IAF MD 5:2015 clause 4.4:”The CAB shall provide the audit time determination and the justification to the client organization as a part of the contract and make it available to its Accreditation Body upon request”.
To what extent does the information supplied to the client need to be client specific? See below examples:
Question part 1; Which of below listed alternatives can be accepted as audit time determination and justification to be provided to the client organization as part of the contract-
- To state the total days offered and refer to IAF MD 5:2015 and the factors specified in the document? Example “Audit time has been calculated in accordance with requirements in the document IAF MD5:2015, available at iaf.nu”
- To state the total days offered and refer to IAF MD 5:2015 and the factors specified in the document, complemented with information that a more detailed explanation will be included in the audit report of Stage 1?
- To state the total days offered and include a general explanation on the calculation method with examples of factors that may potentially be used as a basis of addition/reduction for audit time calculation?
- To state the total days offered and include information on the number of personnel used, the complexity level used and a specification of the actual factors that has affected the audit time calculation of the client?
- The full man-day calculation shall be included, fully traceable with adjustments in percentages etc. (This “determination and justification” would in this case have the same level of detail as the one available to the Accreditation Body at assessment)
Question part 2; Is it acceptable to state in the contract that, due to confidentiality reasons, the information will be made available for the client upon request?
September 2017
This question was subsequently discussed at the IAF Technical Committee in Vancouver October 2017, the recorded decision was: –
Consensus of the IAF TC: Decision Log: 17/10/02
MD5 clauses 2.3.2 and 4.4
The justification included in the written contract must be enough for the client to understand the calculation and may not include all of the calculations the CAB used to determine the audit time (which can be reviewed by the AB within the CAB records).
The detail in the contract may include; determination and number of effective personnel, the number of audit days, and the factors without the percentage that were applied based on the information supplied by the organization seeking certification, for all of the requirement documents (e.g. IAF MD 11).
It is not acceptable for the contract to just refer to IAF MD 5 to understand the audit time determination.
Note; the contract may include annexes that include this level of detail. As long as the annex is part of the contract this would be acceptable in meeting IAF MD 5.Additional Discussion
The reason for the new requirements in IAF MD 5 was to make sure the CAB was open and transparent with the clients, as well as the ABs (upon request). And to prevent unfair competition by withholding information from the client.
If we focus too much on the numbers, we have lost the intent as it relates to the value of the audit and it will be lost on the client. We question getting too prescriptive.
There is a need to build awareness with the clients to understand the outliers and the jeopardy that has on the certification. The information should be enough to understand the outliers.