Table of contents
Quality management auditing is a vital process that helps organizations evaluate their performance, identify gaps and opportunities for improvement, and ensure compliance with relevant standards and regulations. However, conducting audits can be challenging and complex, especially when dealing with multiple management systems and diverse stakeholders. That’s why ISO 19011, a globally recognized standard for auditing management systems, can be a valuable tool for organizations that want to streamline their auditing process and achieve better results.
In this blog post, we will explore what ISO 19011 is, how it can benefit your organization, and what are the key requirements and best practices for implementing it. Whether you are an auditor, an audit manager, or an auditee, this guide will help you understand the scope, principles, and guidelines of ISO 19011 and how to apply them in your context.
What is ISO 19011?
ISO 19011 is an international standard that provides guidance on auditing management systems. It covers the entire lifecycle of auditing systems—from planning and conducting audits to evaluating and improving them. It also provides guidance on the competence and evaluation of auditors and audit teams.
ISO 19011 was first published in 2002 as a generic standard for auditing any type of management system. It was revised in 2011 to incorporate the experience and feedback from users and to align with other ISO standards. The latest version, ISO 19011:2018, was published in July 2018 and introduced some significant changes, such as:
- Adding a risk-based approach to the principles of auditing
- Expanding the guidance on managing an audit program, including audit program risk
- Establishing, implementing, monitoring, reviewing, and improving the audit program
- Initiating, preparing, conducting, reporting, and following up on audits
- Evaluating auditor competence and performance
ISO 19011 is relevant for various industries and sectors that use management systems to achieve their objectives. Some examples of management systems that can be audited using ISO 19011 are:
- Quality management systems (e.g., ISO 9001)
- Environmental management systems (e.g., ISO 14001)
- Occupational health and safety management systems (e.g., ISO 45001)
- Information security management systems (e.g., ISO/IEC 27001)
- Energy management systems (e.g., ISO 50001)
- Food safety management systems (e.g., ISO 22000)
Unveiling the Key Principles of ISO 19011
ISO 19011 is based on seven fundamental principles that underpin effective auditing and continual improvement. These principles are:
Integrity: The foundation of professionalism. Auditors should act in an ethical manner and adhere to the code of conduct.
Fair presentation: The obligation to report truthfully and accurately. Auditors should report audit findings and conclusions objectively and impartially.
Due professional care: The application of diligence and judgment in auditing. Auditors should exercise care and competence in performing audits according to applicable standards and requirements.
Confidentiality: The security of information. Auditors should respect the confidentiality of information obtained during audits and protect it from unauthorized access or disclosure.
Independence: The basis for the impartiality of the audit and objectivity of the audit conclusions. Auditors should be free from any bias or conflict of interest that could affect their judgment or credibility.
Evidence-based approach: The rational method for reaching reliable and reproducible audit conclusions. Auditors should base their decisions on verifiable and objective evidence obtained during audits.
Risk-based approach: The consideration of risks and opportunities in planning and conducting audits. Auditors should identify and assess the risks and opportunities associated with the audit objectives, scope, criteria, and program.
The Importance of ISO 19011
ISO 19011 is more than just a set of guidelines for auditing management systems. It is also a valuable tool for organizations that want to improve their performance and credibility through compliance. By adhering to ISO 19011, organizations can enjoy the following benefits and advantages:
- Improved audit quality and consistency. ISO 19011 provides a common framework and language for planning, conducting, reporting, and following up audits, ensuring that they are carried out in a systematic and objective manner. This helps to avoid bias, errors, and misunderstandings, and to increase the reliability and validity of audit results.
- Enhanced auditor competence and confidence. ISO 19011 defines the necessary knowledge, skills, and personal attributes for auditors and audit teams, as well as the criteria and methods for evaluating their competence. This helps to ensure that auditors are qualified and capable of performing their duties effectively and professionally and to boost their confidence and credibility.
- Increased stakeholder trust and satisfaction. ISO 19011 helps organizations demonstrate their commitment to quality, environmental, risk, health and safety, and other management system standards, as well as to meet the expectations and requirements of their customers, regulators, investors, employees, and other interested parties. This helps to build trust and satisfaction among stakeholders and to enhance the reputation and image of the organization.
- Reduced costs and risks. ISO 19011 optimizes an organization’s audit resources and processes, by enabling them to integrate multiple management system audits into a single audit program, and by providing guidance on how to prioritize and focus on the most significant issues and opportunities for improvement. This helps to reduce the costs and risks associated with auditing and to increase the value and benefits of audit outcomes.
Key Requirements of ISO 19011
ISO 19011 outlines the essential requirements and guidelines for managing an audit program and conducting audits. Some of these requirements are:
- Establishing the audit program objectives, scope, criteria, and methods
- Determining the audit program risks and opportunities and taking appropriate actions
- Selecting the audit team members based on their competence, availability, and impartiality
- Defining the roles and responsibilities of the audit team members and other parties involved in the audit process
- Preparing an audit plan that specifies the audit objectives, scope, criteria, schedule, resources, methods, and deliverables
- Communicating with the auditee and other relevant parties before, during, and after the audit
- Collecting and verifying audit evidence through interviews, observations, documents, records, samples, or other sources
- Evaluating the audit evidence against the audit criteria and identifying any non-conformities or opportunities for improvement
- Preparing an audit report that summarizes the audit objectives, scope, and criteria.
Connections to Other ISO Standards
ISO 19011 is not a standalone standard, but rather a guidance document that can be used in conjunction with other ISO standards that specify requirements for management systems. Some of the most common and relevant standards that are related to ISO 19011 are ISO 9001 and ISO 14001.
- ISO 19011 is a standard that provides guidelines for auditing management systems. It covers the whole process of auditing, from planning and conducting to reporting and following up. It also defines the competence requirements for auditors and audit teams. It applies to any kind of management system, whether it is related to quality, environmental, risk, health, safety, or other topics.
- ISO 14001 is a standard that specifies the requirements for an environmental management system (EMS). It helps organizations to manage their environmental impacts and enhance their environmental performance. It also helps them to comply with relevant laws and regulations regarding environmental issues.
- ISO 9001 is a standard that specifies the requirements for a quality management system (QMS). It helps organizations to ensure that they consistently provide products and services that meet customer and regulatory expectations. It also helps them to improve their customer satisfaction and loyalty.
These standards have some common principles and elements, such as continual improvement, customer focus, leadership, engagement of people, process approach, evidence-based decision-making, and relationship management. Therefore, organizations that implement more than one standard can benefit from a more integrated and consistent approach to managing their quality and environmental aspects.
ISO 19011 can be used in conjunction with ISO 14001 and ISO 9001 to conduct internal or external audits of the EMS and QMS, as well as other management systems that the organization may have in place. By following the guidelines of ISO 19011, auditors can ensure that they assess the conformity and effectiveness of the EMS and QMS against the requirements of ISO 14001 and ISO 9001, as well as provide value-added information and feedback to the organization.
How ISO 19011 Serves Different Business Roles and Functions
ISO 19011 is a guidance document that can benefit anyone who is involved in or interested in auditing management systems. Some of the specific stakeholders who can use ISO 19011 are:
Auditors and Audit Teams
ISO 19011 is used here to plan, conduct, report, and follow up audits in a systematic and objective manner, ensuring that they provide value-added information and feedback to the auditees. This group can also use ISO 19011 to evaluate and improve their own competence and performance as auditors.
Audit Program Managers
They can use ISO 19011 to establish, implement, monitor, review, and improve an audit program that meets the objectives and needs of the organization. Also, it is used to select and manage auditors and audit teams and to ensure the quality and consistency of audit activities.
Auditees
They can use ISO 19011 to understand the audit process and their roles and responsibilities in it. They can also use ISO 19011 to prepare for audits and to respond to audit findings and recommendations in a constructive and cooperative manner.
Top Management
They can use ISO 19011 to support and oversee the audit program and its outcomes. They can also use ISO 19011 to ensure that the audit program is aligned with the strategic direction and policies of the organization and that it provides relevant and reliable information for decision-making and improvement.
Other Interested Parties
They can use ISO 19011 to gain confidence in the organization’s management systems and their conformity to applicable standards and requirements. They can also use ISO 19011 to provide feedback and suggestions for improving the audit program and its results.
By utilizing ISO 19011, individuals and organizations can drive improvement in their management systems and their overall performance. ISO 19011 can help them to identify strengths and weaknesses, opportunities and risks, best practices, and areas for improvement, as well as to monitor progress and measure results.
Implementing ISO 19011: Best Practices and Tips
Implementing ISO 19011 can be a rewarding but challenging endeavor. Here are some practical advice and steps for successfully implementing ISO 19011:
Establish Clear Objectives
Before starting an audit program or an audit activity, it is important to define the purpose, scope, criteria, and expected outcomes of the audit. This will help to ensure that the audit is relevant, focused, efficient, and effective.
Adopt a Risk-Based Approach
When planning and conducting audits, it is advisable to consider the risks and opportunities associated with the auditee’s context, objectives, processes, activities, outputs, and outcomes. This will help to prioritize and allocate audit resources appropriately, as well as to address the most significant issues and opportunities for improvement.
Follow the Principles of Auditing
When performing audits, it is essential to adhere to the principles of auditing outlined in ISO 19011. These principles are integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, and risk-based approach. These principles will help to ensure that audits are conducted in an ethical, impartial, competent, respectful, factual, logical, and systematic manner.
Use Appropriate Methods and Tools
When conducting audits, it is important to use methods and tools that are suitable for the audit objectives, scope, criteria, context, risks, opportunities, information sources, and stakeholders. These methods and tools should be applied in a consistent and objective manner, ensuring that they provide sufficient and reliable audit evidence. Some examples of methods are interviews, observations, document reviews, sampling techniques, and data analysis. Some examples of tools are checklists, questionnaires, audit reports, audit records, and software applications.
30+ Audit and inspection checklists free for download.
Communicate Effectively
When conducting audits, it is essential to communicate effectively with all parties involved in the audit process. This includes establishing rapport and trust, listening actively, asking open-ended and probing questions, providing clear and constructive feedback, resolving conflicts and disagreements, and reporting audit results and recommendations. Effective communication will help to ensure that audits are conducted in a respectful and cooperative manner and that they provide value-added information and feedback to the auditees and other interested parties.
Evaluate and Improve
After completing an audit program or an audit activity, it is advisable to evaluate the performance and outcomes of the audit process. This includes reviewing the audit objectives, scope, criteria, methods, tools, results, recommendations, feedback, and follow-up actions. This will help to identify strengths and weaknesses, best practices, and areas for improvement, as well as to monitor progress and measure results. Based on the evaluation results, actions should be taken to improve the audit program or the audit activity accordingly.
How to Better Perform and Manage ISO 19011 Audits
One of the software applications that can help organizations to conduct audits using ISO 19011 guidelines is Certainty. Our software allows users to create audit checklists, assign audit tasks, collect and analyze audit data, generate audit reports, and track corrective actions. It also provides features such as risk assessment, audit scoring, audit scheduling, audit notifications, audit dashboard, and audit history. Certainty can help organizations to streamline their audit processes, improve their audit quality and consistency, and enhance their audit outcomes.
You might also be interested in:
