Performing an Audit

Auditing is important in maintaining trust and efficiency in a company’s management system. An organization must foster a culture of continual improvement. They will be making worthwhile efforts for success, whether it be planning, scheduling, creating checklists, or carrying out or following up on audits, if they can pinpoint the areas to be audited. You can prevent inconsistencies between procedures and team member unavailability for the audit by creating a plan and schedule in advance. An audit plan assists your teams in organizing their operations and work properly. Scheduling audits will ensure that no procedure or area is overlooked.

Future audits should be announced to all departments as a courtesy so that they can be ready with the necessary documentation and other resources, such as evidence of the accomplished action plans, for the reviewer. Except in cases when there is a surprise audit of questionable behavior, your staff has every right to...

An overview of the steps for performing an audit as per ISO 19011 guidelines

There are six main steps for conducting an audit, as listed here:

1. Initiating the audit:
   • Establishing initial contact with the auditee
   • Determining the feasibility of the audit
2. Preparing the audit:
   • Conducting a document review
   • Planning the audit
   • Task allocation to the audit team
   • Framing of documented information
3. Conducting audit activities:
   • Designating duties to guides and observers
   • Administering the opening meeting
   • Communication between the auditors and auditees and among the audit team members during the audit
   • Examining the availability and accessibility of audit information
   • Documented information examination while conducting the audit
   • Gathering and verifying information
   • Framing audit findings
   • Finalizing audit conclusions and conducting the closing meeting
4. Preparing and distributing the audit report
5. Completing the audit
6. Conducting an audit follow-up

Steps 1 to 3 are explained in this chapter...

Initiating the audit

The auditor must start the audit by getting in touch with the process owner and making sure the audit is possible. When doing an audit, it’s better to make sure someone is there to present evidence than to try to catch them by surprise. It’s also important to note that the audit team leader is the one who is ultimately responsible for how an audit is done.

Initiating an audit usually involves two steps, as mentioned here:

1. Establishing initial contact with the auditee: To establish contact with the auditee, the auditor and auditee decide on the communication channels. Both parties agree on the objectives, scope, methods, and composition of the audit team, which may include observers, guides, technical experts, or other roles. Any problems with the composition should be worked out at this point. The audit team intends to see relevant documents and records so that they can plan the audit. The laws and regulations that apply are considered...

Preparing audit activities

The administration of the audit operations is covered in depth in the audit activities of ISO 19011. This methodical technique can assist in ensuring that your audits are efficient and reliable and strengthen the audit system. The individual steps in the process are detailed here:

1. Performing the document review: After the initiation process, the required documents must be reviewed. This helps in determining the extent of the system documentation for the audit and to analyze any gap which decides the audit plan in the following step. These documents include but are not limited to the following:
   • Information Security Management System (ISMS) scope and objectives
   • Information Security (IS) policy
   • ISMS risk register
   • Statement of Applicability (SoA)
   • Legal records
   • Monitoring and measurement records
   • Records of corrective actions
   • Management reviews

The management system’s documented information must be analyzed in order to comprehend the auditee’...

Conducting audit activities

The steps in the process of conducting an audit are elaborated on as follows. There are no rules to adhering to this sequence but it can be tweaked according to the characteristics of specific audits:

1. Assigning roles and responsibilities to guides and observers: The presence of guides and/or observers is agreed upon by the audit team and auditee, following which they may accompany the audit team. They do not form part of the decisions during the audit and the audit team leader is the ultimate decision-maker who can at any point in time discontinue guides/observers if they interfere with audit activities. Guides usually help the audit team members arrange interviews with specific personnel, access specific locations in the organization, abide by the organizational rules of health, safety, or access, or make any general clarifications.
2. Conducting the opening meeting: The main purpose of the opening meeting is to discuss the audit plan and arrangements...

Summary

Everyone who conducts or participates in audits or audit programs can use ISO 19011. It is designed for individuals involved with supervising audit program administration and evaluating audit participants. ISO 19011 is a valuable resource for anyone tasked with improving an audit program. It is designed for those who administer audit programs or conduct audits (internal or external) of management systems.

There are six main steps established by ISO 19011 for the conduct of an audit, starting from initiating the audit to conducting follow-ups after the audit is over. Steps 1 through 3 were explained in this chapter. Audit initiation takes place first, between the auditee and the audit team. This is followed by preparing for the audit by reviewing the documents presented by the auditee, preparing the audit plan, assigning work to the audit team, and the preparation of documented information according to the work assigned. Conducting audit activities starts by defining the...