QE FINALS PDF

Overview of ISO 19011:2018 Guidelines for Auditing Management Systems Seetharam Kandarpa, ASQ CMQ/OE, CQA & CPGP Chair- Healthcare ASQ Mumbai LMC About Author Seetharam Kandarpa, ASQ CMQ/OE, CQA & CPGP...

Overview of ISO 19011:2018 Guidelines for Auditing Management Systems Seetharam Kandarpa, ASQ CMQ/OE, CQA & CPGP Chair- Healthcare ASQ Mumbai LMC About Author Seetharam Kandarpa, ASQ CMQ/OE, CQA & CPGP Chief Manager Quality Assurance Abbott Healthcare Pvt. Ltd., Mumbai, India http://seetharamkandarpa.webnode.in Having over 15 years of versatile industrial experience in QA and Production functions at API/ Formulation facilities (approved by various regulatory agencies USFDA, TGA, MHRA, WHO etc.) of top pharma companies in India such as Aurobindo Pharma Ltd., Mylan Laboratories Ltd., Dr. Reddy's Laboratories Ltd., Ipca Laboratories Ltd. and Abbott Healthcare Pvt. Ltd. Having experience in handling Regulatory Inspections of USFDA, MHRA, WHO, TGA, KFDA and PMDA Having Training on Culture of Quality and Data Integrity Assurance by Dr. Ajaz S Hussain Having Training and certification on 'Cleaning Validation' by Destin A. Leblanc Back to Contents  Introduction to ISO 19011:2018 Overview of ISO – ISO (the International Organization for Standardization) is an independent, non- governmental international organization with a membership of 162 national standards bodies – Through its members, it brings together experts to share knowledge and develop voluntary, consensus-based, market relevant International Standards that support innovation and provide solutions to global challenges – ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization – ISO has published 22354 International Standards and related documents, covering almost every industry, from technology, to food safety, to agriculture and healthcare. ISO International Standards impact everyone, everywhere – Find ISO’s Central Secretariat in Geneva, Switzerland – Learn more about structure of ISO and how ISO is governed For More Details: https://www.iso.org Continues…  Introduction to ISO 19011:2018 Overview of ISO 19011 Document – ISO 19011 is an International Standard of ISO on ‘Guidelines for auditing management systems’ – This document provides guidance on auditing management systems, including the principles of auditing, managing an audit programme and conducting management system audits, as well as guidance on the evaluation of competence of individuals involved in the audit process – It is applicable to all organizations that need to plan and conduct internal or external audits of management systems or manage an audit programme – The application of this document to other types of audits is possible, provided that special consideration is given to the specific competence needed – Revision History: First Version- ISO 19011:2002 Second Version- ISO 19011:2011 Third & Current Version- ISO 19011:2018 (Preview) For More Details: https://www.iso.org/standard/70017.html Continues…  Introduction to ISO 19011:2018 Overview of ISO 19011:2018 Document – This document was prepared by Project Committee ISO/PC 302, Guidelines for auditing management systems – Publication date : 2018-July – Number of pages : 46 – Preview (Click Here) For More Details: https://www.iso.org/standard/70017.html Continues…  Introduction to ISO 19011:2018 Main Differences 3rd Version (2018) Vs 2nd Version (2011) – Addition of the risk-based approach to the principles of auditing – Expansion of the guidance on managing an audit programme, including audit programme risk – Expansion of the guidance on conducting an audit, particularly the section on audit planning – Expansion of the generic competence requirements for auditors – Adjustment of terminology to reflect the process and not the object (“thing”) – Removal of the annex containing competence requirements for auditing specific management system disciplines (due to the large number of individual management system standards, it would not be practical to include competence requirements for all disciplines) – Expansion of Annex A to provide guidance on auditing (new) concepts such as organization context, leadership and commitment, virtual audits, compliance and supply chain For More Details: https://www.iso.org/standard/70017.html Back to Contents  Different Types of Audits Audit can be conducted against a st 2nd Party 3rd Party range of audit criteria, separately 1 Party or in combination, including but Audit Audit Audit not limited to: Certification External and/or provider audit accreditation – Requirements defined in one or more audit management system standards; Internal audit – Policies and requirements specified by relevant interested parties; Other Statutory, external regulatory – Statutory and regulatory requirements; interested and similar party audit audit – One or more management system processes defined by the organization or other parties; – Management system plan(s) relating to the provision of specific outputs of a management system (e.g. quality plan, project plan). For More Details: https://www.iso.org/standard/70017.html Back to Contents  3 Terms and Definitions ISO and IEC maintain terminological databases for use in standardization at: – ISO Online browsing platform: available at https://www.iso.org/obp – IEC Electropedia: available at http://www.electropedia.org/ Audit – Systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled Combined Audit – Audit carried out together at a single auditee on two or more management systems Joint Audit – Audit carried out at a single auditee by two or more auditing organizations For More Details: https://www.iso.org/standard/70017.html Continues…  3 Terms and Definitions Audit Programme – Arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose Audit scope – Extent and boundaries of an audit Audit plan – Description of the activities and arrangements for an audit Audit criteria – Set of requirements used as a reference against which objective evidence is compared For More Details: https://www.iso.org/standard/70017.html Continues…  3 Terms and Definitions Objective evidence – Data supporting the existence or verity of something [Objective evidence can be obtained through observation, measurement, test or by other means; Objective evidence for the purpose of the audit generally consists of records, statements of fact, or other information which are relevant to the audit criteria and verifiable] Audit evidence – Records, statements of fact or other information, which are relevant to the audit criteria and verifiable Audit findings – Results of the evaluation of the collected audit evidence against audit criteria [Audit findings indicate conformity or nonconformity; Audit findings can lead to the identification of risks, opportunities for improvement or recording good practices; In English if the audit criteria are selected from statutory requirements or regulatory requirements, the audit finding is termed compliance or non-compliance] For More Details: https://www.iso.org/standard/70017.html Continues…  3 Terms and Definitions Audit conclusion – Outcome of an audit, after consideration of the audit objectives and all audit findings Audit client – Organization or person requesting an audit [In the case of internal audit, the audit client can also be the auditee or the individual(s) managing the audit programme. Requests for external audit can come from sources such as regulators, contracting parties or potential or existing clients] Auditee – Organization as a whole or parts thereof being audited Audit team – One or more persons conducting an audit, supported if needed by technical experts [One auditor of the audit team is appointed as the audit team leader; The audit team can include auditors-in-training] For More Details: https://www.iso.org/standard/70017.html Continues…  3 Terms and Definitions Auditor – person who conducts an audit Technical expert – Person who provides specific knowledge or expertise to the audit team [Specific knowledge or expertise relates to the organization, the activity, process, product, service, discipline to be audited, or language or culture; A technical expert to the audit team does not act as an auditor] Observer – Individual who accompanies the audit team but does not act as an auditor Management system – Set of interrelated or interacting elements of an organization to establish policies and objectives, and processes to achieve those objectives Risk – effect of uncertainty For More Details: https://www.iso.org/standard/70017.html Continues…  3 Terms and Definitions Conformity: Fulfilment of a requirement Nonconformity: Non-fulfilment of a requirement Competence – ability to apply knowledge and skills to achieve intended results Requirement – Need or expectation that is stated, generally implied or obligatory Process – Set of interrelated or interacting activities that use inputs to deliver an intended result Performance: Measurable result Effectiveness – Extent to which planned activities are realized and planned results achieved For More Details: https://www.iso.org/standard/70017.html Back to Contents  4 Principles of Auditing Auditing is characterized by reliance on a number of principles These principles should help to make the audit an effective and reliable tool in support of management policies and controls, by providing information on which an organization can act in order to improve its performance Adherence to these principles is a prerequisite for providing audit conclusions that are relevant and sufficient and for enabling auditors, working independently from one another, to reach similar conclusions in similar circumstances For More Details: https://www.iso.org/standard/70017.html Continues…  4 Principles of Auditing Integrity Risk-based Fair approach Presentation Auditing Principles Evidence- Due based Professional Approach Care Independence Confidentiality For More Details: https://www.iso.org/standard/70017.html Continues…  4 Principles of Auditing 1) Integrity: the foundation of professionalism – Auditors and the individual(s) managing an audit programme should: perform their work ethically, with honesty and responsibility only undertake audit activities if competent to do so perform their work in an impartial manner, i.e. remain fair and unbiased in all their dealings be sensitive to any influences that may be exerted on their judgement while carrying out an audit 2) Fair presentation: the obligation to report truthfully and accurately – Audit findings, audit conclusions and audit reports should reflect truthfully and accurately the audit activities – Significant obstacles encountered during the audit and unresolved diverging opinions between the audit team and the auditee should be reported – The communication should be truthful, accurate, objective, timely, clear and complete For More Details: https://www.iso.org/standard/70017.html Continues…  4 Principles of Auditing 3) Due professional care: the application of diligence and judgement in auditing – Auditors should exercise due care in accordance with the importance of the task they perform and the confidence placed in them by the audit client and other interested parties – An important factor in carrying out their work with due professional care is having the ability to make reasoned judgements in all audit situations 4) Confidentiality: security of information – Auditors should exercise discretion in the use and protection of information acquired in the course of their duties – Audit information should not be used inappropriately for personal gain by the auditor or the audit client, or in a manner detrimental to the legitimate interests of the auditee. This concept includes the proper handling of sensitive or confidential information For More Details: https://www.iso.org/standard/70017.html Continues…  4 Principles of Auditing 5) Independence: the basis for the impartiality of the audit and objectivity of the audit conclusions – Auditors should be independent of the activity being audited wherever practicable, and should in all cases act in a manner that is free from bias and conflict of interest – For internal audits, auditors should be independent from the function being audited if practicable. Auditors should maintain objectivity throughout the audit process to ensure that the audit findings and conclusions are based only on the audit evidence – For small organizations, it may not be possible for internal auditors to be fully independent of the activity being audited, but every effort should be made to remove bias and encourage objectivity For More Details: https://www.iso.org/standard/70017.html Continues…  4 Principles of Auditing 6) Evidence-based approach: the rational method for reaching reliable and reproducible audit conclusions in a systematic audit process – Audit evidence should be verifiable. It should in general be based on samples of the information available, since an audit is conducted during a finite period of time and with finite resources – An appropriate use of sampling should be applied, since this is closely related to the confidence that can be placed in the audit conclusions 7) Risk-based approach: an audit approach that considers risks and opportunities – Audit evidence should be verifiable. It should in general be based on samples of the information available, since an audit is conducted during a finite period of time and with finite resources – An appropriate use of sampling should be applied, since this is closely related to the confidence that can be placed in the audit conclusions For More Details: https://www.iso.org/standard/70017.html Back to Contents  5 Managing an Audit Programme Audit programme should be established covering audits – addressing one or more management system standards or other requirements – conducted either separately or in combination (combined audit) The extent of an audit programme- based on – the size and nature of the auditee – the nature, functionality, complexity, the type of risks and opportunities – the level of maturity of the management system(s) to be audited The functionality of the management system – can be even more complex when most of the important functions are outsourced and managed under the leadership of other organizations (multiple locations/sites (e.g. different countries)) – particular attention should be paid to the design, planning and validation of the audit programme For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme The audit programme should take into account the auditee’s: – organizational objectives – relevant external and internal issues – the needs and expectations of relevant interested parties – information security and confidentiality requirements Audit priority should be given to allocating resources and methods to matters in a management system with higher inherent risk and lower level of performance Competent individuals should be assigned to manage the audit programme Programme should include information and identify resources to enable the audits to be conducted effectively and efficiently within the specified time frames For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme objectives risks and relevant opportunities; documented Actions to information address them criteria for scope (extent, selecting boundaries, audit team locations) of members Audit each audit Programme Information schedule (number/ audit duration/ methods frequency) of Audits audit types audit criteria (internal/ external) Note: Some of this information may not be available until more detailed audit planning is complete For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme PDCA Cycle For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Establishing Audit Programme Initiating Audit Objectives Determining and Evaluating Audit Preparing Audit Activities PLAN Programme Risks and Opportunities Establishing Audit Programme Implementing Audit Programme Conducting Audit Activities DO Preparing and Distributing Audit Report Monitoring Audit Programme Completing Audit CHECK Reviewing and Improving Audit Conducting Audit Follow-up Programme ACT For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Establishing audit programme objectives – The audit client should ensure that the audit programme objectives are established to direct the planning and conducting of audits the audit programme is implemented effectively – objectives should be consistent with the audit client’s strategic direction and support management system policy and objectives – These objectives can be based on consideration of needs and expectations of relevant interested parties (both external andinternal) characteristics of and requirements for processes, products, services and projects, and any changes to them management system requirements need for evaluation of external providers auditee’s level of performance and level of maturity of the management system(s), as reflected in relevant performance indicators (e.g. KPIs), the occurrence of nonconformities or incidents or complaints from interested parties identified risks and opportunities to the auditee results of previous audits For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Determining and evaluating audit programme risks and opportunities – The individual(s) managing the audit programme should identify and present to the audit client the risks and opportunities considered when developing the audit programme resource requirements Risks Opportunities Planning allowing multiple audits to be Resources conducted in a single visit Selection of audit team minimizing time and distances Communication travelling to site Implementation Control of documented information matching the level of competence monitoring, reviewing and improving of the audit team to the level of the audit programme competence needed availability and cooperation of auditee aligning audit dates with the and availability of evidence to be availability of auditee’s key staff sampled For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Establishing the audit programme – Roles and responsibilities of the individual(s) managing the audit programme Establish the extent of the audit programme Determine the external and internal issues, and risks and opportunities that can affect the audit programme, and implement actions to address them, integrating these actions in all relevant auditing activities, as appropriate Ensuring the selection of audit teams and the overall competence for the auditing activities by assigning roles, responsibilities and authorities, and supporting leadership, as appropriate Establish all relevant processes including processes (for coordination & scheduling, audit methods, evaluating auditors, communication, resolution of disputesetc.) Provision of resources Documentation Monitor, review and improve audit program Communication to audit client and other interested parties For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Establishing the audit programme – Competence of individual(s) managing audit programme should have the necessary competence to manage the programme and its associated risks and opportunities and external and internal issues effectively and efficiently Should have knowledge of – audit principles, methods and processes – management system standards, other relevant standards and reference/guidance documents – information regarding the auditee and its context (e.g. external/internal issues, relevant interested parties and their needs and expectations, business activities, products, services and processes of the auditee) – applicable statutory and regulatory requirements and other requirements relevant to the business activities of the auditee – risk management, project and process management, and information and communications technology (ICT) appropriately should engage in appropriate continual development activities to maintain the necessary competence to manage the audit programme For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Establishing the audit programme – Establishing extent of audit programme Can vary depending on the information provided by the auditee regarding its context Other impacting factors – the objective, scope and duration of each audit and the number of audits to be conducted, reporting method and, if applicable, audit follow up; – the management system standards or other applicable criteria; – the number, importance, complexity, similarity and locations of the activities to be audited; – those factors influencing the effectiveness of the management system; – applicable audit criteria, such as planned arrangements for the relevant management system standards, statutory and regulatory requirements and other requirements to which the organization is committed; – results of previous internal or external audits and management reviews, if appropriate; – results of a previous audit programme review; – language, cultural and social issues; – the concerns of interested parties – significant changes, the occurrence of internal and external events – availability of information and communication technologies to support audit activities – business risks and opportunities, including actions to address them For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Establishing the audit programme – Determining audit programme resources Consider – the financial and time resources necessary to develop, implement, manage and improve audit activities – audit methods – the individual and overall availability of auditors and technical experts having competence appropriate to the particular audit programme objectives – the extent of the audit programme and audit programme risks and opportunities – travel time and cost, accommodation and other auditing needs – the impact of different time zones – the availability of information and communication technologies – the availability of any tools, technology and equipment required – the availability of necessary documented information – requirements related to the facility, including any security clearances and equipment (e.g. background checks, personal protective equipment, ability to wear clean room attire) For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Implementing audit programme – General Once the audit programme has been established and related resources have been determined it is necessary to implement the operational planning and the coordination of all the activities within the programme The individual(s) managing the audit programme should: – communicate the relevant parts of the audit programme to relevant interested parties and inform them periodically of its progress – define objectives, scope and criteria for each individual audit and select audit methods – coordinate and schedule audits and other activities relevant to the audit programme – ensure the audit teams have the necessary competence and provide necessary resources to the audit teams – ensure the conduct of audits in accordance with the audit programme, managing all operational risks, opportunities and issues (i.e. unexpected events), as they arise during the deployment of the programme – ensure relevant documented information regarding the auditing activities is properly managed and maintained – define and implement the operational controls necessary for audit programme monitoring – review the audit programme in order to identify opportunities for its improvement For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Implementing audit programme – Defining the objectives, scope and criteria for an individual audit Each individual audit should be based on defined audit objectives, scope and criteria, and these should be consistent with overall audit programme The audit objectives define what is to be accomplished by the individual audit In the event of any changes to the audit objectives, scope or criteria, the audit programme should be modified if necessary and communicated to interested parties, for approval if appropriate When more than one discipline is being audited at the same time it is important that the audit objectives, scope and criteria are consistent with the relevant audit programmes for each discipline. For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Implementing audit programme – Selecting and determining audit methods The individual(s) managing the audit programme should select and determine the methods for effectively and efficiently conducting an audit, depending on the defined audit objectives, scope and criteria Audits can be performed on-site, remotely or as a combination. – On-site – Remote – combined The use of these methods should be suitably balanced, based on, among others, consideration of associated risks and opportunities Where two or more auditing organizations conduct a joint audit of the same auditee, the individuals managing the different audit programmes should agree on the audit methods and consider implications for resourcing and planning the audit If an auditee operates two or more management systems of different disciplines, combined audits may be included in the audit programme For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Implementing audit programme – Selecting and determining audit methods (Contd.) For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Implementing audit programme – Selecting audit team members The individual(s) managing the audit programme should appoint the members of the audit team, including the team leader and any technical experts needed for the specific audit taking into account the competence needed to achieve the objectives of the individual audit within the defined scope If there is only one auditor, the auditor should perform all applicable duties of an audit team leader Size and composition of the audit team for the specific audit should be decided considering necessary impacting factors [such as overall competence needed, complexity, joint/ combined audit, audit methods, elimination of conflicts of interest, ability of audit team to work with stakeholders, relevant external/ internal issues (language, social, cultural characteristics), need for interpreters/ technical experts and typed & complexity of the processes to be audited] Auditors-in-training may be included in the audit team, but should participate under the direction and guidance of an auditor If a conflict of interest or competence issue arises, it should be resolved with the appropriate parties (e.g. audit team leader, the individual(s) managing the audit programme, audit client or auditee) before any changes are made in composition of team For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Implementing audit programme – Assigning responsibility for an individual audit to the audit team leader The individual(s) managing the audit programme should assign the responsibility for conducting the individual audit along with audit infomration to an audit team leader in sufficient time before the scheduled date of the audit, in order to ensure the effective planning of the audit Where a joint audit is conducted, it is important to reach agreement among the organizations conducting the audits, before the audit commences, on the specific responsibilities of each party, particularly with regard to the authority of the team leader appointed for the audit – Managing audit programme results The individual(s) managing the audit programme should ensure – evaluation of the achievement of the objectives for each audit within the audit programme – review and approval of audit reports regarding the fulfilment of the audit scope and objectives – review of the effectiveness of actions taken to address audit findings – distribution of audit reports to relevant interested parties – determination of the necessity for any follow-up audit – communicating audit results and best practices to other areas of the organization For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Implementing audit programme – Managing and maintaining audit programme records The individual(s) managing the audit programme should ensure – audit records are generated, managed and maintained to demonstrate the implementation of the audit programme – any information security and confidentiality needs associated with the audit records are addressed Records Related to Audit Programme Related to Each Audit Related to the Audit Team Schedule of audits Audit plans and audit Competence and Audit programme objectives reports performance evaluation of and extent Objective audit evidence the audit team members Those addressing audit and findings Criteria for the selection of programme risks and Nonconformity reports audit teams and team opportunities, and relevant corrections and corrective members and formation of external and internal issues action reports audit teams Reviews of the audit Audit follow-up reports Maintenance and programme effectiveness improvement of competence For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Monitoring audit programme – The individual(s) managing the audit programme should ensure the evaluation of: whether schedules are being met and audit programme objectives are being achieved the performance of the audit team members including the audit team leader and the technical experts the ability of the audit teams to implement the audit plan feedback from audit clients, auditees, auditors, technical experts and other relevant parties sufficiency and adequacy of documented information in the whole auditprocess For More Details: https://www.iso.org/standard/70017.html Continues…  5 Managing an Audit Programme Reviewing and improving audit programme – The individual(s) managing the audit programme and the audit client should review the audit programme to assess whether its objectives have been achieved – Lessons learned from the audit programme review should be used as inputs for the improvement of the programme – The individual(s) managing the audit programme should ensure: review of the overall implementation of the audit programme identification of areas and opportunities for improvement application of changes to the audit programme if necessary review of the continual professional development of auditors reporting of the results of the audit programme and review with the audit client and relevant interested parties, as appropriate For More Details: https://www.iso.org/standard/70017.html Back to Contents  6 Conducting an Audit Initiating audit – General The responsibility for conducting the audit should remain with the assigned audit team leader until the audit is completed – Establishing contact with auditee The audit team leader should ensure that contact is made with the auditee majorly to: – confirm communication channels with the auditee’s representatives and the authority to conduct the audit – provide relevant information on the audit objectives, scope, criteria, methods and audit team composition, including any technical experts – request access to relevant information for planning purposes; make arrangements for the audit including the schedule – determine applicable statutory and regulatory requirements and other requirements – confirm the agreement with the auditee regarding the extent of the disclosure and the treatment of confidential information – Determining feasibility of audit The feasibility of the audit should be determined to provide reasonable confidence that the audit objectives can be achieved Where the audit is not feasible, an alternative should be proposed to the audit client, in agreement with the auditee For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Preparing audit activities – Performing review of documented information The relevant management system documented information of the auditee should be reviewed in order to: – gather information to understand the auditee’s operations and to prepare audit activities and applicable audit work documents, e.g. on processes, functions – establish an overview of the extent of the documented information to determine possible conformity to the audit criteria and detect possible areas of concern, such as deficiencies, omissions or conflicts, an alternative should be proposed to the audit client, in agreement with the auditee – Audit planning Risk-based approach to planning – The audit team leader should adopt a risk-based approach to planning the audit based on the information in the audit programme and the documented information provided by the auditee – The amount of detail provided in the audit plan should reflect the scope and complexity of the audit, as well as the risk of not achieving the audit objectives – Risks to the auditee can result from the presence of the audit team members adversely influencing the auditee’s arrangements for health and safety, environment and quality, and its products, services, personnel or infrastructure (e.g. contamination in clean room facilities) – For combined audits, particular attention should be given to the interactions between operational processes and any competing objectives and priorities of the different management systems For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Preparing audit activities – Audit planning (Contd.) Audit planning details – The scale and content of the audit planning can differ from case to case – Audit planning should be sufficiently flexible to permit changes which can become necessary as the audit activities progress – Audit planning should address or reference the key information of audit such as objectives, scope, methods, criteria, schedule, audit team etc. – Audit plans should be presented to the auditee. Any issues with the audit plans should be resolved between the audit team leader, the auditee and, if necessary, the individual(s) managing the audit programme – Assigning work to audit team The audit team leader, in consultation with the audit team, should assign to each team member responsibility for auditing specific processes, activities, functions or locations and, as appropriate, authority for decision-making Take into account the impartiality and objectivity and competence of auditors and the effective use of resources, as well as different roles and responsibilities of auditors, auditors-in-training and technical experts Audit team meetings should be held, as appropriate, by the audit teamleader For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Preparing audit activities – Preparing documented information for audit The audit team members should collect and review the information relevant to their audit assignments and prepare documented information for the audit, using any appropriate media – physical or digital checklists – audit sampling details – audio visual information Documented information prepared for, and resulting from, the audit should be retained at least until audit completion, or as specified in the auditprogramme Documented information created during the audit process involving confidential or proprietary information should be suitably safeguarded at all times by the audit team members For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Conducting audit activities – Assigning roles and responsibilities of guides and observers Guides and observers may accompany the audit team with approvals from the audit team leader, audit client and/or auditee, if required Should not influence or interfere with the conduct of the audit. If this cannot be assured, the audit team leader should have the right to deny observers from being present during certain audit activities Guides, appointed by the auditee, should assist the audit team and act on the request of the audit team leader or the auditor to which they have beenassigned Their responsibilities should include the following: – assisting the auditors in identifying individuals to participate in interviews and confirming timings and locations – arranging access to specific locations of the auditee – ensuring that rules concerning location-specific arrangements for access, health and safety, environmental, security, confidentiality and other issues are known and respected by the audit team members and observers and any risks are addressed – witnessing the audit on behalf of the auditee, when appropriate – providing clarification or assisting in collecting information, when needed For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Conducting audit activities – Conducting opening meeting The purpose of the opening meeting is to: – confirm the agreement of all participants (e.g. auditee, audit team) to the audit plan – introduce the audit team and their roles – ensure that all planned audit activities can be performed An opening meeting should be held with the auditee’s management and, where appropriate, those responsible for the functions or processes to beaudited During the meeting, an opportunity to ask questions should beprovided The meeting should be chaired by the audit team leader – Communicating during audit The audit team should confer periodically to exchange information, assess audit progress and reassign work between the audit team members, as needed Evidence collected during the audit that suggests an immediate and significant risk should be reported without delay to the auditee and, as appropriate, to the auditclient Where the available audit evidence indicates that the audit objectives are unattainable, the audit team leader should report the reasons to the audit client and the auditee to determine appropriate action For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Conducting audit activities – Audit information availability and access Where, when and how to access audit information is crucial to the audit This is independent of where the Information is created, used and/or stored Based on these issues, the audit methods need to be determined. The audit can use a mixture of methods. Also, audit circumstances may mean that the methods need to change during the audit – Reviewing documented information while conducting audit The auditee’s relevant documented information should be reviewed to: – determine the conformity of the system, as far as documented, with audit criteria – gather information to support the audit activities If adequate documented information cannot be provided within the time frame given in the audit plan, the audit team leader should inform both the individual(s) managing the audit programme and the auditee. Depending on the audit objectives and scope, a decision should be made as to whether the audit should be continued or suspended until documented information concerns are resolved For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Conducting audit activities – Collecting and verifying information During the audit, information relevant to the audit objectives, scope and criteria, including information relating to interfaces between functions, activities and processes should be collected by means of appropriate sampling and should be verified, as far as practicable Only information that can be subject to some degree of verification should be accepted as audit evidence Where the degree of verification is low the auditor should use their professional judgement to determine the degree of reliance that can be placedon it as evidence Audit evidence leading to audit findings should be recorded. If, during the collection of objective evidence, the audit team becomes aware of any new or changed circumstances, or risks or opportunities, these should be addressed by the team accordingly Methods of collecting information include: interviews; observations; review of documents, including records For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Conducting audit activities – Collecting and verifying information Source of Information Collecting by means of appropriate Sampling Audit Evidence Evaluating against Audit Criteria Audit Findings Reviewing Audit Conclusions For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Conducting audit activities – Generating audit findings Audit evidence should be evaluated against the audit criteria in order to determine audit findings Audit findings can indicate conformity or nonconformity with audit criteria When specified by the audit plan, individual audit findings should include conformity and good practices along with their supporting evidence, opportunities for improvement, and any recommendations to the auditee Nonconformities and their supporting audit evidence should be recorded Nonconformities can be graded (qualitative or quantitative) depending on the context of the organization and its risks They should be reviewed with the auditee in order to obtain acknowledgement that the audit evidence is accurate and that the nonconformities are understood Unresolved issues should be recorded in the audit report For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Conducting audit activities – Determining audit conclusions Preparation for closing meeting: The audit team should confer prior to the closing meeting in order to – review the audit findings and any other appropriate information collected during the audit, against the audit objectives; – agree on the audit conclusions, taking into account the uncertainty inherent in the audit process; – prepare recommendations, if specified by the audit plan; – discuss audit follow-up, as applicable Content of audit conclusions: Audit conclusions should address issues suchas – the extent of conformity with the audit criteria and robustness of the management system, including the effectiveness of the management system in meeting the intended outcomes, the identification of risks and effectiveness of actions taken by the auditee to address risks – the effective implementation, maintenance and improvement of the management system – achievement of audit objectives, coverage of audit scope and fulfilment of audit criteria – similar findings made in different areas that were audited or from a joint or previous audit for the purpose of identifying trends For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Conducting audit activities – Conducting closing meeting A closing meeting should be held to present the audit findings andconclusions The closing meeting should be chaired by the audit team leader and attended by the management of the auditee and include, as applicable: – those responsible for the functions or processes which have been audited – the audit client – other members of the audit team – other relevant interested parties as determined by the audit client and/or auditee Meeting can be formal or less formal Any diverging opinions regarding the audit findings or conclusions between the audit team and the auditee should be discussed and, if possible, resolved. If not resolved, this should be recorded For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Preparing and distributing audit report – Preparing audit report The audit team leader should report the audit conclusions in accordance with the audit programme The audit report should provide a complete, accurate, concise and clear record of the audit, and should include or refer to – audit objectives, audit scope and the functions or processes audited – identification of the audit client, audit team and auditee’s participants in the audit – dates and locations where the audit activities were conducted – audit criteria, audit findings and related evidence, audit conclusions – a statement on the degree to which the audit criteria have been fulfilled – any unresolved diverging opinions between the audit team and the auditee – audits by nature are a sampling exercise; as such there is a risk that the audit evidence examined is not representative For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Preparing and distributing audit report – Distributing audit report The audit report should be issued within an agreed period of time The audit report should be dated, reviewed and accepted, as appropriate, in accordance with the audit programme The audit report should then be distributed to the relevant interested parties defined in the audit programme or audit plan Consider appropriate measures to ensure confidentiality For More Details: https://www.iso.org/standard/70017.html Continues…  6 Conducting an Audit Completing audit – The audit is completed when all planned audit activities have been carried out, or as otherwise agreed with the audit client – Documented information pertaining to the audit should be retained or disposed – If disclosure of the contents of an audit document is required, the audit client and auditee should be informed as soon as possible – Lessons learned from the audit can identify risks and opportunities for the audit programme and the auditee Conducting audit follow-up – The outcome of the audit can, depending on the audit objectives, indicate the need for corrections, or for corrective actions, or opportunities for improvement – Such actions are usually decided and undertaken by the auditee within an agreed timeframe – The completion and effectiveness of these actions should be verified. This verification may be part of a subsequent audit – Outcomes should be reported to the individual managing the audit programme and the audit client for management review For More Details: https://www.iso.org/standard/70017.html Back to Contents  7 Competence and Evaluation of Auditors General Competence Confidence Ability (to achieve (of Audit Team) (in Audit Process) Objectives) – Competence should be evaluated regularly through a process that considers personal behaviour and the ability to apply the knowledge and skills gained through education, work experience, auditor training and audit experience – It is not necessary for each auditor in the audit team to have the same competence – The overall competence of the audit team needs to be sufficient to achieve the audit objectives Auditor Competence Evaluation Process Main Steps Outcome Determine the required competence to fulfil Selection of audit team members the needs of the audit programme Determining the need for improved Establish the evaluation criteria competence (e.g. additional training); Select the appropriate evaluation method Ongoing performance evaluation of auditors conduct the evaluation For More Details: https://www.iso.org/standard/70017.html Continues…  7 Competence and Evaluation of Auditors Determining auditor competence – General In deciding the necessary competence for an audit, consider an auditor’s knowledge and skills related to – the size, nature, complexity, products, services and processes of auditees – the methods for auditing, the management system disciplines to be audited – the complexity and processes of the management system to be audited – the types and levels of risks and opportunities addressed by the management system – the objectives and extent of the audit programme – the uncertainty in achieving audit objectives – other requirements, such as those imposed by the audit client or other relevant interested parties, where appropriate For More Details: https://www.iso.org/standard/70017.html Continues…  7 Competence and Evaluation of Auditors Determining auditor Ethical competence Collaborative Open-minded – Personal behaviour Culturally sensitive Diplomatic Auditors should possess the necessary attributes to enable them to act Open to improvement Professional Observant in accordance with the principles of Behaviours auditing Auditors should exhibit professional Able to act Perceptive with fortitude behaviour during the performance of audit activities Self-reliant Versatile Decisive Tenacious For More Details: https://www.iso.org/standard/70017.html Continues…  7 Competence and Evaluation of Auditors Determining auditor competence – Knowledge and skills Auditor Audit Team Leaders Knowledge and skills necessary to achieve Knowledge and skills of Auidtor the intended results of the audits Additional knowledge and skills necessary to Generic competence provide leadership to the audit team Level of discipline Sector-specific knowledge and skills Generic knowledge and skills of management system auditors – Audit principles, processes and methods – Management system standards and other references – The organization and its context – Applicable statutory and regulatory requirements and other requirements For More Details: https://www.iso.org/standard/70017.html Continues…  7 Competence and Evaluation of Auditors Determining auditor competence – Knowledge and skills (Contd.) Discipline and sector-specific competence of auditors – management system requirements and principles, and their application – fundamentals of the discipline(s) and sector(s) related to the management systems standards as applied by the auditee – application of discipline and sector-specific methods, techniques, processes and practices – principles, methods and techniques relevant to the discipline and sector Generic competence of audit team leader – plan the audit and assign audit tasks according to the specific competence of individual audit team members – discuss strategic issues with top management of the auditee to determine whether they have considered these issues when evaluating their risks and opportunities – develop and maintain a collaborative working relationship among the audit team members – manage the audit process – represent and lead the audit team – prepare and complete the audit report For More Details: https://www.iso.org/standard/70017.html Continues…  7 Competence and Evaluation of Auditors Determining auditor competence – Knowledge and skills (Contd.) Knowledge and skills for auditing multiple disciplines – the audit team member should have an understanding of the interactions and synergy between the different management systems – Audit team leaders should understand the requirements of each of the management system standards being audited and recognize the limits of their competence in each of the disciplines – Achieving auditor competence Successfully completing training programmes Experience in a relevant technical, managerial or professional position involving the exercise of judgement, decision making, problem solving and communication with managers, professionals, peers, customers and other relevant interestedparties Education/training and experience in a specific management system discipline and sector that contribute to the development of overall competence Audit experience acquired under the supervision of an auditor competent in the same discipline For More Details: https://www.iso.org/standard/70017.html Continues…  7 Competence and Evaluation of Auditors Determining auditor competence – Achieving audit team leader competence Additional audit experience to develop the competence by working under the direction and guidance of a different audit team leader Establishing auditor evaluation criteria – Qualitative- such as having demonstrated desired behaviour, knowledge or the performance of the skills, in training or in the workplace – Quantitative- such as the years of work experience and education, number of audits conducted, hours of audit training For More Details: https://www.iso.org/standard/70017.html Continues…  7 Competence and Evaluation of Auditors Selecting appropriate auditor evaluation method For More Details: https://www.iso.org/standard/70017.html Continues…  7 Competence and Evaluation of Auditors Conducting auditor evaluation – The information collected about the auditor under evaluation should be compared against the criteria of required knowledge and skills – When an auditor under evaluation who is expected to participate in the audit programme does not fulfil the criteria, then additional training, work or audit experience should be undertaken and a subsequent re-evaluation should be performed Maintaining and improving auditor competence – Auditors and audit team leaders should continually improve their competence – Auditors should maintain their auditing competence through regular participation in management system audits and continual professional development through means such as additional work experience, training, private study, coaching, attendance at meetings, seminars and conferences or other relevant activities For More Details: https://www.iso.org/standard/70017.html Back to Contents