A subjective enforcement decision is when someone analyzes the situation and then makes a decision on whether or not to enforce the policy.

COTS software is normally developed prior to an organization selecting that software for its use.

In the PDCA cycle, if a check detects an abnormality, then record the abnormality and continue the work per the procedure.

Process improvement activities should also be conducted as per a defined process.

Good ideas are of little value unless they are accepted and implemented.

When listening to a speaker, the speaker's verbal, vocal, and body channels always convey the same message.

A histogram is a bar graph.

It is very easy to distinguish between accidental loss and intentional loss, with respect to security activities.

COQ is also known as 'Price of Non-Conformance'.

While unit testing should be done, it is not necessary to spend the time and effort to develop and document the unit test plan and cases because it is conducted by the developers themselves.

The Quality Manager is in the business of selling quality.

If common causes of variation result in a process operating outside the customer's specifications, the process is improved by reducing the special causes of variation.

Risk management is not an independent auditing process.

Process capability determination motivates an organization towards process improvements.

The development of the approach for process deployment is much harder than the actual deployment of the process.

Management commitment is the single most important requirement for successful implementation of quality managemen

QA is a management function with emphasis on the process producing the product.

It is very important 'to evaluate how employees feel about their manager or leader' to assess the climate of a specific organization or group. An assessment of an organization's 'climate' discovers if the employees' satisfaction level is positive or negative.

Focusing on quality can increase productivity, reduce costs, and improve customer satisfaction.

Quality Assurance is defined as those activities designed to identify 'defects which have already been created'.

Goals explain how the vision will be achieved.

Controls are placed near the end of a process or workbench because this is the most appropriate location.

Internal control is not a serial process, where one component affects only the next. It is a multidirectional interactive process in which almost any component can and will influence another

As the type of product changes on the process maturity continuum, the work processes also change

A measure is a single attribute of a product or process.

Staged models are composed of a number of distinct levels of maturity.

Within an ISO process assessment, a capability level is said to be established 'only' and 'only if' all the process attributes are 'fully achieved'.

QFD can be used to provide forward and backward traceability of value in the software development life cycle.

Baselines should always be based on objectively measured data. For this reason, baselines should never be based on subjective measures.

If the input product to a workbench does not meet the entry criteria, it should be accepted to save time and reworked later in the process.

Processes containing only common causes of variation are considered stable.

The greater the involvement of the entire IT staff in quality, the larger the size of the quality staff that is needed.

As the maturity level increases, the cost per unit of work increases.

An objective baseline relies on judgment being applied in making the measure.

Quality cannot be delegated.

A "leader" and a "manager" are two terms that basically mean the same thing.

Establishing security baseline is the starting point to a better security program.

A measure can be reliable, but invalid. An unreliable measure cannot be valid.

Boundary analysis techniques are used to create test cases that divide equivalence partitioned groups.

Measurement has a high cost; too much investment is required and the return is too low.

The code walkthrough and code inspection are the same thing.

An objective for conducting a 'baseline study' can be to identify quantitatively 'potential problems'.

As processes mature, there is a decrease in cycle time to produce a product.

The objective of estimation sampling is to select a sample, which represents the universe as closely as possible and is a snapshot of the universe. Estimation will permit the Quality Assurance Analyst to inform management of the size or severity of a problem without

examining the entire universe. The data gathered in the sample is extrapolated to the entire universe

Cooperation is required to improve quality and to implement quality management.

There are five levels of ISO Process Capability.

The theory of levels of maturity is that organizations can skip a level if business needs require them to be at a higher maturity level.

Staff job satisfaction increases significantly as processes mature.

The check sheet is used to record data gathered over a period of time to determine frequency of an event.

In a Waterfall Development Model, most risk management activity occurs close to milestones.

Audits can be performed by the individuals involved in conducting the work.

During a review, both the producer and product are reviewed.

There is a strong correlation between process maturity and defect rates. As the process maturity level increases, the defect rate decreases.

The concept of "just in time", as pioneered by Toyota, is only applicable to inventory control.