Auditing Standard pertaining to Auditing Routine

ISO Standard for Auditing 19011

1. TRAINING ON
MANAGEMENT SYSTEM AUDITS
(Based on ISO19011:2018 Standard)
Part - I : Audit Concepts and Terminology (Clause 1 2 3 4)
Part - II : Audit Management (5)
Part - III : Audit Activities (6)
Part - IV : Competence and Evaluation of Auditors (7)

2. TRAINING ON MANAGEMENT SYSTEM AUDITS
-  Audit pre process - How to organized the audit basic acitives in coordination with
Certifcation body, Organzation ,Auditor, Scope ,standard requirement,Resources for Audit .
- Audit process- Where actually start? , What is the Pre audit work, Onsite work, Post audit
work
- Auditor process - Selection for scope, Competence measure, Allocation method,
Monitoring audit process,Reviewing audit process, Evaluating audit process accroding his audit
activities
- Called as Audit management
2

3. Ex 16 – ISMS audit plan

Ex17 - Checklist for control objectives

Ex 18 – Stage1 Document review

Ex 19 / 20 /21– Mock drill – Opening meeting/ Onsite visit audit/ Closing
Meeting

Ex 21- Evaluation findings only Major/minor/OFI

Ex 23- Audit report writing ( Output from Ex 20)

Ex 24 - Role ,Responsibility of - Auditor/Lead Auditor/Auditee

4. TRAINING ON MANAGEMENT SYSTEM AUDITS
Part - I
4
Audit Concepts and Terminology

5. TRAINING ON MANAGEMENT SYSTEM AUDITS
What is audit ?
Most of us are familiar with the term ‘audit’.
Typically, ‘audit’ is considered to be associated with financial
matters such as accounting, costing, taxation, etc.
As a result, the very mention of the word ‘audit’ evokes fear, not
comfort.
However, management system audits are totally different in
nature, whether on quality management system (ISO9001:2015
QMS) or other management systems (ISO14001 EMS, 45001
OHSMS, SA8000,ISMS 27001, etc.)
The International Organization for Standardization (ISO) has
even published a standard (ISO19011:2018, latest revision
published in July 2018) to provide guidance on how to conduct
management system audits.
5

6. TRAINING ON MANAGEMENT SYSTEM AUDITS
4
Definition of Audit:
“Audit is a systematic, independent and documented process for
obtaining audit evidence and evaluating it objectively to
determine the extent to which the audit criteria are fulfilled.”

Scope of Audit:
Audit scope may include the examination of System
Adequacy and/or Compliance, and identification of
Improvement Opportunities.
Types of Audit:
1. Internal Audit
2. External Audit
3. Combined Audit
4. Joint Audit

7. TRAINING ON MANAGEMENT SYSTEM AUDITS
1. Internal Audit (First Party Audit)
It is conducted by, or on behalf of, the organization itself for
management review and other internal purposes (e.g. to confirm
the intended operation of the management system or to obtain
information for improvement of the management system), and may
form the basis for an organization’s self- declaration of conformity.
In many cases, particularly in smaller organizations, independence
can be demonstrated by the freedom from responsibility for the
activity being audited or freedom from bias and conflict of interest.
7

8. TRAINING ON MANAGEMENT SYSTEM AUDITS
2. External Audit (2nd / 3rd Party Audit)
Second party audits are conducted by parties having an
interest in the organization, such as customers, or by other
persons on their behalf.
Third party audits are conducted by independent auditing
organizations, such as regulators or those providing
registration or certification.
3. Combined Audit
When two or more management systems of different disciplines
(e.g. quality, environmental, occupational health and safety,
ISMS ) are audited together, this is termed a combined audit.
4. Joint Audit
When two or more auditing organizations cooperate to audit a single
auditee, this is termed a joint audit.
8

9. TRAINING ON MANAGEMENT SYSTEM AUDITS
Principles of Auditing ( 7 principles )
Management system audit can become an effective support tool
for management by checking the implementation status of policies
and procedures, and providing information that can help
improving the process performance.
In order to ensure that the audit conclusions are relevant, and
different auditors arrive at similar conclusions in similar
circumstances, the ISO has spelt out some pre-requisites/
guidelines for the auditors and the audit process itself.
Auditing is characterized by reliance on a number of principles
known as the
“Principles of Auditing” which every auditor and audit manager
must adhere to.
9

10. TRAINING ON MANAGEMENT SYSTEM AUDITS
8
Principles of Auditing (For Auditors and Audit Managers)
1. Integrity (the foundation of professionalism)
- To perform the work with honesty, diligence, and responsibility
- To observe and respect any applicable legal requirements
- To demonstrate technical competence while undertaking work
- To perform the work in an impartial manner, and
- Be sensitive to any influences that may be exerted by other interested
parties on their judgment while carrying out an audit.
2. Fair presentation (obligation to report truthfully and accurately)
- Audit findings, audit conclusions and audit reports should reflect truthfully
and accurately the audit activities.
- Significant obstacles encountered during the audit and unresolved diverging
opinions between the audit team and the auditee may be reported.
- The communication has to be truthful, accurate, objective, timely, clear and
Complete

11. TRAINING ON MANAGEMENT SYSTEM AUDITS
Principles of Auditing (For Auditors and Audit Managers)
3. Due professional care (the application of diligence and
judgement in auditing)
-  Auditors should exercise due care in accordance with the importance of
the
task they perform and the confidence placed in them by the audit client and
other interested parties.
- An important factor in carrying out their work with due professional care
is having the ability to make reasoned judgements in all audit situations.
3. Confidentiality (security of information)
- Auditors should be prudent in the use and protection of information acquired
in the course of their duties.
- Audit information should not be used inappropriately for the personal gain by
the auditor or the audit client or in a manner detrimental to the legitimate
interest of the auditee. This concept includes the proper handling of
sensitive, confidential or classified information.
11

12. TRAINING ON MANAGEMENT SYSTEM AUDITS
Principles of Auditing (For Audit Process)
5. Independence (the basis for the impartiality of the audit and
objectivity of the audit conclusions)
-  Auditors should be independent of the activity being audited and act in
a manner that is free from bias and conflict of interest wherever
possible.
- For internal audits, auditors should be independent from the
operating managers of the function(s) being audited.
- Auditors should maintain an objective state of mind throughout the audit
process to ensure that the audit findings and conclusions are based only
on the audit evidence.
- For small organizations, it may not be possible for internal auditors to be
fully
independent of the activity being audited, but every effort should be made
to remove bias and allow for objectivity.
12

13. 13
TRAINING ON MANAGEMENT SYSTEM AUDITS
Principles of Auditing (For Audit Process)
6. Evidence-based approach (the rational method for
reaching reliable and reproducible audit conclusions in a
systematic audit process)
- Audit evidence is verifiable.
- It is based on samples of the information available, since an audit
is conducted during a finite period of time and with finite
resources.
- The appropriate use of sampling is closely related to the confidence that
can be placed in the audit conclusions.

14. Principles of Auditing (For Audit Process)

7. Risk-based approach: an audit approach that considers risks and
opportunities
The risk-based approach should substantively influence the planning,
conducting and reporting of audits in order to ensure that audits are focused on
matters that are significant for the audit client, and for achieving the audit
programme objectives


Note: The ISO19011:2018 audit standard is based on the above Seven principles of
auditing.

Let us now get ourselves familiarised with the audit terminology

15. TRAINING ON MANAGEMENT SYSTEM AUDITS
1
2
Audit Terminology:
1. Audit Criteria: The set of policies, procedures or requirements
that apply to the management system being audited.
Notes:
1. Audit criteria are used as a reference against which audit evidence is compared.
2. If the audit criteria are selected from legal or other requirements, the audit finding is
termed compliance or non-compliance.
3. If the audit criteria are selected from standards (internal or external), the audit finding is
termed a conformity or nonconformity.
2.Audit Evidence: Verifiable records, statement of fact or other
information which are relevant to the audit criteria.
Note: Audit evidence may be qualitative or quantitative.
3. Audit Findings: The results of evaluation of the collected audit
evidence against audit criteria which may indicates conformity /
non-conformity /opportunity for improvement / good practices.

16. TRAINING ON MANAGEMENT SYSTEM AUDITS
Audit Terminology:
4. Audit Conclusion: It is the outcome of an audit, after
consideration of the audit objectives and all audit findings.
5. Audit Client: It is the organization or person requesting an
audit
Note: The audit client may be the auditee or any other organization which has the
regulatory or contractual right to request an audit.

6. Auditee: It is the organization being audited.
7. Auditor: He / she is a person who conducts an audit.
16

17. TRAINING ON MANAGEMENT SYSTEM AUDITS
Audit Terminology:
8. Audit Team: It is a team of one or more auditors
conducting an audit, supported (if needed) by technical
experts.
Notes:
1. One auditor of the audit team is appointed as the audit team leader.
2. The audit team may include auditors-in-training.
11. Audit Programme: The arrangements for a set of one or more
audits planned for a specific time frame and directed towards a
specific purpose.
12. Audit plan: A description of the activities and arrangements for
an audit.
13. Risk: The effect of uncertainty on objectives.
17

18. TRAINING ON MANAGEMENT SYSTEM AUDITS
Audit Terminology:
12. Audit Scope: It is the extent and boundaries of an audit.
Note: The audit scope generally includes a description of the physical locations,
organizational units, activities and processes, as well as the time period covered.
13. Competence: The ability to apply knowledge and skills to
achieve intended results.
Note: Ability implies the appropriate application of personal behaviour during the audit
process.
14. Technical Expert: A person who provides specific
knowledge or expertise to the audit team.
Notes:
1. Specific knowledge or expertise is that which relates to the organization, the process
or activity to be audited, or language or culture.
2. A technical expert does not act as an auditor in the audit team.
18

19. TRAINING ON MANAGEMENT SYSTEM AUDITS
Audit Terminology:
15. Conformity: Fulfilment of a requirement.
16. Nonconformity: Non-fulfilment of a requirement.
17. Guide: A person appointed by the auditee to assist the
audit team.
19
18. Process
Set of interrelated activities that use inputs to delivery an intended
results
19.

Performance
measurable result

20. Effectiveness
extent to which planned activities are realized and planned
results achieved

20. TRAINING ON MANAGEMENT SYSTEM AUDITS
Part - II
20
Audit Management
(Managing an audit programme)

21. TRAINING ON MANAGEMENT SYSTEM AUDITS
18
The PDCA (Plan-Do-Check-Act) Flow Chart for Audit
Management
1. Establishing the audit programme
- To develop the programme objectives
- To list out the role, responsibility,
and competence required of audit
manager(s)
- To determine the extent of the audit
programme
- To evaluate audit programme risks
- To establish the audit programme procedures
- To identify audit programme resources
2. Implementing the audit programme
- To define individual audit objectives,
scope and criteria
- To determine the audit method(s)
- To select the audit team
- To assign responsibility for individual
audit(s) to the audit team leader
- To manage and maintain audit programme
records
Competenc
e and
evaluation
of auditors
Audit
Activiti
es
3. Monitoring the audit
programme
4. Reviewing
& improving
audit
programme
PLAN
DO
CHECK
ACT
Let us discuss each step in detail in the next few slides.

22. TRAINING ON MANAGEMENT SYSTEM AUDITS
19
Step 1. Establishing the audit programme
A. Developing the programme objectives:
The objectives must be set, in order to give a direction for the planning and
conduct of audits and to ensure effective implementation of audit programme.
Setting of audit programme objectives may depend on ...
- management priorities, commercial and/or business intentions
- management system(s) requirements
- legal and other requirements
- need for supplier evaluation
- needs and expectations of interested parties (including customers)
- auditee’s level of performance, as reflected in the occurrence of failures or
incidents or customer complaints
- risks to the organization being audited
- results of previous audits, and
- level of maturity of the management system.

23. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 1. Establishing the audit programme (clause 5.2):
A. Developing the programme objectives (…):
Typical examples of audit programme objectives are ...
“To contribute to the improvement of a management system and its
performance.”
“To meet external requirements, e.g. certification to a management
system standard.”
“To verify conformity with contractual requirements.”
“To obtain and maintain confidence in the capability of a supplier.”
“To evaluate compatibility and alignment of the management system
objectives with the management system policy and the overall business
objectives.”
23

24. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 1. Establishing the audit programme (clause 5.2):
B. Role and responsibility of the person(s) managing audit
programme(s):
The person(s) having the responsibility for managing audit programme(s)
must ...
- establish the extent of the audit programme
- evaluate the risks for the audit programme
- establish audit responsibilities and procedures
- ensure necessary resources are provided, including the evaluation of auditors
- ensure the implementation of the audit programme, such as defining audit
objectives, scope and criteria of the individual audits, determining audit
methods and selecting the audit team
- ensure that appropriate audit programme records are maintained, and
- monitor, review and improve the audit programme.
Note: The person(s) assigned the responsibility for managing an audit programme(s)
should inform the top management on the contents of the audit programme and, where
necessary, ask for its approval.
24

25. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 1. Establishing the audit programme (clause 5.2):
C. Competence of the person responsible for managing audit
programme(s):
The audit manager(s) should have competence to manage the audit
programme(s) effectively and efficiently as well as competence in the following
areas relevant to their organization and the audit programme objectives:
- audit principles, procedures, methods and techniques
- management system and reference documents
- applicable legal and other requirements relevant to the activities and/or
products of the organization to be audited
- organizational product and processes
- customer(s), supplier(s) and other interested parties of the organization
to be audited, where applicable, and
- risks associated with the audit programme(s).
25

26. TRAINING ON MANAGEMENT SYSTEM AUDITS
23
(list continues in next slide …)
Step 1. Establishing the audit programme (clause 5.2):
D. Determining the extent of an audit programme:
The audit manager(s) should establish the extent of an audit programme which
depends on the size and nature of the organization to be audited, as well as on the
nature, functionality, complexity and the level of maturity of the management
system(s) to be audited.
Other factors impacting the extent of an audit programme include:
- the scope, objective and duration of each audit, and, the frequency of audit
- the number, importance, similarity and locations of the activities to be audited
- those matters of significance to the effectiveness of the management system
- legal and other requirements, such as standards, contractual requirements, etc.
- the need to meet external requirements, say, for certification

27. TRAINING ON MANAGEMENT SYSTEM AUDITS
24
criminal acts or environmental incident.
Step 1. Establishing the audit programme (clause 5.2):
D. Determining the extent of an audit programme (…):
(… list continues from previous slide)
- conclusions of previous internal / external audits or results of previous
audit programme review
- language, cultural and social issues
- the concerns of interested parties such as customer complaints,
regulatory breaches, etc.
- significant changes to the organization to be audited or its operations
- the extent and maturity of the information and communications technologies
of the auditee, which can impact the use of remote audit methods, and
- the occurrence of internal and external events such as product
failure, contamination, information security leak, health and safety
incident,

28. TRAINING ON MANAGEMENT SYSTEM AUDITS
25
Step 1. Establishing the audit programme (clause 5.2):
E. Evaluating audit programme risks:
The audit manager(s) should consider the risks associated with establishing,
implementing, monitoring and reviewing an audit programme.
These risks may be associated with:
- planning, e.g. failure to set the objectives and extent of audit programme
- resources, e.g. allotting insufficient time to develop the audit programme
- selection of the audit team, e.g. the team does not have the collective
competence to conduct the audit effectively
- implementation, e.g. ineffective communication of the audit programme
- records, e.g. failure to adequately protect audit records to demonstrate audit
programme effectiveness, and
- monitoring, reviewing and improving the audit programme,
e.g. ineffective monitoring of audit programme outcomes.

29. TRAINING ON MANAGEMENT SYSTEM AUDITS
26
- maintaining audit programme records.
Step 1. Establishing the audit programme (clause 5.2):
F. Establishing audit programme procedures:
The audit manager(s) should establish one or more audit programme
procedures, addressing the following:
- planning and scheduling audits considering audit programme risks
- managing information security, confidentiality, risks to the organization
from auditing activities and other matters related to the audit programme
- assuring the competence of auditors and audit team leaders
- selecting appropriate audit teams and assigning their roles and responsibilities
- conducting audits, including the use of appropriate sampling methods
- conducting audit follow-up, if applicable
- reporting to the audit client (e.g. top management) on the overall
achievements of the audit programme
- monitoring the performance, risks and effectiveness of the audit programme,
and

30. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 1. Establishing the audit programme (clause 5.2):
G. Identifying audit programme resources:
When identifying resources for the audit programme, the audit manager(s)
should consider:
- the financial resources necessary to develop, implement, manage and
improve audit activities
- audit methods / techniques
- the availability of auditors and technical experts having competence
appropriate to the particular audit programme objectives
- the extent of the audit programme
- travelling time and cost, accommodation and other auditing needs, and
- the extent and maturity of the information and communication systems of
the organization to be audited which may impact the use of remote audit
methods.
27

31. TRAINING ON MANAGEMENT SYSTEM AUDITS
28
Step 2. Implementing the audit programme
A. General Considerations:
The audit manager(s) should implement the audit programme by:
- communicating the pertinent parts of the audit programme to relevant
parties and informing them periodically of its progress
- defining objectives, scope and criteria for each individual audit
- coordinating and scheduling audits and other activities relevant to
the audit programme
- ensuring the selection of audit teams with the necessary competence
- providing necessary resources to the audit teams
- ensuring the conduct of audits in accordance with the audit programme
and within the agreed time frame, and
- ensuring that audit activities are recorded and records are properly managed
and maintained.

32. TRAINING ON MANAGEMENT SYSTEM AUDITS
29
- treatment of confidential information including the extent of
disclosure.
Step 2. Implementing the audit programme (clause 5.3):
B. Defining individual audit objectives, scope and criteria:
In order to develop the audit plan for each individual audit, it is necessary to
identify and document the specific audit objectives, scope, methods, criteria
and procedures.
The audit objectives define what is to be accomplished by the individual audit
and should be documented in the audit plan. They may include the following:
- determination of the extent of conformity of a management system to be
audited, or parts of it, with audit criteria
- evaluation of the capability of a management system to ensure
compliance with legal and other requirements
- evaluation of the effectiveness of a management system in meeting
its specified objectives
- identification of areas for potential improvement of a management system, and

33. TRAINING ON MANAGEMENT SYSTEM AUDITS
30
Step 2. Implementing the audit programme (clause 5.3):
B. Defining individual audit objectives, scope and criteria (…):
The audit manager(s) should define the individual audit objectives, and these
objectives must be consistent with the overall audit programme objectives.
The audit scope should be consistent with the audit programme and audit
objectives. It includes such factors as physical locations, organizational units,
activities and processes to be audited, as well as the duration of the audit.
The audit criteria (derived from applicable policies, objectives, procedures,
standards, legal / management system / contractual requirements, industry /
business sector codes of conduct) should be used as a reference against which
conformity is determined.
The audit scope and audit criteria should be defined jointly by audit manager(s)
and audit team leader in accordance with audit programme procedures, and,
changes (if any) should be agreed to by the same parties and the audit
programme should be modified accordingly.

34. TRAINING ON MANAGEMENT SYSTEM AUDITS
31
Step 2. Implementing the audit programme (clause 5.3):
B. Defining individual audit objectives, scope and criteria
(…):
Where a combined audit is to be conducted, it should be ensured that ...
- the audit objectives arising from different audit programmes are
aligned, including those objectives arising from the combination
- audit scope is consistent with requirements arising from the
specific management system standards, and
- audit criteria are selected so that efficiency can be gained by combining
similar requirements / subjects from different references.

35. TRAINING ON MANAGEMENT SYSTEM AUDITS
32
Step 2. Implementing the audit programme
C. Determining the audit method(s):
The audit manager(s) should select and determine the audit methods for an
audit depending on the defined audit objectives, scope and criteria for
effectively conducting the audit.
Where two or more auditing organizations conduct a joint audit in the same
auditee, the audit managers should cooperate and exchange information during
the establishment of audit programmes. They should pay special attention to the
division of responsibilities, scheduling of the joint audits, provision of any
additional resources, competence of the audit team and the appropriate
procedures.
Agreement on these matters should be reached before the audit activities start.
If an organization to be audited operates two or more management systems of
different disciplines (such as QMS and EMS), combined audits may be included
in the audit programme. In such a case, special attention should be paid to the
competence of the audit team.

36. TRAINING ON MANAGEMENT SYSTEM AUDITS
33
Step 2. Implementing the audit programme (clause 5.3):
D. Selecting the audit team:
The audit manager(s) should appoint the members of the audit team, including
the team leader and any technical expert(s) needed for the specific audit.

An audit team should be selected, taking into account the competence needed
to achieve the objectives of the individual audit within the defined scope.

If there is only one auditor, the auditor should perform all applicable duties of
an audit team leader.

Note: Clause 7 of ISO19011:2018 standard contains guidance on determining the
competence required for the audit team members and describes processes for evaluating
auditors.

37. TRAINING ON MANAGEMENT SYSTEM AUDITS
34
Step 2. Implementing the audit programme (clause 5.3):
D. Selecting the audit team (…):
In deciding the size and composition of the audit team for the specific audit,
consideration should be given to the following:
- the overall competence of the audit team needed to achieve audit objectives,
scope and criteria
- type of audit (combined / joint) and the kind of audit methods selected
- legal and other requirements such as contractual requirements
- the need to ensure the independence of the audit team from the activities to be
audited and to avoid any conflict of interest
- the ability of audit team members to interact effectively with the auditee, and
- the language of the audit, and an understanding of the auditee’s particular social
and cultural characteristics.
These issues may be addressed either by the auditor's own skills or through the
support of a technical expert.

38. TRAINING ON MANAGEMENT SYSTEM AUDITS
35
Step 2. Implementing the audit programme (clause 5.3):
D. Selecting the audit team (…):
To assure the overall competence of the audit team, the following steps should
be performed:
- identification of knowledge and skills needed to achieve the objectives of audit
- selection of the audit team members so that all of the necessary knowledge
and skills are present in the audit team.
If all the necessary competence is not covered by the auditors in the audit
team, technical experts with additional competence may be included in the
teams.
Technical experts should operate under the direction of an auditor but should
not act as auditors.
Auditors-in-training may be included in the audit team, but should participate
under the direction and guidance of an auditor.

39. TRAINING ON MANAGEMENT SYSTEM AUDITS
36
Step 2. Implementing the audit programme (clause 5.3):
D. Selecting the audit team (…):
Both the audit client and the auditee may request the replacement of particular
audit team members on reasonable grounds based on the principles of
auditing.
Examples of reasonable grounds include lack of competency or previous
unethical behaviour, conflict of interest situations (such as in the case of second
or third party audits, an audit team member having been a former employee of
the auditee or having provided consultancy services to the auditee), etc.
Such grounds should be communicated to the audit team leader and to the
audit manager, who should discuss the issue with the audit client and auditee
before making any decisions or replacing audit team members.
Where a joint audit is conducted, it is important to reach agreement among the
auditing organizations before the audit commences, on the specific
responsibilities of each party, particularly with regard to the authority of the team
leader appointed for the audit.

40. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 2. Implementing the audit programme (clause 5.3):
E. Assigning responsibility for individual audit(s) to the audit
team leader:
The audit manager should assign the responsibility for the conduct of the
individual audit to an audit team leader (also known as lead auditor).
It should be made in advance to give sufficient time for effective audit planning.
The following information should be provided to the audit team leader :
- the audit objectives
- the audit criteria and any reference documents
- the audit methods and procedures
- the audit scope, including identification of the organizational and
functional units and processes to be audited
- the composition of the audit team
- the locations, dates, and duration of the audit activities to be conducted, and
- the allocation of appropriate resources to conduct the audit.
40

41. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 2. Implementing the audit programme (clause 5.3):
E. Assigning responsibility for individual audit(s) to the audit
team leader(…):
The assignment information should also cover the following, as appropriate:
- the working and reporting language of the audit where this is different from
the language of the auditor and/or the auditee
- audit report contents requested by the audit programme
- matters related to confidentiality and information security, if required by
the audit programme
- any follow-up actions, for example, from a previous audit, if applicable, and
- coordination with other audit activities, in case of a joint audit.
The audit manager should ensure that the information provided to the audit
team leader adequately addresses identified risks to the achievement of audit
objectives.
41

42. TRAINING ON MANAGEMENT SYSTEM AUDITS
39
Step 2. Implementing the audit programme (clause 5.3):
F. Managing and maintaining audit programme records:
The audit manager(s) should manage and maintain records to demonstrate
the implementation of the audit programme.
Processes should be established to ensure that any privacy or
confidentiality needs associated with the audit records are satisfied.
Records should include the following:
- Records related to the audit programme such as audit programme
objectives, those addressing audit risks, reviews of the audit programme
effectiveness.
- Records related to individual audit such as audit plans & reports,
nonconformity reports, corrective and preventive action reports, audit follow-
up reports, etc.
- Records related to audit personnel such as competence and
performance evaluation of the audit team members, audit team
selection, maintenance and improvement of competence.

43. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 3. Audit programme monitoring
The audit manager(s) should monitor the implementation of audit programme(s)
at periodic intervals considering the need to ...
- review and approve audit reports, and ensure their distribution to
the top management and other relevant parties
- determine the necessity of any follow-up audit
- evaluate the performance of the audit team members
- evaluate the ability of the audit teams to implement the audit plan
- evaluate conformity with audit programmes, schedules and audit objectives,
and
- evaluate feedback from top management, auditees, auditors, and
other interested parties.
43

44. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 3. Audit programme monitoring
At times, it may be needed to modify the audit programme, before its
completion. Some factors may determine this, such as:
- initial audit findings
- demonstrated level of management system effectiveness
- changes to the client’s or the auditee’s management system
- change of legal requirements and/or standard, and
- change of supplier.
44

45. TRAINING ON MANAGEMENT SYSTEM AUDITS
4
2
2. Lessons learned from the review should be used for continual improvement.
Step 4. Reviewing and improving audit programmes
The audit manager(s) should review the audit programme to assess whether
its objectives have been met.
The audit programme review should consider, for example:
- results and trends from monitoring
- conformity with audit programme procedure(s)
- evolving needs and expectations of interested parties
- audit programme records, alternative or new auditing methods
- effectiveness of the measures taken to to address the audit risks
- confidentiality & information security issues relating to the audit programme,
and
- continual professional development of auditors.
Notes:
1. The audit manager(s) should review the overall implementation of audit programme(s), identify
the area of improvement and amend the programme if necessary, and report the results to the
top management.

46. TRAINING ON MANAGEMENT SYSTEM AUDITS
4
3
Part - III
Audit Activities
(Conducting an audit)

47. Flow Chart for Audit Activities
TRAINING ON MANAGEMENT SYSTEM AUDITS
44
1. Initiating the audit
- To establish initial contact with the auditee
- To determine the feasibility of audit
Let us discuss each step in detail in the next few slides.
2. Preparing for the audit activities
- To prepare the audit plan
- To assign work to audit team
- To prepare the work documents
3. Conducting audit activities
- To perform document review
- To conduct the opening meeting
- To communicate during audit
- To collect and verify information
- To record audit findings and conclusions
- To conduct the closing meeting
4. Preparing & distributing the audit report
- To prepare the audit report
- To distribute the audit report
5. Completing the audit
6. Conducting audit follow-up (if
applicable)

48. TRAINING ON MANAGEMENT SYSTEM
AUDITS
45
Step 1. Initiating the audit (clause 6.2):
A. General Considerations:
On initiation of an audit, the audit manager assigns the responsibility for the
audit to the audit team leader, as is defined in the audit programme.
The audit manager transfers the necessary information to the audit team leader.
The responsibility for conducting the assigned audit remains with the audit
team leader until the audit is completed.
To initiate an audit, the steps outlined in the next few slides should be
considered.
However, the sequence can differ depending on the auditee, processes
and specific situations.

49. TRAINING ON MANAGEMENT SYSTEM AUDITS
46 - to find out, the auditee’s expectations and needs related to the audit.
Step 1. Initiating the audit (clause 6.2):
B. Establishing initial contact with the auditee:
The initial contact for the audit with the auditee can be informal or formal, and,
it should be made by the audit team leader.
The purposes of the initial contact are:
- to establish communication channels with the auditee’s representative(s)
- to confirm the authority to conduct the audit
- to provide information on the audit scope, methods and team composition
- to request access to relevant documents for planning purposes, including
records
- to determine applicable legal and other requirements
- to confirm the agreement with the auditee regarding the extent of the
disclosure and the treatment of the confidential information
- to make arrangements for the audit including scheduling the date(s)
- to agree on the attendance of observers and the need for guides for the team

50. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 1. Initiating the audit (clause 6.2):
C. Determining the feasibility of the audit:
The feasibility of an audit determines whether all of the necessary resources,
information, arrangements, etc., are in place to provide reasonable confidence
that the audit objectives can be achieved.
The feasibility of the audit should be determined, taking into consideration
such factors as the availability of …
- sufficient and appropriate information for planning the audit
- adequate cooperation from the auditee, and
- adequate time and resources for performing the audit.

Where the audit is not feasible, an alternative should be proposed to the
audit client, in agreement with the auditee.
50

51. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 2. Preparing for the audit activities (clause 6.3):
A. Preparing the audit plan:
The audit team leader should prepare an audit plan based on the information
contained in the audit programme and documentation provided by the
auditee.
The audit plan should consider the effect of the audit on the auditee’s processes
and provide the basis for the agreement among the audit client, audit team and
the auditee regarding the conduct of the audit.
The plan should facilitate the efficient scheduling and coordination of the
audit activities to achieve an effective outcome.
The amount of detail provided in the audit plan should reflect the scope and
complexity of the audit as well as risks and the effect of uncertainty on the
audit outcome.
51

52. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 2. Preparing for the audit activities (clause 6.3):
A. Preparing the audit plan (...):
In preparing the audit plan the audit team leader should be aware of
appropriate sampling techniques, compatibility of audit team members and
risks to the organization created by the audit.
Risks to the organization may include an audit team member who
mishandle the auditee’s information, creates a safety, health,
environmental or a security risk such as a threat to the auditee’s products,
services, personnel and/or infrastructure.
For combined and joint audits, particular attention should be given to the
interfaces between processes of the management system(s).
The details may differ, for example, between initial and subsequent audits
and also between internal and external audits.
The audit plan should be sufficiently flexible to permit changes which can
become necessary as the audit activities progress.
52

53. TRAINING ON MANAGEMENT SYSTEM AUDITS
50 - the allocation of appropriate resources to critical areas of the audit.
Step 2. Preparing for the audit activities (clause 6.3):
A. Preparing the audit plan (...):
The audit plan must cover or reference the following:
- the audit objectives
- the audit scope, including identification of the organizational and functional
units and processes to be audited
- the audit criteria and any reference documents
- the locations, dates, expected times and duration of audit activities to be
conducted, meetings with the auditee’s management as well as other
meetings
- the audit method to be used including the extent to which audit sampling
is needed to obtain sufficient audit evidence and the design of the
sampling programme, if applicable
- the roles and responsibilities of audit team members, guides and observers,
and

54. TRAINING ON MANAGEMENT SYSTEM AUDITS
51
Note: The audit plan should be reviewed and accepted by the audit client, and
presented to the auditee, before the audit activities begin.
Step 2. Preparing for the audit activities (clause 6.3):
A. Preparing the audit plan (...):
Where appropriate, the audit plan should also cover the following:
- identification of the auditee’s representative for the audit
- the working and reporting language of the audit where this is different from
the language of the auditor and/or the auditee
- the audit report topics
- logistics and communication arrangements including specific
arrangements for the sites to be audited
- any specific measures taken to address risks and the effect of uncertainty
on the audit objectives
- matters related to confidentiality and information security
- any follow-up actions, for example, from a previous audit, and
- coordination with other audit activities, in case of a joint audit.

55. TRAINING ON MANAGEMENT SYSTEM AUDITS
5
2
Step 2. Preparing for the audit activities (clause 6.3):
B. Assigning work to the audit team:
The audit team leader, in consultation with the audit team, should assign to each
team member responsibility for auditing specific processes, functions, sites,
areas or activities.
Such assignments should respect the independence and competence of auditors
and the effective use of resources, as well as different roles and responsibilities
of auditors, auditors-in-training and technical experts.
Audit team briefings, which should be held on a regular basis by the audit
team leader, should allocate work assignments and decide possible changes.
Changes to the work assignments can be made as the audit progresses to
ensure the achievement of the audit objectives.

56. TRAINING ON MANAGEMENT SYSTEM AUDITS
53
suitably safeguarded at all times by the audit team
members.
Step 2. Preparing for the audit activities (clause 6.3):
C. Preparing work documents:
The audit team members should review the information relevant to their
audit assignments and prepare work documents as necessary for reference
and for recording audit evidences.
Such work documents should include:
- checklists and audit sampling plans, and
- forms for recording information, such as supporting evidence, audit
findings and records of meetings.
The use of checklists and forms should not restrict the extent of audit
activities, which can change as a result of information collected during the
audit.
Work documents should be retained at least until audit completion.
Those documents involving confidential or proprietary information should be

57. TRAINING ON MANAGEMENT SYSTEM AUDITS
54 plan, the audit team leader should inform the audit manager, and the auditee.
Step 3. Conducting audit activities (clause 6.4):
A. Document review:
Relevant documentation of auditee’s management system should be reviewed ...
- to gather information for the preparation of the audit activities
- to get an overview on the extent of the system documentation, and
- to determine the system’s conformity, as far as documented, with audit criteria.
The documentation can include relevant management system documents
and records, as well as previous audit reports.
The review should take into account the size, nature & complexity of the
auditee’s management system and organization, and the objectives and scope
of the audit.
Notes:
1. The review may be combined with the other audit activities and may continue
throughout the audit, if this is not detrimental to the effectiveness of its conduct.
2. If adequate documentation cannot be provided within the time frame given in the audit

58. TRAINING ON MANAGEMENT SYSTEM AUDITS
55
Step 3. Conducting audit activities (clause 6.4):
B. Conducting opening meeting:
The purpose of the opening meeting is to confirm the audit plan, introduce
the audit team and ensure that all planned audit activities are in place.
An opening meeting should be held with the auditee management and,
where appropriate, those responsible for the functions or processes to be
audited.
In many instances, for example internal audits in a small organization, the
opening meeting may simply consist of communicating that an audit is being
conducted and explaining the nature of the audit.
For other audit situations, the meeting may be formal and records of
the attendance should be kept.
The meeting should be chaired by the audit team leader, and the following
items should be considered, as appropriate:

59. TRAINING ON MANAGEMENT SYSTEM AUDITS
56
- confirmation of the language(s) to be used during the audit
Step 3. Conducting audit activities (clause 6.4):
B. Conducting opening meeting (…):
The following shall be covered in the opening meeting:
- introduction of all participants, and an outline of their roles
- confirmation of the audit objectives, scope and criteria
- confirmation of the audit plan and other relevant arrangements with the auditee,
such as the date and time for the closing meeting, any interim meetings
between the audit team and the auditee's management, and any late changes
- presentation of the methods to be used, including advising the auditee that
the audit evidence will be based on a sample of the information available
- introduction of methods to manage risks to the organization, products,
services, personnel and/or infrastructure associated with the audit
- confirmation of formal communication channels between the audit team
and the auditee

60. TRAINING ON MANAGEMENT SYSTEM AUDITS
57
or conclusions of the audit, including complaints or appeals.
Step 3. Conducting audit activities (clause 6.4):
B. Conducting opening meeting (…):
The following shall be covered in the opening meeting (…):
- confirmation that, during the audit, the auditee will be kept informed of
audit progress
- confirmation of availability of resources and facilities needed by the audit
team
- confirmation of matters relating to confidentiality and information security
- confirmation of relevant health and safety, emergency and security
procedures for the audit team
- information on method of reporting audit findings including any grading
- information about conditions under which the audit may be terminated
- information about the closing meeting
- information about how to deal with possible findings during the audit, and
- information about any system for feedback from the auditee on the findings

61. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 3. Conducting audit activities (clause 6.4):
C. Communication during the audit :
It may be necessary to make formal arrangements for communication within the
audit team with the auditee and potentially with external bodies (e.g. regulators)
during the audit, especially where legislative requirements require the
mandatory reporting of nonconformities.
The audit team should confer periodically to exchange information, assess
audit progress, and to reassign work between the audit team members as
needed.
During the audit, the audit team leader should periodically communicate
the progress of the audit and any concerns to the auditee and audit client,
as appropriate.
Evidence collected during the audit that suggests an immediate and significant
risk to the auditee should be reported without delay to the auditee and, as
appropriate, to the audit client.
61

62. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 3. Conducting audit activities (clause 6.4):
C. Communication during the audit (…):
Any concern about an issue outside the audit scope should be noted and
reported to the audit team leader, for possible communication to audit client and
auditee.
Where the available audit evidence indicates that the audit objectives are
unattainable, the audit team leader should report the reasons to the audit
client and the auditee to determine appropriate action.
Such action may include reconfirmation or modification of the audit plan,
changes to the audit objectives or audit scope, or termination of the audit.
Any need for changes to the audit plan which may become apparent as
auditing activities progress should be reviewed with and approved by the
person responsible for managing the audit programme and, as appropriate,
the auditee.
62

63. TRAINING ON MANAGEMENT SYSTEM AUDITS
6
0
- providing clarification or assisting in collecting information.
Step 3. Conducting audit activities (clause 6.4):
D. Roles and responsibilities of guides and observers:
Guides and observers (e.g. regulator or other interested parties) may accompany
the audit team. They should not influence or interfere with the conduct of the
audit.
Guides, appointed by the auditee, should assist the audit team and act on
the request of the audit team leader.
Their responsibilities should include the following:
- establishing contacts and timing for interviews
- arranging access to specific parts or sites of the auditee
- ensuring that rules concerning site safety and security procedures are
known and respected by the audit team members and observers
- witnessing the audit on behalf of the auditee, and

64. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 3. Conducting audit activities (clause 6.4):
E. Collection and verification of information:
During the audit, information relevant to the audit objectives, audit scope and
audit criteria, including information relating to interfaces between functions,
activities and processes, should be collected by means of appropriate sampling
and should be verified.
Only information that is verifiable should be accepted as audit
evidence. Audit evidence relevant to the audit findings should be
recorded.
If during collection of evidences, the audit team becomes aware of any new
or changed risk, they should be addressed accordingly.
Methods of collecting information include interviews, observations, review
of documents, etc.
Note: For guidance on various work elements mentioned above, please read the
reference document (pdf) accompanying this presentation.
64

65. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 3. Conducting audit activities (clause 6.4):
F. Audit findings:
Audit evidence must be evaluated against audit criteria to identify audit
findings. Audit findings can indicate conformity or nonconformity with audit
criteria.
When specified by the audit objectives, audit findings should identify
opportunities for improvement and provide recommendations for best practice,
where this does not compromise independence.
The audit team should meet as needed to review the audit findings at
appropriate stages during the audit.
Conformity with audit criteria should be summarized to indicate locations,
functions or processes that were audited.
If included in the audit plan, individual audit findings of conformity and
their supporting evidence should also be recorded.
65

66. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 3. Conducting audit activities (clause 6.4):
F. Audit findings (…):
Non-conformities and their supporting audit evidence should be recorded.
Non-conformities may be graded.
They should be reviewed with the auditee to obtain acknowledgement that
the audit evidence is accurate, and that the non-conformities are
understood.
Every attempt should be made to resolve any diverging opinions concerning
the audit evidence and/or findings, and unresolved points should be recorded.
For combined and joint audits, arrangements on dealing with findings related to
criteria coming from the different requirements audited (multiple criteria) should
be in place.
66

67. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 3. Conducting audit activities (clause 6.4):
G. Audit conclusions:
The audit team should confer prior to the closing meeting to:
- review the audit findings, and any other appropriate information
collected during the audit, against the audit objectives
- agree on the audit conclusions, taking into account the uncertainty
inherent in the audit process
- prepare recommendations, if specified by the audit objectives, and
- discuss audit follow-up, as applicable.
67

68. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 3. Conducting audit activities (clause 6.4):
G. Audit conclusions (…):
Audit conclusions can address issues such as:
- the extent of conformity of the management system with audit criteria,
including the effectiveness of the management system in meeting the stated
objectives
- the effective implementation/maintenance/improvement of management
system
- the capability of the management review process to ensure the continuing
suitability, adequacy, effectiveness and improvement of a management
system
- attempt to identify root causes of findings, if stated by the audit objectives, and
- consolidate similar findings made in different areas that were audited for
the purpose of identifying trends.
If specified by audit objectives, audit conclusions may lead to 65
regarding improvements, business relationships, or future auditing activities.

69. TRAINING ON MANAGEMENT SYSTEM AUDITS
66
records of attendance, should be kept.
Step 3. Conducting audit activities (clause 6.4):
H. Conducting the closing meeting:
A closing meeting, facilitated by the audit team leader, should be held to present
the audit findings and conclusions in such a manner that they are understood
and acknowledged by the auditee.
Participants in the closing meeting should include representatives of the
auditee, and may also include the audit client and other parties.
If applicable, the audit team leader should advise the auditee of situations
encountered during the audit that may decrease the reliance that can be
placed on the audit conclusions.
If defined in the management system or by agreement with the audit manager,
the participants should agree, on the time frame for an action plan to address the
audit findings.
For some audit situations, the meeting may be formal and minutes including

70. TRAINING ON MANAGEMENT SYSTEM AUDITS
67
- any related post audit activities.
Step 3. Conducting audit activities (clause 6.4):
H. Conducting the closing meeting (…):
In case of internal audits, the closing meeting is less formal and may consist
solely of communicating the audit findings and audit conclusions.
As appropriate, the following should be explained in the closing meeting:
- advising the auditee that the audit evidence collected was based on a
sample of the information available
- the method of reporting, including any grading
- the process of handling of audit findings and possible consequences
- presentation of the audit findings in such a manner that they are
understood and acknowledged by the auditee, and

71. TRAINING ON MANAGEMENT SYSTEM AUDITS
68
Step 3. Conducting audit activities (clause 6.4):
H. Conducting the closing meeting (…):
Any diverging opinions regarding the audit findings and/or conclusions
between the audit team and the auditee should be discussed and if possible
resolved.
If not resolved, all opinions should be recorded.
If specified by the audit objectives, recommendations for improvements may
be presented.
It should be emphasized that recommendations are not binding.

72. TRAINING ON MANAGEMENT SYSTEM AUDITS
69
- a statement on the extent of the conformity to the audit criteria.
Step 4. Preparing and distributing the audit report (clause 6.5):
A. Preparing the audit report:
The audit team leader should be responsible for the preparation and contents
of the audit report.
The audit report should provide a complete, accurate, concise and clear record
of the audit, and in accordance with the audit procedures should include or
refer to the following:
- the audit objectives
- the audit scope, particularly identification of the organizational and
functional units or processes audited and the period of time
covered
- identification of the audit client
- identification of audit team and auditee´s participants in the audit
- the dates and locations where the audit activities were conducted
- the audit criteria, the audit findings, the audit conclusions, and

73. TRAINING ON MANAGEMENT SYSTEM AUDITS
7
0
Step 4. Preparing and distributing the audit report (clause 6.5):
A. Preparing the audit report (…):
The audit report can also include or refer to the following, as appropriate:
- the audit plan
- a summary of the audit process, including the uncertainty and/or any obstacles
encountered that may decrease the reliability of the audit conclusions
- confirmation if the audit objectives have been accomplished within the
audit scope in accordance with the audit plan
- any areas within the audit scope not covered
- a management summary covering the audit conclusions and the main
audit findings that support them
- any unresolved diverging opinions between the audit team and the auditee
- opportunities for improvement, strengths and best practices identified agreed
follow-up action plans (if any)
- a statement of the confidential nature of the contents, and
- Distribution list for the audit report

74. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 4. Preparing and distributing the audit report (clause 6.5):
B. Distributing the audit report :
The audit report should be issued within an agreed period of time.
If it is delayed, the reasons should be communicated to the auditee and the
audit manager.
The audit report should be dated, reviewed and approved as appropriate
in accordance with audit programme procedures.
The audit report should then be distributed to recipients as defined in the
audit procedures.
74

75. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 5. Completing the audit (clause 6.6):
The audit is completed when all audit plan activities have been carried out or
as otherwise agreed with the audit manager.
Documents pertaining to the audit should be retained or destroyed by
agreement between the participating parties and in accordance with audit
programme procedures and applicable legal and other requirements.
Unless required by law, the audit team and the audit manager should not
disclose the contents of documents, any other information obtained during the
audit, or the audit report, to any other party without the explicit approval of the
audit client and, where appropriate, the approval of the auditee.
If disclosure of the contents of an audit document is required, the audit client
and auditee should be informed as soon as possible.
Lessons learned from the audit should be entered into the continual improvement
process of the management system of the organization needing to conduct
audits.
75

76. TRAINING ON MANAGEMENT SYSTEM AUDITS
Step 6. Conducting audit follow-up (clause 6.7):
The conclusions of the audit may, depending on the audit objectives, indicate
the need for corrections, corrective, preventive or improvement actions.
Such actions are usually decided and undertaken by the auditee within
an agreed timeframe.
As appropriate, the auditee should keep the person responsible for managing
the audit programme and the audit team informed of the status of these
actions.
The completion and effectiveness of the actions should be
verified. This verification may be part of a subsequent audit.
76

77. TRAINING ON MANAGEMENT SYSTEM AUDITS
Part - IV
77
Competence and Evaluation of Auditors

78. TRAINING ON MANAGEMENT SYSTEM AUDITS
Competence and evaluation of auditors (clause 7):
A. General considerations:
Confidence and reliance in the audit process depends on the competence of
those involved in planning & conducting the audits, including auditors and team
leaders.
Competence has to be evaluated through a process that considers
personal behaviours and the ability to apply the knowledge and skills
gained through education, work experience, auditor training and audit
experience.
This process should take into consideration the needs of the audit programme
and its objectives. Some of the knowledge and skills are common to auditors of
all management system disciplines, others are specific to auditors of specific
management system disciplines.
The evaluation of auditors must be planned, implemented and documented
in accordance with the audit programme to provide an outcome that is
objective, consistent, fair and reliable.
78

79. TRAINING ON MANAGEMENT SYSTEM AUDITS
Competence and evaluation of auditors (clause 7):
A. General considerations (…):
The evaluation process should include four main steps:
1) Determine the competence of audit personnel needed for the audit
programme
2) Establish the evaluation criteria
3) Select the appropriate evaluation method, and
4) Conduct the evaluation.
The outcome of the evaluation process should provide a basis for:
- audit team selection
- determination of training and other competence enhancement needs, and
- ongoing performance evaluation of auditors.
Auditors should develop, maintain and improve their competence
through continual professional development and regular participation in
audits.
79

80. TRAINING ON MANAGEMENT SYSTEM AUDITS
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Overall
considerations:
In deciding the appropriate knowledge and skills, consider the following:
- the size, nature and complexity of the organization(s) to be audited
- the management system disciplines to be audited
- the objectives and extent of the audit programme
- other requirements, like those imposed by external bodies,where appropriate
- the role of the audit process in the management system of the
organization(s) to be audited
- the complexity of the management system to be audited, and
- the uncertainty in achieving audit objectives.
80

81. TRAINING ON MANAGEMENT SYSTEM AUDITS
7
8
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Personal behaviours:
An auditor must possess (or develop) the following 14 qualities:
1. Ethical : fair, truthful, sincere, honest and discreet
2. Open minded : willingness to consider alternative ideas or points of view
3. Diplomatic : tact in dealing with people
4. Observant : active observation of physical surroundings and activities
5. Perceptive : aware of and able to understand situations
6. Adaptable : adjust readily to different situations
7. Tenacious : persistence, focus on achieving objectives
8. Decisive : reaching timely conclusions based on logical reasoning and
analysis
9. Self reliant : acting and functioning independently while interacting effectively
with others

82. TRAINING ON MANAGEMENT SYSTEM AUDITS
79
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Personal behaviours (…):
Auditor’s 14 qualities (…):
10. Acting with fortitude : willing to act responsibly and ethically even
though these actions may not always be popular and may sometimes
result in disagreement or confrontation
11. Well organized : exhibiting effective time management, prioritization,
planning and efficiency
12. Open to improvement : learning from situations, striving for
better audit results
13. Culturally sensitive : observe & respect cultural traditions of the auditee, and
14. Team player : works well with other audit team members.

83. TRAINING ON MANAGEMENT SYSTEM AUDITS
8
0
-
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Knowledge and
skills: Generic knowledge and skills of management system auditors
Auditors should have knowledge and skills in the following areas:
a) Audit principles, procedures and techniques: to enable the auditor to apply
those appropriate to different audits and ensure that audits are conducted in a
consistent and systematic manner. An auditor should be able to:
- apply audit principles, procedures, methods and techniques
- plan & organize the work effectively, to conduct the audit within agreed time schedule
- prioritize and focus on matters of significance, understand the types of auditing risks
- collect information through interviewing, observing, and reviewing documents & data
- understand the appropriateness and consequences of using sampling techniques
- verify the accuracy of collected information, confirm the sufficiency & appropriateness
of audit evidence to support audit findings and conclusions
- assess those factors that may affect the reliability of audit findings and conclusions
- use work documents to record audit activities, prepare audit reports
- maintain the confidentiality and security of information, and communicate effectively
(including use of interpreters and translators).

84. TRAINING ON MANAGEMENT SYSTEM AUDITS
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Knowledge and skills (…):
Generic knowledge and skills of management system auditors
b) Management system and reference documents: to enable the auditor to
comprehend the scope of audit and apply audit criteria. Knowledge and skills in this
area should cover:
- the application of management systems to different organizations
- interaction between the components of the management system
- specific management system standards, applicable procedures or other
management system documents used as audit criteria
- recognizing the hierarchy of reference documents
- application of the reference documents to different audit situations
- control and protection of information, data, documents and records
- organizational context: to enable the auditor to comprehend the auditee's structure,
business and management practices. Knowledge and skills in this area should
cover:
- organizational types, governance, size, structure, functions and relationships
- general business and management concepts, processes and related
terminology (including planning, budgeting and management of personnel)
- cultural and social aspects of the auditee.
84

85. TRAINING ON MANAGEMENT SYSTEM AUDITS
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Knowledge and skills
(…):
Generic knowledge and skills of management system auditors
c) Applicable legal and other requirements: that apply to the auditee to
enable the auditor to work within, and be aware of, the organization’s legal
and contractual requirements. Knowledge and skills specific to the jurisdiction
and/or auditee’s activities and products should cover:
- laws and regulations
- basic legal terminology, and
- contract and liability.
85

86. TRAINING ON MANAGEMENT SYSTEM AUDITS
83
- lead the audit team to reach audit conclusions, prepare & complete the audit
report.
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Knowledge and skills (…):
Generic knowledge and skills of audit team leader
d) Audit team leaders should have additional knowledge and skills to manage and
provide leadership to the audit team in order to facilitate the efficient and effective
conduct of the audit.
An audit team leader should have the knowledge and skills necessary to:
- balance the strengths and weaknesses of the individual audit team members
- develop a harmonious working relationship among the team members
- manage the audit process, including:
- planning the audit and making effective use of resources during the audit
- managing the uncertainty of achieving audit objectives, preventing/resolving conflicts
- protecting the safety and health of the audit team members during the audit
- organizing & directing audit team members, directing and guiding the auditors-in-training
- represent the audit team in communications with the audit client and auditee
- understand and respect the experts’ opinions, and

87. TRAINING ON MANAGEMENT SYSTEM AUDITS
8
4
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Knowledge and skills
(…):
Discipline & sector specific knowledge and skills of management system
auditors
An auditor who intends to audit a specific type of management system should
have the discipline and sector specific knowledge and skills that are
appropriate for auditing the particular type of management system and
industry sector.
Each auditor in the audit team does not need to have the same competence.
However, the overall competence of the audit team needs to be sufficient to
meet the audit objectives.

Note: For discipline-specific criteria, please read the reference document (pdf)
accompanying this presentation.

88. TRAINING ON MANAGEMENT SYSTEM AUDITS
8
5
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Knowledge and skills (…):
The discipline and sector specific knowledge and/or skills of auditors include…
- understanding of the discipline and sector specific management system
requirements and principles, and their application
- understanding applicable legal and other requirements relevant to the
discipline and sector: to enable the auditor to work within, and be aware of,
the requirements those apply to the organization being audited. Knowledge
and skills specific to the jurisdiction and/or auditee’s obligations, activities and
products.
- understanding of the information (e.g. body of knowledge) that is fundamental to
the business and technical processes, science and technology underlying the
discipline sufficient to enable the auditor to evaluate management system
elements associated with the discipline

89. TRAINING ON MANAGEMENT SYSTEM AUDITS
8
5
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Knowledge and skills (…):
Discipline & sector specific knowledge and skills of management system
auditors
The discipline and understanding of the information (e.g. body of knowledge) that
is fundamental to the business and technical processes, science and technology
underlying the discipline sufficient to enable the auditor to evaluate management
system elements associated with the discipline
- understanding of discipline-specific knowledge related to the particular sector,
nature of operations, or workplace being audited sufficient for the auditor to
evaluate the auditee’s activities, services, processes, products and services
- - understanding risk management principles, methods & techniques relevant to the
discipline and sector to enable the auditor to examine the auditee’s approach to
managing risk

90. TRAINING ON MANAGEMENT SYSTEM AUDITS
86
They must acquire audit experience under a lead auditor’s supervision.
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Education, work
experience, training and audit experience:
Auditors
Auditors should have completed an education sufficient to acquire the
knowledge and skills.
They should have work experience that contributes to the development of the
knowledge and skills. This work experience should be in a technical, managerial
or professional position involving the exercise of judgment, decision making,
problem solving and communication with managers, professionals, peers,
customers and/or other interested parties. Part of the work experience should be
in a position where the activities undertaken contribute to the development of
knowledge and skills in a management system for which they intend to audit.
They should have completed training in audit principles, procedures &
techniques.

91. TRAINING ON MANAGEMENT SYSTEM AUDITS
8
7
Competence and evaluation of auditors (clause 7):
B. Determining auditor competence - Education, work
experience, training and audit experience (…):
Audit team leaders (Lead auditors)
An audit team leader should have acquired additional audit experience to develop
the knowledge and skills. This additional experience should have been gained by
working under the direction and guidance of an audit team leader.
Auditors who intend to become an audit team member in the audit of combined or
integrated management systems should have:
- the competence necessary to audit at least one management system discipline
forming part of the combined or integrated management systems, as long as the
audit team includes auditors with competence for all disciplines, and
- an understanding of the interaction and synergy between the different management
systems.
Note: An audit team leader conducting audits of combined or integrated
management systems should meet the above recommendations and have
discipline- specific competence to coordinate the auditing of multiple disciplines.

92. TRAINING ON MANAGEMENT SYSTEM AUDITS
88
Competence and evaluation of auditors (clause 7):
C. Establishing the evaluation criteria:
The criteria may be qualitative (such as having demonstrated personal
behaviours, knowledge or the performance of the skills, in training or in the
workplace) and quantitative (such as the years of work experience and
education, number of audits conducted, hours of audit training).
D. Selecting the appropriate evaluation method:
The evaluation should be conducted using two or more of the methods
selected from those in Table 1 (next slide).
In using Table 1, the following should be noted:
- the methods outlined represent a range of options and may not apply
in all situations
- the various methods outlined may differ in their reliability, and
- typically, a combination of methods should be used to ensure an outcome that is
objective, consistent, fair and reliable.

93. TRAINING ON MANAGEMENT SYSTEM AUDITS
Competence and evaluation of auditors (clause 7):
D. Selecting the appropriate evaluation method (…): Table 1
93
Evaluation method Objectives Examples

Review of records

To verify the background of the auditor

Analysis of records of education, training,
employment and audit experience

Feedback

To provide information about how the
performance of the auditor is perceived

Surveys, questionnaires, personal
references, testimonials, complaints,
performance evaluation, peer review

Interview

To evaluate personal behaviours and
communication skills, to verify information
and test knowledge and to acquire
additional information

Personal interviews

Observation

To evaluate personal behaviours and the
ability to apply knowledge and skills

Role playing, witnessed audits, on-the-job
performance

Testing

To evaluate personal behaviours and
knowledge and skills and their application

Oral and written exams, psychometric
testing

Post-audit review

To provide information on the auditor
performance during the audit activities,
identify strengths and weaknesses

Review of the audit report, interviews with
the audit team leader, the audit team and,
if appropriate, feedback from the auditee

94. TRAINING ON MANAGEMENT SYSTEM AUDITS
Competence and evaluation of auditors (clause 7):
E. Conducting the evaluation:
In this step the information collected about the person is compared against the
set criteria.
Where a person expected to participate in the audit programme does not meet
the criteria, additional training, work and/or audit experience, and a subsequent
re-evaluation should be performed.
94

95. TRAINING ON MANAGEMENT SYSTEM AUDITS
91
Competence and evaluation of auditors (clause 7):
F. Maintenance and improvement of competence:
Auditors should maintain their auditing competence through regular participation
in management system audits and continual professional development. It
involves the maintenance and improvement of competence.
This may be achieved through additional work experience, training, private
study, coaching, seminars and conferences or other relevant activities.
Auditors, audit team leaders and audit managers should continually improve
their competence.
The organization needing to conduct audits should establish suitable
mechanisms for the continual evaluation of the auditors, team leaders and audit
managers .
The continual professional development activities should take into account
results of post audit reviews, changes in the needs of the individual and the
organization needing to conduct audits, the practice of auditing, standards and
other requirements.

96. TRAINING ON MANAGEMENT SYSTEM AUDITS
92
Review and questions