SGS cheat sheet

ISO 19011:2018 provides guidance (recommendations) on auditing management systems; ISO/IEC 17021-1:2015 contains the requirements for bodies providing audit and certification of management systems.

Annex SL harmonized structure: clause 4 Context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

ISO 9001:2015 mandates no quality manual, no management representative and no documented procedures; it requires 'documented information' to be maintained (documents) or retained (records).

Verbal forms per ISO/IEC Directives Part 2: 'shall' = requirement, 'should' = recommendation, 'may' = permission, 'can' = possibility/capability.

Only normative clauses and normative annexes contain requirements; an annex marked 'informative' provides guidance and cannot be used as an audit criterion on its own.

ISO 31000:2018 defines risk as the effect of uncertainty on objectives, expressed as a combination of the consequences of events and their likelihood.

Risk-based thinking in ISO 9001:2015 sits in clause 6.1 (actions to address risks and opportunities); no formal risk register, risk methodology or documented risk assessment is required.

ISO/IEC 17021-1 requires a two-stage initial certification audit, surveillance at least once a calendar year, and recertification before the certificate expires.

The certification decision shall not be made by the audit team; it is taken by certification body personnel not involved in performing the audit.

ISO 19011:2018 sets seven audit principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach.

Integrity is the foundation of professionalism: honesty, truthfulness and discretion in all audit dealings.

Fair presentation requires reporting truthfully and accurately, including significant obstacles encountered and unresolved diverging opinions between the team and the auditee.

Confidentiality: audit information shall not be used improperly for personal gain or in a way prejudicial to the interests of the auditee; secure handling of records is required.

Evidence-based approach: audit conclusions shall be reached only from verifiable information traceable to the audit criteria; evidence is the link between criteria and findings.

Independence is the basis for impartiality of the audit conclusion; an auditor shall not audit an activity for which they have direct responsibility (no self-review).

Impartiality threat categories commonly used: self-interest, self-review, familiarity, intimidation, financial interest, advocacy; mitigations include rotation, declarations, and separation of functions.

ISO/IEC 17021-1 bars a certification body from certifying a management system on which it provided consultancy within two years of the end of that consultancy, and bars personnel who provided the consultancy from auditing that client for two years.

A conflict-of-interest declaration is required from audit team members before the audit; undisclosed relationships that create self-interest must result in replacement or exclusion.

Process: a set of interrelated or interacting activities that transforms inputs into outputs; it requires defined inputs/outputs, sequence and interaction, criteria and methods, resources, authorities and addressed risks.

PDCA applies at two levels: to the management system as a whole and to each individual process within it.

Turtle diagram elements: inputs, outputs, with what (resources/equipment), with who (people/competence), how (methods/criteria), and what results (performance indicators).

Risk = combination of the likelihood of an event and its consequence; risk evaluation compares the result of risk analysis against defined risk criteria.

ISO 31000 treatment options: avoid the risk, take or increase the risk, remove the risk source, change likelihood, change consequences, share the risk, retain the risk.

Risk-based audit planning directs greater audit time and depth to processes with high complexity, high maturity gaps, recent change, poor previous results, complaints or regulatory exposure.

Process effectiveness is judged by whether the process achieves its intended results, not by whether a documented procedure exists.

Where processes are outsourced, the standard requires control over them to be defined and the auditor evaluates the effectiveness of that control.

Audit objectives, scope and criteria are defined before planning; criteria are the set of requirements (standard, regulation, procedure, contract) against which evidence is compared.

Audit programme = arrangements for a set of audits over a time frame; audit plan = description of activities and arrangements for one specific audit.

ISO 19011 audit plan content: objectives, scope, criteria, dates and sites, expected time and duration, roles and responsibilities, allocation of resources, auditees, methods, sampling plan, logistics, confidentiality and security arrangements.

Initial certification sequence: stage 1 reviews documented information, site-specific conditions and readiness; stage 2 evaluates implementation and effectiveness.

Document review before the audit checks that documented information covers the audit criteria and is available; observations from the review are verified during the audit, not reported as findings from the desk review.

Audit duration drivers include effective number of personnel, scope and complexity, technology, regulatory requirements, outsourced processes, shift patterns and previous audit results.

Effective number of personnel counts all persons within scope, including part-time, shift-working and non-permanent personnel, expressed as full-time equivalents.

The sampling plan states the population, sample size, selection basis (statistical or judgmental) and what the sample is intended to demonstrate.

Checklists are working aids for the auditor; they do not restrict the audit to listed items and shall not be used to structure the audit around the standard clauses alone.

Evidence sources: interviews, observation of activities and conditions, review of documents and records, and analysis of data; significant conclusions should be corroborated by at least two independent sources.

Evidence -> compared with audit criteria -> audit finding; findings may indicate conformity or nonconformity, and only evidence, not opinion, supports a nonconformity.

Statistical sampling uses probability selection so results can be extrapolated with a stated confidence; judgmental sampling relies on auditor knowledge and must be justified.

Zero-acceptance attribute sampling: n = ln(1 - C) / ln(1 - p); C = 0.95 and p = 0.05 gives n ≈ 59 units with no defects allowed.

Sampling never demonstrates 100% conformity; a clean sample supports the conclusion only for the population and period sampled.

Opening meeting confirms the plan, scope, criteria, methods, communication channels, availability of resources, confidentiality, safety and closing arrangements.

Open questions gather information and explanation; closed questions confirm specific facts; leading questions that suggest the expected answer are avoided.

Interview at the place where the activity is performed, interview the person responsible for the activity, then verify the statements against records or observation.

For remote or ICT-supported auditing, the auditor must confirm the effectiveness of the technology and the security of information exchange before relying on it.

Major nonconformity: affects the capability of the management system to achieve intended results, or represents a significant risk, legal breach, or complete absence of a required element.

Minor nonconformity: an isolated lapse that does not indicate a systemic failure and does not significantly affect the system's capability to achieve intended results.

A nonconformity record states the requirement (criterion), the objective evidence (what, where, when), the sample examined and the classification.

Correction eliminates the detected nonconformity; corrective action eliminates its cause to prevent recurrence; the two are audited separately.

Audit report content: objectives, scope, criteria, dates and sites, team, summary of the audit process, findings and their classification, conclusions on conformity and effectiveness, diverging opinions and limitations.

Audit conclusion is the auditor's professional judgement on overall conformity and effectiveness against the audit criteria, not merely a list of nonconformities.

Significant issues that could affect the audit conclusion are communicated to the client and auditee immediately rather than only in the final report.

Follow-up verifies both implementation and effectiveness of corrections and corrective actions; verification may be by written evidence or on-site, chosen on the basis of risk.

Improvement recommendations are optional and must be clearly separated from findings of nonconformity in the report.

Competence = ability to apply knowledge and skills to achieve intended results; it is evidenced by education, training, experience and demonstrable personal attributes.

ISO 19011 competence areas: personal attributes; knowledge of audit principles, procedures and methods; knowledge of management system standards and reference documents; knowledge of organizational context; knowledge of the audited sector.

Audit team leader adds: managing the audit and balancing objectives, representing the team with the client, assigning tasks, resolving conflict and reaching decisions.

Competence evaluation methods include record review, interview, observation, witnessed audit, testing and feedback from peers and auditees.

Competence must be evaluated against the specific technical sector and the standards used in the audit, not only against generic auditing skills.

Continuing professional development maintains and improves competence through additional training, further audit experience and sector-specific updating.

Witnessed or observed audits are a recognized method of monitoring auditor performance on site and are used as input to formal re-evaluation of competence.

Technical experts advise the audit team but do not audit as auditors unless they also meet auditor competence requirements.