Free CQA Exam Flashcards

A first-party audit is performed within an organization on its own system or processes. A second-party audit is performed by a party with an interest, commonly a customer auditing a supplier. A third-party audit is performed by an independent external body, such as a certification body.

A product audit evaluates an output against product requirements. A process audit evaluates whether a process is controlled and effective. A system audit evaluates an interconnected management system against broader criteria. The audit object—not merely the department visited—determines the type.

A combined audit evaluates multiple management systems together. A joint audit uses two or more auditing organizations on one auditee. A hybrid audit mixes on-site and remote methods, while a remote audit gathers evidence without the audit team being physically present at the audited location.

A compliance audit determines conformity with specified requirements. A surveillance audit periodically checks continued conformity after approval or certification. A for-cause audit responds to a specific concern, event, or credible signal and focuses its scope on the triggering risk.

The purpose explains why the audit is being performed; the scope defines its boundaries, locations, functions, processes, and period. A CAPA-verification audit may be narrow and evidence-focused, while a system-effectiveness audit requires broader process interactions. Scope should be sufficient to achieve the stated purpose.

Criteria are the requirements used as the reference. Evidence is verifiable information gathered during the audit. A finding results from evaluating that evidence against the criteria. Without a criterion, an observation may be interesting but cannot support a conformity or nonconformity conclusion.

The audit client is the person or organization requesting or commissioning the audit. The auditee is the organization or part of an organization being audited. They may be within the same company, but their roles, authority, and responsibilities should remain clear.

The lead auditor directs the team and is accountable for coordinating planning, assignments, communication, evidence evaluation, meetings, and the report. Team members gather and analyze evidence in assigned areas. The lead should use team expertise without surrendering responsibility for a coherent audit conclusion.

An observer accompanies the audit under agreed arrangements but does not perform auditor duties or interfere with evidence collection. The lead auditor should clarify the observer's role, confidentiality obligations, and access limits so the observer does not influence interviews or conclusions.

Confidentiality protects information obtained through the audit. Due care requires competent, diligent judgment proportional to the risk. Conflict-of-interest controls identify relationships or incentives that could impair impartiality. An auditor should disclose a conflict and follow the program's decision on reassignment or safeguards.

If immediate danger exists, follow the site's emergency and safety procedures. Preserve and verify the evidence, then communicate promptly through the authorized escalation path. Stay within the auditor's authority and applicable legal obligations; do not conceal the issue or make accusations beyond the evidence.

Credibility depends on competent auditors, objective and traceable evidence, consistent methods, transparent criteria, and sufficient independence from the activity audited. Independence does not require every auditor to be external; an internal auditor can be independent of the work being evaluated.

Confirm audit authority, purpose, scope, type, delivery format, applicable criteria, process boundaries, resources, and documentation needs. These decisions should agree with one another. A scope that cannot answer the audit purpose should be corrected before detailed scheduling begins.

Review applicable requirements, process maps, procedures, prior audit results, complaints, performance trends, major changes, and open CAPAs. Look for repeat findings, high-risk interfaces, and weak performance. Pre-audit review directs attention but does not replace collecting current evidence.

Define the population, selection method, sample rationale, and how risk affects depth. Include different shifts, sites, products, periods, or risk groups when relevant. Record what was sampled so another reviewer can understand the coverage and limits of the evidence.

Forward tracing follows an input or requirement through processing to the final output and records. Backward tracing starts with an output, event, or record and follows it to source materials, approvals, and prior steps. Using both directions can expose broken traceability or inconsistent controls.

It should identify objectives, scope, criteria, locations, timing, team assignments, key contacts, meetings, methods, and logistical or confidentiality needs. Share it with relevant stakeholders early enough to resolve conflicts, while recognizing that evidence may justify controlled changes during the audit.

Confirm authority, purpose, scope, criteria, schedule, methods, communication channels, rating approach, confidentiality, safety, and participant roles. The meeting creates a common operating framework; it is not the time to announce conclusions before evidence has been collected.

Each method has limits. Interviews describe intended or remembered practice, observation shows current behavior, measurements provide quantitative facts, and documents show requirements or records. Agreement among independent sources strengthens evidence; contradictions indicate where further investigation is needed.

Objective evidence can be observed, measured, confirmed, corroborated, or documented. It is specific enough to be verified and connected to the audit criteria. An auditor's intuition may guide the next sample, but it is not itself evidence for a finding.

Adjust when evidence reveals unexpected risk, a key process is unavailable, time is being consumed unevenly, or the original coverage will not achieve the objectives. Reallocate resources and communicate the change promptly while protecting scope integrity and required independence.

Group related evidence by criterion and process, then consider significance, severity, frequency, and risk. Distinguish an isolated event from a systemic pattern and assess potential effects on products, processes, systems, and cost. Escalate sampling when the available evidence is insufficient.

Restate purpose, scope, and rating criteria; present supported results; confirm that the evidence is understood; and explain response, CAPA, follow-up, and responsibility expectations. Agreement on the evidence is valuable, but the auditee need not agree with every audit conclusion.

Identify the applicable requirement, state the specific objective evidence, and explain the gap between them. Avoid blame, speculation, and vague phrases such as 'poor system.' A reader should be able to trace the statement to both the criterion and the sampled facts.

Provide context, objectives, scope, criteria, methods, a clear executive summary, prioritized findings, evidence-based conclusions, and response timelines. Use unique identifiers for tracking and obtain required approvals before controlled distribution and retention of the audit file.

Correction fixes or contains the detected problem. Root-cause analysis determines why the problem occurred. Corrective action removes or controls the cause to prevent recurrence. Closing a finding after correction alone leaves the system vulnerable to the same failure.

Verify implementation through revised documents, records, training, and direct observation, then examine outcome data over a meaningful period to determine whether recurrence was prevented. If action is late or ineffective, escalate, reissue the request, expand follow-up, or re-audit under the program rules.

Useful characteristics include integrity, observation, analytical thinking, attention to detail, diplomacy, cultural awareness, adaptability, and the ability to work independently and collaboratively. Effective auditors remain curious and firm without becoming adversarial or assuming that difference equals nonconformity.

Match assignments to competence, technical expertise, independence, language ability, and risk while balancing workload and schedule. Clarify deliverables and interfaces, especially where processes cross departments. Reassign resources when evidence or timing shows the original plan is no longer effective.

Remain calm, restate the request and agreed ground rules, clarify why the evidence is needed, and offer a reasonable time-bound path. If obstruction continues, document it and involve the lead auditor, audit client, or appropriate authority rather than arguing personally.

Technical audiences may need detailed evidence, process data, and criterion references. Executives need material risk, trends, business impact, and decisions. Keep the facts consistent while changing depth and presentation; charts should clarify the conclusion rather than decorate the report.

Use open-ended questions to explore a process: 'How do you approve this change?' Use closed questions to confirm a specific fact: 'Was this approved before release?' Begin broadly, then narrow and verify without using leading questions that suggest the desired answer.

Active listening focuses on the speaker, pauses, and meaning rather than preparing the next question. Paraphrasing—'So the supervisor releases every batch; is that correct?'—checks understanding and gives the interviewee a chance to correct ambiguity before the auditor records evidence.

A supervisor may inhibit candid responses, while a translator can alter nuance. Explain roles, direct questions to the interviewee, observe pauses and body language carefully, and confirm key facts through records or observation. Use private interviews when appropriate and permitted.

Forming establishes orientation and dependence; storming brings disagreement; norming establishes working agreements; performing delivers effective collaboration; and adjourning closes the team's work. A leader changes support and direction as the team moves through these stages.

Invite evidence and interpretations from every member, separate facts from opinions, test conclusions against criteria, and resolve disagreement through reasoned review. Prevent one expert or senior member from dominating. Consensus should result from evidence, not pressure to appear united.

Define secure platforms, time zones, contacts, document access, evidence naming, backup channels, and when live video or local support is required. Confirm what was actually observed versus shown indirectly. Geographic convenience must not weaken evidence integrity or confidentiality.

Management should establish authority, independence, objectives, resources, and access, then respond to material results. Budgets must include planning, fieldwork, reporting, follow-up, auditee time, and special audit needs. A nominal program without time or escalation authority cannot provide credible assurance.

Define role-specific knowledge and skill requirements, evaluate initial competence, provide training in audit methods and applicable requirements, observe performance, and maintain continuing development. Include cultural, communication, facilitation, and industry considerations rather than treating one generic course as permanent qualification.

Use a balanced set such as plan completion, report timeliness, CAPA closure and effectiveness, repeat findings, risk reduction, stakeholder response, and business impact. Counts of completed audits show activity, not effectiveness. Summarize trends and changing risks for management review.

Set a risk-based cycle, then revise frequency and scope using changes, prior results, complaints, performance, and emerging risks. Analyze findings across departments and sites for systemic patterns. Share verified best practices rather than merely repeating the same calendar each year.

Define risk-based qualification, self-assessment, audit, surveillance, improvement, escalation, and re-evaluation methods. Consider supplier criticality, performance, geography, outsourced-audit controls, and contractual access. A questionnaire alone is not sufficient assurance for every supplier risk.

Higher or changing risk can justify more frequent, deeper, or specially skilled audits; stable low risk may support reduced coverage with monitoring. Consider business continuity and succession readiness as well as operational quality. Document the rationale so resource choices are defensible.

Evaluate access control, audit trails, data changes, retention, retrieval, backup, security, and evidence of unauthorized activity or fraud. Confirm that records remain attributable, complete, accurate, and available. A clean screen view does not prove the underlying data are controlled.

Prevention costs avoid defects, appraisal costs evaluate conformity, internal-failure costs arise before delivery, and external-failure costs arise after delivery. Audit trends can show whether investment in prevention and effective controls is reducing failure cost and supporting business objectives across connected processes.

Use Pareto charts to rank categories, cause-and-effect diagrams or 5 Whys to explore causes, flowcharts to expose steps, control charts to study behavior over time, histograms to view distributions, scatter diagrams to explore association, check sheets to collect data, and PDCA to test and standardize improvement.

DMAIC defines the problem, measures current performance, analyzes causes, improves the process, and controls the gain. Lean tools remove waste and improve flow: 5S organizes work, kanban controls pull, error-proofing prevents mistakes, standard work stabilizes methods, and value-stream mapping exposes delay and waste.

Mean, median, and mode describe center; standard deviation and a frequency distribution describe spread and shape. Look for systemic versus isolated patterns and investigate outliers. Common-cause variation belongs to the current system; special causes are specific signals. For a stable process, Cp reflects potential spread-based capability, while Cpk also reflects centering and cannot exceed Cp.

Random sampling gives population members a defined chance of selection. Stratified sampling draws from important subgroups; cluster sampling selects natural groups and examines units within them. Producer risk is rejecting acceptable quality, while consumer risk is accepting unacceptable quality. Confidence and measurement-system adequacy affect how strongly the sample supports a conclusion.

Change control authorizes and assesses change; configuration management preserves the approved baseline. Verification asks whether specified requirements were met, while validation asks whether intended use is met. FMEA studies failure modes, HACCP controls critical hazards, CTQ translates customer needs into measures, and SWOT frames internal and external strategy factors.