PECB ISO-45001-Lead-Auditor Practice Test Questions Answers

Audit reports should provide a clear summary of the audit process, findings, and conclusions based on the defined scope, objectives, and criteria. They do not include administrative details (e.g., invoices) or operational aspects (e.g., corrective action plans).

Analysis of Options:

A. A copy of the certification body invoice for the audit: Incorrect. Invoices are unrelated to the content of audit reports and are handled separately.

B. A reference to the audit criteria used: Correct. Audit criteria (e.g., ISO 45001 standards) must be included in the report to define the basis for the audit.

C. A statement of the audit objectives: Correct. The report must outline the objectives to ensure clarity on the purpose of the audit.

D. Audit findings and any related evidence: Correct. Findings and evidence are essential to support conclusions and recommendations.

E. Confirmation of the audit scope: Correct. The scope defines the boundaries of the audit and must be documented in the report.

F. Contact details for all members of the audit team: Incorrect. Personal contact details are unnecessary and not typically included in reports.

G. The audit conclusions reached: Correct. Conclusions summarize the outcomes of the audit, such as conformity, nonconformities, or recommendations.

H. A corrective action plan that addresses the identified nonconformities: Incorrect. Corrective action plans are the auditee ' s responsibility and not included in the audit report.

ISO References:

ISO 19011:2018, Clause 6.7.3: Content of audit reports.

The correct responses are C and D .

Certification bodies are required to have documented procedures for determining audit time and to determine the time needed to plan and accomplish a complete and effective audit . Audit duration is not something that can simply be shortened because the client asks for less disruption. ISO/IEC 17021-1 requires the certification body to determine audit time through its documented process, and the justification for the duration must be recorded. ( IAS )

IAF MD 5 also states that certification bodies shall identify the audit time for each client and that this framework is used within the certification body’s processes to determine the appropriate audit time , taking into account the specifics of the client organization. That means the request may be considered , but it does not have to be accepted. ( IAF )

Therefore:

C. Advise that his request will be considered but may not be taken up is correct, because the certification body can review the request, but the final decision must still comply with its audit-time rules and adequacy requirements. ( IAF )

D. Advise the OHS Manager that the audit duration and team make-up will be decided in line with the internal procedures of the certification body is correct, because ISO/IEC 17021-1 requires the certification body to use documented procedures for audit time and team decisions. ( IAS )

Why the other options are incorrect:

A is inappropriate because the request is not automatically a reason to tell the client to choose another certification body.

B is incorrect because the request cannot simply be accepted without following the certification body’s rules. ( IAS )

E is too absolute; the request should be considered against the certification body’s requirements, not rejected automatically. ( IAF )

F is unnecessary because the people managing the audit programme already have the responsibility to handle such matters through the certification body’s procedures. ( IAS )

The correct answer is D .

ABC states that it has implemented one single OH and S management system for both plants . Once a single management system covers both sites, the certification body has to determine and audit the scope of the management system being operated , not an artificially narrowed commercial scope. IAF MD 1 says a multi-site organization has a single management system , and the certification body must confirm that a single management system is deployed and determine the scope of the management system being operated . It also says the certification document must reflect the scope of certification and the sites/legal entities covered by that multi-site certification. ( IAF )

The argument that XYZ is “just a supplier” does not solve the problem. IAF MD 5 makes an important distinction: where an external provider is only a supplier, the certification body audits the organization’s control of the supplied activity, not the performance of the activity itself . But here, XYZ is not outside the management system; ABC has already said both plants are inside one single OHSMS . So XYZ cannot simply be treated as an external supplier for certification-scoping purposes. ( IAF )

This is also consistent with the multi-site certification rules that do not allow an organization to exclude covered sites just to avoid certification consequences. IAF MD 1 explicitly says it is not admissible to exclude a problematic site from scope during certification, and the certification documents must show the sites covered by the certified system. While this example is about a “problematic” site, the principle is the same: once the site is part of the single management system, it cannot be carved out simply for convenience or marketing. ( IAF )

Therefore, as a third-party auditor, you should not agree to audit only the food plant while ignoring the packaging plant if both are included in the same ISO 45001 management system.