Audit methods: on-site and remote audits
D.A.S. Certification chooses the audit method together with the organisation, case by case, considering the organisation's preference, its size and complexity, its location and the type of activities, always in compliance with accreditation requirements (IAF MD 4).
Every audit follows the same steps. What changes is how it is delivered. The steps of an audit
Three ways to deliver an audit
- On site
On-site audit
The auditors visit the organisation's premises. Processes are observed directly where the work is done.
Used mainly for large organisations or organisations with complex processes, and for organisations located in areas easily reached by the D.A.S. Certification audit team or by one of its contracted auditors.
D.A.S. Certification works with contracted auditors in several countries. All of them sign impartiality and confidentiality declarations.
- Remote
Remote audit – classic
The whole audit takes place on a live video call, for the full audit days.
It includes interviews, screen sharing of documents and records and, where feasible, a live video walk-through of work areas.
It uses common video-call tools (for example Zoom or Teams) and follows IAF MD 4 on the use of information and communication technology in auditing.
- Remote
Remote audit – facilitated
For small organisations with processes that are not too complex.
The opening meeting and the closing meeting take place on a video call. In between, the audit continues in writing and with short calls through a messaging application agreed with the organisation (for example WhatsApp or Messenger).
The auditor sends questions and requests for evidence. The organisation replies with documents, photos and short videos. The auditor reviews them and asks follow-up questions.
The audit time is the same as determined for the audit. Only the delivery changes.
This mode is a distinctive feature of D.A.S. Certification. It offers flexibility and practicality for small organisations: no travel and less disruption of daily work, while the audit criteria stay the same.
It is explicitly provided for in the D.A.S. Certification internal procedures and in the D.A.S. Certification Agreement signed by the client, which lists among the remote auditing techniques teleconferencing, access to documents via intranet, e-mail, instant messaging and video calls via webcam or smartphone. The client therefore knows from the contract that this option exists.
The method is always agreed with the client in advance and confirmed in the audit plan.
Comparison
| On-site audit | Remote audit – classic | Remote audit – facilitated | |
|---|---|---|---|
| Best suited to | Large or complex organisations; locations easily reached by the auditors | Organisations where all activities can be shown reliably on video | Small organisations with processes that are not too complex |
| How it runs | Auditors at the premises | Live video call for the full audit days | Video call at start and end; messaging and short calls in between |
| Meetings | In person | On video call | Opening and closing on video call |
| Evidence | Direct observation, interviews, records | Interviews, shared screens, live video of work areas | Documents, photos and short videos sent by the organisation, follow-up questions |
How D.A.S. Certification decides
- D.A.S. Certification chooses the method together with the organisation, case by case, considering the organisation's preference, its size and complexity, its location and the type of activities, always in compliance with accreditation requirements (IAF MD 4 on the use of information and communication technology in auditing).
- The method is proposed in the offer and confirmed in the audit plan.
- Remote methods are used only when the technology, the connection and the nature of the activities allow the auditors to obtain reliable evidence. If this is not possible, the audit, or part of it, is carried out on site.
- Confidentiality and data protection are agreed before the audit: what can be shared, how, and how long it is kept.
ISO 45001
For occupational health and safety, remote techniques are limited to reviewing documents and records and interviewing staff and workers. The control of processes and of OH&S risks cannot be audited remotely, so an on-site part is always needed (IAF MD 5:2023 §4.5).
IAF MD 5:2023 (PDF) (opens in a new tab)Continue reading
What is an audit and how it is carried out
The audit cycle, plan, team, findings and decision, step by step.
How long it takes: the man-days calculator
How audit time is determined under IAF MD 5.