PECB Certified Management Systems Internal Auditor cheat sheet

A management system is a set of interrelated or interacting elements of an organization used to establish policies and objectives, and processes to achieve those objectives (ISO 9000:2015 definition).

The High Level Structure (Harmonized Structure) used by most ISO MSS since 2012 has 10 clauses: 1 Scope, 2 Normative references, 3 Terms and definitions, 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Clauses 4-10 are the auditable requirements; clauses 1-3 are introductory and contain no auditable requirements.

Annex SL (now ISO/IEC Directives Part 1, Consolidated ISO Supplement) defines the common text, common terms and core definitions that MSS standards must adopt; it does not itself contain requirements an auditor can cite.

The process approach: a process is a set of interrelated or interacting activities that use inputs to deliver an intended result; auditors evaluate inputs, outputs, sequence, interaction, controls, and performance indicators.

Risk-based thinking replaces a separate preventive action clause in ISO 9001:2015 and ISO 14001:2015; risks and opportunities are addressed in clause 6.1.

PDCA maps to MSS clauses: Plan = 4, 5, 6; Do = 7, 8; Check = 9; Act = 10.

Documented information combines the former 'documents' (maintain) and 'records' (retain); clause 7.5 sets requirements for creating, updating and controlling it.

Outsourced processes remain the organization's responsibility and must be controlled; control type and extent are defined in the management system (e.g. ISO 9001:2015 clause 8.4).

ISO 19011:2018 defines an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled.

Objective evidence = records, statements of fact or other information, verifiable and based on observation, measurement, test or other means; it must be traceable to the criteria it is evaluated against.

Audit criteria = set of requirements used as a reference against which objective evidence is compared (e.g. ISO standard clauses, internal procedures, legal requirements, contracts).

Audit evidence is evaluated against audit criteria to produce audit findings; findings indicate conformity or nonconformity, and may also indicate risks or opportunities for improvement.

Six principles of auditing (ISO 19011:2018 clause 4): integrity; fair presentation; due professional care; confidentiality; independence; evidence-based approach. Risk-based approach is added as a seventh principle in the 2018 edition.

Audit types by subject: system audit, process audit, product audit; by relationship: first-party (internal), second-party (customer/supplier), third-party (certification/regulatory).

An internal audit is a first-party audit performed by, or on behalf of, the organization itself for management review and other internal purposes; it may form the basis for a self-declaration of conformity.

Independence does not require the auditor to be outside the organization; it requires the auditor not to audit their own work, and to be free from bias and conflict of interest.

Audit criteria, audit evidence and audit findings are distinct: criteria are the reference, evidence is what is found, findings are the result of evaluation. A finding without criteria is not an audit finding.

ISO 19011:2018 clause 5 covers managing an audit programme: establishing objectives, determining risks and opportunities, planning, implementing, monitoring, reviewing and improving the programme.

Audit programme vs audit plan: the programme is the set of one or more audits planned for a specific time frame; the plan is the description of activities and arrangements for a specific audit (ISO 19011:2018 clause 6.3).

Audit programme inputs include: organizational objectives and context, scope and complexity, risks and opportunities, level of maturity, results of previous audits, and interested party needs.

Audit programme performance indicators may include: degree of conformity of audits to plans, conformity of audit teams to competence requirements, feedback from auditees and clients, and effectiveness of audit programme implementation.

Initiating the audit (clause 6.2): determine feasibility, establish contact with the auditee, confirm authority to conduct the audit, and obtain information on the auditee's activities and processes.

The audit plan should define: audit objectives, scope (boundaries, functions, processes), criteria, dates and locations, audit team roles, allocation of time and resources, and identification of auditee personnel.

Sampling in audit planning: the audit team should select samples based on risk and significance, and the sampling plan should be documented; statistical sampling is not mandatory.

A checklist is an auditor tool, not a substitute for the audit plan; ISO 19011 does not require checklists and does not prescribe their format.

Audit objectives state what the audit is intended to accomplish; audit scope states what is covered (boundaries such as sites, units, processes, and time period).

Opening meeting (clause 6.4.2): confirm the audit plan, explain how activities will be carried out, confirm communication channels, clarify that the audit is sampling-based, and confirm the auditee's resources and availability.

The audit is based on sampling; therefore absence of a nonconformity does not prove full conformity, and the opening meeting should state this explicitly.

Collecting and verifying information (clause 6.4.3): sources include interviews, observation of activities and conditions, and review of documents and records.

Interview technique: ask open questions, avoid leading questions, verify statements with records or observation (triangulation), and record who said what.

Evaluating evidence against criteria (clause 6.4.5): evidence must be evaluated against the audit criteria; findings are classified as conformities or nonconformities, and may include opportunities for improvement.

Nonconformity classification: major nonconformity = management system requirement not addressed, or a situation that would cause the system to fail to achieve its intended results; minor = isolated lapse that does not indicate system failure. Classification schemes are organization-defined, not mandated by ISO 19011.

Audit team meetings: the audit team should meet periodically to exchange information, assess audit progress, and reassign work if needed.

Preparing audit conclusions (clause 6.4.8): conclusions address whether the audit objectives were met, conformity of the management system, effectiveness of implementation and maintenance, and opportunities for improvement.

Closing meeting (clause 6.4.9): present audit findings and conclusions, explain the sampling basis, agree on timeframes for corrective action, and note that the report will follow.

Audit report content (ISO 19011:2018 clause 6.5.2): audit objectives, scope, identification of client, audit team and auditee, dates and locations, criteria, findings, conclusions, and any deviations from the audit plan.

The audit report should be dated, reviewed and approved by the audit programme manager or designated person before distribution; it is the property of the client and confidentiality must be respected.

Findings should be stated with the three elements: the requirement (criteria), the objective evidence observed, and the nonconformity statement; adding the risk or consequence strengthens the finding.

Nonconformity reports should identify the requirement reference, the evidence, the location/process, the date, and the responsible function; correction and corrective action are recorded separately.

Correction vs corrective action: correction fixes the immediate condition; corrective action eliminates the root cause so the nonconformity does not recur (ISO 9000:2015 definitions).

Follow-up (clause 6.7): the audit programme should include verification of the implementation and effectiveness of corrective actions; the audit is not closed until follow-up is completed.

The audit is complete when all planned activities are accomplished or otherwise justified; audit records should be retained (clause 6.6) as evidence of programme implementation.

Verification of effectiveness requires evidence after implementation, e.g. a re-audit, review of process performance data, or review of records from the corrected process.

Escalation: if corrective action is not taken or is ineffective, the finding should be escalated to top management; unresolved nonconformities may affect the management review input (ISO 9001:2015 clause 9.3).