Risk-based audit programme under resource and travel constraints
You are the ISO 55001 programme manager at a certification body with 42 certified clients. The programme is under pressure: three lead auditors cover all clients; one is the only auditor with rail sector competence and retires in four months; a second has audited the same energy client for four consecutive surveillance cycles; a third is also a technical reviewer for the same client's files. One client, a waste-to-energy operator, received a major nonconformity 11 months ago and has had two complaints about odour and downtime; its surveillance is due. Another client, a logistics group, has added three new warehouses and changed its maintenance contractor since certification. Travel budget has been cut by 30%, and the operations director proposes remote surveillance for all clients, with the same lead auditor retained 'for continuity'. An accreditation assessor will review the programme in six months.
1. Identify the main risks in the current programme and propose changes using a risk-based approach.
Read the worked answer
Risks include concentration of rail competence in one retiring auditor; over-familiarity and self-review because the same energy client has had four consecutive cycles with one auditor who also performs technical review; a high-risk waste-to-energy client with a major nonconformity and complaints; a logistics client with significant changes that may need earlier attention; travel cuts driving inappropriate remote auditing; and an accreditation assessment in six months.
Changes: build a competence map and recruit or train a rail auditor, or use a technical expert paired with a qualified auditor; rotate lead auditors for the energy client and separate technical review from audit; schedule the waste-to-energy surveillance earlier, with more time and focus on the major nonconformity's effectiveness and the complaints; bring forward the logistics surveillance or conduct a special audit to cover the new warehouses and contractor change; adjust the programme schedule and resources based on risk rather than equal intervals.
Document the rationale and retain records. Inform affected clients of changes. The programme should show that risk, performance and changes drove the schedule.
2. What competence and impartiality actions are needed for the auditor pool?
Read the worked answer
For the retiring rail specialist, identify a replacement now, arrange shadowing and competence assessment before retirement. If no replacement is available, decline or defer rail audits rather than use an unqualified auditor. Technical experts can fill sector knowledge gaps but cannot replace asset management system audit competence; pair them with a qualified lead auditor.
For impartiality, do not assign an auditor to the same client for more than a defined period without a documented risk assessment. At minimum, rotate the energy client and ensure the technical reviewer is not the same person who audited the file. Check whether the auditor's technical review role creates self-review. Implement annual impartiality declarations and monitor assignments.
For the waste-to-energy client, consider a different team because of the complaints and prior findings, not because of personal like or dislike. Keep competence records and assignment rationale for the accreditation assessor. Any conflict-of-interest declaration should be reviewed before scheduling, not after the audit.
3. Evaluate the proposal for remote surveillance of all clients and define programme performance indicators.
Read the worked answer
Remote surveillance for all clients is not justified by a 30% travel cut. Remote auditing can be effective for document review and interviews, but ISO 55001 evidence often requires observing assets, maintenance work, site conditions and safety practices; remote methods may miss physical asset condition and workforce culture. Use a risk-based mix: remote for low-risk, stable clients with good performance; on-site for high-risk clients, major nonconformity follow-up, scope changes, and initial certification or recertification where physical evidence is essential.
Define criteria for remote feasibility, including connectivity, confidentiality, ability to observe via video and document access, and record the justification. Retaining the same lead auditor 'for continuity' conflicts with rotation and familiarity risks; continuity can be provided by a team member or technical expert, not necessarily the lead.
Programme performance indicators: audit plan completion, nonconformity closure timeliness and effectiveness, complaints, auditor competence and rotation, client feedback, accreditation findings, and adherence to the risk-based schedule. Review them at management review.