Section A – Objective Type Questions

(Questions 1–12 × 1 mark = 12 marks)

1. When determining the scope of the QMS under Clause 4.3, which of the following must NOT be used as justification to exclude a requirement?

A) The type of products and services the organization offers
B) The complexity of the organization’s processes
C) Simply because it is inconvenient to implement
D) The size and nature of the organization

Answer: C – Convenience is never a valid basis for exclusion; only Clause 8 requirements that genuinely do not apply, given the organization’s products/services, may be excluded.

2. Which sub-clause specifically requires the organization to determine the interaction between QMS processes, including their inputs and outputs?

A) Clause 4.1
B) Clause 4.4
C) Clause 5.1
D) Clause 7.5

Answer: B – Clause 4.4 (QMS and its processes).

3. Per Clause 5.2, the quality policy must be:

A) Kept confidential to top management only
B) Available and maintained as documented information, communicated, understood, and applied within the organization
C) Reviewed only during external audits
D) Optional for small organizations

Answer: B – The policy must be available, maintained, communicated, understood, and applied.

4. Under Clause 6.2, quality objectives must be:

A) Vague and aspirational, without measurement
B) Consistent with the quality policy, measurable where practicable, monitored, communicated, and updated as appropriate
C) Set solely by external certification bodies
D) Fixed permanently once established

Answer: B – Objectives must be consistent with policy, measurable where practicable, monitored, communicated, and updated.

5. Which clause requires the organization to determine the knowledge necessary for the operation of its processes (“organizational knowledge”)?

A) Clause 7.1.6
B) Clause 7.2
C) Clause 7.4
D) Clause 8.1

Answer: A – Clause 7.1.6 Organizational knowledge.

6. In ISO 19011 terminology, the person or organization requesting an audit is known as the:

A) Auditee
B) Audit client
C) Technical expert
D) Guide

Answer: B – Audit client.

7. Which of the following is an example of “testimonial” audit evidence, as opposed to documentary evidence?

A) A calibration certificate
B) A verbal statement made during an interview
C) A signed work order
D) A training record

Answer: B – A verbal statement is testimonial evidence; certificates, work orders, and records are documentary.

8. Which ISO 19011 concept refers to selecting a subset of a population for examination, when it is impractical or unnecessary to examine all of it?

A) Audit criteria
B) Audit sampling
C) Audit scope
D) Audit programme

Answer: B – Audit sampling.

9. Which of the following best distinguishes a Stage 1 audit from a Stage 2 audit in a third-party certification process?

A) Stage 1 evaluates effective implementation of the QMS; Stage 2 reviews documentation only
B) Stage 1 reviews documentation and readiness, including whether the QMS is sufficiently developed to proceed; Stage 2 evaluates implementation and effectiveness on-site
C) Stage 1 and Stage 2 are identical and interchangeable
D) Stage 1 occurs only after certification has been granted

Answer: B – Stage 1 assesses documentation/readiness; Stage 2 assesses on-site implementation and effectiveness.

10. Under Clause 8.5.2, “identification and traceability” primarily refers to:

A) Identifying outputs by suitable means and controlling their unique identification and status with respect to monitoring and measurement requirements, where traceability is a requirement
B) Labeling employee ID cards
C) Marketing product identification numbers
D) A requirement that applies only to the electronics industry

Answer: A – Identification and control of unique identity/status, with traceability where required.

11. Which of the following best defines “effectiveness” as used in ISO 9001:2015?

A) The ratio of output to input resources
B) The extent to which planned activities are realized and planned results achieved
C) The complete absence of any nonconformities
D) The speed at which a process is completed

Answer: B – Effectiveness is the extent to which planned activities are realized and results achieved.

12. Per ISO 19011 guidance on auditor competence, which of the following is NOT typically considered when evaluating an auditor?

A) Personal behavior (e.g., ethical, open-minded, diplomatic)
B) Knowledge and skills, both generic and discipline-specific
C) The auditor’s personal income level
D) Education, work experience, auditor training, and audit experience

Answer: C – Personal income is not an auditor competence criterion; behavior, knowledge/skills, education, and experience are.

Section B – Matching Type Questions

(Questions 13–20 × 1 mark = 8 marks) — Match each item in Column A to the correct item in Column B.

Set 1: Match the term to its correct definition (Questions 13–16)
Column A:

13. Nonconformity
14. Correction
15. Preventive action
16. Continual improvement

Column B:

A. Action to eliminate the cause of a potential nonconformity or other undesirable potential situation
B. Non-fulfillment of a requirement
C. Recurring activity to enhance performance
D. Action to eliminate a detected nonconformity

Answer 13: B – Nonconformity: non-fulfillment of a requirement.

Answer 14: D – Correction: action to eliminate a detected nonconformity.

Answer 15: A – Preventive action: action to eliminate the cause of a potential nonconformity.

Answer 16: C – Continual improvement: recurring activity to enhance performance.

Set 2: Match the audit-related role to its correct description (Questions 17–20)
Column A:

17. Lead auditor
18. Technical expert
19. Observer
20. Guide

Column B:

A. Accompanies the audit team but does not audit; appointed by the auditee to assist the team (e.g., facilitates access, clarifies site-specific rules)
B. Provides specific knowledge or expertise to the audit team but does not act as an auditor
C. Watches the audit but does not audit or act as a technical expert
D. The person appointed to be responsible for the audit and its conduct

Answer 17: D – Lead auditor: responsible for the audit and its conduct.

Answer 18: B – Technical expert: provides specific knowledge/expertise, does not audit.

Answer 19: C – Observer: watches the audit without auditing or advising.

Answer 20: A – Guide: appointed by the auditee to assist the audit team on site.

Section C – Scenario-Based Questions

(Questions 21–40 × 1 mark = 20 marks) — Apply ISO 9001:2015 and ISO 19011 principles to each situation below.

21. An organization’s quality manual states the QMS excludes “warehousing” activities because they are outsourced to a third-party logistics provider, though the organization still defines requirements and monitors the provider’s performance. Is this an acceptable basis for exclusion under Clause 4.3?

A) No – exclusions under ISO 9001:2015 apply only to Clause 8 requirements that genuinely do not apply; control of an outsourced process remains within the QMS under Clause 8.4
B) Yes – any outsourced activity can always be fully excluded from the QMS scope
C) No – only top management can decide exclusions, and only verbally
D) Yes – provided the third party is itself ISO 9001 certified

Answer: A – Outsourcing an activity does not remove it from the QMS; it must be controlled under Clause 8.4, not excluded from scope.

22. Reviewing records, you find the organization’s quality policy was last communicated to staff during induction three years ago, and current employees interviewed cannot state its intent, although a poster is displayed in the lobby. What is the most likely nonconformity?

A) No nonconformity – posting the policy on a wall satisfies the requirement
B) Clause 5.2.2 – the policy is not effectively communicated, understood, and applied throughout the organization
C) Clause 8.5.1 nonconformity only
D) This is solely an HR/training matter and outside the audit’s scope

Answer: B – A poster alone does not satisfy communication if staff cannot demonstrate understanding of the policy’s intent.

23. An organization has documented a risk register under Clause 6.1, but during interviews, process owners are unaware of any risks or opportunities relevant to their own processes, and no actions are linked to the register. What should the auditor conclude?

A) Clause 6.1 is fully met since a risk register document exists
B) Risk-based thinking is not effectively implemented; a nonconformity should be considered, since awareness and action at the process level are not evident
C) Risk-based thinking is optional and cannot be audited
D) Only top management needs to be aware of risks and opportunities

Answer: B – A risk register with no process-level awareness or linked actions indicates risk-based thinking is not effectively embedded.

24. A quality engineer’s training record shows a completed competency assessment for a new inspection method, but during the audit you observe the engineer performing the inspection incorrectly. What is the most balanced response?

A) No issue – a record exists showing the competency was assessed
B) Investigate further: compare the observed performance against the competency criteria; if the practice does not meet criteria, this indicates a Clause 7.2 concern despite the paper record
C) Immediately terminate the audit
D) Disregard the observation, since training records always take precedence over direct observation

Answer: B – Direct observation that contradicts a training record should be investigated, not dismissed in favor of the paperwork.

25. Document control records show a critical work instruction has three different “current” versions in circulation across two production lines and the quality office, each with a different revision date. Which clause is most relevant, and what is the underlying risk?

A) Clause 7.5.3 Control of documented information; the risk is personnel following outdated or incorrect instructions
B) Clause 8.3 Design and development; work instructions are not controlled documents so there is no real risk
C) Clause 9.2 Internal audit; the risk is scheduling conflicts
D) Clause 6.2 Quality objectives; the risk is missed targets

Answer: A – Multiple conflicting “current” versions is a classic Clause 7.5.3 control failure with real operational risk.

26. During the audit, a customer-supplied mold is found damaged, and there is no record that the customer was informed. Which clause addresses this, and what is the correct expectation?

A) Clause 8.5.3 – the organization must report to the customer if their property is lost, damaged, or found unsuitable for use, and retain records of what occurred
B) Clause 8.5.4 – the organization is not required to inform the customer at all
C) Clause 8.4 Control of externally provided processes, only
D) This situation is not addressed anywhere in ISO 9001:2015

Answer: A – Clause 8.5.3 requires reporting to the customer when their property is lost, damaged, or unsuitable for use.

27. A finished-goods warehouse audit reveals products stored on the floor in a damp area without protective wrapping, and several units show visible corrosion. Which clause is most applicable?

A) Clause 8.5.4 Preservation of outputs during production and service provision
B) Clause 8.5.5 Post-delivery activities
C) Clause 7.1.3 Infrastructure, only
D) Clause 8.6 Release of products and services, only

Answer: A – Inadequate storage/protection causing degradation is a Clause 8.5.4 preservation issue.

28. An organization provides after-sales maintenance as a contractual obligation, but the QMS has no defined process for post-delivery activities such as warranty claims or field service. Which clause is most directly relevant?

A) Clause 8.5.5 Post-delivery activities
B) Clause 8.2.3 Review of requirements
C) Clause 9.1.2 Customer satisfaction, only
D) Clause 10.1 Improvement, only

Answer: A – Contracted after-sales obligations fall under Clause 8.5.5 Post-delivery activities.

29. An engineering change was implemented on the shop floor to correct a fit issue, but there is no record of who authorized it, when, or whether it was verified before implementation. Which clause is most applicable?

A) Clause 8.5.6 Control of changes for production or service provision
B) Clause 8.3.6, only if the change originated from a formal design activity
C) Clause 7.5.2 Creating and updating documented information, only
D) Clause 6.3 Planning of changes, only

Answer: A – An unauthorized, unverified shop-floor change to production is a Clause 8.5.6 control-of-changes gap.

30. Which of the following would be considered acceptable evidence of “release” of product per Clause 8.6, before delivery to the customer?

A) A verbal confirmation from a machine operator that the batch “looked fine”
B) Documented evidence of conformity with acceptance criteria, with traceability to the person(s) authorizing release, retained as documented information
C) A customer purchase order alone
D) A supplier’s certificate of conformity for raw material only

Answer: B – Release requires documented conformity evidence and traceable authorization, not a verbal opinion.

31. Analyzing quality data trends (Clause 9.1.3), you find scrap rates have risen steadily by 15% quarter over quarter, but no action has been taken and the trend was not presented at management review. What is the most likely finding?

A) Clause 9.1.3 – data is not being adequately analyzed and used to evaluate QMS performance; and Clause 9.3 – an important performance trend was not considered at management review
B) No nonconformity – Clause 9.1.3 only requires collecting data, not analyzing it
C) Clause 8.5.1 only
D) This is purely a financial matter, not a quality one

Answer: A – An unanalyzed adverse trend omitted from management review reflects gaps in both Clause 9.1.3 and Clause 9.3.

32. The internal audit programme states all processes should be audited annually based on risk, but records show high-risk processes (design, supplier approval) were audited at the same frequency as low-risk administrative processes. What does this indicate?

A) Full conformity, since all processes were audited within the year
B) A weakness in Clause 9.2.1 implementation – the programme should reflect the importance of the processes concerned, changes, and prior audit results, rather than treating all processes identically regardless of risk
C) An internal auditor competency issue only, not a systemic finding
D) There is no requirement to prioritize audits by risk

Answer: B – Audit programmes must weight frequency/depth by risk and importance, not treat all processes equally.

33. Management review minutes list attendees and agenda items, but record no outputs – no decisions, actions, resource needs, or improvement opportunities – and follow-up on action items cannot be demonstrated. What is the correct classification?

A) Clause 9.3.3 – management review outputs must include decisions on improvement opportunities, changes needed, and resource needs, retained as documented information
B) No issue, since attendance was recorded
C) Clause 5.1 only, since it concerns top management
D) This falls entirely outside the scope of ISO 9001:2015

Answer: A – Clause 9.3.3 requires documented outputs – decisions, actions, and resource needs – not just a record of attendance.

34. During a follow-up audit verifying closure of a previous major nonconformity, the correction was implemented, but there is no evidence of root cause analysis or that the same failure mode was checked elsewhere. What should the auditor conclude?

A) The nonconformity can be closed, since the immediate defect no longer occurs
B) The corrective action is not yet adequate per Clause 10.2; the nonconformity should remain open pending evidence of root cause analysis and broader verification
C) The follow-up audit is unnecessary once any correction has been made
D) The auditor should close it anyway, to avoid delaying certification

Answer: B – Without root cause analysis and broader verification, the corrective action is incomplete and the NC should stay open.

35. During a surveillance audit, you discover a significant, unreported change – a new product line involving different processes – that was never communicated to the certification body. What is the appropriate response?

A) Ignore it, since surveillance audits only sample a portion of the QMS
B) Note the change, verify how it was planned and controlled under Clause 6.3, assess whether it affects the certification scope, and ensure the certification body is informed so scope and future audit planning can be updated
C) Immediately suspend the certificate without further investigation
D) Mention it informally to the client and take no further action

Answer: B – Significant unreported changes must be evaluated under Clause 6.3 and reported so certification scope stays accurate.

36. An auditee files a formal complaint with the certification body alleging an auditor behaved unprofessionally and was biased. What is the appropriate process?

A) The lead auditor should personally resolve the complaint directly with the client, without involving the certification body
B) The certification body should apply a documented, impartial complaints-handling process, with investigation independent of those involved and a formal response to the complainant
C) Complaints against auditors cannot be raised once the audit report is issued
D) The complaint should be dismissed automatically, since audits are inherently subjective

Answer: B – Certification bodies must handle complaints through a documented, impartial process independent of those involved.

37. During a remote audit, you ask to see a live video demonstration of a measuring instrument’s calibration status. The auditee’s camera repeatedly shows only documents and avoids the physical equipment. What should you do?

A) Accept the documents alone as sufficient evidence
B) Request direct, unedited visual verification of the physical equipment and its calibration label; if this cannot be reliably obtained, note the limitation on evidence sufficiency and consider whether on-site verification is needed
C) End the audit without further discussion
D) Assume deliberate deception and issue a major nonconformity without further evidence

Answer: B – Insist on direct, verifiable evidence of the physical item; document any limitation on evidence sufficiency.

38. A quality manager privately asks the audit team, “Please don’t audit the new production line today – it’s not ready,” and requests the plan be quietly changed without informing the certification body. What principle should guide the response?

A) Confidentiality allows the auditor to quietly comply
B) The audit plan should only be changed through an agreed, transparent process; the lead auditor should discuss the request with the team and client contact, document any justified change, and avoid arrangements that undermine audit integrity or fairness
C) The auditor should refuse to discuss it and immediately end the audit
D) The request is irrelevant, since audit plans can never be changed under any circumstances

Answer: B – Any change to the audit plan must be transparent, justified, and agreed – never a quiet, unilateral accommodation.

39. For a high-volume, homogeneous process (thousands of identical routine transactions), which sampling approach is generally most defensible for a statistically representative conclusion?

A) Judgmental sampling based solely on the auditor’s intuition, with no defined method
B) A statistically-based sampling method (e.g., random sampling with a defined sample-size rationale), which suits large, homogeneous populations better than purely judgmental sampling
C) Reviewing only the very first and very last record chronologically
D) No sampling is needed; audits must review 100% of all records

Answer: B – Statistically-based sampling is the more defensible method for large, homogeneous populations.

40. During the closing meeting, an audit team member privately disagrees with the Lead Auditor’s decision not to raise a nonconformity for a borderline observation. What is the appropriate process for resolving this before conclusions are presented?

A) The team member should publicly contradict the Lead Auditor in front of the auditee during the closing meeting
B) Differing professional judgments should be discussed and resolved within the audit team – with the Lead Auditor responsible for the final decision – before the closing meeting, so the team presents unified, agreed conclusions
C) Each auditor should independently issue separate, conflicting reports
D) The disagreement should be ignored entirely and never documented

Answer: B – Internal disagreements are resolved within the team beforehand so a single, agreed conclusion is presented.