ISO AUDITOR Risk & Opportunity Assessment 2 — Questions and Answers
Question 1: Under ISO 9001:2015, which clause specifically requires the organization to determine external and internal issues relevant to its purpose when establishing risk context?
- Clause 4.1 (Correct answer)
- Clause 6.1
- Clause 8.1
- Clause 9.1
Correct answer: Clause 4.1
Clause 4.1 requires determining external and internal issues that are relevant to the organization's purpose and that affect its ability to achieve intended results.
Question 2: An auditor reviews a company's risk register and finds that all risks are rated only by likelihood, with no consideration of impact. What is the primary deficiency?
- The risk register lacks a two-dimensional risk evaluation approach (Correct answer)
- The risk register is not required by ISO 9001
- Likelihood is the only factor required by ISO 9001
- The register should only list opportunities, not risks
Correct answer: The risk register lacks a two-dimensional risk evaluation approach
Effective risk evaluation under ISO 9001:2015 considers both the likelihood of occurrence and the severity of consequences to prioritize risks appropriately.
Question 3: A manufacturing firm identifies a new regulation that could restrict a key raw material. Under ISO 9001:2015, this would be classified as:
- An external risk requiring action planning (Correct answer)
- An internal opportunity for process improvement
- A corrective action trigger
- A management review input only
Correct answer: An external risk requiring action planning
New regulations are external issues (Clause 4.1) that create risks to achieving quality objectives and require actions planned under Clause 6.1.
Question 4: ISO 9001:2015 requires that actions taken to address risks and opportunities be proportionate to:
- The potential effect on conformity of products and services (Correct answer)
- The number of employees affected
- The cost of implementation
- The age of the QMS
Correct answer: The potential effect on conformity of products and services
Clause 6.1.2 states that actions to address risks and opportunities shall be proportionate to the potential impact on conformity of products and services.
Question 5: During an audit, you discover that risk and opportunity actions are planned but never integrated into QMS processes. Which ISO 9001:2015 requirement is NOT being met?
- Clause 6.1 — actions must be integrated and implemented in QMS processes (Correct answer)
- Clause 7.5 — documented information must be retained
- Clause 8.4 — external provider control
- Clause 10.2 — nonconformity and corrective action
Correct answer: Clause 6.1 — actions must be integrated and implemented in QMS processes
Clause 6.1.2 explicitly requires that actions to address risks and opportunities be integrated into and implemented within QMS processes.
Question 6: Which of the following best describes an 'opportunity' in the context of ISO 9001:2015 risk-based thinking?
- A favorable circumstance that can be exploited to improve performance or achieve objectives (Correct answer)
- The absence of a documented risk
- A corrective action that resolved a nonconformity
- A customer complaint that leads to product redesign
Correct answer: A favorable circumstance that can be exploited to improve performance or achieve objectives
An opportunity is a set of circumstances that makes it possible to achieve a positive outcome, such as adopting new technology or entering a new market to enhance quality performance.
Question 7: An auditor asks for evidence that risk-based thinking has been applied across the QMS. Which combination of records would best satisfy this request?
- Risk register linked to QMS process controls and objective plans (Correct answer)
- Customer satisfaction surveys and audit schedules
- Supplier evaluation forms and training records
- Management review minutes and corrective action logs
Correct answer: Risk register linked to QMS process controls and objective plans
A risk register linked to process controls and objective plans demonstrates that risks have been identified, evaluated, and addressed through actual QMS mechanisms.
ISO AUDITOR Risk & Opportunity Assessment 2
Under ISO 9001:2015, which clause specifically requires the organization to determine external and internal issues relevant to its purpose when establishing risk context?