Preparation for an AMS Certification Audit
What the exam tests
Certification mechanics and the readiness conditions you must satisfy before an external audit, plus how findings are graded and closed.
Core rules
- Choose an accredited certification body with relevant scope and competence; agree a scope statement describing the AMS and its boundaries - not a claim about asset performance.
- Two-stage audit: stage 1 checks readiness - documentation, scope, context, internal audit and management review completed, and the AMS operating with evidence available; stage 2 evaluates implementation and effectiveness through interviews, sampling and site visits.
- Findings: major nonconformity (requirement absent, or system failure with significant risk), minor nonconformity, observation/opportunity for improvement. Major findings normally require correction and verification before certification.
- Certification is valid for three years with surveillance audits, typically annual, and recertification before expiry. The certification decision is taken by an impartial function, not by the audit team alone.
Worked example
Stage 1 finds that management review has never covered audit results. The client records it as a minor nonconformity, adds the item to the agenda, retains the record and closes it before stage 2. At stage 2 an outsourced security-control process has no control evidence; that is raised as a major finding under operational control. Reasoning: stage 1 checks the system exists; stage 2 tests whether it works.
Traps
Believing ISO 55000 is certifiable - it is guidance, only ISO 55001 requirements are audited; asking the certification body to run your internal audit; confusing AMS scope with a site list; leaving internal audit and management review until the week before stage 1.