Some of the wording of the standard ISO/IEC 17021-1, related to stage I and stage II, having to be considered as one audit, conducted in two stages (9.3.1.1) cause some interpretation problems.
It is stated in a NOTE under 9.3.1.2.1 that “Stage 1 does not require a formal audit plan (see 9.2.3).”
Secondly, 9.2.3.1 states that “The certification body shall ensure that an audit plan is established prior to each audit identified in the audit programme…”.
Related questions are the following:
- What is required as the audit plan for a stage I? Is a telephone conversation acceptable?
- Since the stage II audit is not a separate audit, a formal audit plan is not required either?
- Or does this mean that the stage II audit (or the overall «initial audit») plan has to be prepared prior to stage I (i.e. prior to «the initial audit»), maybe in a more generic way, but with the objective that the stage I provides further focus/adaptation to this plan (ref. 9.3.1.2.2.f)?
- Do the requirements for 9.2.3 (and more specifically 9.2.3.2) apply to the audit plan for a stage II (even though that is not a separate audit)? Particular attention is requested to the requirement in 9.2.3.2.a (objectives) which are quite different for a stage I (9.3.1.2.2) from a stage II ‘audit’ (9.3.1.3).
- Can it be required that the CAB prior to the stage I at least will have to inform the client that prior to stage II an audit plan is prepared in line with the requirements of 9.2.3?
- A note normally does not contain requirements; how then can a note make requirements not applicable (as is the case here)?
September 2016
The sequence of clauses in ISO/IEC 17021-1 is as follows :
- § 9.1.3.2 and 9.3.3.1 : the initial audit (part of the audit programme)is a two-stage audit
- § 9.2.3.1: … an audit plan is established prior to each audit identified in the audit programme to provide the basis for agreement regarding the conduct and scheduling of the audit activities.
- § 9.2.3.2: “The audit plan shall be appropriate to the objectives and the scope of the audit.”
- § 9.2.3.2 and 9.2.3.3: give the elements to be found in each formal audit plan for each audit; It may come that some elements are not applicable/ necessary for stage 1.
Then an audit plan is required before the initial audit (then before stage I) so that the organisation to be audited is aware of what is to be audited and when (“agreement regarding the conduct and scheduling of the audit activities”). The CB may choose to draft one unique plan for stage I and II, in the form required per § 9.2.3.2 and 9.2.3.3, the plan addressing all elements of 9.3.1.2.2 and 9.3.1.3. If there is only one plan, it has to be reminded to the client that the plan may be adjusted after stage 1, following the conclusions of stage I.
If the CB chooses to have a plan in 2 parts, one for stage I, and then, after stage I, one specific for stage II it may accommodate the form of the stage I plan, as all points of § 9.2.3.2 and 9.2.3.3 may not apply. What is captured in the NOTE, is not to say that a plan is not required but is only waiving the formal aspects of the plan.From there answers to questions :
- A plan (whether separate or not) is required but does not have to be formal, focusing on the objectives stated in § 9.3.1.2.2. If the plan is specific to stage 1 (where not the full team is present and not all elements are audited) it may waive some points of § 9.2.3.2 (c-d-e-f) as not yet identified at this stage, and of 9.2.3.3 (b-c). As does not have to be formal maybe an email or a phone call is acceptable. Records on what has been agreed with the client needed to demonstrate implementation of requirements (e.g. 9.2.3.1)
- See above: stage II plan is required, whether specific or integrated in the global “initial audit” plan
- An overall plan may be prepared before stage I (in other words the audit plan communicated before stage 1 may include the elements of stage 2), with the information known by the CB at this stage , to be reviewed after stage I conclusions
- All apply
- Yes, it has to be required in the case that the plan is not drafted in once
- According to ISO, Information marked as “NOTE” is intended to assist the understanding or use of the document. The NOTE intends to waive the “formal aspects” of the plan and not the full requirement