Every audit begins with a plan, but success depends on executing that plan with precision and consistency. When auditors follow a structured approach, they uncover meaningful insights that drive organizational improvement. ISO 19011:2002 establishes this framework through Clause 6, which details the specific activities that transform audit objectives into actionable findings. These activities create a systematic pathway from initial contact with the auditee through final report distribution, ensuring nothing falls through the cracks.
Table of Contents
- Initiating the audit
- Appointing the audit team leader
- Defining objectives, scope, and criteria
- Determining feasibility and selecting the team
- Establishing initial contact
- Conducting document review
- Preparing for on-site audit activities
- Developing the audit plan
- Assigning work and preparing working documents
- Conducting on-site audit activities
- Opening meeting
- Collecting and verifying information
- Generating audit findings
- Preparing audit conclusions
- Closing meeting
- Preparing and distributing the audit report
- Completing the audit and conducting follow-up
Initiating the audit
The audit process begins long before any documents are reviewed or sites are visited. Proper initiation sets the foundation for everything that follows, establishing clear expectations and ensuring all parties understand their roles.
Appointing the audit team leader
The first critical step involves designating an audit team leader who will guide the entire process. This individual bears responsibility for coordinating all subsequent activities, maintaining audit integrity, and serving as the primary point of contact. The team leader must possess both technical competence in the relevant management system and strong leadership skills to direct auditors effectively.
Defining objectives, scope, and criteria
Clear objectives answer the fundamental question of what the audit aims to accomplish. These might include determining conformity with specific standards, evaluating system effectiveness, or identifying improvement opportunities. The scope establishes boundaries by specifying which locations, processes, and time periods the audit will cover, while criteria provide the benchmarks against which auditors will measure performance.
Determining feasibility and selecting the team
Before committing resources, auditors must confirm the audit is feasible by considering factors like information availability, auditee cooperation, and resource adequacy. Once feasibility is established, the team leader assembles a group with the necessary competence, considering factors such as technical expertise, independence from audited activities, and the ability to work collaboratively.
Establishing initial contact
The audit team leader reaches out to the auditee to establish communication channels, confirm audit authority, discuss timing and team composition, request document access, and arrange logistical details. This initial contact sets the tone for the entire audit, building rapport while clarifying expectations on both sides.
Conducting document review
Document review serves as the auditor’s homework phase, providing essential context before on-site activities begin. This step allows auditors to understand the documented system, identify potential areas of concern, and prepare targeted questions for verification activities.
The review encompasses management system documents, procedures, previous audit reports, and relevant records. Auditors examine these materials to determine if the documented system meets audit criteria and to establish an overview of documented information extent. This preliminary analysis reveals possible deficiencies, omissions, or conflicts that warrant closer examination during on-site activities.
In some situations, particularly for smaller audits or when documentation is limited, this review may be deferred until on-site activities commence. However, when documentation proves inadequate, the audit team leader must inform relevant parties and decide whether to continue or suspend the audit until documentation issues are resolved.
Preparing for on-site audit activities
Thorough preparation transforms general audit objectives into specific action plans that guide on-site work. This phase bridges the gap between planning and execution, ensuring auditors arrive ready to gather evidence efficiently.
Developing the audit plan
The audit team leader prepares a detailed plan that facilitates scheduling and coordination of activities. This plan must balance comprehensiveness with flexibility, allowing for adjustments as findings emerge. Key elements include audit objectives and criteria, scope details, dates and locations, expected duration of activities, team roles and responsibilities, and resource allocation to critical areas.
The plan should be reviewed and accepted by the audit client, then presented to the auditee before on-site activities begin. Any objections require resolution among the audit team leader, auditee, and audit client before proceeding.
Assigning work and preparing working documents
The audit team leader assigns specific processes, functions, or areas to individual auditors based on their competence and the need for independence. Team members then prepare working documents such as checklists, sampling plans, and forms for recording information. These tools provide structure without restricting auditors from pursuing new lines of inquiry as information emerges during the audit.
Conducting on-site audit activities
On-site activities represent the heart of the audit process, where auditors gather and verify evidence through direct observation, interviews, and document examination. This phase demands careful execution to ensure findings rest on solid evidence.
Opening meeting
The audit formally begins with an opening meeting involving the auditee’s management and relevant personnel. This session confirms the audit plan, summarizes how activities will unfold, establishes communication channels, and provides an opportunity for questions. For small organizations, the opening meeting might be brief and informal, while larger audits require formal meetings with documented attendance.
Collecting and verifying information
Auditors gather information through multiple methods to build a complete picture. Interviews with personnel at various levels reveal understanding and adherence to procedures. Direct observation of activities verifies that practices align with documentation. Examination of records and documents provides objective evidence of system implementation. Throughout this process, auditors employ appropriate sampling techniques to collect representative information within time and resource constraints.
Only verifiable information qualifies as audit evidence, and auditors must recognize the inherent uncertainty in sampling-based audits. The confidence placed in audit conclusions depends directly on the quality and representativeness of evidence collected.
Generating audit findings
As evidence accumulates, auditors evaluate it against audit criteria to generate findings. These findings may indicate conformity or nonconformity with criteria, and when specified by audit objectives, they can identify improvement opportunities. The audit team meets periodically to review findings, ensuring consistency in evaluation and providing opportunities to adjust the audit approach as needed.
Nonconformities must be documented with supporting evidence and reviewed with the auditee to ensure accuracy and mutual understanding. Auditors should make every effort to resolve diverging opinions about evidence or findings, recording any unresolved points for later consideration.
Preparing audit conclusions
Before the closing meeting, the audit team confers to review all findings and collected information against audit objectives. They agree on conclusions while acknowledging the uncertainty inherent in the audit process, prepare any recommendations if specified, and discuss follow-up actions if included in the audit plan. These conclusions address issues such as the extent of system conformity, implementation effectiveness, and the capability of management review processes to ensure continuing improvement.
Closing meeting
The audit team leader chairs a closing meeting to present findings and conclusions in a manner that ensures understanding and acknowledgment by the auditee. Participants typically include the auditee and may also involve the audit client and other parties. The meeting covers audit findings, discusses any situations that might affect reliance on conclusions, and when appropriate, agrees on timeframes for corrective and preventive action plans.
Preparing and distributing the audit report
The audit report provides a complete, accurate, concise, and clear record of the audit. The report must include audit objectives, scope with identification of audited units and time periods, audit client identification, team leader and member identification, dates and places of on-site activities, audit criteria, findings, and conclusions.
The audit team leader holds responsibility for report preparation and contents. The report should be issued within agreed timeframes, with any delays communicated promptly to the audit client along with a new target date. After review and approval according to audit program procedures, the report is distributed to designated recipients.
The report remains the property of the audit client, and all recipients must maintain confidentiality. Team members should not disclose report contents without explicit approval from the audit client and, where appropriate, the auditee.
Completing the audit and conducting follow-up
The audit formally concludes when all planned activities are complete and the approved report has been distributed. At this point, documents pertaining to the audit should be retained or destroyed according to agreed-upon procedures and applicable requirements.
While audit conclusions often indicate the need for corrective, preventive, or improvement actions, these actions fall outside the audit scope itself. The auditee typically decides and implements such actions within agreed timeframes, keeping the audit client informed of progress. Verification of corrective action completion and effectiveness may occur as part of a subsequent audit, providing continuous improvement opportunities.
What do you think? How might your organization benefit from implementing a more structured approach to audit activities? What challenges do you anticipate when moving from informal assessments to systematic audits following ISO 19011 guidelines?
Leave a Reply