Background: ISO/IEC 17021-1:2015 does not specify requirements for audit time and audit duration. IAF-MD5 and e.g. ISO/TS22003 describe this in more detail. MD5 describes in §4.1 that audit duration (on-site) should not be less than 80% of the audit time indicating that planning and reporting should typically be <20% of the audit time. ISO/TS22003 is a bit clearer by mentioning that preparation (and reporting) are not included in audit time.
In practice it is noted that CAB’s consider to allocate time for reporting (else no report would be made), but time for planning and more importantly preparation of the audit team is not included (nor mentioned) and thus depends on the personal time of the team members.
Question: Could it be considered to suggest an amendment to IAF-MD5 to identify whether preparation time is required, that this be justified and recorded, and potentially indicate a ‘minimum’?
September 2016
Clause 9.1.4 of ISO/IEC 17021-1:2015 specifies the overriding requirements for audit time and requires that ‘for each client the certification body shall determine the time needed to plan and accomplish a complete and effective audit of the client’s management system.’ This is confirmed by clause 0.6 of IAF MD 5 which states that ‘notwithstanding the guidance provided by this document (MD 5) the time allocated for a specific audit should be sufficient to plan and accomplish a complete and effective audit of the client’s management system.’
It is, therefore, clear that preparation time to plan an audit is required by both ISO/IEC 17021-1:2015 and IAF MD 5.
There will be evidence from witnessed audits and reports to determine whether or not the certification body has an effective process for planning audits. Providing the certification body has demonstrated an effective process for planning audits and is allocating sufficient on site time to accomplish a complete and effective audit, there is no need for it to separately justify and record planning time.