The auditglossary

A simple root cause technique: ask why a problem happened, then ask why again of each answer, usually about five times, until you reach a cause the organisation can act on. It works best for single-thread problems and when each answer is checked against evidence rather than assumed.

See also Root cause analysis, Corrective action, Nonconformity. Guide: Root cause analysis and corrective action

Independent confirmation, by a national accreditation body such as UKAS in the UK, that a certification body is competent and impartial. For management system certification, accreditation bodies assess certification bodies against ISO/IEC 17021-1. Accreditation applies to the certification body, not to the certified organisation.

See also Certification body, Certification audit, Competence.

The set of requirements that audit evidence is compared against, such as the clauses of a standard, the organisation’s own policies and procedures, contractual terms or legal requirements. Clear criteria are what make a finding objective rather than a matter of opinion.

In Orisynx: There is no pre-loaded clause library: the criteria come from audit templates your organisation builds, which can follow the clause structure of a standard.

See also Audit evidence, Audit finding, Audit scope.

Records, statements of fact or other information that relate to the audit criteria and can be verified. It is gathered by interview, observation and review of documents and records, usually by sampling, and may be qualitative or quantitative.

In Orisynx: Files, links and notes can be attached as evidence, and each checklist answer is recorded as “in order” or as an “exception”.

See also Audit criteria, Audit finding, Documented information. Guide: How to write an audit finding that gets fixed

The result of evaluating audit evidence against the audit criteria. A finding can show conformity or nonconformity, and can also point to a risk, an opportunity for improvement or good practice. A well-written nonconformity finding states the requirement, the evidence and what was not met.

In Orisynx: Findings are linked to an audit, graded by severity (low, medium, high or critical) and move through draft, open, in review and closed.

See also Nonconformity, Audit evidence, Observation, Opportunity for improvement. Guide: How to write an audit finding that gets fixed

In ISO 19011, the description of the activities and arrangements for a single audit: its objectives, scope, criteria, dates, locations, team and schedule of interviews. It is distinct from the audit programme, which covers a set of audits over a period.

In Orisynx: In Orisynx the term is used at programme level: an audit plan has a status of draft, active or archived and holds the planned audits for the period.

See also Audit programme, Audit scope, Audit criteria, Lead auditor.

The arrangements for a set of one or more audits planned for a specific time frame and directed towards a specific purpose, usually a year of internal audits. ISO 19011 and the management system standards expect the programme to take account of the importance of the processes concerned, changes affecting the organisation and the results of previous audits.

In Orisynx: An audit plan holds the programme’s planned audits, each with a status (tentative, scheduled, confirmed, moved or cancelled), a priority, a risk level and a department or site, and the programme can be imported from .xlsx or .csv.

See also Audit plan, Internal audit, Risk-based thinking. Guide: How to plan a risk-based audit programme

The extent and boundaries of an audit, such as the sites, departments, processes, activities and time period it covers. The scope of a single audit is usually narrower than the scope of the management system or the certificate.

See also Audit plan, Audit criteria, Audit programme.

The organisation, or the part of it, being audited. In practice the word is also used for the people interviewed during an audit, such as a process owner or department manager.

See also Internal audit, Audit scope, Lead auditor.

An audit by an accredited certification body to decide whether an organisation’s management system meets a standard and can be certified. The initial certification audit is carried out in two stages, as set out in ISO/IEC 17021-1, and is followed by surveillance audits and recertification within a cycle that is typically three years.

In Orisynx: Certification is one of the audit types, so the certification body’s visits can be planned and tracked alongside internal audits.

See also Stage 1 audit, Stage 2 audit, Certification body, Surveillance audit. Guide: Preparing for an ISO certification audit

An independent organisation that audits management systems against a standard and issues certificates. Accredited certification bodies work to ISO/IEC 17021-1 and are overseen by a national accreditation body. They set their own conventions for some practices, such as how nonconformities are graded.

See also Accreditation, Certification audit, External audit. Guide: Preparing for an ISO certification audit

The ability to apply knowledge and skills to achieve intended results. Management system standards require the organisation to decide what competence people need, make sure they have it through education, training or experience, and keep documented information as evidence. ISO 19011 applies the same idea to auditors.

See also Lead auditor, Documented information, Management system.

Fulfilment of a requirement. ISO uses conformity for meeting the requirements of a standard or the organisation’s own system, and tends to keep compliance for legal and regulatory obligations.

See also Nonconformity, Audit criteria, Audit finding.

Action to deal with a detected nonconformity itself, such as reworking a product, replacing an expired record or retraining an individual. A correction contains the problem but does not remove its cause; that is the job of corrective action.

See also Corrective action, Nonconformity. Guide: Root cause analysis and corrective action

Action to eliminate the cause of a nonconformity and prevent it from happening again. The management system standards expect the organisation to react to the nonconformity, find its cause, decide whether similar problems exist or could occur, act on the cause and then review whether the action was effective.

In Orisynx: The person responsible for an action accepts it or disputes it with a reason, and the action breaks down into tasks with an assignee, priority, due date and status.

See also Correction, Root cause analysis, Effectiveness review. Guide: Root cause analysis and corrective action

Information an organisation must control and keep, and the medium it is held on. Since the 2015 revisions the term replaces the older split between documents and records: standards ask the organisation to maintain some documented information, such as a policy, and to retain other documented information as evidence, such as audit results.

In Orisynx: A document library holds controlled documents, separate from the files, links and notes attached to records as evidence.

See also Audit evidence, Harmonized structure, Management system.

A check, made some time after a corrective action is complete, that the action has removed the cause and the problem has not recurred. It looks for evidence in later records, results or audits, rather than confirming only that the planned action was carried out.

In Orisynx: Effectiveness is recorded on each action as effective, partially effective, ineffective or pending.

See also Corrective action, Follow-up audit. Guide: How to check a corrective action worked

An audit carried out by someone outside the organisation. Second-party audits are made by or for a customer or other party with an interest in the organisation, such as a supplier audit; third-party audits are made by an independent body, such as a certification body.

See also Internal audit, Supplier audit, Certification audit.

A further audit, or a shorter visit, to verify that corrective actions from an earlier audit have been carried out and are effective. Certification bodies typically use one after a major nonconformity when documentary evidence alone is not enough to close it.

In Orisynx: Follow-up is one of the audit types, so a return visit to verify actions is planned and recorded like any other audit.

See also Corrective action, Effectiveness review, Major nonconformity.

The common clause structure, core text and shared terms that ISO management system standards follow, set out in Annex SL of the ISO/IEC Directives. It gives standards such as ISO 9001, ISO 14001, ISO/IEC 27001 and ISO 45001 the same ten clauses, from scope through to improvement, which makes integrated management systems and integrated audits easier. It was called the High Level Structure until 2021.

See also Management system, Integrated audit, PDCA.

A single audit that covers two or more management systems at once, such as quality, environment and occupational health and safety. ISO 19011 calls this a combined audit. It relies on the shared harmonized structure, while still checking the requirements that are specific to each standard.

See also Harmonized structure, Management system, Audit scope.

People or organisations that can affect, be affected by, or believe themselves to be affected by the organisation’s decisions or activities, such as customers, regulators, employees, suppliers and neighbours. The harmonized-structure standards ask the organisation to identify the relevant ones and their relevant requirements as part of understanding its context.

See also Management system, Risk-based thinking, Harmonized structure.

An audit an organisation carries out on its own management system, by its own staff or by people acting on its behalf, to check that the system meets its own requirements and those of the standard and is effectively implemented and maintained. Every harmonized-structure standard requires a planned programme of internal audits, with auditors who are objective and impartial towards the work they audit.

In Orisynx: Internal audits are planned in an audit plan, carried out from templates your organisation builds, and their findings and actions are tracked to closure.

See also Audit programme, External audit, Management review. Guide: How to plan a risk-based audit programme

The auditor who leads an audit team and is responsible for planning and conducting the audit, managing the team, communicating with the auditee and reporting the conclusions. ISO 19011 calls this role the audit team leader; lead auditor is also the name of common training courses.

See also Competence, Audit plan, Auditee.

A nonconformity graded as serious by a certification body. It typically means a requirement has not been addressed at all, has broken down entirely, or the evidence raises doubt about the system’s ability to achieve its intended results. Certification is usually withheld or put at risk until the organisation shows that correction and corrective action have been taken.

See also Minor nonconformity, Nonconformity, Certification audit, Follow-up audit. Guide: Major vs minor nonconformity, and OFIs

A review by top management, at planned intervals, of whether the management system remains suitable, adequate and effective. The standards list the inputs to consider, including audit results, nonconformities and corrective actions, and the outputs, such as decisions on improvement and resources.

In Orisynx: Audit summary, finding trend and remediation status reports can be prepared as inputs to the review.

See also Internal audit, Management system, PDCA.

The interrelated parts of an organisation, such as its structure, roles, policies, objectives and processes, that work together to set policies and objectives and achieve them. A management system can cover one discipline, such as quality or information security, or several in an integrated system.

See also Harmonized structure, Integrated audit, PDCA.

A nonconformity graded as less serious by a certification body: typically an isolated lapse that does not call into question the system’s ability to achieve its intended results. The organisation is usually expected to submit a corrective action plan, which is then verified at the next audit.

See also Major nonconformity, Nonconformity, Observation. Guide: Major vs minor nonconformity, and OFIs

Non-fulfilment of a requirement, whether that requirement comes from a standard, the customer, the law or the organisation’s own system. In an audit it is recorded as a finding backed by objective evidence, and certification bodies typically grade it as major or minor.

See also Conformity, Major nonconformity, Minor nonconformity, Corrective action. Guide: Major vs minor nonconformity, and OFIs

A note an auditor records about a situation that is not a nonconformity but could become one if left alone. The term is not defined in ISO 9000 or ISO 19011, so its meaning varies between certification bodies and organisations, and some treat it much like an opportunity for improvement.

See also Opportunity for improvement, Audit finding, Minor nonconformity. Guide: How to write an audit finding that gets fixed

A finding that points to something that conforms but could be done better. It does not need corrective action, and the organisation decides whether and how to act on it, though auditors may check what was decided.

See also Observation, Audit finding, Risk-based thinking. Guide: How to write an audit finding that gets fixed

A four-step cycle for managing and improving processes: plan what to do, do it, check the results against what was planned, and act on what was learned. The management system standards use it as their underlying model, with internal audit and management review forming much of the check step.

See also Management system, Harmonized structure, Management review.

Action to eliminate the cause of a potential nonconformity before it occurs. Since the 2015 revisions, ISO 9001 and the other harmonized-structure standards no longer have a separate preventive action requirement: the intent is covered by risk-based thinking and actions to address risks and opportunities. Some sector standards, such as ISO 13485, still require it.

See also Risk-based thinking, Corrective action.

An audit by the certification body, before the certificate expires, to confirm that the management system as a whole continues to meet the standard and to renew certification for a further cycle, typically three years. It reviews performance over the whole cycle, including the results of surveillance audits.

See also Certification audit, Surveillance audit, Certification body. Guide: Preparing for an ISO certification audit

The idea, made explicit in ISO 9001:2015, that an organisation should consider risks and opportunities when planning its system and processes and act on them in proportion to their effect. It replaced the separate preventive action requirement, and it also shapes how audit programmes are prioritised.

See also Preventive action, Audit programme, Interested parties. Guide: How to plan a risk-based audit programme

A structured investigation into why a nonconformity happened, going past the immediate symptom to the underlying cause that, once removed, stops it recurring. Common techniques include the 5 whys, fishbone (Ishikawa) diagrams and fault tree analysis.

See also 5 whys, Corrective action, Nonconformity. Guide: Root cause analysis and corrective action

The first part of an initial certification audit, defined in ISO/IEC 17021-1. The certification body reviews the documented management system, the organisation’s understanding of the standard, the scope and site conditions, and whether internal audits and management review have been planned and carried out, to judge readiness for stage 2. Concerns raised here may be classed as nonconformities at stage 2 if they are not dealt with.

See also Stage 2 audit, Certification audit, Certification body. Guide: Preparing for an ISO certification audit

The second part of an initial certification audit, defined in ISO/IEC 17021-1, in which the certification body evaluates the implementation and effectiveness of the management system on site. Its findings, and the closure of any nonconformities, inform the certification decision.

See also Stage 1 audit, Certification audit, Major nonconformity. Guide: Preparing for an ISO certification audit

A document required by ISO/IEC 27001 (clause 6.1.3) that lists the necessary information security controls, states whether each Annex A control is included or excluded with a justification, and shows whether included controls are implemented. Certification auditors use it to understand and test the scope of the controls.

See also Documented information, Risk-based thinking, Audit scope.

An audit of a supplier or contractor, carried out by the customer or someone acting on its behalf, to check that the supplier can meet agreed requirements. It is one way to evaluate and monitor external providers, as the management system standards require.

In Orisynx: Supplier is one of the audit types, alongside internal, external, surveillance, certification and follow-up.

See also External audit, Audit programme, Audit criteria.

A periodic audit by the certification body between certification and recertification to confirm the management system still meets the standard. Surveillance audits are typically held at least once a calendar year, the first within twelve months of the certification decision, and each samples part of the system rather than all of it.

In Orisynx: Surveillance is one of the audit types, so certification-body visits sit in the same programme and calendar as internal audits.

See also Certification audit, Recertification audit, Certification body. Guide: Preparing for an ISO certification audit