What is an audit and how it is carried out
Information about audits is often scattered. This page explains the whole process in one place, step by step, as D.A.S. Certification carries it out under ISO/IEC 17021-1.
At a glance
- An audit checks evidence, not intentions
- Certificate valid for 3 years
- Surveillance every year
- Decision taken by people who did not audit you
What an audit is
An audit is a systematic, independent and documented process to obtain evidence and evaluate it objectively, to determine to what extent agreed criteria are fulfilled.
Here the criteria are the requirements of ISO 9001, ISO 14001 or ISO 45001 and the organisation's own rules. Evidence means facts that can be checked: records, documents, interviews and what the auditor sees.
| Internal audit | Supplier audit | Certification audit | |
|---|---|---|---|
| Who audits | First party: the organisation audits itself, by its own staff or someone it appoints | Second party: a customer audits its supplier | Third party: an independent, accredited certification body |
| Why | Required by the standards | The customer checks its supplier | To decide on certification |
| Result | Internal improvement | A decision of the customer | A certification decision and, if positive, a certificate recognised under accreditation |
The internal audit is a requirement of the standard and is checked during the certification audit. It never replaces it.
The audit cycle
Certification follows a cycle of three years. Each step has a clear purpose.
Stage 1
A readiness review. The auditor checks the documented information (the documents and records the system requires), the scope, the sites and the legal requirements, and that an internal audit and a management review have been done. Stage 2 is planned. Stage 1 can identify issues to address before Stage 2.
Stage 2
The auditors evaluate whether the whole management system is implemented and effective, on site or remotely as planned.
Certification decision and certificate
If the decision is positive, the certificate is issued. It is valid for 3 years.
Surveillance audits
At least once every calendar year. The first takes place within 12 months of the certification decision. Each one checks a part of the system plus its key elements.
Recertification audit
In the third year, before the certificate expires. If successful, the certificate is renewed for another 3 years.
The audit plan
The audit plan is the document that says what will be audited, when, where and by whom. It contains:
- the audit objectives;
- the scope: activities, sites and processes;
- the audit criteria: the standard and its edition, legal requirements and the organisation's own requirements;
- dates and locations, or the remote connection;
- the schedule by process, department or area, with times;
- the audit team members and their roles;
- the people or functions to be interviewed;
- the language of the audit;
- how findings will be reported.
When you receive it
Before the audit, in advance. This lets the organisation organise people and access, and comment on the plan. Any changes are agreed before the audit starts.
How the audit team is formed
D.A.S. Certification checks three things for every audit team.
Competence
The team knows the standard and the sector of the organisation (the IAF code of its activities). When needed, a technical expert is added.
Impartiality
Every team member signs impartiality and confidentiality declarations and is checked for conflicts of interest, for example no services provided to the organisation in recent years.
Your right to object
D.A.S. Certification communicates the names of the team members in advance. The organisation may object to a member, giving a reason. D.A.S. Certification evaluates the objection and, if it is justified, replaces the person.
Who is who
These are the roles you may meet during an audit.
Lead auditor
Leads the team. Manages the audit plan, the opening and closing meetings and the report.
Auditor
Carries out audit activities on the processes assigned by the lead auditor.
Technical expert
Gives the team specific knowledge of the sector. Does not act as an auditor.
Trainee auditor
An auditor who is qualifying and takes part under the direction of a qualified auditor. Their time is not counted in the audit duration.
Observer
Attends without taking part, for example from the accreditation body NAH during a witness assessment, or from a regulator. The organisation is informed in advance.
Guide
A person of the organisation who accompanies the auditors and helps with access and contacts. A guide does not influence the audit.
Client representative
Also called management representative: the organisation's main contact for the audit.
Glossary (A–Z)
Audit criteria
The requirements used as a reference: the standard, legal requirements and the organisation's own rules.
Audit evidence
Records, statements of fact and other information that can be checked.
Audit finding
The result of comparing the evidence with the criteria: conformity, nonconformity, observation or opportunity for improvement.
Audit plan
The description of the activities and arrangements for one audit.
Audit programme
The set of audits planned for the whole three-year cycle.
Conformity
A requirement is fulfilled.
Correction
Action to fix the nonconformity itself, straight away.
Corrective action
Action to eliminate the cause of a nonconformity so that it does not happen again.
Documented information
Information the organisation must control and keep: documents and records.
Major nonconformity
A requirement is not fulfilled in a way that affects the capability of the management system to achieve its intended results.
Minor nonconformity
A requirement is not fulfilled, but this does not affect that capability.
Opportunity for improvement
A point where the system could work better. The organisation decides whether and how to act.
Root cause
The underlying reason why a problem happened.
Sampling
Examining a selection of records or activities instead of all of them.
Scope of certification
The activities, products, services and sites covered by the certificate.
A typical audit day
The steps below are shown in their usual order. The times are set in the audit plan.
Opening meeting
Introductions. The plan, the scope and confidentiality are confirmed, together with how findings are reported and the safety rules.
Interviews
With management and with process owners (the people responsible for each process).
Sampling of records and documented information
The auditor examines a sample, not every document.
Observation of activities on site
Work areas, operations, equipment and controls.
Daily debrief
A short meeting with the client representative on progress and possible findings.
Closing meeting
The findings, the conclusions and the next steps are presented. The organisation can ask questions and discuss the findings.
Audit findings
A finding is the result of comparing what the auditor found with the requirements. There are four types.
Major nonconformity
A requirement is not fulfilled in a way that affects the capability of the management system to achieve its intended results. For example, a required process is missing, or there is a systematic failure.
Minor nonconformity
A requirement is not fulfilled, but this does not affect that capability. For example, an isolated lapse.
Observation
A situation that is not a nonconformity but could become one if it is not addressed.
Opportunity for improvement
A point where the system could work better. The auditor does not prescribe specific solutions: the organisation decides how to act.
Corrections and corrective actions
- For each nonconformity, the organisation analyses the root cause and defines corrections and corrective actions.
- Under the D.A.S. Certification Agreement, nonconformities must be closed within 30 days; failure to do so may lead to suspension of the certificate.
- For major nonconformities a supplementary audit (on documents or on site) is carried out to verify their resolution.
- For minor nonconformities the organisation submits a written proposal for their resolution, which is verified at the next surveillance audit.
- Five minor nonconformities against the same requirement are treated as one major nonconformity.
- If the implementation of corrections and corrective actions for a major nonconformity cannot be verified within 6 months after the last day of Stage 2, a new Stage 2 is needed before certification (ISO/IEC 17021-1).
Source: D.A.S. Certification Agreement
Report, decision and certificate
Audit report
Sent to the organisation. It records the findings and the recommendation of the audit team.
Certification decision
Taken by competent D.A.S. Certification personnel who did not carry out the audit. This keeps the decision independent.
Certificate
If the decision is positive, D.A.S. Certification issues the certificate. It states the scope, the sites and the standard. It is valid for 3 years, subject to successful surveillance, and is listed in the D.A.S. Certification register and on IAF CertSearch.
More information:Verify a certificate Use of certification marks Suspension and withdrawal Appeals and complaints
Frequently asked questions
What is an audit?
An audit is a systematic, independent and documented process to obtain evidence and evaluate it objectively, to determine to what extent agreed criteria are fulfilled.
How long is a certificate valid?
If the decision is positive, the certificate is issued. It is valid for 3 years.
How often are surveillance audits carried out?
At least once every calendar year. The first takes place within 12 months of the certification decision. Each one checks a part of the system plus its key elements.
Who takes the certification decision?
Taken by competent D.A.S. Certification personnel who did not carry out the audit. This keeps the decision independent.
What is a major nonconformity?
A requirement is not fulfilled in a way that affects the capability of the management system to achieve its intended results. For example, a required process is missing, or there is a systematic failure.
When do we receive the audit plan?
Before the audit, in advance. This lets the organisation organise people and access, and comment on the plan. Any changes are agreed before the audit starts.
Continue reading
How the audit is delivered: on site or remote
On-site, classic remote and facilitated remote audits compared.
What is audited: the management system
The structure of ISO 9001, ISO 14001 and ISO 45001 explained.
How long it takes: the man-days calculator
How audit time is determined under IAF MD 5.