Typical process flow for third party audit and certification process (acc.

to ISO 17021:2011)

Initial certification decision / Expire of

Three (3) years certification cycle

Recertification decision certification

On-going surveillance activities

1. Client submits 3. Surveillance audits 4. Recertification

First surveillance to take place within Recertification activities to be
application for initial 2. Initial certification
12 months of stage 2 audit, then at completed before expire of
certification least annually.
certification.

2.1 Select and

1.1 Exchange of appoint competent
information between stage 1 audit team 3.1 / 4.1 Exchange of information between client and certification body
client and (e.g. change to scope); determine if changes to audit programme
certification body required
2.2 Plan for stage 1
audit
1.2 Review of 4.2 Recertification
application for audit planning
certification 2.3 Perform stage 1
audit

1.3 Identification
areas of concern and
2.4 Resolve stage 1 3.2 / 4.3 Confirm audit programme and communicate to client
request for additional
information (if areas of concerns (if
applicable) applicable)

3.3 / 4.4 Confirm/appoint competent audit team

2.5 Confirm/appoint
1.4 Development of
competent stage 2
audit programme
audit team

1.5 Proposal for 2.6 Plan for stage 2 3.4 Plan for 4.5 Plan for
certification and audit(s) surveillance audit recertification audit
confirmation of audit
programme
4.6 Perform
2.7 Perform stage 2 3.5 Perform
recertification
audit(s) surveillance audit
audit(s)
1.6 Client and
certification engage
in formal 2.8 Resolve stage 2 3.6 Resolve 4.7 Resolve
arrangements for areas of concerns (if surveillance audit recertification audit
certification applicable) areas of concerns (if areas of concerns (if
applicable) applicable)

2.9 Initial certification 3.7 Surveillance audit 4.8 Recertification

audit conclusions conclusions audit conclusions

2.10 Initial 4.9 Recertification

3.8 Independent
certification decision decision
review of
certification (if
required)

2.11 Granting of 4.10 Granting of

initial certification recertification and
and inssuance of issuance of
certification certification
documents documents

Confirm or adjust audit programme and appropriate audit follow-up and surveillance activities
including frequency and duration. Specil audits must also be taken into consideration.
Guidelines for auditing managements (ISO 19011:2011) -
Process flow for the management of an audit programme, figure 1

5.2 Establishing the audit programme objectives Plan

5.3 Establishing the audit programme

5.3.1 Roles and responsibilities of the person managing the

audit programme

5.3.2 Competence of the person of the person managing the

audit programme

5.3.3 Establishing the extent of the audit programme

5.3.4 Identifying and evaluating audit programme risks

5.3.5 Establishing procedures for the audit programme

5.3.6 Identifying audit programme resources

Do
5.4 Implementing the audit programme

5.4.1 General
Competence and
5.4.2 Defining the objectives, scope and criteria for an evaluation of auditors
individual audit (Clause 7)

5.4.3 Selecting the audit methods

5.4.4 Selecting the audit team members

5.4.5 Assessing responsibility for an individual audit to the Performing an audit

audit team leader (Clause 6)

5.4.6 Managing the audit programme outcome

5.4.7 Managing and maintaining audit programme records

Check
5.5 Monitoring he audit programme

Act
5.6 Reviewing and improving the audit programme
Guidelines for auditing managements (ISO 19011:2011) -
Typical audit activities, Figure 2

6.2 Initialiting tha audit

6.2.1 General

6.2.2 Establishing initial contact with the Auditee

6.2.3 Determining the feasibility of the audit

6.3 Preparing audit activities

6.3.1 Performing document review in preparation for the

audit

6.3.2 Preparing the audit plan

6.3.3 Assigning work to the audit team

6.3.4 Preparing work documents

6.4 Conducting the audit activities

6.4.1 General

6.4.2 Conducting the opening meeting

6.4.3 Performing document review while conducting the

audit

6.4.4 Communicating during the audit

6.4.5 Assigning roles and responsibilities of guides and

observers

6.4.6 Collecting and verifying information

6.4.7 Generating audit findings

6.4.8 Preparing audit conclusions

6.4.9 Conducting the close meeting

6.5 Preparing and distributing he audit report

6.5.1 Preparing the audit report

6.5.2 Distributing the audit report

6.6 Completing the audit

6.7 Conducting audit follow-up (if specified in the audit plan)

Guidelines for auditing managements (ISO 19011:2011) -
Overview of the process of collecting and verifying information, Figure 3

Source of information

Collecting by means of appropriate sampling

Audit evidence

Evaluating against audit criteria

Audit findings

Reviewing

Audit conclusions