Background: ISO 17021-1 regulates in clause 9.2.3.1 that it’s the task of the CAB to ensure that an audit plan is established prior to each audit identified in the audit programme to provide the basis for agreement regarding the conduct and scheduling of the audit activities. 9.2.3.2 d) states that the audit plan has to cover beside others the information related remote auditing activities.
Question: Is it’s acceptable if the CAB delegate the decision related the percentage of remote audit activities to the lead auditor as long the rules for this are described, known and followed?
March 2026
It is commonly understood that the audit programme for the certification cycle is the sole responsibility of the CAB, including the planning of remote audit activities according to IAF MD4, scheme-specific requirements and CAB’s own policies and rules.
It may be the case that a Lead Auditor is given some additional tasks related to the development of the audit programme, provided that the person is recognised as sufficiently competent and authorised for these particular tasks by the CAB. Under those conditions, delegation of such tasks to the Lead Auditor could be acceptable.