Initial certification planning and team impartiality at a hospital group
You manage the certification programme at an accredited body. A hospital group with five hospitals and 4,000 staff applies for initial ISO 55001 certification for its estates and facilities asset management. The proposed team is: Lead auditor A, who has 12 years' facilities experience but conducted a paid 'readiness review' for the client eight months ago and advised on the asset management plan; auditor B, a mechanical engineer who until 18 months ago was employed by the client as maintenance manager; and technical expert C, who has no ISO 55001 audit experience but 20 years in healthcare engineering. The client wants stage 1 and stage 2 in the same week to meet a board deadline. Documents arrived three days before stage 1, including an asset register of 18,000 items, a scope statement and 14 procedures. The sales team has already quoted 10 audit days, and the client expects all five sites to be visited during stage 2.
1. Identify the main impartiality and competence threats in the proposed team and state what you would do before the audit.
Read the worked answer
Lead auditor A's paid readiness review, including advice on the asset management plan, is management system consultancy. ISO/IEC 17021-1 requires the certification body not to certify a system on which it provided consultancy, and personnel who advised the client should not audit it. A must be removed from the team for this client; the readiness review also means the body must assess whether it has a conflict at client level, not only at auditor level.
Auditor B was the client's maintenance manager until 18 months ago. That creates familiarity and self-review threats, particularly for maintenance processes. Replace B unless a documented risk assessment shows the threat is insignificant; for an initial audit, replacement is cleaner. Technical expert C can bring healthcare engineering knowledge but cannot substitute for asset management system audit competence; C must work under a qualified auditor and be briefed on audit methods.
The team still needs competence in ISO 55001, asset management principles and the client's processes. Document the competence evaluation and the decision on each person before the audit.
2. The client wants stage 1 and stage 2 in the same week. Explain the objectives of stage 1 and whether this request can be accepted.
Read the worked answer
Stage 1 evaluates the client's readiness for stage 2: whether the asset management system documentation meets the standard's requirements, whether scope and boundaries are defined, whether internal audit and management review have been performed, whether objectives and plans exist, and whether stage 2 resources can be planned. It is not a paper-only exercise; it involves interviews and site familiarization.
Running stage 1 and stage 2 in the same week defeats the purpose because the client needs time to correct gaps before stage 2 evidence is tested. The request should be refused unless the body can show stage 1 is complete and the client has had a reasonable interval to act. With documents arriving three days before stage 1, the team cannot prepare properly.
If stage 1 finds the system is not ready, stage 2 must be postponed. Record the decision and communicate it to the client; do not soften it to meet the board deadline. The audit plan should show separate objectives, dates and deliverables for each stage.
3. Evaluate the proposed 10 audit days and all-five-site expectation. What factors determine audit time and site sampling?
Read the worked answer
Audit time should be determined by a documented method considering the number of employees, number of sites, asset criticality, process complexity, regulatory context, outsourced processes, prior audit results and the need to interview top management and operational staff. A 10-day quote set by sales before stage 1 is not evidence that 10 days is adequate.
For a five-hospital group with 18,000 assets, assess whether all sites must be visited at initial certification or whether a justified sampling approach applies. If sampling is permitted, it must be representative and include the largest or most complex site plus sites with different processes; the sample cannot be chosen by the client. If all sites are required, the body must resource the audit or decline the deadline.
The audit plan should show time for the opening meeting, interviews, site walks, evidence sampling, team meetings and closing meeting, not just document review. Document the rationale for days and sites so the accreditation assessor can see it was risk-based.