Guidelines for Auditing Management Systems Part 2

ISO 19011:2018(E) 5.2 Establishing audit programme objectives The audit client should ensure that the audit programme objectives are established to direct the planning and conducting of audits and should ensure the audit programme is implemented effectively. Audit programme objectives should be consistent with the audit client’s strategic direction and support management system policy and objectives. These objectives can be based on consideration of the following: a) needs and expectations of relevant interested parties, both external and internal; b) characteristics of and requirements for processes, products, services and projects, and any changes to them; c) management system requirements; d) need for evaluation of external providers; e) auditee’s level of performance and level of maturity of the management system(s), as reflected in relevant performance indicators (e.g. KPIs), the occurrence of nonconformities or incidents or complaints from interested parties; f) identified risks and opportunities to the auditee; g) results of previous audits. Examples of audit programme objectives can include the following: — identify opportunities for the improvement of a management system and its performance; — evaluate the capability of the auditee to determine its context; — evaluate the capability of the auditee to determine risks and opportunities and to identify and implement effective actions to address them; — conform to all relevant requirements, e.g. statutory and regulatory requirements, compliance commitments, requirements for certification to a management system standard; — obtain and maintain confidence in the capability of an external provider; — determine the continuing suitability, adequacy and effectiveness of the auditee’s management system; — evaluate the compatibility and alignment of the management system objectives with the strategic direction of the organization. 5.3 Determining and evaluating audit programme risks and opportunities There are risks and opportunities related to the context of the auditee that can be associated with an audit programme and can affect the achievement of its objectives. The individual(s) managing the audit programme should identify and present to the audit client the risks and opportunities considered when developing the audit programme and resource requirements, so that they can be addressed appropriately. There can be risks associated with the following: a) planning, e.g. failure to set relevant audit objectives and determine the extent, number, duration, locations and schedule of the audits; b) resources, e.g. allowing insufficient time, equipment and/or training for developing the audit programme or conducting an audit; c) selection of the audit team, e.g. insufficient overall competence to conduct audits effectively; ISO 19011:2018(E) d) communication, e.g. ineffective external/internal communication processes/channels; e) implementation, e.g. ineffective coordination of the audits within the audit programme, or not considering information security and confidentiality; f) control of documented information, e.g. ineffective determination of the necessary documented information required by auditors and relevant interested parties, failure to adequately protect audit records to demonstrate audit programme effectiveness; g) monitoring, reviewing and improving the audit programme, e.g. ineffective monitoring of audit programme outcomes; h) availability and cooperation of auditee and availability of evidence to be sampled. Opportunities for improving the audit programme can include: — allowing multiple audits to be conducted in a single visit; — minimizing time and distances travelling to site; — matching the level of competence of the audit team to the level of competence needed to achieve the audit objectives; — aligning audit dates with the availability of auditee’s key staff. 5.4 Establishing the audit programme 5.4.1 Roles and responsibilities of the individual(s) managing the audit programme The individual(s) managing the audit programme should: a) establish the extent of the audit programme according to the relevant objectives (see 5.2) and any known constraints; b) determine the external and internal issues, and risks and opportunities that can affect the audit programme, and implement actions to address them, integrating these actions in all relevant auditing activities, as appropriate; c) ensuring the selection of audit teams and the overall competence for the auditing activities by assigning roles, responsibilities and authorities, and supporting leadership, as appropriate; d) establish all relevant processes including processes for: — the coordination and scheduling of all audits within the audit programme; — the establishment of audit objectives, scope(s) and criteria of the audits, determining audit methods and selecting the audit team; — evaluating auditors; — the establishment of external and internal communication processes, as appropriate; — the resolutions of disputes and handling of complaints; — audit follow-up if applicable; — reporting to the audit client and relevant interested parties, as appropriate. e) determine and ensure provision of all necessary resources; f) ensure that appropriate documented information is prepared and maintained, including audit programme records; ISO 19011:2018(E) g) monitor, review and improve the audit programme; h) communicate the audit programme to the audit client and, as appropriate, relevant interested parties. The individual(s) managing the audit programme should request its approval by the audit client. 5.4.2 Competence of individual(s) managing audit programme The individual(s) managing the audit programme should have the necessary competence to manage the programme and its associated risks and opportunities and external and internal issues effectively and efficiently, including knowledge of: a) audit principles (see Clause 4), methods and processes (see A.1 and A.2); b) management system standards, other relevant standards and reference/guidance documents; c) information regarding the auditee and its context (e.g. external/internal issues, relevant interested parties and their needs and expectations, business activities, products, services and processes of the auditee); d) applicable statutory and regulatory requirements and other requirements relevant to the business activities of the auditee. As appropriate, knowledge of risk management, project and process management, and information and communications technology (ICT) may be considered. The individual(s) managing the audit programme should engage in appropriate continual development activities to maintain the necessary competence to manage the audit programme. 5.4.3 Establishing extent of audit programme The individual(s) managing the audit programme should determine the extent of the audit programme. This can vary depending on the information provided by the auditee regarding its context (see 5.3). NOTE In certain cases, depending on the auditee's structure or its activities, the audit programme might only consist of a single audit (e.g. a small project or organization). Other factors impacting the extent of an audit programme can include the following: a) the objective, scope and duration of each audit and the number of audits to be conducted, reporting method and, if applicable, audit follow up; b) the management system standards or other applicable criteria; c) the number, importance, complexity, similarity and locations of the activities to be audited; d) those factors influencing the effectiveness of the management system; e) applicable audit criteria, such as planned arrangements for the relevant management system standards, statutory and regulatory requirements and other requirements to which the organization is committed; f) results of previous internal or external audits and management reviews, if appropriate; g) results of a previous audit programme review; h) language, cultural and social issues; i) the concerns of interested parties, such as customer complaints, non-compliance with statutory and regulatory requirements and other requirements to which the organization is committed, or supply chain issues; ISO 19011:2018(E) j) significant changes to the auditee’s context or its operations and related risks and opportunities; k) availability of information and communication technologies to support audit activities, in particular the use of remote audit methods (see A.16); l) the occurrence of internal and external events, such as nonconformities of products or service, information security leaks, health and safety incidents, criminal acts or environmental incidents; m) business risks and opportunities, including actions to address them. 5.4.4 Determining audit programme resources When determining resources for the audit programme, the individual(s) managing the audit programme should consider: a) the financial and time resources necessary to develop, implement, manage and improve audit activities; b) audit methods (see A.1); c) the individual and overall availability of auditors and technical experts having competence appropriate to the particular audit programme objectives; d) the extent of the audit programme (see 5.4.3) and audit programme risks and opportunities (see 5.3); e) travel time and cost, accommodation and other auditing needs; f) the impact of different time zones; g) the availability of information and communication technologies (e.g. technical resources required to set up a remote audit using technologies that support remote collaboration); h) the availability of any tools, technology and equipment required; i) the availability of necessary documented information, as determined during the establishment of the audit programme (see A.5); j) requirements related to the facility, including any security clearances and equipment (e.g. background checks, personal protective equipment, ability to wear clean room attire). 5.5 Implementing audit programme 5.5.1 General Once the audit programme has been established (see 5.4.3) and related resources have been determined (see 5.4.4) it is necessary to implement the operational planning and the coordination of all the activities within the programme. The individual(s) managing the audit programme should: a) communicate the relevant parts of the audit programme, including the risks and opportunities involved, to relevant interested parties and inform them periodically of its progress, using established external and internal communication channels; b) define objectives, scope and criteria for each individual audit; c) select audit methods (see A.1); d) coordinate and schedule audits and other activities relevant to the audit programme; e) ensure the audit teams have the necessary competence (see 5.5.4); ISO 19011:2018(E) f) provide necessary individual and overall resources to the audit teams (see 5.4.4); g) ensure the conduct of audits in accordance with the audit programme, managing all operational risks, opportunities and issues (i.e. unexpected events), as they arise during the deployment of the programme; h) ensure relevant documented information regarding the auditing activities is properly managed and maintained (see 5.5.7); i) define and implement the operational controls (see 5.6) necessary for audit programme monitoring; j) review the audit programme in order to identify opportunities for its improvement (see 5.7). 5.5.2 Definingtheobjectives,scopeandcriteriaforanindividualaudit Each individual audit should be based on defined audit objectives, scope and criteria. These should be consistent with the overall audit programme objectives. The audit objectives define what is to be accomplished by the individual audit and may include the following: a) determination of the extent of conformity of the management system to be audited, or parts of it, with audit criteria; b) evaluation of the capability of the management system to assist the organization in meeting relevant statutory and regulatory requirements and other requirements to which the organization is committed; c) evaluation of the effectiveness of the management system in meeting its intended results; d) identification of opportunities for potential improvement of the management system; e) evaluation of the suitability and adequacy of the management system with respect to the context and strategic direction of the auditee; f) evaluation of the capability of the management system to establish and achieve objectives and effectively address risks and opportunities, in a changing context, including the implementation of the related actions. The audit scope should be consistent with the audit programme and audit objectives. It includes such factors as locations, functions, activities and processes to be audited, as well as the time period covered by the audit. The audit criteria are used as a reference against which conformity is determined. These may include one or more of the following: applicable policies, processes, procedures, performance criteria including objectives, statutory and regulatory requirements, management system requirements, information regarding the context and the risks and opportunities as determined by the auditee (including relevant external/internal interested parties requirements), sector codes of conduct or other planned arrangements. In the event of any changes to the audit objectives, scope or criteria, the audit programme should be modified if necessary and communicated to interested parties, for approval if appropriate. When more than one discipline is being audited at the same time it is important that the audit objectives, scope and criteria are consistent with the relevant audit programmes for each discipline. Some disciplines can have a scope that reflects the whole organization and others can have a scope that reflects a subset of the whole organization. ISO 19011:2018(E) 5.5.3 Selecting and determining audit methods The individual(s) managing the audit programme should select and determine the methods for effectively and efficiently conducting an audit, depending on the defined audit objectives, scope and criteria. Audits can be performed on-site, remotely or as a combination. The use of these methods should be suitably balanced, based on, among others, consideration of associated risks and opportunities. Where two or more auditing organizations conduct a joint audit of the same auditee, the individuals managing the different audit programmes should agree on the audit methods and consider implications for resourcing and planning the audit. If an auditee operates two or more management systems of different disciplines, combined audits may be included in the audit programme. 5.5.4 Selecting audit team members The individual(s) managing the audit programme should appoint the members of the audit team, including the team leader and any technical experts needed for the specific audit. An audit team should be selected, taking into account the competence needed to achieve the objectives of the individual audit within the defined scope. If there is only one auditor, the auditor should perform all applicable duties of an audit team leader. NOTE Clause 7 contains guidance on determining the competence required for the audit team members and describes the processes for evaluating auditors. To assure the overall competence of the audit team, the following steps should be performed: — identification of the competence needed to achieve the objectives of the audit; — selection of the audit team members so that the necessary competence is present in the audit team. In deciding the size and composition of the audit team for the specific audit, consideration should be given to the following: a) the overall competence of the audit team needed to achieve audit objectives, taking into account audit scope and criteria; b) complexity of the audit; c) whether the audit is a combined or joint audit; d) the selected audit methods; e) ensuring objectivity and impartiality to avoid any conflict of interest of the audit process; f) the ability of the audit team members to work and interact effectively with the representatives of the auditee and relevant interested parties; g) the relevant external/internal issues, such as the language of the audit, and the auditee’s social and cultural characteristics. These issues may be addressed either by the auditor's own skills or through the support of a technical expert, also considering the need for interpreters; h) type and complexity of the processes to be audited. Where appropriate, the individual(s) managing the audit programme should consult the team leader on the composition of the audit team. If the necessary competence is not covered by the auditors in the audit team, technical experts with additional competence should be made available to support the team. Auditors-in-training may be included in the audit team, but should participate under the direction and guidance of an auditor. ISO 19011:2018(E) Changes to the composition of the audit team may be necessary during the audit, e.g. if a conflict of interest or competence issue arises. If such a situation arises, it should be resolved with the appropriate parties (e.g. audit team leader, the individual(s) managing the audit programme, audit client or auditee) before any changes are made. 5.5.5 Assigning responsibility for an individual audit to the audit team leader The individual(s) managing the audit programme should assign the responsibility for conducting the individual audit to an audit team leader. The assignment should be made in sufficient time before the scheduled date of the audit, in order to ensure the effective planning of the audit. To ensure effective conduct of the individual audits, the following information should be provided to the audit team leader: a) audit objectives; b) audit criteria and any relevant documented information; c) audit scope, including identification of the organization and its functions and processes to be audited; d) audit processes and associated methods; e) composition of the audit team; f) contact details of the auditee, the locations, time frame and duration of the audit activities to be conducted; g) resources necessary to conduct the audit; h) information needed for evaluating and addressing identified risks and opportunities to the achievement of the audit objectives; i) information which supports the audit team leader(s) in their interactions with the auditee for the effectiveness of the audit programme. The assignment information should also cover the following, as appropriate: — working and reporting language of the audit where this is different from the language of the auditor or the auditee, or both; — audit reporting output as required and to whom it is to be distributed; — matters related to confidentiality and information security, as required by the audit programme; — any health, safety and environmental arrangements for the auditors; — requirements for travel or access to remote sites; — any security and authorization requirements; — any actions to be reviewed, e.g. follow-up actions from a previous audit; — coordination with other audit activities, e.g. when different teams are auditing similar or related processes at different locations or in the case of a joint audit. Where a joint audit is conducted, it is important to reach agreement among the organizations conducting the audits, before the audit commences, on the specific responsibilities of each party, particularly with regard to the authority of the team leader appointed for the audit. ISO 19011:2018(E) 5.5.6 Managing audit programme results The individual(s) managing the audit programme should ensure that the following activities are performed: a) evaluation of the achievement of the objectives for each audit within the audit programme; b) review and approval of audit reports regarding the fulfilment of the audit scope and objectives; c) review of the effectiveness of actions taken to address audit findings; d) distribution of audit reports to relevant interested parties; e) determination of the necessity for any follow-up audit. The individual managing the audit programme should consider, where appropriate: — communicating audit results and best practices to other areas of the organization, and — the implications for other processes. 5.5.7 Managing and maintaining audit programme records The individual(s) managing the audit programme should ensure that audit records are generated, managed and maintained to demonstrate the implementation of the audit programme. Processes should be established to ensure that any information security and confidentiality needs associated with the audit records are addressed. Records can include the following: a) Records related to the audit programme, such as: — schedule of audits; — audit programme objectives and extent; — those addressing audit programme risks and opportunities, and relevant external and internal issues; — reviews of the audit programme effectiveness. b) Records related to each audit, such as: — audit plans and audit reports; — objective audit evidence and findings; — nonconformity reports; — corrections and corrective action reports; — audit follow-up reports. c) Records related to the audit team covering topics such as: — competence and performance evaluation of the audit team members; — criteria for the selection of audit teams and team members and formation of audit teams; — maintenance and improvement of competence. The form and level of detail of the records should demonstrate that the objectives of the audit programme have been achieved. ISO 19011:2018(E) 5.6 Monitoring audit programme The individual(s) managing the audit programme should ensure the evaluation of: a) whether schedules are being met and audit programme objectives are being achieved; b) the performance of the audit team members including the audit team leader and the technical experts; c) the ability of the audit teams to implement the audit plan; d) feedback from audit clients, auditees, auditors, technical experts and other relevant parties; e) sufficiency and adequacy of documented information in the whole audit process. Some factors can indicate the need to modify the audit programme. These can include changes to: — audit findings; — demonstrated level of auditee’s management system effectiveness and maturity; — effectiveness of the audit programme; — audit scope or audit programme scope; — the auditee’s management system; — standards, and other requirements to which the organization is committed; — external providers; — identified conflicts of interest; — the audit client’s requirements. 5.7 Reviewing and improving audit programme The individual(s) managing the audit programme and the audit client should review the audit programme to assess whether its objectives have been achieved. Lessons learned from the audit programme review should be used as inputs for the improvement of the programme. The individual(s) managing the audit programme should ensure the following: — review of the overall implementation of the audit programme; — identification of areas and opportunities for improvement; — application of changes to the audit programme if necessary; — review of the continual professional development of auditors, in accordance with 7.6; — reporting of the results of the audit programme and review with the audit client and relevant interested parties, as appropriate. The audit programme review should consider the following: a) results and trends from audit programme monitoring; b) conformity with audit programme processes and relevant documented information; c) evolving needs and expectations of relevant interested parties; d) audit programme records; ISO 19011:2018(E) e) alternative or new auditing methods; f) alternative or new methods to evaluate auditors; g) effectiveness of the actions to address the risks and opportunities, and internal and external issues associated with the audit programme; h) confidentiality and information security issues relating to the audit programme. 6 Conducting an audit 6.1 General This clause contains guidance on preparing and conducting a specific audit as part of an audit programme. Figure 2 provides an overview of the activities performed in a typical audit. The extent to which the provisions of this clause are applicable depends on the objectives and scope of the specific audit. 6.2 Initiating audit 6.2.1 General The responsibility for conducting the audit should remain with the assigned audit team leader (see 5.5.5) until the audit is completed (see 6.6). To initiate an audit, the steps in Figure 1 should be considered; however, the sequence can differ depending on the auditee, processes and specific circumstances of the audit. 6.2.2 Establishing contact with auditee The audit team leader should ensure that contact is made with the auditee to: a) confirm communication channels with the auditee’s representatives; b) confirm the authority to conduct the audit; c) provide relevant information on the audit objectives, scope, criteria, methods and audit team composition, including any technical experts; d) request access to relevant information for planning purposes including information on the risks and opportunities the organization has identified and how they are addressed; e) determine applicable statutory and regulatory requirements and other requirements relevant to the activities, processes, products and services of the auditee; f) confirm the agreement with the auditee regarding the extent of the disclosure and the treatment of confidential information; g) make arrangements for the audit including the schedule; h) determine any location-specific arrangements for access, health and safety, security, confidentiality or other; i) agree on the attendance of observers and the need for guides or interpreters for the audit team; j) determine any areas of interest, concern or risks to the auditee in relation to the specific audit; k) resolve issues regarding composition of the audit team with the auditee or audit client.