An audit can be conducted against a range of audit criteria, separately or in combination, including but not limited to:
— requirements defined in one or more management system standards;
— policies and requirements specified by relevant interested parties;
— statutory and regulatory requirements;
— one or more management system processes defined by the organization or other parties;
— management system plan(s) relating to the provision of specific outputs of a management system
(e.g. quality plan, project plan).
This document provides guidance for all sizes and types of organizations and audits of varying scopes and scales, including those conducted by large audit teams, typically of larger organizations, and those by single auditors, whether in large or small organizations. This guidance should be adapted as appropriate to the scope, complexity and scale of the audit programme.
This document concentrates on internal audits (first party) and audits conducted by organizations on their external providers and other external interested parties (second party). This document can also be useful for external audits conducted for purposes other than third party management system certification. ISO/IEC 17021-1 provides requirements for auditing management systems for third party certification; this document can provide useful additional guidance (see Table 1).
