IAF MD 5 §5 states that: “The CAB shall obtain an update of client data related to its management system as part of each surveillance audit. The planned audit time of a surveillance audit shall be reviewed at least at every surveillance and recertification audit to take into account changes in the organization, system maturity, etc. The evidence of review including any adjustments to the audit time of management systems audits shall be recorded.”
ISO/IEC 17021-1 § 9.1.4 states that: “The certification body shall have documented procedures for determining audit time. For each client the certification body shall determine the time needed to plan and accomplish a complete and effective audit of the client’s management system.”
We are facing the following practice of a MS CB: audit time is determined for one client for the whole certification cycle (i.e. initial + 2 surveillances audits) through 3 years contract. Changes concerning the client (number of persons, organization, QMS, direction, etc.) which might affect audit time are in some cases, not known in advance of a surveillance audit, and in this case the audit time is calculated based on previous information. The CB collects this information during the surveillance audit, and, if it is felt that audit time for the surveillance was not enough, plans and performs a complementary audit (this happens rather rarely).
Question: is this practice, i.e. adjusting the audit time after the surveillance, acceptable and fulfilling ISO 17021-1 § 9.1.4?
If the answer is yes, we would expect the CB to provide evidences that auditors team has collected all necessary information, and that it has performed adjustment of the audit time independently of the review of the content of the report.
If the answer is no, the CB is required to make an update of clients’ information before the planning of each audit (surveillance or recertification) and to adjust, if necessary, the audit time the audit.
September 2019
As the case has been presented, the answer is YES, occasionally.
Obtaining such information prior to the audit would be preferred as this allows the CB to make adjustments in advance, however obtaining the information during the surveillance audit is acceptable as long as it is acted upon by the CB.
Contracts should include the ability to make time adjustments.
As mentioned in the clause 8.5.3 of ISO 17021-1:2015:
Certification clients are obliged by the contractual agreement with the CAB to notify the CAB on significant changes. This requirement would at least allow a CAB in case of major changes to adjust audit time for a surveillance audit in the planning phase or even lead to extraordinary audits prior to the conduct of a regular surveillance audit.