PECB ISO 55001 Lead Auditor cheat sheet

Asset: an item, thing or entity that has potential or actual value to an organization; value can be tangible or intangible, financial or non-financial (ISO 55000).

Asset management: coordinated activity of an organization to realize value from assets; it converts organizational objectives into asset-related decisions, plans and activities.

Asset management system: a management system for asset management whose function is to establish the asset management policy and asset management objectives, and the processes needed to achieve those objectives.

ISO 55000 provides the overview, principles and terminology; ISO 55001 specifies requirements (certifiable); ISO 55002 gives implementation guidance. Only ISO 55001 is auditable for certification.

The three core concepts are value, alignment and leadership: value realized from assets, alignment of asset management with organizational objectives, and leadership as an enabler.

The asset management system elements are: context of the organization, leadership, planning, support, operation, performance evaluation and improvement - mirroring the ISO management system High-Level Structure.

The asset management system sits within the organization's overall management system and interacts with other systems such as quality (ISO 9001), environment (ISO 14001) and OH&S (ISO 45001).

The asset management system is a tool to coordinate and control activities; it does not by itself guarantee results, and its effectiveness depends on the people, processes and information it links.

Asset management is not the same as maintenance management: maintenance is one activity within asset management, which also covers strategy, planning, investment, performance and lifecycle decisions.

Clause 4 Context: determine external and internal issues, interested parties and their requirements, and the scope of the asset management system; the scope must be documented.

Clause 5 Leadership: top management must demonstrate leadership, establish the asset management policy and objectives, and ensure resources and responsibilities are assigned.

Clause 6 Planning: address risks and opportunities, set asset management objectives and plans to achieve them, and plan changes to the asset management system.

Clause 6 also requires strategic asset management planning linking organizational objectives to asset portfolio, asset management plans and asset lifecycle activities.

Clause 7 Support: resources, competence, awareness, communication and documented information; information management is essential for asset management decision-making.

Clause 8 Operation: plan and control operational processes, manage change, and control outsourced processes; criteria for processes must be established and control maintained.

Clause 9 Performance evaluation: monitor, measure, analyse and evaluate performance; conduct internal audits at planned intervals; perform management review at planned intervals.

Clause 10 Improvement: handle nonconformities and corrective actions, and continually improve the suitability, adequacy and effectiveness of the asset management system.

Documented information required includes scope, policy, objectives, plans, evidence of competence, and results of monitoring, internal audits and management reviews.

Audit: a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled (ISO 19011).

Audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.

Audit criteria: the set of policies, procedures or requirements used as a reference against which objective evidence is compared.

Audit evidence: records, statements of fact or other information relevant to the audit criteria and verifiable; evidence is evaluated against criteria to produce audit findings.

Audit findings: results of evaluating collected evidence against audit criteria; findings indicate conformity or nonconformity.

Nonconformity: non-fulfilment of a requirement; classify as major (system breakdown or significant risk) or minor (isolated lapse not affecting system effectiveness).

Observation and opportunity for improvement are not nonconformities; they are recommendations and should be distinguished from findings against criteria.

Independence: auditors must be independent of the activity being audited; an auditor cannot audit their own work to preserve objectivity.

Audit types: first-party (internal), second-party (supplier/customer), third-party (certification/regulatory); audits may be combined or joint.

Define audit objectives, scope and criteria before planning; scope must state organizational units, physical locations, asset types and processes covered.

Establish the audit programme and audit plan: the programme covers a set of audits over time; the audit plan covers one audit and includes schedule, roles and resources.

Perform document review of the asset management system (policy, objectives, plans, procedures, records) to understand the system before on-site activities.

Conduct risk-based planning: prioritize processes and asset types with higher risk to value realization, safety or compliance.

Prepare audit checklists based on ISO 55001 clauses and the organization's own criteria; checklists are aids, not scripts, and must allow for follow-up.

Select the audit team with competence in asset management, the relevant asset types and audit techniques; consider technical experts where specialized assets exist.

Prepare working documents: audit plan, checklists, sampling plan, forms for findings and attendance, and copies of criteria.

Communicate the audit plan with the auditee, agree dates, logistics, access, safety requirements and confidentiality arrangements before the audit.

Sampling: auditors examine a sample of processes, records and assets; sampling must be representative and justified given time and risk.

Opening meeting: confirm scope, criteria, plan, roles, communication channels and safety arrangements; confirm the audit is a sample and findings are based on evidence.

Evidence collection methods: interviews, observation of activities and assets, and review of documented information and records.

Interview technique: ask open questions, verify with records, and cross-check with observation; triangulate evidence from multiple sources.

Trace a sample of assets through the lifecycle: acquisition, operation, maintenance, performance monitoring, and disposal, to test linkage between plans and practice.

Verify that asset management objectives are measurable, monitored and linked to organizational objectives, and that plans exist to achieve them.

Evaluate competence and awareness of personnel against the asset management policy, objectives and their contribution to value realization.

Document each finding with the criteria, evidence, location and person; classify as nonconformity (major/minor), observation or opportunity for improvement.

Closing meeting: present findings, agree on factual accuracy and timelines for corrective action, and explain the audit conclusion and any follow-up.

Audit conclusion: statement on the extent of conformity and the effectiveness of the asset management system, based on the audit objectives and scope.

The closing meeting presents findings and conclusions; the auditee should be given the opportunity to clarify or dispute findings with evidence.

The audit report should include audit objectives, scope, criteria, dates, audit team, findings, conclusions and any areas of uncertainty or limitations.

Findings should be recorded against the specific requirement (clause) of ISO 55001 or the organization's own criteria.

Corrective action: the auditee analyses the root cause, plans and implements action, and the effectiveness of the action is verified.

Follow-up audits verify that corrective actions have been implemented and are effective; timelines depend on the severity of the nonconformity.

Distribution and retention of the audit report must respect confidentiality and the organization's documented information requirements.

The audit is complete when all planned activities are performed and the report is issued; the audit programme continues with follow-up and next audits.

Records of the audit, findings, corrective actions and follow-up are retained as evidence of the audit programme's effectiveness.

For certification audits, the certification body makes the certification decision based on the audit report and any corrective action evidence.

Audit programme: set of one or more audits planned for a specific timeframe and directed at a specific purpose; managed by a competent person with authority.

Programme management includes planning, resourcing, monitoring, reviewing and improving the audit programme to ensure it achieves its objectives.

Establish programme objectives, extent, risk and opportunities; determine audit frequency and methods based on risk and the importance of processes.

Assign competent auditors and ensure impartiality; auditors must not audit their own work and must be free from conflicts of interest.

Monitor the programme: track audit completion, findings trends, corrective action closure and resource use, and adjust the programme accordingly.

Review the programme at planned intervals with top management to confirm it remains suitable, adequate and effective.

Record and retain documented information on the audit programme and each audit, including plans, reports, findings and follow-up.

Combine or integrate audits with other management systems (e.g., ISO 9001, ISO 14001) where criteria and scope overlap, while preserving audit objectives.

Competence of auditors includes asset management knowledge, audit principles and techniques, and understanding of the organization's assets and context.