Allocating 14 Auditor-Days Across a Three-Site Certificate After a Reported Spill
Nordvale Surface Coatings holds one ISO 14001:2015 certificate covering three plants: Ashford (UK), Żory and Kraków (Poland). Scope: design and manufacture of industrial surface coatings. The programme manager is planning the second surveillance audit of the three-year cycle and has 14 auditor-days left. Ashford was audited at certification and again at the first surveillance. Żory has not been visited since the initial certification audit. Kraków was added to scope nine months ago by a desk review of documents, with no site visit. In February a solvent spill of roughly 2,400 litres reached the site drainage system at Żory; the regional inspectorate fined the company, and the client notified the certification body as a significant change. At Kraków the site EHS manager is also the internal EMS auditor, and the internal audit report for the site was signed off nine days before this external audit. The client asks that the surveillance be a two-day visit to Ashford, as originally scheduled, because 'the Polish sites are low risk'.
1. How should the programme manager allocate the remaining 14 auditor-days, and on what criteria? Justify each change to the planned programme.
Read the worked answer
Start from risk, not from the calendar. ISO 19011:2018 (clauses 5.3 and 6.2) and the ISO/IEC 17021-1 requirements on audit time and audit programme management require the programme to be risk-based and the duration to reflect complexity, aspects, size and previous performance (see also IAF MD 5 for audit duration and IAF MD 1 for multi-site sampling). Three facts change the risk profile: the Żory spill and regulatory sanction; Kraków never having been seen on site although the certificate covers it; and Ashford having been audited twice with no adverse indicators.
A defensible allocation of the 14 days:
- Żory - 5 days on site. Spill investigation and corrective action (10.2), evaluation of compliance (9.1.2), emergency preparedness and response (8.2), liaison with the regulator, and verification that the significant-change notification actually triggered a review of the programme and of the risk assessment.
- Kraków - 4 days on site. The certificate rests on a desk review only. Verify that what was accepted on paper exists: aspects and impacts (6.1.2), compliance obligations (6.1.3), operational control (8.1), competence (7.2).
- Ashford - 1–2 days, possibly partly remote. Monitoring (9.1.1), objectives (6.2), management review (9.3), internal audit (9.2).
- 2 days for team planning, reporting and follow-up of previous findings; 1 day contingency.
Challenge the client's premise: 'the Polish sites are low risk' is the auditee's opinion, not a programme input. The spill and the unvisited site are objective inputs. Revise the programme formally, record the rationale, and inform the client that the schedule has changed. Team competence must follow the new profile: Polish language capability or a professional interpreter, and an auditor with spill-response and permitting knowledge.
2. What does the internal audit arrangement at Kraków mean for the audit, and how would you deal with it?
Read the worked answer
This is a self-review threat and it defeats the purpose of clause 9.2. Two elements of ISO 14001:2015 clause 9.2 are engaged: 9.2.2 a) requires the audit programme to be planned with regard to the importance of processes and the results of previous audits, and 9.2.2 c) requires auditors to be selected and audits conducted so that objectivity and impartiality are safeguarded. An EHS manager auditing the EHS system of their own site is not objective; the nine-day gap between the internal report and the external audit suggests the schedule was driven by the external date rather than by risk.
Do not simply accept the report. Interview the EHS manager and the site director separately: who selected the auditor, who approved the programme, what competence criteria were applied (7.2), what findings were raised, and how were they closed (10.2). Ask other auditees whether they were interviewed at all and whether they have seen the report. Check the management review minutes (9.3) to see whether internal audit results were actually used as an input.
If the evidence shows the internal audit at Kraków covered only areas the EHS manager does not own, or that impartiality was safeguarded another way, there may be no finding. If it shows self-auditing of their own area with no compensating control, raise a nonconformity against 9.2.2 c). Whether it is major depends on the coverage of the whole site programme: one compromised audit within an otherwise sound programme is usually minor; a programme that exists only on paper is not.