Guidelines for Auditing Management Systems Part 3

ISO 19011:2018(E) 6.2.3 Determining feasibility of audit The feasibility of the audit should be determined to provide reasonable confidence that the audit objectives can be achieved. The determination of feasibility should take into consideration factors such as the availability of the following: a) sufficient and appropriate information for planning and conducting the audit; b) adequate cooperation from the auditee; c) adequate time and resources for conducting the audit. NOTE Resources include access to adequate and appropriate information and communication technology. Where the audit is not feasible, an alternative should be proposed to the audit client, in agreement with the auditee. 6.3 Preparing audit activities 6.3.1 Performing review of documented information The relevant management system documented information of the auditee should be reviewed in order to: — gather information to understand the auditee’s operations and to prepare audit activities and applicable audit work documents (see 6.3.4), e.g. on processes, functions; — establish an overview of the extent of the documented information to determine possible conformity to the audit criteria and detect possible areas of concern, such as deficiencies, omissions or conflicts. The documented information should include, but not be limited to: management system documents and records, as well as previous audit reports. The review should take into account the context of the auditee’s organization, including its size, nature and complexity, and its related risks and opportunities. It should also take into account the audit scope, criteria and objectives. NOTE 6.3.2 6.3.2.1 Guidance on how to verify information is provided in A.5. Audit planning Risk-based approach to planning The audit team leader should adopt a risk-based approach to planning the audit based on the information in the audit programme and the documented information provided by the auditee. Audit planning should consider the risks of the audit activities on the auditee’s processes and provide the basis for the agreement among the audit client, audit team and the auditee regarding the conduct of the audit. Planning should facilitate the efficient scheduling and coordination of the audit activities in order to achieve the objectives effectively. The amount of detail provided in the audit plan should reflect the scope and complexity of the audit, as well as the risk of not achieving the audit objectives. In planning the audit, the audit team leader should consider the following: a) the composition of the audit team and its overall competence; b) the appropriate sampling techniques (see A.6); c) opportunities to improve the effectiveness and efficiency of the audit activities; ISO 19011:2018(E) d) the risks to achieving the audit objectives created by ineffective audit planning; e) the risks to the auditee created by performing the audit. Risks to the auditee can result from the presence of the audit team members adversely influencing the auditee’s arrangements for health and safety, environment and quality, and its products, services, personnel or infrastructure (e.g. contamination in clean room facilities). For combined audits, particular attention should be given to the interactions between operational processes and any competing objectives and priorities of the different management systems. 6.3.2.2 Audit planning details The scale and content of the audit planning can differ, for example, between initial and subsequent audits, as well as between internal and external audits. Audit planning should be sufficiently flexible to permit changes which can become necessary as the audit activities progress. Audit planning should address or reference the following: a) the audit objectives; b) the audit scope, including identification of the organization and its functions, as well as processes to be audited; c) the audit criteria and any reference documented information; d) the locations (physical and virtual), dates, expected time and duration of audit activities to be conducted, including meetings with the auditee’s management; e) the need for the audit team to familiarize themselves with auditee’s facilities and processes (e.g. by conducting a tour of physical location(s), or reviewing information and communication technology); f) the audit methods to be used, including the extent to which audit sampling is needed to obtain sufficient audit evidence; g) the roles and responsibilities of the audit team members, as well as guides and observers or interpreters; h) the allocation of appropriate resources based upon consideration of the risks and opportunities related to the activities that are to be audited. Audit planning should take into account, as appropriate: — identification of the auditee’s representative(s) for the audit; — the working and reporting language of the audit where this is different from the language of the auditor or the auditee or both; — the audit report topics; — logistics and communications arrangements, including specific arrangements for the locations to be audited; — any specific actions to be taken to address risks to achieving the audit objectives and opportunities arising; — matters related to confidentiality and information security; — any follow-up actions from a previous audit or other source(s) e.g. lessons learned, project reviews; — any follow-up activities to the planned audit; — coordination with other audit activities, in case of a joint audit. ISO 19011:2018(E) Audit plans should be presented to the auditee. Any issues with the audit plans should be resolved between the audit team leader, the auditee and, if necessary, the individual(s) managing the audit programme. 6.3.3 Assigning work to audit team The audit team leader, in consultation with the audit team, should assign to each team member responsibility for auditing specific processes, activities, functions or locations and, as appropriate, authority for decision-making. Such assignments should take into account the impartiality and objectivity and competence of auditors and the effective use of resources, as well as different roles and responsibilities of auditors, auditors-in-training and technical experts. Audit team meetings should be held, as appropriate, by the audit team leader in order to allocate work assignments and decide possible changes. Changes to the work assignments can be made as the audit progresses in order to ensure the achievement of the audit objectives. 6.3.4 Preparing documented information for audit The audit team members should collect and review the information relevant to their audit assignments and prepare documented information for the audit, using any appropriate media. The documented information for the audit can include but is not limited to: a) physical or digital checklists; b) audit sampling details; c) audio visual information. The use of these media should not restrict the extent of audit activities, which can change as a result of information collected during the audit. NOTE Guidance on preparing audit work documents is given in A.13. Documented information prepared for, and resulting from, the audit should be retained at least until audit completion, or as specified in the audit programme. Retention of documented information after audit completion is described in 6.6. Documented information created during the audit process involving confidential or proprietary information should be suitably safeguarded at all times by the audit team members. 6.4 Conducting audit activities 6.4.1 General Audit activities are normally conducted in a defined sequence as indicated in Figure 1. This sequence may be varied to suit the circumstances of specific audits. 6.4.2 Assigning roles and responsibilities of guides and observers Guides and observers may accompany the audit team with approvals from the audit team leader, audit client and/or auditee, if required. They should not influence or interfere with the conduct of the audit. If this cannot be assured, the audit team leader should have the right to deny observers from being present during certain audit activities. For observers, any arrangements for access, health and safety, environmental, security and confidentiality should be managed between the audit client and the auditee. ISO 19011:2018(E) Guides, appointed by the auditee, should assist the audit team and act on the request of the audit team leader or the auditor to which they have been assigned. Their responsibilities should include the following: a) assisting the auditors in identifying individuals to participate in interviews and confirming timings and locations; b) arranging access to specific locations of the auditee; c) ensuring that rules concerning location-specific arrangements for access, health and safety, environmental, security, confidentiality and other issues are known and respected by the audit team members and observers and any risks are addressed; d) witnessing the audit on behalf of the auditee, when appropriate; e) providing clarification or assisting in collecting information, when needed. 6.4.3 Conducting opening meeting The purpose of the opening meeting is to: a) confirm the agreement of all participants (e.g. auditee, audit team) to the audit plan; b) introduce the audit team and their roles; c) ensure that all planned audit activities can be performed. An opening meeting should be held with the auditee’s management and, where appropriate, those responsible for the functions or processes to be audited. During the meeting, an opportunity to ask questions should be provided. The degree of detail should be consistent with the familiarity of the auditee with the audit process. In many instances, e.g. internal audits in a small organization, the opening meeting may simply consist of communicating that an audit is being conducted and explaining the nature of the audit. For other audit situations, the meeting may be formal and records of attendance should be retained. The meeting should be chaired by the audit team leader. Introduction of the following should be considered, as appropriate: — other participants, including observers and guides, interpreters and an outline of their roles; — the audit methods to manage risks to the organization which may result from the presence of the audit team members. Confirmation of the following items should be considered, as appropriate: — the audit objectives, scope and criteria; — the audit plan and other relevant arrangements with the auditee, such as the date and time for the closing meeting, any interim meetings between the audit team and the auditee’s management, and any change(s) needed; — formal communication channels between the audit team and the auditee; — the language to be used during the audit; — the auditee being kept informed of audit progress during the audit; — the availability of the resources and facilities needed by the audit team; — matters relating to confidentiality and information security; ISO 19011:2018(E) — relevant access, health and safety, security, emergency and other arrangements for the audit team; — activities on site that can impact the conduct of the audit. The presentation of information on the following items should be considered, as appropriate: — the method of reporting audit findings including criteria for grading, if any; — conditions under which the audit may be terminated; — how to deal with possible findings during the audit; — any system for feedback from the auditee on the findings or conclusions of the audit, including complaints or appeals. 6.4.4 Communicating during audit During the audit, it may be necessary to make formal arrangements for communication within the audit team, as well as with the auditee, the audit client and potentially with external interested parties (e.g. regulators), especially where statutory and regulatory requirements require mandatory reporting of nonconformities. The audit team should confer periodically to exchange information, assess audit progress and reassign work between the audit team members, as needed. During the audit, the audit team leader should periodically communicate the progress, any significant findings and any concerns to the auditee and audit client, as appropriate. Evidence collected during the audit that suggests an immediate and significant risk should be reported without delay to the auditee and, as appropriate, to the audit client. Any concern about an issue outside the audit scope should be noted and reported to the audit team leader, for possible communication to the audit client and auditee. Where the available audit evidence indicates that the audit objectives are unattainable, the audit team leader should report the reasons to the audit client and the auditee to determine appropriate action. Such action may include changes to audit planning, the audit objectives or audit scope, or termination of the audit. Any need for changes to the audit plan which may become apparent as auditing activities progress should be reviewed and accepted, as appropriate, by both the individual(s) managing the audit programme and the audit client, and presented to the auditee. 6.4.5 Audit information availability and access The audit methods chosen for an audit depend on the defined audit objectives, scope and criteria, as well as duration and location. The location is where the information needed for the specific audit activity is available to the audit team. This may include physical and virtual locations. Where, when and how to access audit information is crucial to the audit. This is independent of where the information is created, used and/or stored. Based on these issues, the audit methods need to be determined (see Table A.1). The audit can use a mixture of methods. Also, audit circumstances may mean that the methods need to change during the audit. 6.4.6 Reviewing documented information while conducting audit The auditee’s relevant documented information should be reviewed to: — determine the conformity of the system, as far as documented, with audit criteria; — gather information to support the audit activities. NOTE Guidance on how to verify information is provided in A.5. ISO 19011:2018(E) The review may be combined with the other audit activities and may continue throughout the audit, providing this is not detrimental to the effectiveness of the conduct of the audit. If adequate documented information cannot be provided within the time frame given in the audit plan, the audit team leader should inform both the individual(s) managing the audit programme and the auditee. Depending on the audit objectives and scope, a decision should be made as to whether the audit should be continued or suspended until documented information concerns are resolved. 6.4.7 Collecting and verifying information During the audit, information relevant to the audit objectives, scope and criteria, including information relating to interfaces between functions, activities and processes should be collected by means of appropriate sampling and should be verified, as far as practicable. NOTE 1 For verifying information see A.5. NOTE 2 Guidance on sampling is given in A.6. Only information that can be subject to some degree of verification should be accepted as audit evidence. Where the degree of verification is low the auditor should use their professional judgement to determine the degree of reliance that can be placed on it as evidence. Audit evidence leading to audit findings should be recorded. If, during the collection of objective evidence, the audit team becomes aware of any new or changed circumstances, or risks or opportunities, these should be addressed by the team accordingly. Figure 2 provides an overview of a typical process, from collecting information to reaching audit conclusions. Figure 2 — Overview of a typical process of collecting and verifying information Methods of collecting information include, but are not limited to the following: — interviews; ISO 19011:2018(E) — observations; — review of documented information. NOTE 3 Guidance on selecting sources of information and observation is given in A.14. NOTE 4 Guidance on visiting the auditee’s location is given in A.15. NOTE 5 Guidance on conducting interviews is given in A.17. 6.4.8 Generatingauditfindings Audit evidence should be evaluated against the audit criteria in order to determine audit findings. Audit findings can indicate conformity or nonconformity with audit criteria. When specified by the audit plan, individual audit findings should include conformity and good practices along with their supporting evidence, opportunities for improvement, and any recommendations to the auditee. Nonconformities and their supporting audit evidence should be recorded. Nonconformities can be graded depending on the context of the organization and its risks. This grading can be quantitative (e.g. 1 to 5) and qualitative (e.g. minor, major). They should be reviewed with the auditee in order to obtain acknowledgement that the audit evidence is accurate and that the nonconformities are understood. Every attempt should be made to resolve any diverging opinions concerning the audit evidence or findings. Unresolved issues should be recorded in the audit report. The audit team should meet as needed to review the audit findings at appropriate stages during the audit. NOTE 1 Additional guidance on the identification and evaluation of audit findings is given in A.18. NOTE 2 Conformity or nonconformity with audit criteria related to statutory or regulatory requirements or other requirements, is sometimes referred to as compliance or non-compliance. 6.4.9 6.4.9.1 Determining audit conclusions Preparation for closing meeting The audit team should confer prior to the closing meeting in order to: a) review the audit findings and any other appropriate information collected during the audit, against the audit objectives; b) agree on the audit conclusions, taking into account the uncertainty inherent in the audit process; c) prepare recommendations, if specified by the audit plan; d) discuss audit follow-up, as applicable. 6.4.9.2 Content of audit conclusions Audit conclusions should address issues such as the following: a) the extent of conformity with the audit criteria and robustness of the management system, including the effectiveness of the management system in meeting the intended outcomes, the identification of risks and effectiveness of actions taken by the auditee to address risks; b) the effective implementation, maintenance and improvement of the management system; c) achievement of audit objectives, coverage of audit scope and fulfilment of audit criteria; d) similar findings made in different areas that were audited or from a joint or previous audit for the purpose of identifying trends. ISO 19011:2018(E) If specified by the audit plan, audit conclusions can lead to recommendations for improvement, or future auditing activities. 6.4.10 Conducting closing meeting A closing meeting should be held to present the audit findings and conclusions. The closing meeting should be chaired by the audit team leader and attended by the management of the auditee and include, as applicable: — those responsible for the functions or processes which have been audited; — the audit client; — other members of the audit team; — other relevant interested parties as determined by the audit client and/or auditee. If applicable, the audit team leader should advise the auditee of situations encountered during the audit that may decrease the confidence that can be placed in the audit conclusions. If defined in the management system or by agreement with the audit client, the participants should agree on the time frame for an action plan to address audit findings. The degree of detail should take into account the effectiveness of the management system in achieving the auditee’s objectives, including consideration of its context and risks and opportunities. The familiarity of the auditee with the audit process should also be taken into consideration during the closing meeting, to ensure the correct level of detail is provided to participants. For some audit situations, the meeting can be formal and minutes, including records of attendance, should be kept. In other instances, e.g. internal audits, the closing meeting can be less formal and consist solely of communicating the audit findings and audit conclusions. As appropriate, the following should be explained to the auditee in the closing meeting: a) advising that the audit evidence collected was based on a sample of the information available and is not necessarily fully representative of the overall effectiveness of the auditee’s processes; b) the method of reporting; c) how the audit finding should be addressed based on the agreed process; d) possible consequences of not adequately addressing the audit findings; e) presentation of the audit findings and conclusions in such a manner that they are understood and acknowledged by the auditee’s management; f) any related post-audit activities (e.g. implementation and review of corrective actions, addressing audit complaints, appeal process). Any diverging opinions regarding the audit findings or conclusions between the audit team and the auditee should be discussed and, if possible, resolved. If not resolved, this should be recorded. If specified by the audit objectives, opportunities for improvement recommendations may be presented. It should be emphasized that recommendations are not binding. ISO 19011:2018(E) 6.5 Preparing and distributing audit report 6.5.1 Preparing audit report The audit team leader should report the audit conclusions in accordance with the audit programme. The audit report should provide a complete, accurate, concise and clear record of the audit, and should include or refer to the following: a) audit objectives; b) audit scope, particularly identification of the organization (the auditee) and the functions or processes audited; c) identification of the audit client; d) identification of audit team and auditee’s participants in the audit; e) dates and locations where the audit activities were conducted; f) audit criteria; g) audit findings and related evidence; h) audit conclusions; i) a statement on the degree to which the audit criteria have been fulfilled; j) any unresolved diverging opinions between the audit team and the auditee; k) audits by nature are a sampling exercise; as such there is a risk that the audit evidence examined is not representative. The audit report can also include or refer to the following, as appropriate: — the audit plan including time schedule; — a summary of the audit process, including any obstacles encountered that may decrease the reliability of the audit conclusions; — confirmation that the audit objectives have been achieved within the audit scope in accordance with the audit plan; — any areas within the audit scope not covered including any issues of availability of evidence, resources or confidentiality, with related justifications; — a summary covering the audit conclusions and the main audit findings that support them; — good practices identified; — agreed action plan follow-up, if any; — a statement of the confidential nature of the contents; — any implications for the audit programme or subsequent audits. 6.5.2 Distributing audit report The audit report should be issued within an agreed period of time. If it is delayed, the reasons should be communicated to the auditee and the individual(s) managing the audit programme. The audit report should be dated, reviewed and accepted, as appropriate, in accordance with the audit programme. ISO 19011:2018(E) The audit report should then be distributed to the relevant interested parties defined in the audit programme or audit plan. When distributing the audit report, appropriate measures to ensure confidentiality should be considered. 6.6 Completing audit The audit is completed when all planned audit activities have been carried out, or as otherwise agreed with the audit client (e.g. there might be an unexpected situation that prevents the audit being completed according to the audit plan). Documented information pertaining to the audit should be retained or disposed of by agreement between the participating parties and in accordance with audit programme and applicable requirements. Unless required by law, the audit team and the individual(s) managing the audit programme should not disclose any information obtained during the audit, or the audit report, to any other party without the explicit approval of the audit client and, where appropriate, the approval of the auditee. If disclosure of the contents of an audit document is required, the audit client and auditee should be informed as soon as possible. Lessons learned from the audit can identify risks and opportunities for the audit programme and the auditee. 6.7 Conducting audit follow-up The outcome of the audit can, depending on the audit objectives, indicate the need for corrections, or for corrective actions, or opportunities for improvement. Such actions are usually decided and undertaken by the auditee within an agreed timeframe. As appropriate, the auditee should keep the individual(s) managing the audit programme and/or the audit team informed of the status of these actions. The completion and effectiveness of these actions should be verified. This verification may be part of a subsequent audit. Outcomes should be reported to the individual managing the audit programme and reported to the audit client for management review. 7 Competence and evaluation of auditors 7.1 General Confidence in the audit process and the ability to achieve its objectives depends on the competence of those individuals who are involved in performing audits, including auditors and audit team leaders. Competence should be evaluated regularly through a process that considers personal behaviour and the ability to apply the knowledge and skills gained through education, work experience, auditor training and audit experience. This process should take into consideration the needs of the audit programme and its objectives. Some of the knowledge and skills described in 7.2.3 are common to auditors of any management system discipline; others are specific to individual management system disciplines. It is not necessary for each auditor in the audit team to have the same competence. However, the overall competence of the audit team needs to be sufficient to achieve the audit objectives. The evaluation of auditor competence should be planned, implemented and documented to provide an outcome that is objective, consistent, fair and reliable. The evaluation process should include four main steps, as follows: a) determine the required competence to fulfil the needs of the audit programme; b) establish the evaluation criteria; c) select the appropriate evaluation method; ISO 19011:2018(E) d) conduct the evaluation. The outcome of the evaluation process should provide a basis for the following: — selection of audit team members (as described in 5.5.4); — determining the need for improved competence (e.g. additional training); — ongoing performance evaluation of auditors. Auditors should develop, maintain and improve their competence through continual professional development and regular participation in audits (see 7.6). A process for evaluating auditors and audit team leaders is described in 7.3, 7.4 and 7.5 . Auditors and audit team leaders should be evaluated against the criteria set out in 7.2.2 and 7.2.3 as well as the criteria established in 7.1. The competence required of the individual(s) managing the audit programme is described in 5.4.2. 7.2 Determining auditor competence 7.2.1 General In deciding the necessary competence for an audit, an auditor’s knowledge and skills related to the following should be considered: a) the size, nature, complexity, products, services and processes of auditees; b) the methods for auditing; c) the management system disciplines to be audited; d) the complexity and processes of the management system to be audited; e) the types and levels of risks and opportunities addressed by the management system; f) the objectives and extent of the audit programme; g) the uncertainty in achieving audit objectives; h) other requirements, such as those imposed by the audit client or other relevant interested parties, where appropriate. This information should be matched against that listed in 7.2.3. 7.2.2 Personal behaviour Auditors should possess the necessary attributes to enable them to act in accordance with the principles of auditing as described in Clause 4. Auditors should exhibit professional behaviour during the performance of audit activities. Desired professional behaviours include being: a) ethical, i.e. fair, truthful, sincere, honest and discreet; b) open-minded, i.e. willing to consider alternative ideas or points of view; c) diplomatic, i.e. tactful in dealing with individuals; d) observant, i.e. actively observing physical surroundings and activities; e) perceptive, i.e. aware of and able to understand situations; f) versatile, i.e. able to readily adapt to different situations; ISO 19011:2018(E) g) tenacious, i.e. persistent and focused on achieving objectives; h) decisive, i.e. able to reach timely conclusions based on logical reasoning and analysis; i) self-reliant, i.e. able to act and function independently while interacting effectively with others; j) able to act with fortitude, i.e. able to act responsibly and ethically, even though these actions may not always be popular and may sometimes result in disagreement or confrontation; k) open to improvement, i.e. willing to learn from situations; l) culturally sensitive, i.e. observant and respectful to the culture of the auditee; m) collaborative, i.e. effectively interacting with others, including audit team members and the auditee’s personnel. 7.2.3 7.2.3.1 Knowledge and skills General Auditors should possess: a) the knowledge and skills necessary to achieve the intended results of the audits they are expected to perform; b) generic competence and a level of discipline and sector-specific knowledge and skills. Audit team leaders should have the additional knowledge and skills necessary to provide leadership to the audit team. 7.2.3.2 Generic knowledge and skills of management system auditors Auditors should have knowledge and skills in the areas outlined below. a) Audit principles, processes and methods: knowledge and skills in this area enable the auditor to ensure audits are performed in a consistent and systematic manner. An auditor should be able to: — understand the types of risks and opportunities associated with auditing and the principles of the risk-based approach to auditing; — plan and organize the work effectively; — perform the audit within the agreed time schedule; — prioritize and focus on matters of significance; — communicate effectively, orally and in writing (either personally, or through the use of interpreters); — collect information through effective interviewing, listening, observing and reviewing documented information, including records and data; — understand the appropriateness and consequences of using sampling techniques for auditing; — understand and consider technical experts’ opinions; — audit a process from start to finish, including the interrelations with other processes and different functions, where appropriate; — verify the relevance and accuracy of collected information; ISO 19011:2018(E) — confirm the sufficiency and appropriateness of audit evidence to support audit findings and conclusions; — assess those factors that may affect the reliability of the audit findings and conclusions; — document audit activities and audit findings, and prepare reports; — maintain the confidentiality and security of information. b) Management system standards and other references: knowledge and skills in this area enable the auditor to understand the audit scope and apply audit criteria, and should cover the following: — management system standards or other normative or guidance/supporting documents used to establish audit criteria or methods; — the application of management system standards by the auditee and other organizations; — relationships and interactions between the management system(s) processes; — understanding the importance and priority of multiple standards or references; — application of standards or references to different audit situations. c) The organization and its context: knowledge and skills in this area enable the auditor to understand the auditee’s structure, purpose and management practices and should cover the following: — needs and expectations of relevant interested parties that impact the management system; — type of organization, governance, size, structure, functions and relationships; — general business and management concepts, processes and related terminology, including planning, budgeting and management of individuals; — cultural and social aspects of the auditee. d) Applicable statutory and regulatory requirements and other requirements: knowledge and skills in this area enable the auditor to be aware of, and work within, the organization’s requirements. Knowledge and skills specific to the jurisdiction or to the auditee’s activities, processes, products and services should cover the following: — statutory and regulatory requirements and their governing agencies; — basic legal terminology; — contracting and liability. NOTE Awareness of statutory and regulatory requirements does not imply legal expertise and a management system audit should not be treated as a legal compliance audit. 7.2.3.3 Disciplineandsector-specificcompetenceofauditors Audit teams should have the collective discipline and sector-specific competence appropriate for auditing the particular types of management systems and sectors. The discipline and sector-specific competence of auditors include the following: a) management system requirements and principles, and their application; b) fundamentals of the discipline(s) and sector(s) related to the management systems standards as applied by the auditee; c) application of discipline and sector-specific methods, techniques, processes and practices to enable the audit team to assess conformity within the defined audit scope and generate appropriate audit findings and conclusions; ISO 19011:2018(E) d) principles, methods and techniques relevant to the discipline and sector, such that the auditor can determine and evaluate the risks and opportunities associated with the audit objectives. 7.2.3.4 Generic competence of audit team leader In order to facilitate the efficient and effective conduct of the audit an audit team leader should have the competence to: a) plan the audit and assign audit tasks according to the specific competence of individual audit team members; b) discuss strategic issues with top management of the auditee to determine whether they have considered these issues when evaluating their risks and opportunities; c) develop and maintain a collaborative working relationship among the audit team members; d) manage the audit process, including: — making effective use of resources during the audit; — managing the uncertainty of achieving audit objectives; — protecting the health and safety of the audit team members during the audit, including ensuring compliance of the auditors with the relevant health and safety, and security arrangements; — directing the audit team members; — providing direction and guidance to auditors-in-training; — preventing and resolving conflicts and problems that can occur during the audit, including those within the audit team, as necessary. e) represent the audit team in communications with the individual(s) managing the audit programme, the audit client and the auditee; f) lead the audit team to reach the audit conclusions; g) prepare and complete the audit report. 7.2.3.5 Knowledge and skills for auditing multiple disciplines When auditing multiple discipline management systems, the audit team member should have an understanding of the interactions and synergy between the different management systems. Audit team leaders should understand the requirements of each of the management system standards being audited and recognize the limits of their competence in each of the disciplines. NOTE Audits of multiple disciplines done simultaneously can be done as a combined audit or as an audit of an integrated management system that covers multiple disciplines. 7.2.4 Achieving auditor competence Auditor competence can be acquired using a combination of the following: a) successfully completing training programmes that cover generic auditor knowledge and skills; b) experience in a relevant technical, managerial or professional position involving the exercise of judgement, decision making, problem solving and communication with managers, professionals, peers, customers and other relevant interested parties; c) education/training and experience in a specific management system discipline and sector that contribute to the development of overall competence; ISO 19011:2018(E) d) audit experience acquired under the supervision of an auditor competent in the same discipline. NOTE Successful completion of a training course will depend on the type of course. For courses with an examination component it can mean successfully passing the examination. For other courses, it can mean participating in and completing the course. 7.2.5 Achieving audit team leader competence An audit team leader should have acquired additional audit experience to develop the competence described in 7.2.3.4. This additional experience should have been gained by working under the direction and guidance of a different audit team leader. 7.3 Establishing auditor evaluation criteria The criteria should be qualitative (such as having demonstrated desired behaviour, knowledge or the performance of the skills, in training or in the workplace) and quantitative (such as the years of work experience and education, number of audits conducted, hours of audit training). 7.4 Selecting appropriate auditor evaluation method The evaluation should be conducted using two or more of the methods given in Table 2. In using Table 2, the following should be noted: a) the methods outlined represent a range of options and may not apply in all situations; b) the various methods outlined may differ in their reliability; c) a combination of methods should be used to ensure an outcome that is objective, consistent, fair and reliable. Table 2 — Auditor evaluation methods Evaluation method Objectives Examples Review of records To verify the background of the auditor Analysis of records of education, training, employment, professional credentials and auditing experience Feedback To provide information about how the performance of the auditor is perceived Interview To evaluate desired professional behaviour and communication skills, to verify information and test knowledge and to acquire additional information Surveys, questionnaires, personal references, testimonials, complaints, performance evaluation, peer review Personal interviews Observation To evaluate desired professional behaviour and the ability to apply knowledge and skills To evaluate desired behaviour and knowledge and skills and their application To provide information on the auditor performance during the audit activities, identify strengths and opportunities for improvement Testing Post-audit review Role playing, witnessed audits, on-the-job performance Oral and written exams, psychometric testing Review of the audit report, interviews with the audit team leader, the audit team and, if appropriate, feedback from the auditee 7.5 Conducting auditor evaluation The information collected about the auditor under evaluation should be compared against the criteria set in 7.2.3. When an auditor under evaluation who is expected to participate in the audit programme ISO 19011:2018(E) does not fulfil the criteria, then additional training, work or audit experience should be undertaken and a subsequent re-evaluation should be performed. 7.6 Maintaining and improving auditor competence Auditors and audit team leaders should continually improve their competence. Auditors should maintain their auditing competence through regular participation in management system audits and continual professional development. This may be achieved through means such as additional work experience, training, private study, coaching, attendance at meetings, seminars and conferences or other relevant activities. The individual(s) managing the audit programme should establish suitable mechanisms for the continual evaluation of the performance of the auditors and audit team leaders. The continual professional development activities should take into account the following: a) changes in the needs of the individual and the organization responsible for the conduct of the audit; b) developments in the practice of auditing including the use of technology; c) relevant standards including guidance/supporting documents and other requirements; d) changes in sector or disciplines.