Free CQI IRCA QMS LA Exam Flashcards

Customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision making, and relationship management. They explain the intent behind ISO 9001's requirement clauses but are never themselves cited as audit criteria.

Plan = Clauses 4-6 (context, leadership, planning); Do = Clauses 7-8 (support, operation); Check = Clause 9 (performance evaluation); Act = Clause 10 (improvement). The clause sequence was deliberately built around PDCA.

Replaced the standalone 'preventive action' clause from the 2008 edition. Requires proportionate action on risks and opportunities — NOT a mandatory formal risk-management methodology, risk register, or quantified scoring. Surfaces in clauses 4.4, 5.1.2, 6.1, and 9.3.

The common ten-clause skeleton (1 Scope, 2 Normative references, 3 Terms/definitions, 4 Context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement) shared by ISO 9001, 14001, 45001 and other modern ISO management system standards. Clauses 1-3 are not substantive audit criteria.

Inputs/outputs, sequence and interaction, criteria/methods (including monitoring and KPIs), resources needed, assigned responsibilities/authorities, risks and opportunities, and how the process will be evaluated and improved. SIPOC and the turtle diagram are practical tools for this.

Requires determining external and internal issues relevant to the organization's purpose and strategic direction that affect its ability to achieve intended QMS results, and monitoring/reviewing that information over time.

Requires determining interested parties relevant to the QMS and their relevant requirements. Analysis is limited to parties and requirements relevant to the QMS — not an exhaustive stakeholder census.

The QMS scope must be maintained as documented information, including written justification for any requirement determined not applicable. An exclusion is valid only if it does not affect the organization's ability to ensure conformity of products/services or enhance customer satisfaction.

ISO 9001:2015 removed the mandatory 'management representative' role. Clause 5.1.1(a) places direct, non-delegable accountability for QMS effectiveness on top management — auditors must gather evidence of leadership commitment directly from top management, not just the quality department.

Must be appropriate to the organization's context, provide a framework for quality objectives, and commit to satisfying requirements and continual improvement. It must be documented, communicated, understood within the organization, and available to relevant interested parties.

Requires determining risks/opportunities arising from the Clause 4.1/4.2 context and planning proportionate actions to address them. ISO 9001:2015 does NOT require a documented risk-management process or a formal risk register.

What will be done, what resources are required, who is responsible, when it will be completed, and how results will be evaluated. Objectives must also be consistent with policy, measurable where practicable, monitored, communicated, and updated. Missing any element is a common audit finding.

When measuring equipment is found unfit for purpose, the organization must assess the impact of the finding on the validity of previous measurement results — not simply recalibrate the equipment and move on. This is a high-yield exam detail.

Addresses institutional-memory risk: what happens to critical process knowledge when an experienced person leaves. Draws on internal sources (experience, lessons learned) and external sources (standards, customers, conferences).

'Maintained' documented information (e.g., procedures, policy) is kept current. 'Retained' documented information (records) is fixed evidence of a result. Both must be identified, formatted, and reviewed/approved before use.

Requirements must be reviewed BEFORE the organization commits to supply a product or service. Verbal orders must be confirmed before acceptance, and the results of the review must be documented — auditors check the review is dated before production, not retrofitted afterward.

Three distinct controls: review evaluates design progress against requirements; verification checks design outputs against design inputs; validation checks the resulting product/service against its intended or specified use, and must be completed before delivery unless the customer stipulates otherwise.

(1) Products/services incorporated into the organization's own products/services, (2) products/services delivered directly to the customer on the organization's behalf, and (3) a process, or part of a process, outsourced to an external provider.

Correction; segregation/containment/return/suspension; informing the customer; and obtaining concession authorization. Required documented information must record the nonconformity, actions taken, any concessions obtained, and who authorized the disposition.

Auditors must be selected, and audits conducted, to ensure the objectivity and impartiality of the audit process — nobody may audit their own work.

Required inputs include status of previous actions, changes in issues, performance trends (customer satisfaction, objectives, conformity, nonconformities, monitoring results, audit results), resource adequacy, and risk/opportunity effectiveness. External provider performance and resource adequacy are the two most commonly missing inputs.

Correction eliminates a DETECTED nonconformity's symptom (e.g., re-calibrating one out-of-tolerance gauge). Corrective action eliminates the ROOT CAUSE to prevent recurrence (e.g., revising the calibration schedule so gauges never drift again).

Requires root-cause analysis, including checking whether similar nonconformities exist elsewhere or could potentially occur. Corrective action taken must then be reviewed for effectiveness.

Integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach. Risk-based approach is the newest, added in the 2018 revision.

Audit evidence is compared against audit criteria to produce an audit finding (conformity, nonconformity, or opportunity for improvement — ISO 19011:2018 clause 3.6). Findings are then synthesized by the audit team into an overall audit conclusion.

Requires truthfully and accurately reporting audit findings, conclusions, and reports — including significant obstacles encountered during the audit and unresolved diverging opinions between the audit team and the auditee. These must never be omitted.

First-party = the organization audits its own QMS (internal audit, Clause 9.2). Second-party = an organization audits an external party with a direct interest, e.g., a customer auditing a supplier. Third-party = an independent certification body with no direct commercial relationship, governed by ISO/IEC 17021-1.

A combined audit covers two or more management-system disciplines (e.g., QMS + EMS) at one site by one audit team. A joint audit means two or more auditing organizations cooperate to audit a single auditee together.

Set programme objectives → determine and evaluate programme risks and opportunities → establish the programme's extent and resources → establish supporting procedures.

Audit objectives, scope, and criteria; locations, dates, and duration; methods including the extent of sampling; roles and responsibilities of the team; and allocation of resources to critical areas. Must be reviewed and accepted by the audit client and presented to the auditee before the opening meeting.

Directs more time and larger or more targeted samples toward higher-risk processes, consistent with the risk-based approach — the seventh ISO 19011:2018 audit principle.

Interviews, observation of activities, review of documented information/records, and data or performance indicators. Evidence is strongest when multiple independent sources corroborate the same finding; only verified information counts as audit evidence.

Start with open questions, avoid leading the interviewee, and corroborate the interviewee's statements with other evidence rather than accepting them at face value.

Tracing a single process forward and backward across every function it touches (e.g., order-to-delivery) rather than visiting departments in isolation. This exposes the handoffs where nonconformities most often hide.

Because audits rely on sampling rather than a 100% review of evidence. This inherent audit risk is managed through risk-based, representative sampling — it is never fully eliminated.

A technical expert provides specific subject-matter knowledge to the audit team but does not act as an auditor. Observers and auditors-in-training may accompany the team, with agreement of the team leader, auditee, and audit client, but do not audit.

The total breakdown or absence of a required process; a nonconformity likely to result in product or service failure; or an accumulation of minor nonconformities against one requirement showing a systemic failure.

A single lapse or isolated slip that does NOT represent a systemic failure of the process or requirement.

Neither ISO 9001 nor ISO 19011 defines these grades. The certification body sets its own grading scheme under its ISO/IEC 17021-1 obligations, though the major/minor definitions taught on IRCA courses are the industry-standard convention.

An unresolved major nonconformity blocks certification or recertification. Minor nonconformities typically allow certification to proceed against an accepted correction and corrective-action plan.

(1) The requirement — the specific clause or documented procedure not met; (2) the objective evidence — specific, factual, traceable data; (3) the statement of nonconformity that links the two together.

Must cite a specific ISO 9001:2015 clause number (or documented procedure) that was not met — never a general area of the standard, and never a quality management principle by name.

Must be specific, factual, and traceable: exact document or record references, dates, sample sizes, and roles. Vague words like 'some,' 'often,' or 'poorly' are not acceptable.

The names of individuals or opinions about a person's competence or attitude — reference roles and facts only, so the statement is defensible and someone who wasn't on the audit can trace it back to the record, interview, or observation that generated it.

Presents findings, confirms nonconformity grading, and agrees timeframes for the auditee's response. It should surface no findings the auditee hasn't already seen the supporting evidence for during the audit.

Requires objective evidence that the corrective action was BOTH implemented AND effective — a completed action plan alone is not sufficient to close the nonconformity.

Governs certification bodies (CBs) themselves — their competence, consistency, impartiality, and confidentiality when auditing and certifying management systems. It does not set QMS requirements; that is ISO 9001.

National accreditation bodies (e.g., UKAS, ANAB) accredit certification bodies against ISO/IEC 17021-1. The IAF's multilateral recognition arrangement keeps accreditation consistent worldwide.

Stage 1 is a readiness review that evaluates documented information and readiness for Stage 2. Stage 2 is the on-site audit of implementation and effectiveness of the QMS, leading to the certification decision, which is made by CB personnel independent of the audit team.

Certified organizations receive surveillance audits at least annually and undergo a full recertification audit before the three-year certification cycle expires. A CB or auditor that consulted on the QMS design cannot later audit that same QMS.