The activities that are specifically required by ISO 17021-1 as part of third-party (Certification Body) surveillance audit processes are:
*Option A: Audit use of certification marks on marketing materials. This option is correct because ISO 17021-
1:2015 clause 9.6.2.2 requires the certification body to audit the client's use of marks and/or any other reference to certification, as applicable, to ensure conformity with the certification requirements.
*Option B: Review changes to the QMS since last visit. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review any changes affecting the client's quality management system and its ability to continue to fulfil the requirements of the standard used for certification.
*Option C: Confirm effectiveness of internal audit and management review. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to confirm the continuing effectiveness of the client's quality management system, including the effectiveness of the internal audit and management review processes.
*Option F: Review the status of previously raised findings and audit effectiveness of any outstanding findings.
This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review the status of findings and any corrective actions taken by the client in response to previous audits, and to verify the effectiveness of the implemented corrective actions.
*Option H: Verify legal compliance. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to verify the client's compliance with applicable statutory and regulatory requirements related to the scope of certification.
*Option I: Handling of customer complaints since last visit. This option is correct because ISO 17021-1:2015 clause 9.6.2.2 requires the certification body to review the client's handling of customer complaints related to the certified activities since the last audit.
The following options are not correct:
*Option D: Complete a full document review of the quality management system. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to complete a full document review of the quality management system during surveillance audits. A full document review is only required during the initial certification audit or when there are significant changes to the quality management system or the certification requirements.
*Option E: Failing to meet financial responsibilities. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to audit the client's financial responsibilities during surveillance audits. The certification body may have contractual arrangements with the client regarding the payment of fees, but this is not part of the surveillance audit process.
*Option G: Review the calibration status of the instrumentation. This option is not correct because ISO 17021-
1:2015 clause 9.6.2.2 does not require the certification body to review the calibration status of the instrumentation during surveillance audits. The certification body may audit the client's monitoring and measuring resources as part of the quality management system requirements, but this is not a specific activity required by ISO 17021-1.
*Option J: Conduct a minimum number of annual surveillance audits during the certification period. This option is not correct because ISO 17021-1:2015 clause 9.6.2.2 does not require the certification body to conduct a minimum number of annual surveillance audits during the certification period. The certification body may determine the frequency and duration of surveillance audits based on the risk and performance of the client, but this is not a specific activity required by ISO 17021-1.
References:
*ISO 17021-1:2015 Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 1: Requirements
*ISO 9001 Lead Auditor Course Material, Module 7: Audit Follow-up and Surveillance, Slide 8: Surveillance Audit
*ISO 9001 Lead Auditor Training Course - IRCA Certified, Section 7.2: Audit Follow-up and Surveillance
*Lead Auditor Exam Preparation Guide (EPG) Template - PECB, Section 3.2: Exam Content Outline, Subsection 3.2.1: Section 1 - Audit Fundamentals, Subsection 3.2.2: Section 2 - Audit Principles, Subsection
3.2.3: Section 3 - Audit Process, Subsection 3.2.4: Section 4 - Audit Competencies

Explanation:
A screenshot of a chat Description automatically generated

According to the ISO 9000:2015 document, the seven quality management principles are:
Customer focus
Leadership
Engagement of people
Process approach
Improvement
Evidence-based decision making
Relationship management
For each principle, the document provides a statement, a rationale, key benefits, and actions you can take to apply the principle in your organization.
Based on the document, here is a possible way to match a potential benefit to each of the four quality management principles you mentioned:
Table
Quality management principle
Potential benefit
Customer focus
Increased revenue and market share
Engagement of people
Enhanced trust and collaboration throughout the organization
Improvement
Enhanced drive for innovation
Evidence-based decision making
Increased ability to demonstrate effectiveness of past actions

Explanation:

Table
Statement
First-party audits
Second-party audits
Third-party audits
The audit scope is typically determined by the organisation being audited.
Yes
No
No
The outcome of the audit is typically certification to a recognised standard.
No
No
Yes
The audit scope is typically confined to service/product provision capability.
No
Yes
No
Here is a brief explanation of each statement:
The audit scope is typically determined by the organisation being audited: This statement applies to first-party audits, also known as internal audits, where the organisation audits its own processes and activities to ensure conformity and improvement1. The organisation can decide the scope of the audit based on its own needs and objectives2. This statement does not apply to second-party audits, where the customer audits the supplier, or third-party audits, where an independent body audits the organisation. In these cases, the audit scope is determined by the customer or the certification body, respectively34.
The outcome of the audit is typically certification to a recognised standard: This statement applies to third- party audits, where an independent body audits the organisation to verify that it meets the requirements of a specific standard, such as ISO 9001, and issues a certificate of conformity if the audit is successful34. This statement does not apply to first-party audits or second-party audits, where the outcome of the audit is not certification, but rather self-improvement or supplier qualification13.
The audit scope is typically confined to service/product provision capability: This statement applies to second- party audits, where the customer audits the supplier to ensure that they are meeting the requirements specified in the contract, such as service or product quality, delivery, or performance34. The audit scope is usually focused on the specific aspects of the service or product that are of interest to the customer3. This statement does not apply to first-party audits or third-party audits, where the audit scope is broader and covers the entire quality management system or the relevant clauses of the standard14.

Explanation:

Table
Statement
First-party audits
Second-party audits
Third-party audits
The audit scope is typically determined by the organisation being audited.
Yes
No
No
The outcome of the audit is typically certification to a recognised standard.
No
No
Yes
The audit scope is typically confined to service/product provision capability.
No
Yes
No
Here is a brief explanation of each statement:
The audit scope is typically determined by the organisation being audited: This statement applies to first-party audits, also known as internal audits, where the organisation audits its own processes and activities to ensure conformity and improvement1. The organisation can decide the scope of the audit based on its own needs and objectives2. This statement does not apply to second-party audits, where the customer audits the supplier, or third-party audits, where an independent body audits the organisation. In these cases, the audit scope is determined by the customer or the certification body, respectively34.
The outcome of the audit is typically certification to a recognised standard: This statement applies to third- party audits, where an independent body audits the organisation to verify that it meets the requirements of a specific standard, such as ISO 9001, and issues a certificate of conformity if the audit is successful34. This statement does not apply to first-party audits or second-party audits, where the outcome of the audit is not certification, but rather self-improvement or supplier qualification13.
The audit scope is typically confined to service/product provision capability: This statement applies to second- party audits, where the customer audits the supplier to ensure that they are meeting the requirements specified in the contract, such as service or product quality, delivery, or performance34. The audit scope is usually focused on the specific aspects of the service or product that are of interest to the customer3. This statement does not apply to first-party audits or third-party audits, where the audit scope is broader and covers the entire quality management system or the relevant clauses of the standard14.

Explanation:
Here is the correct matching of the ISO 9001 Clause 8 extracts to the audit evidence:
* Audit evidence: Three subcontract trainers who had delivered training were not approved as defined in procedure SA1 Supplier Approval revision 3.ISO 9001 Clause 8 extract: 8.4.1 ...shall apply criteria for
... external providers...(This clause requires the organization to control external providers, including ensuring their approval and competence.)
* Audit evidence: A training programme for a customer was not documented as required in procedure TD
2 Training revision 2.ISO 9001 Clause 8 extract: 8.3.5 ...shall retain documented information on design and development outputs.(This clause addresses the need to retain documented information related to design and development outputs, such as a training programme.)
* Audit evidence: One trainer had not recorded the damage to a customer's training room wall caused by using sticky tape to hang training aids, as required in procedure TD 2 Training revision 2.ISO 9001 Clause 8 extract: 8.5.3 ...shall retain documented information on what has occurred.(This clause relates to retaining documented information on activities and outcomes, including records of damage or issues encountered.)
* Audit evidence: Five sales orders had no record of having been reviewed to verify the ability to provide these courses.ISO 9001 Clause 8 extract: 8.2.3.1 ...shall conduct a review before committing...(This clause specifies the requirement to review and verify the organization's ability to meet customer requirements before accepting sales orders.) These mappings reflect the specific requirements of ISO 9001:2015 for managing external providers, retaining documented information, and reviewing contracts.