General Instructions

1. This paper contains 40 questions in three parts: scenario-based, objective, and matching questions.

2. Each question carries 1 mark. There is no negative marking.

3. The correct answer is shown immediately after each question to support study and revision.

4. For scenario questions, focus on the requirement, objective evidence, auditor judgment, and the most appropriate next action.

5. Apply ISO 9001:2015 and ISO 19011 auditing principles as stated in the source practice paper.

———————————————————————————————-

Part A — Scenario-Based Questions

(20 questions × 1 mark = 20 marks) — Apply ISO 9001:2015 and ISO 19011 principles.

1. During the opening meeting of a certification audit, the auditee’s quality manager states the production manager scheduled for interview is unavailable and asks to postpone that part of the audit to another day, outside the agreed audit plan. As Lead Auditor, what should you do first?

A) Cancel the audit immediately due to lack of cooperation

B) Discuss the impact on the audit objectives with the auditee and try to rearrange the schedule within the agreed audit timeframe, adjusting the plan by mutual agreement

C) Proceed and simply skip the production department entirely

D) Immediately report a major nonconformity to the certification body

Answer: B — Adjust the plan by mutual agreement rather than cancelling or unilaterally skipping a department.

2. Reviewing internal audit records, you find the Production department was last internally audited 14 months ago, although the organization’s own procedure requires a 12-month cycle. There is no other evidence of a broader breakdown. How should this best be classified?

A) Major nonconformity – the entire QMS has failed

B) Minor nonconformity – an isolated deviation from the organization’s own documented interval, with no evidence of systemic failure

C) No finding should be raised at all

D) Opportunity for improvement only – nonconformities cannot be raised against internal procedures

Answer: B — An isolated schedule slippage against the organization’s own interval, without evidence of wider failure, is typically minor.

3. During document review, you notice a controlled work instruction was revised six months ago, but the obsolete version is still posted and in use at the workstation on the shop floor. Which clause(s) are most likely nonconforming?

A) 7.5 Control of documented information, only

B) 8.5.1 Control of production and service provision, only

C) Both 7.5 (control of documented information) and 8.5.1 (control of production)

D) 9.1 Monitoring and measurement, only

Answer: C — Both the failure to withdraw the obsolete document and its use on the floor are nonconformities.

4. An auditor finds that a supplier’s certificate of conformity for a safety-critical component was accepted with no verification of the actual product characteristics received. Which clause is most directly relevant?

A) 8.4 Control of externally provided processes, products and services

B) 7.1.5 Monitoring and measuring resources

C) 8.3 Design and development

D) 10.3 Continual improvement

Answer: A — Acceptance of externally provided product without verification is a Clause 8.4 control gap.

5. During an interview, a machine operator cannot explain the acceptance criteria for a critical in-process inspection, even though records show the inspection was completed and passed. What is the most appropriate interpretation?

A) No issue exists, since the records show the inspection passed

B) A potential competence/awareness concern (Clauses 7.2/7.3) even though records exist, warranting further investigation

C) This can only ever be a documented-information nonconformity

D) This must be recorded as an opportunity for improvement, never a nonconformity

Answer: B — Passing records don’t rule out a competence/awareness gap; it should be investigated further, not dismissed.

6. Which of the following would most likely be classified as a Major Nonconformity rather than a minor one?

A) One missing signature on a single routine work order

B) Complete absence of any process for managing customer complaints, despite multiple documented customer complaints on file

C) A calibration label that is slightly faded but still fully legible

D) A single typographical error in a controlled procedure

Answer: B — A systemic absence of a required process, with real-world impact (unresolved complaints), is major.

7. While conducting a second-party audit, the lead auditor realizes they have a long-standing personal friendship with the auditee’s quality manager. What is the correct course of action?

A) Continue as planned, since friendship does not affect technical competence

B) Disclose the relationship to the audit client/certification body and, if it threatens impartiality, arrange to be reassigned or have another auditor cover the affected areas

C) Continue the audit but simply avoid interviewing the quality manager

D) Mention it informally to the auditee only and proceed as normal

Answer: B — Impartiality must be safeguarded by disclosure and, if needed, reassignment.

8. The QMS manual states customer satisfaction is monitored quarterly, but records show no customer satisfaction data has been collected for two years. Which clause(s) does this most directly relate to?

A) 9.1.1 General (monitoring and measurement) and 9.1.2 Customer satisfaction

B) 8.2.1 Customer communication only

C) 5.1.2 Customer focus only, with no link to Clause 9

D) 6.1 Actions to address risks and opportunities only

Answer: A — Both general monitoring/measurement and the specific customer-satisfaction requirement are affected.

9. An organization’s Quality Manual excludes Clause 8.3 (Design and development) from its QMS scope. During the audit, however, you observe engineering staff actively modifying customer drawings in-house for custom orders. What should you conclude?

A) The exclusion is invalid, since design activity is actually being performed; this should be raised as a finding

B) No issue exists – design exclusions are always permitted regardless of actual activity

C) This is irrelevant unless the organization is in the aerospace sector

D) The auditor should disregard this since design was not in the original audit plan

Answer: A — An exclusion is only valid if the activity does not actually occur; observed design activity invalidates it.

10. During the closing meeting, the auditee strongly disagrees with a nonconformity, insisting the evidence was misinterpreted. What is the most appropriate action for the Lead Auditor?

A) Withdraw the finding immediately to preserve the relationship

B) Review the objective evidence and audit criteria with the audit team and the auditee; retain the finding if evidence supports it, or correct it if a genuine error is identified

C) Refuse to discuss the matter further and close the meeting

D) Escalate directly to the certification body without any discussion with the auditee

Answer: B — Findings are resolved by revisiting objective evidence together, not by unilateral withdrawal or refusal to discuss.

11. You are leading a multi-site audit of an organization with 8 branches operating under one centrally controlled QMS. Which sampling approach is most appropriate?

A) Audit the head office only, every time

B) Select a representative, risk-based sample of sites, considering differences in size, activity, and past performance, consistent with ISO 19011/IAF guidance

C) Audit all 8 sites in full during every surveillance visit

D) Choose one site entirely at random with no consideration of risk

Answer: B — Multi-site sampling should be representative and risk-based, per ISO 19011/IAF principles.

12. Reviewing the corrective action closure for a prior nonconformity (missing calibration records for one torque wrench), you find the auditee produced a valid calibration certificate for that tool, but took no action regarding other similar tools or the root cause. Is this corrective action adequate?

A) Yes – the immediate nonconformity has been corrected

B) No – an adequate corrective action (Clause 10.2) requires root cause analysis and action to prevent recurrence, not merely a correction of the single instance

C) Yes, provided top management signs off

D) It is irrelevant, since corrective actions are outside the scope of certification audits

Answer: B — Correction alone (fixing the one tool) is not corrective action; root cause and prevention of recurrence are required.

13. An employee tells the auditor, off the record, that two safety-related customer complaints last month were never logged in the complaints register. What should the auditor do?

A) Disregard the statement since it is not documented evidence

B) Seek corroborating objective evidence (e.g. emails, correspondence) and, if confirmed, raise a finding related to complaint handling / control of nonconforming outputs

C) Immediately record a major nonconformity without seeking any corroboration

D) Name the employee in the audit report as the source

Answer: B — Auditors should seek to corroborate verbal information with objective evidence before concluding.

14. Which of the following best illustrates a “vertical” audit trail as opposed to a “horizontal” one?

A) Tracing a single customer order from receipt through production, inspection, and dispatch, examining every process it passes through in depth

B) Sampling the same generic process (e.g. training records) identically across several departments

C) Reviewing only the top-level quality manual

D) Interviewing only members of top management

Answer: A — Tracing one order through every process it touches is a vertical (in-depth) trail; horizontal trails sample one process across areas.

15. During a remote (ICT-assisted) audit, the video connection repeatedly drops while evidence is being reviewed via screen-share. What is the most appropriate response?

A) Terminate the audit and automatically record a major nonconformity

B) Document the technical difficulty, adjust the audit plan/timing, and use alternative means (e.g. photographs, pre-recorded evidence, rescheduled sessions) to obtain sufficient evidence; inform the certification body if scope or timing is materially affected

C) Draw conclusions based only on the previous audit’s history

D) Ignore the disruptions and complete the report as originally planned

Answer: B — Adapt method and timing, document the disruption, and ensure evidence sufficiency before drawing conclusions.

16. A draft finding reads only: “Employee did not follow procedure XYZ,” with no reference to which specific clause of the procedure was violated or what was actually observed. What is the main weakness of this finding?

A) Nothing – the finding is acceptable as written

B) It lacks clear, objective, and traceable evidence linked to a specific requirement; it should state what was observed, against which criteria, with supporting references

C) It is too detailed for an audit report

D) It must automatically be treated as a major nonconformity

Answer: B — Findings must be specific, evidence-based, and traceable to a stated requirement.

17. During management review, top management discusses only budget and financial results, with no reference to audit results, process performance, customer feedback, or QMS effectiveness. This is most directly a finding against:

A) Clause 9.3 Management review – inadequate inputs/outputs considered

B) Clause 7.4 Communication

C) Clause 8.1 Operational planning and control

D) Clause 6.2 Quality objectives, only

Answer: A — Management review must address the full set of prescribed inputs/outputs, not financial results alone.

18. You observe a batch of parts tagged as “nonconforming” stored in the general stock area alongside conforming inventory, with no physical or system-based segregation. Which clause is most applicable?

A) 8.7 Control of nonconforming outputs

B) 7.1.3 Infrastructure

C) 8.2 Requirements for products and services

D) 9.2 Internal audit

Answer: A — Failure to segregate/control identified nonconforming output is a Clause 8.7 issue.

19. A client asks the Lead Auditor to “soften” a valid nonconformity because a time-critical contract bid depends on prompt certificate renewal. What principle is being challenged, and what should the auditor do?

A) Confidentiality – the auditor should comply to preserve the business relationship

B) Integrity and independence – the auditor must remain objective, report findings strictly on the evidence, and escalate any undue commercial pressure to the certification body’s management

C) Due professional care – the auditor should simply delay issuing the report

D) Fair presentation – which permits findings to be softened when requested

Answer: B — Commercial pressure must not compromise integrity/independence; it should be escalated internally, not accommodated.

20. While drafting the audit report, one team member wants to add: “The quality manager seems overwhelmed and unlikely to sustain the QMS,” with no supporting objective evidence. Should the Lead Auditor include this statement?

A) Yes – personal impressions add useful context

B) No – the audit report must be based on objective, verifiable evidence and factual findings, not subjective opinions about individuals

C) Only if the auditee agrees to it

D) Yes, provided it is used to justify an unrelated nonconformity

Answer: B — Reports must stay to objective, verifiable evidence, not personal opinions about individuals.

Part B — Objective Questions

(12 questions × 1 mark = 12 marks)

1. ISO 9001:2015 is built on the harmonized high-level structure common to all ISO management system standards, known as:

A) Annex SL

B) PDCA Cycle only

C) ISO/IEC Guide 73

D) The Deming Framework

Answer: A – Annex SL

2. Which clause of ISO 9001:2015 requires the organization to determine the needs and expectations of interested parties that are relevant to the QMS?

A) Clause 4.1

B) Clause 4.2

C) Clause 5.1

D) Clause 8.2

Answer: B – Clause 4.2

3. According to ISO 19011, which of the following is NOT one of the fundamental principles of auditing?

A) Integrity

B) Fair presentation

C) Profitability

D) Confidentiality

Answer: C – Profitability is not an audit principle; the seven principles are integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach

4. A nonconformity that is likely to result in the failure of the quality management system, or significantly reduces its ability to achieve intended results, is classified as:

A) An observation

B) A minor nonconformity

C) A major nonconformity

D) An opportunity for improvement

Answer: C – Major nonconformity

5. Under ISO 9001:2015 Clause 5.1, ultimate accountability for the effectiveness of the QMS rests with:

A) The Quality Manager

B) Top management

C) The Lead Auditor

D) The certification body

Answer: B – Top management

6. The systematic, independent, and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled is the definition of:

A) An audit

B) A management review

C) A corrective action

D) A risk assessment

Answer: A – An audit

7. Which clause of ISO 9001:2015 addresses “Control of externally provided processes, products and services”?

A) Clause 7.1.3

B) Clause 8.4

C) Clause 8.5

D) Clause 9.2

Answer: B – Clause 8.4

8. What is the correct sequence of stages in a typical management system audit per ISO 19011?

A) Conducting → Initiating → Preparing → Follow-up

B) Initiating → Preparing → Conducting → Preparing/Distributing the Report → Follow-up

C) Preparing → Reporting → Initiating → Conducting

D) Reporting → Conducting → Follow-up → Initiating

Answer: B – Initiating → Preparing → Conducting → Preparing/Distributing the Report → Follow-up

9. The document that defines the objectives, scope, criteria, methods, and schedule of a specific audit is the:

A) Audit checklist

B) Audit plan

C) Audit programme

D) Audit report

Answer: B – Audit plan

10. “Risk-based thinking,” as introduced throughout ISO 9001:2015, is understood to formalize and extend which concept found in the 2008 edition?

A) Management review

B) Preventive action

C) Design and development

D) Customer communication

Answer: B – Preventive action

11. In a two-person (or larger) audit team, who is responsible for the overall conduct of the audit and the final audit conclusions?

A) The auditee’s management representative

B) The technical expert

C) The lead auditor

D) The certification body’s scheme manager

Answer: C – The lead auditor

12. Which of the following best defines “audit evidence” as used in ISO 19011?

A) Records, statements of fact, or other information which are relevant to the audit criteria and verifiable

B) Any opinion expressed by an auditee representative during an interview

C) The auditor’s personal notes taken during the opening meeting

D) A previously issued nonconformity report

Answer: A – Records, statements of fact, or other information relevant to the audit criteria and verifiable

Part C — Matching Questions

(8 questions × 1 mark = 8 marks)

Set 1: Match the ISO 9001:2015 clause number to its correct title

Column A – Clause	Column B – Title
1. Clause 4	A. Performance evaluation
2. Clause 6	B. Operation
3. Clause 8	C. Context of the organization
4. Clause 9	D. Planning

Answer 1: C – Context of the organization

Answer 2: D – Planning

Answer 3: B – Operation

Answer 4: A – Performance evaluation

Set 2: Match the auditing term to its correct definition

Column A – Term	Column B – Definition
5. Audit criteria	A. Action to eliminate the cause of a detected nonconformity
6. Audit scope	B. Set of policies, procedures, or requirements used as a reference against which audit evidence is compared
7. Audit finding	C. The extent and boundaries of an audit, e.g. locations, organizational units, processes covered
8. Corrective action	D. Results of the evaluation of collected audit evidence against audit criteria

Answer 5: B – Set of policies, procedures, or requirements used as a reference

Answer 6: C – Extent and boundaries of an audit

Answer 7: D – Results of the evaluation of audit evidence against audit criteria

Answer 8: A – Action to eliminate the cause of a detected nonconformity

—————————————————————–

Quick Answer Key

Scenario-Based (1–20): B, B, C, A, B, B, B, A, A, B, B, B, B, A, B, B, A, A, B, B

Objective (1–12): A, B, C, C, B, A, B, B, B, B, C, A

Matching (1–8): C, D, B, A, B, C, D, A