Not sure if you what you mean when you refer to a category. This could be just the pertinent clauses of one particular standard (e.g. clause 4.2 of ISO 14001:2004) or you could mean to choose between ISO 14001:2004 or TS 16949 or any other standard the company is registered to. So I would take a pyramidal view of this, and if you want to build something that should work for any standard following your audit program, then allow for that now, otherwise you'll make something that can only deal with one standard. Even then, what happens if you migrate to an updated standard (e.g. 14001:2015)?
You have a rather complex task in front of you. I hope it's not your first db. Regardless of which approach, I don't have an issue with lookup tables for clause numbers or questions pertaining to a clause. Who selects the questions and inputs the answers to is another matter. This should not be selectable or editable, and should be restricted to auditors IHMO. I have other issues with your tables beyond what has been mentioned, such as connecting auditors to results. You have nothing for the audit as an entity (such as the scheduled date, the applicable standard, who the auditors will be, etc.) which exists far sooner than the results. You can't really begin to assemble a list of questions before the audit begins, which as you probably know, are based on prior audit results, again, because you have no audit table - just results.
Respectfully, I think you need to stop and first make sure you understand db Normalization concepts, especially from the point of view as to what constitutes an Entity and its Attributes. Then research examples of audit db's (and maybe join a forum related to the standard, where you might get suggestions or even db templates or entity diagrams). If you will be starting from scratch get big paper (or a whiteboard whose content is safe until you are done with it) so you can map things out, but it's crucial that you marry your knowledge of the standard with db design concepts. If either is a weak link, you won't build a strong chain. Consider also that your db may even need to be considered part of your document management system, which means not only will it need protection from prying eyes, but also from unauthorized editing.
I was going to go on about table structure, but it will make a long answer much longer, plus you're not even ready to start worrying about what to do about forms. Besides, I don't even know what standard the db is for. If you need links for db design concepts, I have some that I often post, but they're just a start if you're really a novice.
Hope some of that helps.
The more we hear silence, the more we begin to think about our value in this universe.
Paraphrase of Professor Brian Cox.