CQA Practice Questions (2026) — Free Sample Questions with Answers

Answer: D

Remove the tape and restart the interlock herself: An auditor should not operate or modify the auditee's equipment; the person in control of the area must act.

Record it and present it at the closing meeting: Right concern, wrong time; an immediate hazard cannot wait until the end of the audit.

Tell the lead auditor so she can raise it with management: Right channel for most issues, but too slow for an imminent danger; the escort and area supervisor can stop the hazard immediately.

Alert the escort and area supervisor immediately: Correct. An imminent danger to people is raised at once with the person who controls the area; it cannot wait for the closing meeting.

Unsafe conditions are reported immediately through the escort or area management; auditors do not fix equipment themselves.

Answer: A

Remind the buyer that observers do not take part: Correct. Observers accompany the team but must not influence or interfere with the audit; the lead auditor keeps control of the interview and can suggest the topic be raised outside the audit.

Let the questions continue because the buyer represents the client: Being from the client does not make an observer an auditor; interference compromises the interview.

Record the operator's answers as audit evidence: Answers to off-scope commercial questions are not audit evidence for the audit objectives.

Ask the guide to answer the buyer's questions instead: Still lets the observer steer the audit and takes the guide from his role.

Observers watch; they do not ask questions, direct the audit, or influence the results.

Answer: B

As no finding, because customer requirements were met: Uses the wrong criterion; an internal audit tests the organization's own requirements too.

As a nonconformity against the plant's procedure: Correct. The organization's own QMS documents are valid audit criteria; not doing what the procedure requires is a nonconformity, whether or not the parts turned out acceptable.

As a nonconformity against the customer contract: The customer did not require first-article inspection, so no contract requirement was breached.

As an opportunity to relax the procedure: Recommending a specific change is not the auditor's role, and it ignores the requirement that was missed.

Internal policies and procedures are audit criteria in their own right; a missed internal requirement is a nonconformity even when the product is good.

Answer: A

desk audit: Correct. A desk audit (desk assessment) evaluates questionnaire responses and submitted documents away from the auditee's site, with no real-time observation or interviews.

remote audit: A remote audit uses information and communication technology to interview and observe in real time; here nothing happens live.

hybrid audit: A hybrid audit combines on-site and remote activities; no part of this evaluation is on site.

product audit: A product audit examines product against specifications; this evaluates the supplier's quality system on paper.

Desk audit = document and questionnaire review only; remote = real-time ICT; hybrid = part on site, part remote.

Answer: C

Accept the 12-month date, because the auditee owns its corrective action: The auditee owns the action, but the plan must still be acceptable; a year without controls on a sterilization risk is not.

Reject the plan and report that the auditee has failed the audit: An unacceptable schedule calls for negotiation and escalation, not an outright pass/fail declaration.

Require interim controls and milestones; route any extension to the program: Correct. Reviewing a CAPA plan includes judging its schedule against the risk. A major sterilization gap needs interim containment now; a realistic phased schedule may be negotiated, but any extension must go through the program's approval route.

Draft a shorter revalidation protocol for the auditee to follow: Oversteps the auditor's role by designing the auditee's corrective action.

When a CAPA schedule does not fit the risk or the program rules, negotiate interim containment and milestones, and route any extension through the program.

Answer: A

Decline and refer the request to the audit client, who controls distribution: Correct. The audit client (the purchasing company) owns the report and decides its distribution; the lead auditor must keep its contents confidential.

Send only the executive summary, which contains no record details: Any part of the report is confidential to the client; a summary is still a disclosure.

Send the report, because the supplier is the auditee and may share its results: Wrong party: the auditee does not decide distribution of a report commissioned by the client.

Send it once the supplier confirms the other customer will keep it confidential: A confidentiality promise from a third party does not authorize disclosure; only the audit client can decide who receives its report.

The audit client decides who receives the audit report; auditors keep audit information confidential.

Answer: D

As three separate findings, one for each section: Fragments a systemic problem, hiding its pattern and inviting three local fixes instead of one cause analysis.

As one finding against the section with the most recent lapse: Ignores two instances of evidence and misplaces a process-wide issue in one section.

As an opportunity for improvement, because each instance is isolated: A missing required approval is a nonconformity, and three instances in three sections are not isolated.

As one finding on the change-approval process, citing each instance: Correct. Grouping related observations into one finding shows that the change-approval process is weak across sections, which conveys the true severity and risk and lets the auditee address a common cause in one corrective action.

When the same requirement fails in several places, group the observations into a single finding with every instance cited, so the report reflects the systemic risk.

Answer: A

As a nonconformity: 3 of 20 sampled reports lacked approval: Correct — the auditor reports what the evidence shows, including the sample size, so the significance is clear without presenting an estimate as a verified fact.

As a finding that 60 of the 400 reports lack disposition approval: Stating 60 as fact extrapolates the sample to the population; the auditor has only verified 3 reports.

As no finding until all 400 reports have been examined: A properly selected sample is a sufficient basis for a finding; 100% review is not required.

As an observation, because 85% of the sampled reports conformed: A requirement was not met with objective evidence; a high conformance rate does not turn a nonconformity into an observation.

Report sample results as facts ("3 of 20 sampled"), not as unverified population counts.

Answer: B

Refer the readings to the pharmacy's quality unit to investigate: Passing the issue to the auditee's quality unit leaves an in-scope risk unexamined by the audit; the auditor should follow the trail.

Follow up on the readings, since the checklist is only a guide: Correct — checklists are aids that ensure coverage; they do not limit the auditor from pursuing in-scope evidence that comes to light during the audit.

Note the readings for the next audit, when a checklist question can be added: Deferring an in-scope issue with possible patient-safety impact fails due professional care.

Stop the audit and ask the client to approve a revised checklist before continuing: An in-scope trail does not need client approval; halting the audit is unnecessary.

A checklist guides the audit but never limits it: follow in-scope evidence wherever it leads.

Answer: B

Keep the auditor, since an auditee cannot influence team selection: Auditees may raise objections to team members; the program manager should consider them rather than dismiss them outright.

Evaluate the objection and assign another qualified auditor if it is valid: Correct — an objection on reasonable grounds (here, a possible conflict of interest and confidentiality risk) is evaluated by the program manager, who replaces the auditor if the concern is justified, keeping the team competent and impartial.

Remove the auditor at once, without review, to avoid delaying the audit: Replacing auditors automatically on any objection lets the auditee shape the team; the objection should be evaluated first.

Keep the auditor but bar him from examining any proprietary records: Restricting the auditor's access limits the evidence he can gather and does not address the perceived conflict of interest.

Auditee objections to team members are evaluated on their merits by the program manager or client; justified objections lead to a change, unjustified ones do not.

Answer: B

Scatter diagram: A scatter diagram shows the relationship between two variables, not the relative frequency of categories.

Pareto chart: Correct. A Pareto chart ranks categories from most to least frequent with a cumulative line, showing the "vital few" categories to prioritize.

Histogram: A histogram shows the distribution of a continuous measured variable, not counts of named categories ranked for priority.

Control chart: A control chart shows whether a process is stable over time; it does not rank categories.

When management needs to know where to focus first, rank the categories with a Pareto chart.

Answer: D

Reopen the audit and re-examine the evidence on site next week: Without new evidence there is nothing new to examine; reopening the audit under pressure rewards the threat.

Remove the finding if the audit client agrees, to avoid a complaint: Findings follow the evidence; removing one to avoid a complaint sacrifices integrity and fair presentation.

Reply point by point and negotiate a reworded, softer finding: Negotiating wording under pressure turns an evidence-based finding into a bargain; the director should use the formal route.

Keep the finding and refer him to the program's appeal process: Correct. The finding rests on objective evidence already reviewed; a post-report challenge without new evidence is courteously directed to the audit program's appeal or complaint process, and the client is kept informed.

After a report is issued, challenges go through the program's formal appeal or complaint process; findings change only on new objective evidence, not on pressure.

Answer: D

1. 1. Classify: prevention = planning $40,000 + training $30,000 = $70,000; appraisal = incoming inspection $55,000 + internal audits $25,000 = $80,000.
2. 2. Failure: internal (scrap and rework) $120,000 + external (warranty and returns) $90,000 = $210,000.
3. 3. Total COQ = $70,000 + $80,000 + $210,000 = $360,000.
4. 4. Failure share = $210,000 ÷ $360,000 = 0.583 = 58.3%.
5. 5. Interpretation: well over half of quality spending goes to failures, which points to under-investment in prevention.

25.0%: Counts only external failure (warranty and returns, $90,000 ÷ $360,000) and leaves out internal failure.

33.3%: Counts only internal failure (scrap and rework, $120,000 ÷ $360,000) and leaves out external failure.

41.7%: This is the cost of conformance (prevention + appraisal = $150,000 ÷ $360,000), the opposite group of categories.

58.3%: Correct. Failure cost = internal failure (scrap and rework $120,000) + external failure (warranty and returns $90,000) = $210,000, which is 58.3% of the $360,000 total.

Sort every cost into prevention, appraisal, internal failure or external failure first; failure cost is internal plus external failure, and audits and inspection are appraisal costs.

Answer: B

The main concern is that passwords should be changed more often by the system users: Password changes do not help when a single login is shared; attribution remains impossible.

Changes cannot be attributed or detected, so data integrity cannot be shown: Correct. Shared logins prevent attributing entries to individuals, and a disabled audit trail prevents detecting changes; together they mean the reliability of the electronic records cannot be shown.

The system must be revalidated before any further results are reported: This prescribes a remedy; the auditor's conclusion concerns whether the integrity of the records can be shown, and the auditee decides the corrective action.

The records remain reliable because results are still checked by a second analyst: A second review without attribution or an audit trail cannot show who changed what, or whether data were altered.

Data integrity relies on unique user access and an active audit trail so that every entry and change is attributable and detectable.

Answer: A

Rotate auditor assignments periodically across areas: Correct. Periodic rotation brings fresh perspective and guards against over-familiarity, a recognized best practice for audit credibility.

Keep the auditor assigned, since he knows the area well: Long familiarity is the likely cause of the problem; it erodes objectivity over time.

Give the auditor a longer, more detailed checklist: A longer checklist does not address the familiarity that has built up over five years with the same auditor.

Lengthen the warehouse audit for deeper sampling: More time with the same, over-familiar auditor does not restore a fresh, objective view.

Rotate auditors to keep audits objective and fresh; more time or longer checklists do not cure over-familiarity.

Answer: C

1. 1. Rank the bars: requirements 46, coding logic 34, interface 20.
2. 2. Cumulative count of the top three = 46 + 34 + 20 = 100.
3. 3. Cumulative percentage = 100 ÷ 120 × 100 = 83.3%.
4. 4. Interpretation: three of five categories hold over 80% of defects, so improvement should start there.

38.3%: This is the largest bar alone (46 ÷ 120); it is not cumulative.

66.7%: Stops at two categories (46 + 34 = 80 of 120).

83.3%: Correct. 46 + 34 + 20 = 100 defects; 100 ÷ 120 = 83.3%.

93.3%: Includes a fourth category (100 + 12 = 112 of 120).

A Pareto cumulative percentage is the running total of the ranked bars divided by the grand total; it shows how few categories hold most of the problem.