ISO 21001 Lead Auditor cheat sheet

ISO 21001 is a sector-specific management system standard (MSS) built on the same High-Level Structure as ISO 9001; Annex SL clause skeleton (4-10) applies unchanged.

Seven quality principles underpin the standard: customer focus, leadership, engagement of people, process approach, improvement, evidence-based decision-making, relationship management; ISO 21001 adds two learner-centred principles: focus on learners and other beneficiaries, and additional focus on the social dimension of education.

An EOMS is a set of interrelated or interacting elements of an organization used to establish policy and objectives and to achieve those objectives in the provision of educational products and services.

'Educational organization' means any organization that provides education and training; the standard is applicable to public and private, formal and non-formal providers, and to organizations of any size or type.

'Educational product' and 'educational service' are outputs of the educational organization; the learner is the primary beneficiary of the educational service, while other beneficiaries include parents, employers, and society.

The process approach means understanding and managing interrelated processes as a system; a process converts inputs to outputs and requires defined inputs, outputs, controls, resources, and performance indicators.

Risk-based thinking is implicit: clause 6.1 requires determining risks and opportunities for the EOMS, and clause 5.1 requires leadership to promote risk-based thinking.

PDCA (Plan-Do-Check-Act) applies at two levels: each individual process and the EOMS as a whole; 'Check' corresponds to monitoring, measurement, analysis and evaluation (clause 9).

The standard is not a certification-only tool; the introduction states that its intended outcomes are the ability to consistently provide, enhance learner satisfaction, and demonstrate conformity and continual improvement.

Clause 4: interested parties include learners, parents/guardians, staff, employers, regulators, and society; the scope statement must identify the educational products and services covered and justify any exclusion as non-applicable.

Clause 5: top management must establish an EOMS policy that includes a commitment to satisfying applicable requirements and to continual improvement, and must ensure responsibilities and authorities are assigned.

Clause 6: actions to address risks and opportunities; EOMS objectives must be measurable, monitored, communicated, and updated, with a plan of what will be done, resources needed, who is responsible, and when it will be completed.

Clause 7.1.2 notes that people are the most important resource in education; 7.1.3 requires infrastructure including physical facilities and virtual learning environments; 7.1.5 requires a documented process for monitoring and measuring resources.

Clause 7.2 competence: define the necessary competence of persons doing work affecting educational performance, ensure they are competent, and retain documented information as evidence.

Clause 7.5 documented information: maintain documents needed to support the EOMS and retain evidence of results; control includes distribution, access, retrieval, retention, and protection.

Clause 8.1 requires operational planning and control; 8.2 requires determining requirements for educational products and services, including review of requirements and communication with learners.

Clause 8.3 design and development of educational products and services: inputs, controls, outputs, and changes; 8.5 covers production and service provision including identification, traceability, preservation, and post-delivery activities.

Clause 8.6 release of educational products and services requires verification that requirements have been met before release; 8.7 control of nonconforming outputs requires identification, correction, and documented information.

ISO 19011 defines an audit as a systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled.

Audit criteria are the set of policies, procedures, or requirements used as a reference; audit evidence is records, statements of fact, or other information relevant to the criteria and verifiable.

Audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach.

Independence means freedom from bias and conflict of interest; auditors must not audit their own work and should be free from influence that could affect objectivity.

Three audit types: first-party (internal), second-party (external provider or customer), and third-party (certification or accreditation body).

Audit is characterized by the relationship between auditor and auditee; the auditor should be independent of the activity being audited, and impartiality is the absence of bias.

Evidence must be traceable to the audit criteria; findings are classified as conformity, nonconformity (major or minor), observation, or opportunity for improvement.

A major nonconformity is a failure to fulfil a requirement that affects the capability of the management system to achieve intended results, or a systemic failure; a minor nonconformity is an isolated lapse not affecting system capability.

Audit sampling uses a defined sample size and selection method; the auditor must document the sampling rationale and recognize that sampling carries a risk of not detecting nonconformities.

Audit programme vs audit plan: the programme is the set of one or more audits planned for a specific time frame, while the plan describes the activities and arrangements for a single audit.

Audit objectives, scope, and criteria must be defined before audit planning; the scope must state the organizational units, functions, processes, locations, and time period covered.

The audit plan should include audit objectives, criteria, scope, dates, locations, expected time and duration, roles and responsibilities, and allocation of resources.

Document review before the audit should cover the EOMS policy, objectives, scope, process maps, procedures, internal audit results, management review outputs, and previous nonconformities.

Checklist preparation should be based on the audit criteria (ISO 21001 clauses and organization's own requirements) and should not replace auditor judgment; checklists are aids, not scripts.

Auditor competence includes education, training, experience, and audit skills; a lead auditor additionally needs competence in managing an audit team and communicating with top management.

Audit team selection should consider the scope, language, and technical knowledge needed; auditors must have no conflict of interest with the auditee.

Opening meeting should confirm the audit plan, scope, criteria, communication channels, and the method for reporting findings; it should be documented.

Sampling plan and audit trail should be prepared in advance; the auditor should identify which processes, locations, and shifts to sample and justify the selection.

Opening meeting agenda: introductions, confirmation of audit plan and scope, audit criteria, communication arrangements, availability of resources, and confirmation of the audit method.

Evidence collection methods: interviews with staff and learners, observation of activities, review of documented information, and sampling of records; evidence must be recorded and traceable.

Interview technique: ask open questions, listen, verify with records, and avoid leading questions; use the 'show me' approach to verify claims against evidence.

Audit trail: follow the process from input to output and trace a sample of records through the process to verify conformity and effectiveness.

Findings must be supported by objective evidence; the auditor should record the evidence, the requirement, and the gap, and should verify the finding with the auditee before finalizing.

Nonconformity grading: major if the system cannot achieve intended results or a systemic failure; minor if isolated and not affecting system capability; observations are not nonconformities.

Auditor should verify effectiveness of corrective actions from previous audits and check whether the root cause was addressed, not just the symptom.

Communication with the auditee should be ongoing; the auditor should raise concerns as they arise and avoid surprises at the closing meeting.

The audit should cover all clauses in scope, including clause 9 (performance evaluation) and clause 10 (improvement), and should verify internal audit and management review effectiveness.

Closing meeting agenda: thank the auditee, restate the audit scope and criteria, present findings (conformities and nonconformities), explain the grading, and confirm follow-up actions.

The closing meeting should be chaired by the lead auditor and attended by the auditee's management and process owners; the auditee should be given the opportunity to ask questions and clarify.

The audit report should include audit objectives, scope, criteria, dates, locations, audit team, findings, conclusions, and the extent of conformity with the criteria.

Nonconformity reports should state the requirement, the objective evidence, and the nature of the nonconformity; they should be clear enough for the auditee to understand and correct.

Corrective action process: the auditee must contain the nonconformity, determine the cause, plan corrective action, implement it, and verify effectiveness; the auditor verifies the evidence.

Follow-up audit or desk review is used to verify corrective actions; the auditor should check whether the root cause was eliminated and whether similar nonconformities exist elsewhere.

Audit conclusions should state whether the EOMS conforms to the audit criteria and whether it is effectively implemented and maintained; conclusions are not the same as certification decisions.

Records of the audit should be retained, including the audit plan, checklist, evidence, findings, report, and corrective action records, in accordance with the audit programme.

Confidentiality applies to all audit information; the auditor must not disclose audit findings without authorization, and audit records should be protected.

An audit programme is a set of one or more audits planned for a specific time frame and directed towards a specific purpose; it includes arrangements for planning, resourcing, and conducting audits.

Programme management includes establishing objectives, identifying risks and opportunities, planning the programme, implementing it, monitoring it, and reviewing and improving it.

Audit programme risks include resource constraints, auditor competence gaps, scheduling conflicts, and scope creep; the programme manager should identify and address these.

Programme planning should consider the size and complexity of the organization, the importance of processes, the results of previous audits, and the maturity of the EOMS.

Audit programme records should include the audit plan, audit reports, nonconformity reports, corrective action records, and auditor competence records.

Programme monitoring includes tracking audit completion, follow-up of nonconformities, and evaluation of auditor performance; the programme should be reviewed at planned intervals.

The audit programme should be reviewed and updated to reflect changes in the organization, such as new educational products, new locations, or changes in legal requirements.

Programme manager responsibilities include ensuring auditor competence, assigning audit teams, and ensuring the independence of audits; the manager should not audit their own work.

The programme should be aligned with the organization's strategic direction and should support the EOMS objectives and continual improvement.