Surveillance sampling after a major nonconformity
A certification body manages an ISO/IEC 20000-1 certificate for a managed print services company with six operating sites. At the initial certification, two sites were sampled. In the last surveillance, site D received a major nonconformity for incident backlogs; the corrective action was accepted and verified as closed two months ago. Site F opened eight months ago and has never been audited. The next surveillance is due in three weeks. The client asks for a fully remote audit of one site and wants to reduce the sample from two sites to one because 'the last audit found nothing at E.' The audit programme is risk-based. The certification body has remote auditing procedures that permit remote audit of documentation and interviews but require on-site observation of service desk operations and data centre access controls. Travel budget is limited.
1. Determine the site sample for the surveillance and justify your decision.
Read the worked answer
The surveillance sample should include site D and site F. Site D had a major nonconformity; the corrective action was verified as closed, but effectiveness must be confirmed in the next surveillance, not assumed from closure. Site F is new and has never been audited; it is a high-risk site because its controls are unproven. The client's request to reduce the sample to one site and to avoid E is not the deciding factor; the programme is risk-based, and reducing sample size without justification weakens assurance. At least two sites should be sampled, with D and F selected; if the programme requires a rotating sample, the third site can rotate. Document the risk assessment, the prior nonconformity, the new site and any changes in services or volumes. If the certification body cannot resource the sample, it should adjust the programme or certificate scope, not simply accept the client's preference.
2. Advise on the client's request for a fully remote audit.
Read the worked answer
A fully remote audit of one site conflicts with the certification body's own remote auditing procedure, which requires on-site observation of service desk operations and data centre access controls. Remote methods can be used for documentation review, interviews and some sampling, but they cannot verify physical access controls, observation of work practices or the site's actual environment. A hybrid is appropriate: remote for documentation and management interviews, on-site for the service desk and data centre at the selected sites. If travel budget prevents the required on-site activity, the certification body should not issue a remote-only conclusion for those controls; it should reschedule, seek additional resources or reduce the certification scope, and record the limitation. The client's budget is not a valid reason to reduce assurance.
3. What follow-up evidence should be obtained for site D's major nonconformity before or during the surveillance?
Read the worked answer
Before or during surveillance, obtain evidence that the corrective action for site D addressed the cause, not just the backlog: revised incident prioritisation, backlog metrics, staffing or escalation changes, training records and a sample of incidents after the correction showing restoration within targets. Check management review minutes and internal audit follow-up. At the surveillance, sample post-correction incidents and interview staff at D; verify that the backlog has not recurred. If the correction was ineffective, raise a new nonconformity and consider whether the certificate should be suspended or the scope reduced. The verification should be recorded and considered in the certification decision, which must be made independently of the audit team.