Exploring Stage 1 and Stage 2 Audits

May 7, 2015

2 641

A Certification Audit is the first step for those organizations that have decided to undergo an assessment process with a Certification Body (CB) or Registrar to determine if their management system complies with the requirements of a given standard (ISO 9001, ISO 14001, OHSAS 18001, etc). This Certification Audit is divided into two stages: Stage 1 Audit and Stage 2 Audit.

These audits differ in many ways: their purpose, duration, information reviewed and sometimes even in the location where it will take place.

Purpose
The Stage 1 Audit purpose is to determine if an organization is ready or not for a certification audit. Here the Registrar will confirm that the standard’s key requirements are met, it will confirm legal compliance, implementation status and the scope of certification. The output of this audit will be a report identifying any non-conformances or potential non-conformances that the organization will have to correct before Stage 2 audit. If Stage 1 audit is successful, the next audit will be scheduled.

The Stage 2 Audit evaluates the implementation and effectiveness of the organization’s management system(s). During this audit, the Registrar will determine the degree of compliance with the standard’s requirements, and report any non-conformances or potential non-conformances that the organization will have to correct before the compliance certificate can be issued. If Stage 2 audit is successful, the organization’s management system(s) will be certified.

Information assessed
In the Stage 1 Audit the Registrar will normally review the following information:

Policies and procedures.
Legal and technical requirements.

During Stage 2 Audit the information assessed will be:

All relevant documentation (records, procedures and policies) that evidences the management system’s compliance with all the standard’s requirements.
Evaluation of internal audits, management review and objectives.
Audits of all relevant processes.

Duration
Stage 1 Audit usually will be carried out in one day. During this audit, the Registrar can do an on-site visit to the organization’s premises and interview the ISO management representative, all of which will be done in one day.

Stage 2 Audit can be performed in approximately three or four days. This will depend on the complexity and size of the organization being audited.

Location
Both audits take place in the premises of the organization being audited. Only in some cases, Stage 1 Audit can be performed off-site; this will be done if the Registrar doesn’t consider necessary an on-site visit (usually for small and simple organizations). Stage 2 Audit is always performed on-site.

These are the main differences between Stage 1 and Stage 2 Audit. Nonetheless, every organization undergoing a certification process should maintain an open and clear communication with their Registrar in order to clarify any doubts that may arise before the audits take place.

Becoming a Third Party Auditor

Apr 1, 2015

0 512

Accreditation bodies allow organizations seeking accreditation can demonstrate to their customers that they have been successful at meeting the requirements of international accreditation standards.

Third-party auditors are those who perform an external and independent audit of an organization’s management system to evaluate if it meets the requirements of a specific standard; if successful, this third-party audit will provide the organization with certification or registration of conformity with the given standard.

A third party audit is carried out by a Registrar/Certification Body (CB) hired by the organization; therefore, in order for someone to be a third-party auditor, he/she needs to be employed by a CB. All CB, before hiring an auditor, need to ensure that the auditor possesses the knowledge and skills necessary to achieve the intended results of the audits they are expected to perform. Some of these are described below.

Personal attributes that will enable them to act in accordance with the principles of auditing, which include ethical conduct, fair presentation, due professional care, independence, and free use of an evidence-based approach.
Knowledge on the contents of ISO 19011: 2011, Guidelines for auditing management systems.
Knowledge and skills on audit principles, procedures and methods, which will enable them to conducted audits in a consistent and systematic manner.
They should be able to exhibit professional behavior during the performance of audit activities, including being ethical, open-minded, diplomatic, observant, perceptive, versatile, tenacious, decisive, self-reliant, open to improvement, culturally sensitive, and collaborative.
Knowledge and skills on management system and reference documents that will enable them to comprehend the audit scope and apply audit criteria.
Sector specific knowledge which will enable them to comprehend the organization’s structure, business, management practices and the legal and contractual requirements applicable to the organization being audited.

As indicated in ISO 19011, someone pursuing to become a third-party auditor can acquired all these knowledge and skills by using a combination of the following:

Formal education/training and experience that contribute to the development of knowledge and skills in the management system discipline and sector the auditor intends to audit.
Training programs that cover generic auditor knowledge and skills.
Experience in a relevant technical, managerial or professional position involving the exercise of judgment, decision making, problem solving and communication with managers, professionals, peers, customers and other interested parties.
Audit experience acquired under the supervision of an auditor in the same discipline.

After acquiring all the necessary knowledge and skills and successfully being employed by a CB, third-party auditors must pledged to advocate a particular code of ethical conduct in the performance of an audit and they must abide the internal policies and rules of the CB that hires them. All these requirements must be followed in order to protect everyone involved in the audit process.