can help the auditor to understand how XYZ produces or delivers its products or services and what are its main processes and inputs.

The results of XYZ’s last internal audit: This can help the auditor to evaluate if XYZ has implemented corrective actions based on previous audit findings and if it has maintained its QMS effectiveness.

The results of the last two management reviews: This can help the auditor to determine if XYZ has monitored its QMS performance against its objectives and if it has identified any significant changes or opportunities for improvement.

The quality manual (B) is not a required document for ISO 9001 certification, but it may be useful for internal reference or training purposes. It is not necessary for audit planning.

The following table shows the possible matching of the records to the requirements of clause 8.4:

Table

Requirements

Records

Define product requirements

Product specification

Criteria for selection

List of requirements to be met by the external provider

Evaluation of potential external provider

External provider questionnaire

External provider selection

Approved external provider list

Communicate requirements

Purchase order

Monitoring of performance

External provider delivery times and quality issues

Comprehensive and Detailed Explanation: = According to clause 8.4 of ISO 9001:2015, the organization should ensure that externally provided processes, products, and services conform to the specified requirements. To do so, the organization should:

Define the product requirements that are relevant for the external provision, such as specifications, drawings, standards, codes, etc. These should be documented and communicated to the external provider. A record of the product specification can be used as evidence of this requirement.

Establish the criteria for the selection, evaluation, and re-evaluation of external providers, based on their ability to provide processes, products, and services in accordance with the requirements. The criteria should be documented and applied consistently. A record of the list of requirements to be met by the external provider can be used as evidence of this requirement.

Evaluate the potential external providers before selecting them, using the established criteria. The evaluation methods may include questionnaires, audits, references, samples, etc. The results of the evaluation should be documented and reviewed. A record of the external provider questionnaire can be used as evidence of this requirement.

Select the external providers that have demonstrated their competence and conformity to the requirements. The selection should be based on the evaluation results and the organization’s needs. The selection should be documented and approved. A record of the approved external provider list can be used as evidence of this requirement.

Communicate the requirements for the processes, products, and services to be provided by the external provider, including the verification and validation activities, the acceptance criteria, the documentation requirements, the changes control, etc. The communication methods may include purchase orders, contracts, agreements, etc. The communication should be clear, complete, and timely. A record of the purchase order can be used as evidence of this requirement.

Monitor the performance and conformity of the external provider, using the established criteria and methods. The monitoring methods may include inspections, tests, audits, feedback, complaints, etc. The monitoring results should be documented and analyzed. A record of the external provider delivery times and quality issues can be used as evidence of this requirement.