DURATION OF MANAGEMENT SYSTEMS AUDIT
1.
DEFINITIONS
2.
APPLICATION
3.
METHODOLOGY FOR DETERMINING AUDIT DURATION
4.
SURVEILLANCE
5.
RECERTIFICATION
6.
FACTORS FOR ADJUSTMENTS OF AUDIT DURATION
7.
TEMPORARY SITES
8.
MULTI-SITE AUDIT DURATION
I-25cl
Annex A - Quality Management Systems (ISO 9001, ISO/TS 29001, Technical Regulation of Customs Union - TR CU 032
2013), EMS and OH&S MS
Annex B - Complexity Categories of environmental aspects
Annex C - Complexity Categories of occupational health and safety risks
1.
1.1
DEFINITIONS
Audit Duration
Audit duration for all types of audits is the effective time measured in auditor days
required to carry out auditing activity.
1.2
Auditor Day
The duration of an auditor day is 8 hours and does not include travel time or lunch.
1.3
Effective Number of Personnel
The effective number of personnel consists of all full time personnel involved within the
scope of certification including those working on each shift. Non-permanent (seasonal,
temporary and contracted personnel) and part time personnel who will be present at the
time of the audit shall be included in this number.
1.4
Temporary Site
A temporary site is one set up by an organization in order to perform specific work or a
service for a finite period of time and which will not become a permanent site. (eg. a
construction site).
1.5
Complexity Category
The provisions specified in this document are based on five primary complexity
categories of the nature, number and gravity of the environmental aspects of an
organization (EMS) or on five complexity categories of occupational health and safety
risks (OH&S MS) that fundamentally affect the auditor time.
2.
2.1
APPLICATION
General
In determining the audit time C-IMS Certification considers among others the following
aspects:
a) requirements of the relevant management system standard or requirements based on
modules of CONTSTAND scheme (see document I-07);
b) size and complexity;
c) technological and regulatory context;
APPROVED:
14.01.2014
C-IMS Certification
page 1 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
I-25cl
d) any outsourcing of any activities included in the scope of the management system;
e) results of any prior audits;
f) number of sites and multi-site considerations;
g) risks associated with products, processes or activities of the organization;
h) when performing audits of integrated management system.
C-IMS Certification does not apply specific criteria for a specific certification scheme.
In certification of management systems against standards ISO 9001, ISO/TS 29001, ISO
14001 and OHSAS the time spent by any team member that is not assigned as an auditor
(i.e. technical experts, translators, interpreters, observers and auditors-in-training) is not
included into the above established audit time. In an assessment of a QMS based on
modules of CONTSTAND scheme the time spent by a technical expert is included into
the audit time.
NOTE The use of translators and interpreters can necessitate additional audit time.
2.2
Audit Duration
Audit duration for all types of audits includes on site time at a client's premises and time
spent off-site carrying out planning, document review, interacting with client personnel
and report writing.
It is expected that the audit duration involved in these combined activities (irrespective of
whether the activities are undertaken off-site or on-site) shall not typically reduce the
total on-site audit duration to less than 80% of the time shown in Annex A, Tables 1A
(QMS - ISO 9001:2008 and ISO/TS 29001:2010 or a module of CONTSTAND scheme)
and Tables 2A (EMS and OH&S MS). This applies to initial, surveillance and
recertification audits.
Where additional time is required for planning and/or report writing, this will not be
justification for reducing on-site audit duration for any audit.
2.3
Auditor Day
Tables 1A and 2A present audit durations calculated in auditor days on the basis of 8
hours per day. To comply with local legislation for lunch breaks and working hours it
may be needed to adjust the number of days, to achieve the same total number of auditing
hours presented in Tables 1A and 2A.
The number of auditor days allocated shall not be reduced at the planning stages by
programming longer hours per working day.
2.4
Effective Number of Personnel
The effective number of personnel is used as a basis for the calculation of audit duration.
Dependent upon the hours worked, part time personnel numbers may be reduced and
converted to an equivalent number of full time personnel. Appropriate reduction should
be made to the temporary unskilled personnel who are employed in considerable numbers
in some regions. Appropriate reduction of number of personnel also should be made
where significant proportion of staff carry out a similar simple function for instance:
transport, line work, assembly lines, etc.
C-IMS Certification shall agree with the organization to be audited the timing of the audit
in form CF-02, which will best demonstrate the full scope of the client activities.
APPROVED:
14.01.2014
C-IMS Certification
page 2 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
I-25cl
Note: Timing of the audit to best demonstrate the full scope may include the need to audit outside normal
working hours or suit the shift personnel employed.
3
3.1
METHODOLOGY FOR DETERMINING AUDIT DURATION
The methodology used as a basis for the calculation of audit duration of an initial audit
(stage 1 + stage 2) involves the utilization of tables presented in Annex A, Annex B and
Annex C for management systems audits. Tables 1A (for QMS) is based solely upon the
effective number of personnel. Tables 2A (for EMS and OH&S MS), besides the
effective number of personnel, is based also on the environmental complexity of the
organization or on occupational health and safety risks and does not provide minimum or
maximum duration.
Annex B and Tables 2B describe complexity categories of environmental aspects and
their links with business sectors.
Annex C and Tables 2C describe complexity categories of occupational health and safety
risks and their links with industrial sectors.
3.2
Using a suitable multiplier, the same tables may be used as the base for calculating audit
duration for surveillance audits (clause 4) and recertification audits (clause 5).
3.3
For each client C-IMS Certification shall determine the time necessary for planning and
fulfillment of complete and effective audit of the client’s MS. Experience has shown that
apart from the number of personnel, the time required to carry out an effective audit
depends upon other factors for QMS as well as for EMS and OH&S MS. These factors
are described in clause 6. The audit time and justification for this determination are
written down in KF-07 q/e/hs/og/i “Application review”.
3.4
This instruction lists the provisions which should be considered when establishing the
amount of time needed to perform an audit. All factors shall be examined by C-IMS
Certification during the contract review process for their potential impact on the audit
duration regardless of the audit type.
3.5
For QMS audits, where product or service realization processes operate on a shift basis,
the extent of auditing of each shift by C-IMS Certification depends on the processes done
on each shift, and the level of control of each shift that is demonstrated by the client. The
justification for not auditing each shift shall be documented in “Contract review sheet”
for QMS (form KF-07q).
3.6
For an EMS and OH&S MS audit it is appropriate to base audit duration on the effective
number of personnel of the organization and the nature, number and gravity of the
environmental aspects and risks, which are typical in this industry sector. Then the audit
duration should be adjusted based on any significant factors that uniquely apply to the
organization to be audited. Where product or service realization processes operate on a
shift basis, the extent of auditing EMS and OH&S MS of each shift depends on the
processes done on each shift, and the level of control of each shift that is demonstrated by
the client. The justification for not auditing each shift shall be documented in “Contract
review sheet” for EMS and OH&S MS (forms KF-07e/hs).
3.7
The time, indicated in Tables 1A and 2A, is the starting point for estimating the duration
of an initial audit (Stage 1 + Stage 2).
APPROVED:
14.01.2014
C-IMS Certification
page 3 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
I-25cl
4
4.1
SURVEILLANCE
During the initial three year certification cycle, surveillance audit duration for a given
organization should be proportional to the time spent on initial certification audit (stage 1
+ stage 2), with the total amount of time spent annually on surveillance being about 1/3 of
the time spent on the initial certification audit. The appropriate update of client data
related to certification (changes in the organization, system maturity, etc.) shall be
applied for planning of every surveillance audit. The evidence of review including any
adjustments to audit duration shall be recorded.
5
5.1
RECERTIFICATION
The duration of the recertification audit should be calculated on the basis of the updated
information of the client and is normally approximately 2/3 of the time that would be
required for an initial certification audit (Stage 1 + Stage 2) of the organization if such an
initial audit were to be carried out at the time of recertification (i.e. not 2/3 of the original
initial certification audit duration). The audit duration shall take into account the outcome
of the review of the system performance. The review of system performance does not
itself form part of the audit duration for recertification audits.
6
6.1
FACTORS FOR ADJUSTMENTS OF AUDIT DURATION
The starting point for determining audit duration shall be identified based on the effective
number of personnel, then adjusted for the significant factors applying to the client to be
audited, and attributing to each additive or subtractive factor, which is to modify the base
figure.
Factors affecting the audit duration are described in Annex D. The reduction of the audit
duration shall not exceed 30% of time determined according to Tables 1A and 2A.
Calculation of the audit duration of integrated management systems is conducted in
concordance with requirements of procedure PR/27 “Integrated management system
audit”, in this case the audit duration can be reduced by 20%.
The total reduction of the audit duration taking into account the above-stated factors can
be not more than 50% of the normative figures. In every situation the basis for
determination of the audit duration including adjustments made shall be recorded. The
reasons for adjustment of the audit duration shall be written down by the certification
manager in the application review sheet KF-07q/e/hs/i and in Appendix to form CF-02
for all audit types.
6.2
6.3
7
7.1
TEMPORARY SITES
In situations where the certification applicant or certified client provides their product(s)
or service(s) at temporary sites, such sites shall be incorporated into the audit
programmes.
7.2
Temporary sites could range from major project management sites to minor
service/installation sites. The need to visit such sites and the extent of sampling should be
based on an evaluation of the risks of the failure of the QMS to control product or service
output or on an evaluation of the risks of the failure of the EMS and OH&S MS.
Typically audits of temporary sites are performed on-site. However, the following
methods could be considered as alternatives to replace some on-site audits:
- Interviews or progress meetings with the client and/or its customer in person;
APPROVED:
14.01.2014
C-IMS Certification
page 4 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
7.3
I-25cl
Document review of temporary site activities;
In each case, the method of audit should be fully documented and justified in terms of its
effectiveness.
8.
MULTI-SITE AUDIT DURATION
Requirements to multi-site audits are described in instruction I-11 “Multi-site certification”. In
this case the instruction I-11 shall be used to select sites to be sampled prior to applying the
present instruction to each selected site.
APPROVED:
14.01.2014
C-IMS Certification
page 5 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
I-25cl
ANNEX A
Table 1A - Quality Management Systems (ISO 9001:2008; ISO/TS
29001:2010, Technical Regulation of Customs Union TR CU 032/2013)
Relationship between effective number of personnel and audit duration
(Initial Audit only)
Effective Number of
Personnel
Audit Duration
Stage 1 + Stage 2 (days)
Effective Number of
Personnel
1-5
6-10
11-15
16-25
26-45
46-65
66-85
86-125
126-175
176-275
276-425
426-625
1.5
2
2.5
3
4
5
6
7
8
9
10
11
626-875
876-1175
1176-1550
1551-2025
2026-2675
2676-3450
3451-4350
4351-5450
5451-6800
6801-8500
8501-10700
>10700
Audit Duration
Stage 1 + Stage 2
(days)
12
13
14
15
16
17
18
19
20
21
22
Follow progression above
Table 2A - Environmental Management Systems and Occupational Health &
Safety Management Systems
Relationship between effective number of personnel, complexity and audit duration
(Initial Audit only)
Effective Number of
Personnel
Audit Duration
Stage 1 + Stage 2
(days)
High
1-5
6-10
11-15
16-25
26-45
46-65
66-85
86-125
126-175
176-275
276-425
426-625
APPROVED:
14.01.2014
3
3.5
4.5
5.5
7
8
9
11
12
13
15
16
Med
Low
Complexity
2.5
2.5
3
3
3.5
3
4.5
3.5
5.5
4
6
4.5
7
5
8
5.5
9
6
10
7
11
8
12
9
Effective Number of
Personnel
Lim
2.5
3
3
3
3
3.5
3.5
4
4.5
5
5.5
6
Audit Duration
Stage 1 + Stage 2
(days)
High
626-875
876-1175
1176-1550
1551-2025
2026-2675
2676-3450
3451-4350
4351-5450
5451-6800
6801-8500
8501-10700
>10700
C-IMS Certification
17
19
20
21
23
25
27
28
30
32
34
Med
Low
Complexity
13
10
15
11
16
12
17
12
18
13
19
14
20
15
21
16
23
17
25
19
27
20
Follow progression above
Lim
6.5
7
7.5
8
8.5
9
10
11
12
13
14
page 6 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
I-25cl
ANNEX B
Complexity categories of environmental aspects
High -environmental aspects with significant nature and gravity (typically manufacturing or
processing type organizations with significant impacts in several of the environmental aspects);
Medium -environmental aspects with medium nature and gravity (typically manufacturing
organizations with significant impacts in some of the environmental aspects);
Low - environmental aspects with low nature and gravity (typically organizations of an assembly
type environment with few significant aspects);
Limited -environmental aspects with limited nature and gravity (typically organizations of an
office type environment);
Special - these require additional and unique consideration at the audit planning stage.
Table 2A covers the above four top complexity categories: high, medium, low and limited.
Table 1B provides the link between the five complexity categories above and the industry sectors
that would typically fall into that category.
Table 1B
Complexity category
Business sector
High
Mining and quarrying
Oil and gas extraction
Tanning of textiles and clothing
Pulping part of paper manufacturing including paper recycling
Oil refining
Chemicals and pharmaceuticals
Primary productions - metals
Non-metallics processing and products covering ceramics and cement.
Coal based electricity generation
Civil construction and demolition
Hazardous and non hazardous waste processing e.g. incineration
Effluent and sewerage processing
Fishing/farming/forestry
Textiles and clothing except for tanning
Manufacturing of boards, treatment/impregnation of wood and wooden
products
Paper production and printing excluding pulping
Non metallics processing and products covering glass, clay, lime etc.
Surface and other chemically based treatment for metal fabricated
products excluding primary production
Surface and other chemically based treatment for general mechanical
engineering
Medium
APPROVED:
14.01.2014
C-IMS Certification
page 7 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
I-25cl
Production of bare printed circuit boards for electronics industry
Manufacturing of transport equipment - road, rail, air, ships
Non coal based electricity generation and distribution
Gas production, storage and distribution (note extraction is graded
high)
Water abstraction, purification and distribution including river
management (note commercial effluent treatment is graded as high)
Fossil fuel whole sale and retail
Food and tobacco - processing
Transport and distribution - by sea, air, land
Commercial estate agency, estate management, industrial cleaning,
hygiene cleaning, dry cleaning normally part of general business
services
Recycling (utilization), composting, landfill (of non hazardous waste)
Technical testing and laboratories
Healthcare/hospitals/veterinary
Leisure services and personal services excludes hotels/restaurants
Low
Hotels/restaurants
Wood and wooden products excluding manufacturing of boards,
treatment and impregnation of wood
Paper products excluding printing, pulping and paper making
Rubber and plastic injection moulding, forming and assembly –
excludes manufacturing of rubber and plastic raw materials which are
part of chemicals
Hot and cold forming and metal fabrication excluding surface treatment
and other chemical based treatments and primary production
General mechanical engineering assembly excluding surface treatment
and other chemical based treatments
Wholesale and retail
Electrical and electronic equipment assembly excluding manufacturing
of bare printed circuit boards
Limited
Corporate activities and management, HQ and management of holding
companies
Transport and distribution - management services with no actual fleet
to manage
Telecommunications
General business services except commercial estate agency, estate
management, industrial cleaning, hygiene cleaning, dry cleaning
Education services
SPECIAL CASES
Nuclear
Nuclear electricity generation
Storage of large quantities of hazardous material
Public administration
Local authorities
Organizations with environmental sensitive products or services
APPROVED:
14.01.2014
C-IMS Certification
page 8 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
I-25cl
Financial institutions
C-IMS Certification takes into consideration that not all organizations in a specific sector will
always fall in the same complexity category. For example, even though many businesses in the
chemical sector should be classified as "high complexity", an organization which would have
only a mixing free from chemical reaction or emission and/or trading operation could be
classified as "medium" or even "low complexity".
Table 2A does not cover the "special complexity" category for EMS. In these special cases the
audit duration shall be calculated and justified on an individual basis.
APPROVED:
14.01.2014
C-IMS Certification
page 9 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
I-25cl
ANNEX C
Complexity Categories of occupational health and safety risks:
Limited – This risk is considered acceptable. No further action is necessary other than to ensure
that the controls are maintained;
Low – No additional control is required unless it can be implemented at very low cost.
Vulnerable persons need extra protection;
Medium – The risk reduction measures are required within a defined time period. Arrangements
should be made to ensure that the control is maintained, particularly if the risk levels are
associated with harmful consequences;
High – The risk reduction measures are required urgently. Arrangements should be made to
ensure that the control is maintained, particularly if the risk levels are associated with extremely
harmful consequences and very harmful consequences;
Very high – The work activity should be halted until the risk is reduced to an acceptable level. If
it is not possible to reduce the risk the work should remain prohibited.
Table 1C provides the link between the industry sectors and their complexity categories.
Table 1C
Complexity category
Business sector
Very high
Nuclear
Nuclear electricity generation
Storage of large quantities of hazardous material
Organizations with products or services of very high risk for
occupational health and safety
High
Extractive industry and quarrying (including oil and gas exploration)
Tanning of textiles and clothing
Production of coke and refined oil products
Chemicals, chemical products and fibers. Pharmaceuticals
Main metals
Shipbuilding
Aerospace industry
Power supply (generation and distribution)
Gas supply (generation and distribution)
Construction
Health care and social activity
Hospitals
Effluent and sewerage processing and waste (garbage) disposal
APPROVED:
14.01.2014
C-IMS Certification
page 10 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
Medium
Low
Limited
I-25cl
Farming
Fishing
Food products, beverages and tobacco. Textiles and textile
clothing/laundering and dry cleaning
Wood and wooden products
Cellulose and paper
Paper products
Non metallic mineral products
Rubber and plastic products
Manufacture of non metallic products
Manufacture of metallic products
Machinery and equipment
The above-indicated including surface treatment
Electrical and optical equipment
Electronic and electro-vacuum devices, other (micro) electronic
components
Other transport equipment
Manufacturing Not Elsewhere Classified
Utilization (dismantling and separation)
Water supply (including water abstraction and distribution)
Education
Publishing Companies
Printing Companies
Maintenance and repair of motor vehicles and motorcycles
Wholesale and Retail Trade
Transport and storage
Sales
Hotels and Restaurants
Post and telecommunications
Financial Intermediation
Information Technology
Engineering Services
Research and development
Public Administration
Leisure services, cultural and sport activity
Real Estate
Renting
Other professional services
Other Social Services
Table 2A does not cover the "very high" category for OH&S MS. For this category the audit
duration shall be calculated and justified on an individual basis.
APPROVED:
14.01.2014
C-IMS Certification
page 11 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
I-25cl
ANNEX D
Item
No.
1
Factors affecting the MS audit duration
Magnitude of
the factor in %
3
The organization size:
- the physical size of the client organization (large or small);
- the number of people involved in the activities of the client organization in relation
to the scope of the audit including, when relevant, part-time, seasonal contract and
casual personnel;
- complicated logistics;
- the number of sites to be audited.
2
3
3
The organization location:
the level of central control;
the commonalities of processes and products;
the linked processes;
seasonal and climate conditions.
Complexity of the client’s organization and management system:
3
- accessibility to management system documentation and records;
- structure of the management system, including levels of controls, reporting and
internal communication;
- the number and range of people representing various levels within the client
organization to be interviewed;
- activities that require visiting temporary sites;
- complexity of the interaction between the client organization’s activities;
- prior knowledge about the client organization;
- activities which are repetitive;
- changes to the client organization;
- the control and type of shift work;
- the client organization’s occupational health and safety and security conditions.
4
Technological and regulatory context:
3
- the complexity and amount of applicable regulations (e.g. food, pharmaceutical,
aerospace, nuclear power industries);
- the complexity of the technology used in the client organization;
- the complexity of design processes;
- the level of automation.
5
Activities included in the scope of the management system:
3
- the applicable requirements of the management system standard, including
considerations of eligible exclusion of requirements;
- the scope of certification with respect to product, services, activities, processes and
sites, including consideration of their complexity;
- the activities outsourced by the client organization (e.g. extent, level of control,
significance, complexity).
6
Maturity and effectiveness of the management system:
3
- the results and effectiveness of any prior audits performed by the certification body;
- the results and effectiveness of any prior external audits conducted by parties other
than the certification body;
- the effectiveness of the client organization’s internal audit and management review
processes;
- the level of understanding and commitment to the management system within the
client organization;
- existing certified management systems;
- reliable public information (e.g. media reports, customer feedback, regulatory
information or sanctions);
- the period for which the management system has been in operation;
- the capacity of the client organization to achieve its management system objectives.
7
Risks associated with the products, processes or activities of the client
organization:
APPROVED:
14.01.2014
C-IMS Certification
3
page 12 of 13
DURATION OF MANAGEMENT SYSTEMS AUDIT
I-25cl
- the existence of hazardous processes, materials or work environment (e.g.
sterilization with radiation, chemicals used in leather treatment process);
- the risk of non-conformities and their impact (e.g. in health service, food production,
air traffic control);
- the level of vulnerability within processes and operations.
8
3
Culture:
- different cultures;
- the need for interpretation and translation.
9
3
Composition of the audit team:
- the need for translators or interpreters;
- the need for technical experts.
10
Other factors
Total
11
Audit of IMS (see PR-27)
3
Reduction/increase
not more than 30%
Reduction
not more than 20%
Reduction
not more than 50%
Total
Each factor reduces or increases the initial duration of the audit by 3%.
After considering and summing up all factors affecting the reduction or increase of the audit
duration, the final duration of the audit is calculated. The maximum value can amount to 30% of
the initial man-days determined from tables 1A and 2A of Annex A.
When performing an Integrated Management System audit, the calculation of the audit duration
shall be conducted in concordance with requirements of PR-27, where the maximum reduction
of the audit duration can amount to 20%.
Then the quantitative values of factors affecting the audit duration shall be summarized in %
expression and the total value of the audit duration is calculated in %.
The maximum reduction of IMS audit time taking into account all the factors can amount to
50%.
APPROVED:
14.01.2014
C-IMS Certification
page 13 of 13