Part A — Scenario-Based Questions
1. QMS Scope and Exclusion

A manufacturer states in its QMS scope:

“Design and development requirements are not applicable because all products are manufactured to customer drawings.”

During the audit, you discover that engineers routinely modify customer drawings to improve manufacturability and determine final dimensional tolerances before production.

What should the auditor do?

A. Accept the exclusion because customers provide the original drawings.
B. Investigate whether the engineering activities constitute design and development and whether Clause 8.3 is applicable.
C. Immediately issue a major nonconformity.
D. Require the organization to employ a design manager.

Answer: B

Explanation: Under Clause 4.3, the organization must justify requirements determined not applicable. The auditor should investigate whether engineering activities actually involve design responsibility before concluding whether the stated non-applicability is justified.

2. Interested Parties

The organization has identified customers, employees and shareholders as relevant interested parties. A new government regulation significantly affects product requirements, but regulatory authorities have not been considered in the organization’s context review.

What is the BEST audit approach?

A. Immediately issue a major NC.
B. Ignore it because regulators are not customers.
C. Investigate how the organization determines relevant interested parties and monitors their applicable requirements.
D. Add regulators to the organization’s list yourself.

Answer: C

Explanation: Clause 4.2 requires the organization to determine relevant interested parties and relevant requirements because of their effect or potential effect on the organization’s ability to consistently provide conforming products and services.

3. Process Effectiveness

The organization’s assembly process KPI is:

“Number of units produced per shift.”

Production consistently exceeds the target, but internal rejection has increased from 2% to 11%.

What should the auditor investigate?

A. Only production volume because that is the approved KPI.
B. Whether process monitoring adequately evaluates the effectiveness of the process and conformity of outputs.
C. Whether employees receive production bonuses.
D. Whether the production target should be increased.

Answer: B

Explanation: Clause 4.4 requires criteria and methods needed to ensure effective operation and control of QMS processes. Clauses 9.1.1 and 9.1.3 also address monitoring, measurement, analysis and evaluation.

4. Customer Requirements

A salesperson accepts an order requiring delivery within five working days.

Normal manufacturing lead time is three weeks.

The salesperson says:

“Sales accepts the order first. Operations determines later whether we can actually meet the date.”

What should the auditor investigate?

A. Sales commission policy.
B. Review of requirements before commitment to supply products or services.
C. Production overtime policy.
D. Customer satisfaction survey results only.

Answer: B

Explanation: Clause 8.2.3 requires the organization to ensure it has the ability to meet product and service requirements before committing to supply them.

5. Verbal Customer Requirements

A customer places orders by telephone. The sales representative writes the requirements into the ERP system, but there is no process for confirming requirements back to the customer.

What requirement is particularly relevant?

A. 8.2.3
B. 7.1.3
C. 8.5.4
D. 10.1

Answer: A

Explanation: When the customer does not provide a documented statement of requirements, Clause 8.2.3 requires customer requirements to be confirmed before acceptance, where applicable.

6. Infrastructure Failure

A critical CNC machine has experienced six unexpected breakdowns in three months. Production continues meeting output targets through overtime.

Maintenance records show that preventive maintenance has repeatedly been postponed.

What should the auditor investigate?

A. Only whether customer deliveries were late.
B. Whether infrastructure is being appropriately maintained to achieve conformity of products and services.
C. Whether a new machine should be purchased.
D. Whether overtime costs exceed budget.

Answer: B

Explanation: Clause 7.1.3 requires the organization to determine, provide and maintain the infrastructure necessary for operation of its processes and conformity of products and services.

7. Work Environment

A precision inspection room requires a controlled temperature of 20 ± 2°C according to the organization’s inspection method.

Records show temperatures of 25–27°C for several days, but inspections continued.

What should the auditor investigate NEXT?

A. Whether inspectors were comfortable.
B. Whether environmental conditions could affect measurement validity and product acceptance decisions.
C. Whether air-conditioning electricity costs increased.
D. Whether production employees knew the room temperature.

Answer: B

Explanation: Clause 7.1.4 requires an environment suitable for operation of processes and achievement of conformity.

The auditor should follow the evidence into potential effects on previously accepted products.

8. Organizational Knowledge

The company’s only specialist for a critical legacy process will retire next month.

Management acknowledges that most process settings and troubleshooting knowledge exist only in that employee’s experience.

What should the auditor investigate?

A. The employee’s retirement benefits.
B. How necessary organizational knowledge is determined, maintained and made available.
C. Whether retirement can be delayed.
D. Whether a consultant has already been hired.

Answer: B

Explanation: Clause 7.1.6 addresses organizational knowledge necessary for process operation and conformity of products and services.

9. Communication

The Quality Manager changed an important inspection requirement. The revised requirement was entered into the QMS system, but production employees were never informed.

Three days later, operators continued using the previous inspection method.

Which requirement should be investigated in addition to documented-information control?

A. 7.4 Communication
B. 6.3 Planning of changes
C. 9.2 Internal audit
D. 10.3 Continual improvement

Answer: A

Explanation: Clause 7.4 requires the organization to determine what, when, with whom, how and who communicates relevant QMS information.

10. Customer Property

A customer provides an expensive special fixture for use during production.

The fixture is damaged by an employee, repaired internally and returned to service. The customer is not informed.

What should concern the auditor?

A. Nothing because the fixture was repaired.
B. Whether the organization appropriately handled damaged customer property and reported the occurrence to the customer.
C. Whether the employee paid for the repair.
D. Whether the fixture was insured.

Answer: B

Explanation: Clause 8.5.3 addresses property belonging to customers or external providers. When such property is lost, damaged or otherwise unsuitable for use, the organization must report this and retain documented information on what occurred.

11. Identification and Traceability

A manufacturer produces components requiring lot traceability because of customer requirements.

During the audit, 300 finished components are found with identification labels detached from their containers. Employees cannot determine which production lots they belong to.

What is the MOST relevant requirement?

A. 8.5.2
B. 7.3
C. 9.1.2
D. 10.3

Answer: A — Clause 8.5.2

Explanation: Where traceability is a requirement, the organization must control the unique identification of outputs and retain the documented information necessary to enable traceability.

12. Preservation

Electronic components sensitive to electrostatic discharge must be stored in ESD-protective packaging according to the organization’s handling standard.

The auditor finds several components stored in ordinary plastic containers.

What is the strongest audit trail?

A. Employee dress code.
B. Preservation of product conformity during handling and storage.
C. Customer communication.
D. Internal auditor competence.

Answer: B

Explanation: Clause 8.5.4 requires preservation of outputs during production and service provision to the extent necessary to ensure conformity.

Preservation may include identification, handling, contamination control, packaging, storage and protection.

13. Product Release

The organization’s inspection plan requires final inspection before shipment.

A shipment was dispatched before final inspection because the customer urgently needed the parts.

The Operations Manager verbally approved shipment, but there is no documented customer or authorized approval for bypassing inspection.

Which clause is MOST relevant?

A. 8.6
B. 7.5
C. 9.2
D. 10.1

Answer: A — Clause 8.6

Explanation: Release should not proceed until planned arrangements have been satisfactorily completed unless otherwise approved by a relevant authority and, as applicable, the customer.

14. Production Change

A production manager changes a machining parameter to increase output by 15%.

No review of the potential impact on product quality is performed.

What should the auditor investigate?

A. Whether the change increased profit.
B. Whether changes to production/service provision were reviewed and controlled.
C. Whether employees supported the change.
D. Whether the parameter is mentioned in the quality policy.

Answer: B

Explanation: Clause 8.5.6 requires the organization to review and control changes for production or service provision to the extent necessary to ensure continuing conformity.

15. Risk-Based Thinking

The organization has a risk register containing 85 risks.

Every risk is marked “Low.”

During the previous year, however, the company experienced several serious disruptions involving suppliers, equipment and employee turnover.

What is the BEST auditor approach?

A. Accept the register because ISO 9001 does not prescribe a scoring method.
B. Investigate how risks are determined, evaluated and addressed and whether actions are effective.
C. Require the organization to use FMEA.
D. Recalculate every risk for management.

Answer: B

Explanation: Clause 6.1 requires risks and opportunities to be determined and actions planned. ISO 9001 does not mandate a particular risk-management methodology, but the auditor can assess whether the organization’s approach is effective.

16. Planning Changes

A company rapidly relocates its final inspection department to another facility.

After relocation, management discovers that several required measuring instruments and qualified inspectors are unavailable.

Which requirement provides the strongest audit trail?

A. 6.3 Planning of changes
B. 5.2 Quality policy
C. 8.4 External providers
D. 9.1.2 Customer satisfaction

Answer: A

Explanation: Clause 6.3 requires QMS changes to be carried out in a planned manner, considering purpose and consequences, QMS integrity, resource availability, and allocation/reallocation of responsibilities and authorities.

17. Audit Sampling

An auditor reviews one perfectly completed production record and concludes:

“The production process fully conforms to ISO 9001.”

What is wrong with this conclusion?

A. Production records cannot be audited.
B. Audit evidence generally relies on appropriate sampling; one record may not provide sufficient representative evidence for such a broad conclusion.
C. Every production record must always be checked.
D. Only managers may provide audit evidence.

Answer: B

Explanation: Audits typically rely on sampling. The auditor needs sufficient appropriate evidence to support findings and conclusions. Sampling should consider audit objectives, risks and available evidence.

18. Audit Trail

While auditing customer complaints, the auditor discovers that most complaints involve one particular production line.

What should the auditor do?

A. Remain strictly within the customer-service department.
B. Follow the audit trail into relevant production processes, records and controls within the audit scope.
C. Immediately classify production as nonconforming.
D. Stop sampling complaints.

Answer: B

Explanation: Effective process auditing follows evidence across process interfaces. Complaint data may lead to production controls, competence, equipment, inspection, corrective action or other relevant processes.

19. Leadership

The CEO tells the auditor:

“ISO 9001 is entirely the Quality Manager’s responsibility. I only review the financial performance of the company.”

What should the auditor investigate?

A. Whether the Quality Manager has sufficient staff.
B. Top management’s demonstrated leadership and accountability for QMS effectiveness.
C. CEO compensation.
D. Whether the CEO attended ISO training.

Answer: B

Explanation: Clause 5.1.1 assigns several QMS leadership responsibilities directly to top management, including accountability for QMS effectiveness.

These responsibilities cannot simply be transferred entirely to the Quality Manager.

20. Continual Improvement

For three years, all quality objectives have been achieved. Management says:

“Our QMS works well, so there is no reason to identify further improvement opportunities.”

What should the auditor investigate?

A. Nothing; improvement stops when objectives are met.
B. How the organization determines and selects opportunities for improvement and continually improves QMS suitability, adequacy and effectiveness.
C. Whether objectives should deliberately be made impossible.
D. Whether a consultant is needed.

Answer: B

Explanation: Clauses 10.1 and 10.3 address improvement and continual improvement. Consistent achievement does not eliminate the requirement to consider opportunities for further improvement.

Part B — Objective Questions
21. Which clause establishes requirements for determining the QMS scope?

A. 4.1
B. 4.2
C. 4.3
D. 4.4

Answer: C — Clause 4.3

22. Which clause addresses organizational knowledge?

A. 7.1.3
B. 7.1.4
C. 7.1.5
D. 7.1.6

Answer: D — Clause 7.1.6

23. Requirements for communication with customers are primarily found in:

A. 7.4
B. 8.2.1
C. 8.5.2
D. 9.1.2

Answer: B — Clause 8.2.1

Explanation: Clause 8.2.1 specifically addresses customer communication concerning product/service information, enquiries/contracts/orders, feedback/complaints, customer property and relevant contingency requirements.

24. Which clause covers identification and traceability?

A. 8.4.1
B. 8.5.1
C. 8.5.2
D. 8.6

Answer: C — Clause 8.5.2

25. Preservation of outputs is addressed by:

A. 8.5.3
B. 8.5.4
C. 8.5.5
D. 8.5.6

Answer: B — Clause 8.5.4

26. Planned changes to the QMS are primarily addressed in:

A. 5.3
B. 6.1
C. 6.3
D. 7.4

Answer: C — Clause 6.3

27. Which clause addresses release of products and services?

A. 8.5
B. 8.6
C. 8.7
D. 9.1

Answer: B — Clause 8.6

28. Which of the following is the BEST example of objective evidence?

A. “The supervisor seems careless.”
B. “Employees probably don’t understand the process.”
C. Three sampled inspection records lack the approval required by procedure QP-08.
D. “This company needs better quality culture.”

Answer: C

Explanation: Objective evidence should be verifiable. Auditor impressions and assumptions are not sufficient evidence of conformity or nonconformity.

29. The audit scope primarily defines:

A. Every clause that will result in a nonconformity.
B. The boundaries and applicability of the audit.
C. The organization’s financial objectives.
D. The auditor’s personal responsibilities only.

Answer: B

Explanation: Audit scope typically describes boundaries such as locations, organizational units, activities, processes and time period covered.

30. The purpose of an audit opening meeting includes:

A. Negotiating whether ISO requirements apply.
B. Confirming the audit plan, scope, communication channels and relevant arrangements.
C. Presenting all expected nonconformities.
D. Performing management review.

Answer: B

Part C — Matching Questions

Match each situation with the MOST relevant ISO 9001:2015 clause.

A — 4.2 Understanding needs and expectations of interested parties
B — 7.1.3 Infrastructure
C — 8.2.3 Review of requirements for products and services
D — 8.5.3 Property belonging to customers or external providers
E — 8.5.6 Control of changes

31. A customer-owned test fixture is lost, but the customer is not informed.

Answer: D — Clause 8.5.3

32. A salesperson accepts a contract before determining whether the organization can meet a special technical requirement.

Answer: C — Clause 8.2.3

33. Critical production equipment repeatedly fails because scheduled maintenance is not performed.

Answer: B — Clause 7.1.3

34. Manufacturing parameters are changed without reviewing the consequences for product conformity.

Answer: E — Clause 8.5.6

35. The organization fails to consider a newly applicable regulatory body’s requirements when reviewing relevant external stakeholders.

Answer: A — Clause 4.2

Part D — Auditor Judgment

For Questions 36–40 select:

A — Clear evidence supporting a nonconformity
B — Further investigation/evidence required
C — Not necessarily a nonconformity

36. The organization does not maintain a formal document called a “Risk Register.”

Answer: C — Not necessarily a nonconformity

Explanation: ISO 9001:2015 requires the organization to determine risks and opportunities and plan actions, but it does not prescribe a document specifically called a Risk Register.

The auditor should audit the process and evidence rather than insist on a particular format.

37. The organization does not use FMEA for evaluating QMS risks.

Answer: C — Not necessarily a nonconformity

Explanation: ISO 9001 does not mandate FMEA as the risk-assessment methodology. Organizations may use approaches appropriate to their context.

This is a classic Lead Auditor exam trap:

Do not confuse a useful industry tool with an ISO 9001 mandatory requirement.

38. A procedure requires final inspection before every shipment. The auditor samples three shipments and finds that all three were released without the required final inspection, with no authorized exception.

Answer: A — Clear evidence supporting a nonconformity

Explanation: There is:

Requirement: Final inspection required.
Evidence: Three shipments bypassed it.
Gap: Defined release controls were not implemented.

The evidence therefore supports a finding.

39. A machine operator tells the auditor:

“Sometimes we skip the first-piece inspection when production is busy.”

No records have yet been reviewed.

Answer: B — Further investigation required

Explanation: The interview provides an audit trail, but the auditor should seek corroborating objective evidence—for example, production records, inspection records, applicable procedures and additional samples.

Do not automatically convert every verbal statement into a nonconformity.

40. The organization has not established a separate “Continual Improvement Procedure.”

However, improvement is demonstrated through objectives, corrective actions, management reviews, process projects and performance trends.

Answer: C — Not necessarily a nonconformity

Explanation: ISO 9001:2015 requires continual improvement but does not specifically require a documented procedure titled “Continual Improvement Procedure.”

The auditor evaluates the effectiveness of the organization’s improvement processes rather than demanding a specific document.

—————————-

Tips:

For difficult scenario questions, separate four things:

1. What ISO requires
↓
2. What the organization says it does
↓
3. What objective evidence demonstrates
↓
4. Whether a requirement has actually not been fulfilled

For example, suppose an auditor finds that an organization has no risk register.

Do not reason:

No risk register → No risk management → Nonconformity. ❌

Instead ask:

How does the organization determine risks and opportunities?

What actions have been established?

How are those actions integrated into QMS processes?

How is their effectiveness evaluated?

If credible evidence demonstrates that these requirements are being fulfilled, the absence of a document titled “Risk Register” does not by itself establish a nonconformity.

————————————————————-

Quick Answer Key

1–10: B, C, B, B, A, B, B, B, A, B
11–20: A, B, A, B, B, A, B, B, B, B
21–30: C, D, B, C, B, C, B, C, B, B
31–40: D, C, B, E, A, C, C, A, B, C