Free PECB Certified Management Systems Internal Auditor exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PECB Certified Management Systems Internal Auditor exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A company hires an independent consultant to audit its own management system on its behalf. How is the audit classified by the relationship between the parties?

   1. A.A first-party auditCorrect answer: A
   2. B.A second-party audit
   3. C.A third-party certification audit
   4. D.A joint audit

   Explanation: ISO 19011:2026 states: "Internal audits, sometimes called first-party audits, are conducted by, or on behalf of, the organization itself.". An external individual can conduct an internal audit on the organization's behalf; employment status does not determine the party classification. A customer auditing a provider is second party; certification is third party; joint describes multiple auditing organizations.

   Reference: ISO 19011:2026 — Guidelines for auditing management systems — 3.1, Note 1

2. 2Management arranges several audits over a year for a defined assurance purpose. The team leader separately describes activities for next week's audit. Which distinction is correct?

   1. A.Annual: programme; individual audit: planCorrect answer: A
   2. B.Annual: plan; individual audit: programme
   3. C.Annual: scope; individual audit: criteria
   4. D.Annual: criteria; individual audit: scope

   Explanation: A programme comprises "arrangements for a set of one or more audits (3.1) planned for a specific time frame and directed towards a specific purpose". An audit plan is the "description of the activities and arrangements for an audit (3.1)". The annual arrangements are the programme and next week’s activity arrangements are the plan. Scope defines boundaries and criteria define reference requirements, not these two arrangements.

   Reference: ISO 19011:2026 — Guidelines for auditing management systems — 3.5, audit programme definition

3. 3An auditor has not yet located evidence showing that an applicable criterion is fulfilled. What conclusion is justified at that point?

   1. A.Nonconformity is proved merely by the auditor's unsuccessful search
   2. B.Further appropriate inquiry is needed before inferring noncomplianceCorrect answer: B
   3. C.Conformity is proved because no failure has yet been reported
   4. D.The criterion should be removed from the audit

   Explanation: The source states: "if the auditor is not capable of finding evidence of conformity it should not necessarily be taken to infer that the auditee does not comply with the audit criteria.". An unsuccessful search alone does not establish noncompliance. It also does not prove conformity or justify dropping the criterion; further evidence evaluation is needed.

   Reference: ISO 9001 APG — Evidence collection — p.1, Guidance, audit realization

4. 4A manufacturer asks its purchasing department to audit a key supplier's management system for its own supplier assurance. Which relationship defines this audit?

   1. A.First party, because the purchasing staff are employees
   2. B.Third party, because the supplier is a separate company
   3. C.Second party, because the customer has an interest in the supplierCorrect answer: C
   4. D.Joint, because the customer and supplier both attend

   Explanation: ISO 19011:2026 states: "Second-party audits are conducted by parties having an interest in the organization, such as customers, or by other individuals on their behalf.". Customer interest defines second-party auditing. First party would be the supplier auditing itself or on its own behalf. Merely being a separate company does not create independent certification, and attendance by the auditee does not make the audit joint.

   Reference: ISO 19011:2026 — Guidelines for auditing management systems — 3.1, Note 2

5. 5An audit description identifies locations, functions, processes and the period to be covered. Which planning element is being defined?

   1. A.Audit evidence
   2. B.Audit scopeCorrect answer: B
   3. C.Audit conclusion
   4. D.Auditor competence

   Explanation: The source states: "extent and boundaries of an audit". These describe extent and boundaries. Evidence supports a judgment, conclusions are resulting judgments, and competence concerns capability, not audit boundaries.

   Reference: ISO 19011:2026 — Guidelines for auditing management systems — 3.6, audit scope definition

6. 6An applicable requirement does not demand a documented record. The auditor can verify fulfilment through direct observation. How should the lack of an additional written record be treated?

   1. A.As an automatic nonconformity
   2. B.As proof that observation cannot be objective evidence
   3. C.As not automatically disqualifying the observed evidenceCorrect answer: C
   4. D.As a reason to change the requirement to require a record

   Explanation: The source states: "objective evidence does not necessarily depend on the existence of documented information". Objective evidence need not always be documentary. A mandatory record requirement would change the conditions, but the auditor cannot invent one; observation can support verification.

   Reference: ISO 9001 APG — Evidence collection — p.2, documented information and objective evidence

7. 7One audit team evaluates a single factory's quality and environmental management systems together. Which description follows from the number of systems being audited?

   1. A.Joint audit
   2. B.Combined auditCorrect answer: B
   3. C.Follow-up audit
   4. D.Supplier audit

   Explanation: ISO 19011:2026 states: "carried out together at a single auditee (3.14) on two or more management systems". The two management systems being audited together make this a combined audit. Joint concerns two or more auditing organizations, follow-up concerns subsequent action verification, and supplier describes a party relationship; neither multiple organizations, follow-up nor a supplier relationship is specified.

   Reference: ISO 19011:2026 — Guidelines for auditing management systems — 3.2, combined audit definition

8. 8Before evaluating a process, the team agrees which requirements will be used to compare collected evidence. What is being established?

   1. A.The audit findings
   2. B.The corrective actions
   3. C.The audit criteriaCorrect answer: C
   4. D.The audit conclusions

   Explanation: The source states: "set of requirements (3.24) used as a reference against which objective evidence (3.9) is compared". Criteria are the reference requirements used for comparison. Findings and conclusions follow evaluation, while corrective actions address causes of nonconformities.

   Reference: ISO 19011:2026 — Guidelines for auditing management systems — 3.8, audit criteria definition

9. 9During an audit, the team waits only for documents selected by the auditee and does not seek evidence relevant to its own audit trails. What should the auditor do?

   1. A.Treat the auditee's selected bundle as the complete universe of evidence
   2. B.Ask the auditee to determine the final audit findings
   3. C.Conclude nonconformity because the bundle is incomplete
   4. D.Actively seek the evidence needed to evaluate the criteriaCorrect answer: D

   Explanation: The source states: "seek out that evidence rather than requiring the auditee to “serve up the evidence on a plate”.". Auditors should seek relevant evidence, rather than passively accept a curated set. The bundle neither defines all evidence nor delegates evaluation, and incompleteness alone does not establish a particular nonconformity.

   Reference: ISO 9001 APG — Evidence collection — p.1, Introduction

10. 10Two auditing organizations conduct one audit together at a single auditee. Only one management system is included. What makes this a joint audit?

    1. A.Its inclusion of more than one management-system discipline
    2. B.Its use of both physical and virtual audit locations
    3. C.Its combination of first-party and second-party objectives
    4. D.Its participation by two or more auditing organizationsCorrect answer: D

    Explanation: ISO 19011:2026 states: "carried out at a single auditee (3.14) by two or more auditing organizations". Joint is defined by multiple auditing organizations at one auditee. Multiple disciplines would support combined, physical/virtual techniques concern methods, and mixed party objectives do not define joint auditing.

    Reference: ISO 19011:2026 — Guidelines for auditing management systems — 3.3, joint audit definition