CQP Intermediate Level
Management Systems Audits flashcards
Read the question, say the answer to yourself, then turn the card to check. The first 10 of 50 cards are free; the rest come with the subject.
Card 1 of 50
Jump to a card
Complete Flashcard Reference
Review every card in this deck. Open any card to reveal its answer. The first 10 are free; the other 40 come with the subject.
How does KS ISO 19011 define an audit?
A systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Systematic: planned and methodical. Independent: free from bias, never auditing your own work. Documented: the conclusion can be traced back to what was seen.
What are the seven principles of auditing in ISO 19011?
1. Integrity 2. Fair presentation 3. Due professional care 4. Confidentiality 5. Independence 6. Evidence-based approach 7. Risk-based approach
What is the difference between a correction and a corrective action?
Correction: action to eliminate a detected nonconformity. It deals with the instance, for example having an uncalibrated scale calibrated. Corrective action: action to eliminate the cause of a nonconformity and prevent recurrence, for example finding out why the calibration schedule was missed and changing the system so an overdue calibration is escalated.
How does a risk-based internal audit programme allocate its auditor-days?
Score each process, for example 1 to 5 on consequence of failure (C), likelihood (L) and detectability by other means (D, where 5 = would not be detected). Score = C x L x D. Label and coding control at 5 x 4 x 4 = 80 earns far more days than internal communication at 2 x 2 x 2 = 8. Allocate days in proportion to the score rather than evenly, and re-score after any significant change, incident or complaint.
Why does an auditor ask open questions and never leading ones?
An open question invites description and produces information: 'walk me through how a batch is released'. A leading question invites the answer it contains and produces agreement: 'you do calibrate this monthly, don't you?' The evidence it yields is worthless.
How do the audit programme, the audit plan and the checklist differ?
Audit programme: arrangements for a set of audits planned for a specific time frame and directed towards a specific purpose. Audit plan: the activities and arrangements for one audit, prepared by the team leader and agreed with the audit client and the auditee. Checklist: the auditor's own working document for one audit, an aide-memoire rather than a script, not usually issued.
What are the three parts of a properly recorded audit finding?
1. The requirement: cited exactly, to clause, or to document number and revision. 2. The evidence: verifiable, specific, with identifiers, and factual. No adjectives, no attribution, no inference. 3. The statement of nonconformity: one impersonal sentence saying what requirement is not met.
How is a major nonconformity distinguished from a minor one?
Major: a requirement is absent, a control has systemically failed, or the failure raises significant doubt about the system's ability to achieve intended results. Several minor findings against one requirement can add up to one major. Minor: an isolated lapse in an otherwise implemented control, which does not raise doubt about the system as a whole.
How do internal audit results reach management review under KS ISO 9001?
Clause 9.2 requires internal audits; clause 9.3 requires top management to review the system at planned intervals. Clause 9.3.2 makes audit results a required input to that review, and clause 9.3.3 sets its outputs: decisions on improvement, changes to the system and resource needs. Internal audit has no authority to change anything; management review has the authority and needs the evidence.
What is the difference between verifying implementation and verifying effectiveness?
Implementation: the promised action was done, for example the procedure revised and the staff trained. Necessary, but it proves nothing about the outcome. Effectiveness: the nonconformity has stopped occurring, shown by a sample of output since the change. Only this satisfies clause 10.2.1(d), and it needs enough time and output to mean something.
What are audit criteria?
This answer comes with Management Systems Audits. Buy the subject
What is objective evidence, and what does it exclude?
This answer comes with Management Systems Audits. Buy the subject
What are first party, second party and third party audits?
This answer comes with Management Systems Audits. Buy the subject
What is the difference between a combined audit and a joint audit?
This answer comes with Management Systems Audits. Buy the subject
How does an audit differ from an inspection and from a consultancy?
This answer comes with Management Systems Audits. Buy the subject
Why can an audit never prove that a system conforms?
This answer comes with Management Systems Audits. Buy the subject
Who are the audit client, the auditee, a technical expert, an observer and a guide?
This answer comes with Management Systems Audits. Buy the subject
What sequence of audit activities does ISO 19011 set out?
This answer comes with Management Systems Audits. Buy the subject
In which two directions can an audit fail its objectives?
This answer comes with Management Systems Audits. Buy the subject
Does a risk-based audit programme allow low-risk processes to go unaudited?
This answer comes with Management Systems Audits. Buy the subject
What does clause 9.2.2 of KS ISO 9001 require of the audit programme?
This answer comes with Management Systems Audits. Buy the subject
What does an audit plan contain under ISO 19011?
This answer comes with Management Systems Audits. Buy the subject
What are the audit team leader's responsibilities?
This answer comes with Management Systems Audits. Buy the subject
How can a 90-person, single-site organisation meet the independence requirement for internal audit?
This answer comes with Management Systems Audits. Buy the subject
What is the three-source rule of audit technique?
This answer comes with Management Systems Audits. Buy the subject
An auditee asks 'so what should we do about it?' How should the auditor respond?
This answer comes with Management Systems Audits. Buy the subject
What is the 'no surprises' rule for the closing meeting?
This answer comes with Management Systems Audits. Buy the subject
Why must a finding never name an individual or record demeanour?
This answer comes with Management Systems Audits. Buy the subject
Which Kenyan statutory and regulatory requirements can be audit criteria?
This answer comes with Management Systems Audits. Buy the subject
Can an auditor raise a nonconformity against a practice they consider poor but cannot link to a requirement?
This answer comes with Management Systems Audits. Buy the subject
What is the purpose of the opening meeting, and what does it confirm?
This answer comes with Management Systems Audits. Buy the subject
What is presented at the closing meeting?
This answer comes with Management Systems Audits. Buy the subject
When does an auditor report a finding immediately rather than at the closing meeting?
This answer comes with Management Systems Audits. Buy the subject
What should an auditor do when required records cannot be produced?
This answer comes with Management Systems Audits. Buy the subject
How should an auditor respond if the auditee tries to influence them with an inducement?
This answer comes with Management Systems Audits. Buy the subject
What is the sequence of questions in a good audit interview?
This answer comes with Management Systems Audits. Buy the subject
What must an audit report include under ISO 19011?
This answer comes with Management Systems Audits. Buy the subject
How do a finding, a conclusion and a recommendation differ?
This answer comes with Management Systems Audits. Buy the subject
Why is a repeat finding more significant than a new one?
This answer comes with Management Systems Audits. Buy the subject
What is the single most informative figure internal audit can present to management review?
This answer comes with Management Systems Audits. Buy the subject
What are the commonest false root causes, and why are they false?
This answer comes with Management Systems Audits. Buy the subject
What two tests must a root cause pass?
This answer comes with Management Systems Audits. Buy the subject
Which two extent questions must be answered before a corrective action is designed?
This answer comes with Management Systems Audits. Buy the subject
What does clause 10.2.1 of KS ISO 9001 require when a nonconformity occurs?
This answer comes with Management Systems Audits. Buy the subject
What are the limitations of the 5 whys and of the Ishikawa diagram?
This answer comes with Management Systems Audits. Buy the subject
When would you use change analysis, and when barrier analysis?
This answer comes with Management Systems Audits. Buy the subject
If a failure rate had not really changed, how likely is a clean sample of n checks?
This answer comes with Management Systems Audits. Buy the subject
How do follow-up timescales differ for major and minor nonconformities?
This answer comes with Management Systems Audits. Buy the subject
When is an audit complete, and is that the same as closing its findings?
This answer comes with Management Systems Audits. Buy the subject
How is auditor competence determined, acquired, evaluated and maintained under ISO 19011?
This answer comes with Management Systems Audits. Buy the subject
How to revise with these cards
- Answer out loud or on paper before you turn the card: recalling is what fixes it.
- Go through the deck in short sessions of ten to fifteen minutes, every day.
- Shuffle once you know the order, so you are not answering from memory of the sequence.
- When a card catches you out, read the chapter it links to, then try the topic in a past paper.