Annex 22 - Determination of Audit Time - QMS & EMS
Annex 22 - Determination of Audit Time - QMS & EMS
Annex 22 - Determination of Audit Time - QMS & EMS
Annexure 22
This document is mandatory for the consistent application of the relevant clauses of ISO/IEC 17021-1 for
audits of quality and environmental management systems. All clauses of ISO/IEC 17021-1 continue to
apply and this document does not supersede any of the requirements in that standard. Although
personnel numbers (permanent, temporary and part time) of the client are used as the starting point
when considering the determination of audit time of management systems, this is not the sole
consideration and account shall be taken of other factors affecting the audit time, including all those
listed in ISO/IEC 17021-1.
1 DEFINITIONS
1.1 Management Systems Certification scheme
Conformity assessment system related to management systems to which the same specified
requirements, specific rules and processes apply.
Note 1: A virtual site cannot be considered where the processes must be executed in a physical
environment, e.g., warehousing, manufacturing, physical testing
laboratories, installation or repairs to physical products.
Note 2: A virtual site (e.g. company intranet) is considered a single site for the calculation of
audit time.
Annexure 22
• conducting the opening meeting
• performing document review while conducting the audit
• communicating during the audit
• assigning roles and responsibilities of guides and observers
• collecting and verifying information
• generating audit findings
• preparing audit conclusions
• conducting the closing meeting
The effective number of personnel consists of all personnel involved within the scope of
certification including those working on each shift. When included within the scope of
certification, it shall also include non-permanent (e.g. contractors) and part time personnel.
Refer to 2.3 for calculation of effective number of personnel.
For QMS, the provisions in this document are based on three categories, dependant on the risks
posed by failure of the product or service of the client organization. These categories can be
considered as high, medium or low risk. High risk activities (e.g. nuclear, medical,
pharmaceutical, food, construction) normally require more audit time. Medium risk activities
(e.g., simple manufacturing) are likely to require the average time to carry out an effective audit
and low risk activities less time. (See Annex A, Table QMS 2)
For environmental management systems, the provisions specified in this document are based on
five primary complexity categories of the nature, number and gravity of the environmental
aspects of an organization that fundamentally affect the audit time. (See Annex B, Table EMS 2)
2 APPLICATION
2.1 Audit Time
2.1.1 The audit time for all types of audits includes the total time on-site at a client's location (physical
or virtual) (1.7) and time spent off-site carrying out planning, document review, interacting with
client personnel and report writing.
2.1.2 The duration of a management system certification audit (1.7) should typically not be less than
80% of the audit time calculated following the methodology in Section 3. This applies to initial,
surveillance and recertification audits.
Annexure : 22 Issue No. - 02 Issue Date – 12/11/2012 Rev No. - 01 Rev. Date – 04/04/2016
QCS Management Pvt. Ltd.
Annexure 22
2.1.3 Travel (en-route or between sites) and any breaks are not included in the on-site duration of
management system certification audits.
Note: See 1.8. There may be a local legal requirement to include lunch breaks.
2.2.2 The number of audit days allocated shall not be reduced at the planning stages by programming
longer hours per working day. Consideration can be made to allow efficient auditing of shift
activities which may require additional hours in a working day.
2.2.3 If after the calculation the result is a decimal number, the number of days should be adjusted to
the nearest half day (e.g.: 5.3 audit days becomes 5.5 audit days, 5.2 audit days becomes 5 audit
days).
2.2.4 To help ensure the effectiveness of the audit, QCS should also consider the composition and size
of the audit team (e.g. ½ day with 2 auditors may not be as effective as a one day audit with 1
auditor or 1 audit day with one lead auditor and one technical expert is more effective than 1
auditor day without the technical expert).
2.3.1 The effective number of personnel as defined above is used as a basis for the calculation of audit
time of management systems. Considerations for determining the effective number of
employees include part-time personnel and employees partially in scope, those working on
shifts, administrative and all categories of office staff, repetitive processes and the employment
of large numbers of unskilled personnel in some countries.
2.3.2 The justification to determine the effective number of personnel shall be available to the client
organization and to the Accreditation Body for review during their assessments and on request
from the Accreditation Body.
Dependent upon the hours worked, part time personnel numbers and employees partially in
scope may be reduced or increased and converted to an equivalent number of full time
personnel. (e.g. 30 part time personnel working 4 hours/day equates to 15 full time personnel.)
When a high percentage of personnel perform certain activities/positions that are considered
repetitive (e.g. cleaners, security, transport, sales, call centers, etc) a reduction to the number of
personnel which is coherent and consistently applied on a company to company basis within the
Annexure : 22 Issue No. - 02 Issue Date – 12/11/2012 Rev No. - 01 Rev. Date – 04/04/2016
QCS Management Pvt. Ltd.
Annexure 22
scope of certification is permitted. The methods incorporated for the reduction shall be
documented to include any consideration of the risk of the activities/positions.
QCS has determine the duration and timing of the audit which will best assess the effective
implementation of the management system for the full scope of the client activities, including
the need to audit outside normal working hours and various shift patterns. This shall be agreed
with the client.
This issue normally only applies in countries with a low level of technology where temporary
unskilled personnel may be employed in considerable numbers to replace automated processes.
Under these circumstances a reduction in effective personnel may be made, but the
consideration of processes is more important than employee numbers. This reduction is unusual
and the justification for doing so shall be recorded and made available to the AB at assessment.
3.1 The methodology used as a basis for the calculation of audit time of management systems for an
initial audit (Stage 1 + Stage 2) involves the understanding of tables and figures in Annex A and
Annex B for QMS and EMS audits respectively. Annex A (QMS) is based upon the effective
number of personnel (see Clause 2.3 for guidance on the calculation of the effective number of
personnel) and the level of risk, but does not provide minimum or maximum audit time. In
addition to effective number of personnel, Appendix B (EMS) is based also on the environmental
complexity of the organization and does not provide minimum or maximum audit time.
Note: Normal practice is that time spent for Stage 2 exceeds time spent for Stage 1.
3.2 Using a suitable multiplier, the same tables and figures may be used as the base for calculating
audit time for surveillance audits (Clause 5) and recertification audits (Clause 6).
3.3 QCS have processes that provide for the allocation of adequate time for auditing of relevant
processes of the client. Experience has shown that apart from the number of personnel, the
time required to carry out an effective audit depends upon other factors for both QMS and EMS.
These factors are explored in more depth in Clause 8.
3.4 This mandatory document lists the provisions which should be considered when establishing the
amount of time needed to perform an audit. These and other factors need to be examined
during the QCS’s application review process and after Stage 1 and throughout the certification
cycle and at recertification for their potential impact on the determination of audit time
regardless of the type of audit. Therefore the relevant tables, figures and diagrams for both QMS
and EMS which demonstrate the relationship between effective number of personnel and
complexity, cannot be used in isolation. These tables and figures provide the framework for audit
planning and therefore required adjustments for the determination of audit time for all types of
audits.
Annexure : 22 Issue No. - 02 Issue Date – 12/11/2012 Rev No. - 01 Rev. Date – 04/04/2016
QCS Management Pvt. Ltd.
Annexure 22
3.5 For QMS audits, Figure QMS 1 provides a visual guide to making adjustments from the audit
time calculated from Table QMS 1 and provides the framework for a process that should be used
for audit planning by identifying a starting point based on the total effective number of
personnel for all shifts.
3.6 For an EMS audit it is appropriate to base audit time on the effective number of personnel of the
organization and the nature, number and gravity of the environmental aspects of the typical
organization in that industry sector. Tables EMS 1 and EMS 2 provide the framework for the
process that should be used for audit planning. The audit time of management systems should
then be adjusted based on any significant factors that uniquely apply to the organization to be
audited.
3.7 The starting point for determining audit time of management systems shall be identified based
on the effective number of personnel, then adjusted for the significant factors applying to the
client to be audited, and attributing to each factor an additive or subtractive weighting to modify
the base figure. In every situation the basis for the establishment of audit time of management
systems including adjustments made shall be recorded. QCS ensure that any variation in audit
time does not lead to a compromise on the effectiveness of audits. Where product or service
realization processes operate on a shift basis, the extent of auditing of each shift by the QCS
depends on the processes done on each shift, and the level of control of each shift that is
demonstrated by the client. To audit effective implementation, at least one of the shifts shall be
audited. The justification for not auditing the other shifts (e.g. those outside of regular office
hours) shall be documented.
3.8 The audit time of management systems determined using the tables or figures in
Annexes A and B shall not include the time of “auditors-in-training”, observers or the time of
technical experts.
3.9 The reduction of audit time of management systems shall not exceed 30% of the times
established from Tables QMS 1 or EMS 1.
4.1 Determination of audit time of management systems involved in combined offsite activities
(Clause 2.1) should not reduce the total on-site duration of management systems audits to less
than 80% of the audit time calculated from the tables following the methodology in Section 3.
Where additional audit time is required for planning and/or report writing, this will not be
justification for reducing the on-site duration of management systems certification audits. .
4.2 Table QMS 1 and Table EMS 1 provide a starting point for estimating the audit time of an initial
audit (Stage 1 + Stage 2) for QMS and EMS respectively.
4.3 The audit time determined by QCS and the justification for the determination shall be recorded.
This calculation shall include details on the time to be allocated to cover the entire scope of
certification.
Annexure : 22 Issue No. - 02 Issue Date – 12/11/2012 Rev No. - 01 Rev. Date – 04/04/2016
QCS Management Pvt. Ltd.
Annexure 22
4.4 QCS shall provide the audit time determination and the justification to the client organization as
part of the contract and make it available to its Accreditation Body upon request.
4.5 Certification audits may include remote auditing techniques such as interactive web-based
collaboration; web meetings, teleconferences and/or electronic verification of the client’s
processes (see IAF MD4). These activities shall be identified in the audit plan, and the time spent
on these activities may be considered as contributing to the total duration of management
systems audits. If QCS plans an audit for which the remote auditing activities represent more
than 30% of the planned on-site duration of management systems audits, QCS shall justify the
audit plan and maintain the records of this justification which shall be available to an
Accreditation Body for review (see MD4).
5 SURVEILLANCE
During the initial three year certification cycle, audit time for surveillance audits for a given
organization should be proportional to the audit time spent on the initial certification audit
(Stage 1 + Stage 2), with the total amount of time spent annually on surveillance being about 1/3
of the audit time spent on the initial certification audit. QCS shall obtain an update of client data
related to its management system as part of each surveillance audit. The planned audit time of a
surveillance audit shall be reviewed at least at every surveillance and recertification audit to take
into account changes in the organization, system maturity, etc. The evidence of review including
any adjustments to the audit time of management systems audits shall be recorded.
6 RECERTIFICATION
The audit time for the recertification audit should be calculated on the basis of the updated
information of the client and is normally approximately 2/3 of the audit time that would be
required for an initial certification audit (Stage 1 + Stage 2) of the organization if such an initial
audit were to be carried out at the time of recertification (i.e. not 2/3 of the original time spent
on the initial audit). The audit time of management systems shall take account the outcome of
the review of system performance (ISO/IEC 17021-1). The review of system performance does
not itself form part of the audit time for
For the second and subsequent certification cycles, QCS may choose to design an individualized
surveillance and recertification program (see IAF MD3 for Advanced Surveillance and
Recertification Procedures – ASRP) with approval by the Accreditation Body. If an ASRP approach
is not chosen the audit time of management systems should be calculated as indicated in
Clauses 5 and 6.
8 FACTORS FOR ADJUSTMENTS OF AUDIT TIME OF MANAGEMENT SYSTEMS (QMS AND EMS)
The additional factors that need to be considered include but are not limited to:
Annexure 22
b. Staff speaking in more than one language (requiring interpreter(s) or preventing
individual auditors from working independently).
c. Very large site for the number of personnel (e.g., a forest).
d. High degree of regulation (e.g. food, drugs, aerospace, nuclear power, etc.).
e. System covers highly complex processes or relatively high number of unique activities.
f. Activities that require visiting temporary sites to confirm the activities of the permanent
site(s) whose management system is subject to certification.
g. Outsourced functions or processes.
a. Client is not "design responsible" or other standard elements are not covered in
the scope (QMS only).
b. Very small site for number of personnel (e.g. office complex only).
c. Maturity of management system.
d. Prior knowledge of the client management system (e.g., already certified to
another standard by the same CAB).
e. Client preparedness for certification (e.g., already certified or recognized by
another 3rd party scheme).
f. High level of automation.
g. Where staff include a number of people who work “off location” e.g.
salespersons, drivers, service personnel, etc. and it is possible to substantially
audit compliance of their activities with the system through review of records.
h. Activities considered to be of low risk (see Annex A, Table QMS 2 for examples
and Table EMS 1). Low complexity activities, e.g.:
Annexure 22
All attributes of the client’s system, processes, and products/services should be
considered and a fair adjustment made for those factors that could justify more or less
audit time for an effective audit. Additive factors may be off-set by subtractive factors.
9 TEMPORARY SITES
9.1 In situations where the certification applicant or certified client provides their product(s) or
service(s) at temporary sites, such sites shall be incorporated into the audit programs.
9.2 Temporary sites could range from major project management sites to minor service/installation
sites. The need to visit such sites and the extent of sampling should be based on an evaluation of
the risks of the failure of the QMS to control product or service output or the EMS to control
environmental aspects and impacts associated with the client's operations. The sample of sites
selected should represent the range of the client’s scope of certification, competency needs and
service variations having given consideration to sizes and types of activities, and the various
stages of projects in progress and associated environmental aspects and impacts.
9.3 Typically on-site audits of temporary sites would be performed. However, the following methods
could be considered as alternatives to replace some on-site audits:
i) Interviews or progress meetings with the client and/or its customer in person or by
teleconference.
ii) Document review of temporary site activities.
iii) Remote access to electronic site(s) that contains records or other information that is
relevant to the assessment of the management system and the temporary site(s).
iv) Use of video and teleconference and other technology that enable effective auditing to
be conducted remotely.
9.4 In each case, the method of audit should be fully documented and justified in terms of its
effectiveness.
10.1 In the case of a management system operated over multiple sites it is necessary to establish if
sampling is permitted or not.
10.2 For certification of multiple sites where sampling is not permitted, detailed requirements will be
covered in more detail in a new IAF MD when it is available. The starting point for calculating
audit time of the management system is the total involved on all of the sites, consistent with
Table QMS 1 and Table QMS 2 for quality management systems and Table EMS 1 and Table EMS
2 for environmental management systems.
The proportion of the total time spent on each site shall take into account situations where
certain management system processes are not relevant to the site.
10.3 For certification of multiple sites where sampling is permitted, detailed requirements are
covered in more detail in IAF MD1. The starting point for calculating audit time of the
Annexure : 22 Issue No. - 02 Issue Date – 12/11/2012 Rev No. - 01 Rev. Date – 04/04/2016
QCS Management Pvt. Ltd.
Annexure 22
management system is the total involved on each of the sampled sites. MD1 shall be used to
select sites to be sampled prior to applying MD5 to each selected site. The total time should
never be less than that which would have been calculated for the size and complexity of the
operation if all the work had been undertaken at a single site (MD1 – clause 5.3.4).
11.1 If an organization outsources part of its functions or processes, it is the responsibility of QCS to
obtain evidence that the organization has effectively determined the type and extent of controls
to be applied in order to ensure that the externally provided functions or processes do not
adversely affect the effectiveness of the MS, including the organization’s ability to consistently
deliver conforming products and services to its customers or to control its environmental aspects
and commitments to compliance with legal requirements.
11.2 QCS will audit and evaluate the effectiveness of the client's management system in managing
any supplied activity and the risk this poses to the delivery of objectives, customer and
conformity requirements. This may include gathering feedback on the level of effectiveness from
suppliers. However auditing the supplier’s management system is not required, considering that
it is included in the scope of the organization’s management system only the control of the
supplied activity, and not the performance of the activity itself. From this understanding of risk
any additional audit time shall be determined.
Relationship between Effective Number of Personnel and Audit Time (Initial Audit only)
Annexure : 22 Issue No. - 02 Issue Date – 12/11/2012 Rev No. - 01 Rev. Date – 04/04/2016
QCS Management Pvt. Ltd.
Annexure 22
Annexure : 22 Issue No. - 02 Issue Date – 12/11/2012 Rev No. - 01 Rev. Date – 04/04/2016
QCS Management Pvt. Ltd.
Annexure 22
Annexure : 22 Issue No. - 02 Issue Date – 12/11/2012 Rev No. - 01 Rev. Date – 04/04/2016
QCS Management Pvt. Ltd.
Annexure 22
These risk categories are not definitive; they are examples only that could be used by
QCS when determining the risk category of an audit.
High risk
Where failure of the product or service causes economic catastrophe or puts life at risk.
Examples include but are not limited to:
Medium risk
Where failure of the product or service could cause injury or illness. Examples include
but are not limited to:
Non load bearing components and structures; simple construction activities; basic
metals and fabricated products; non-metallic products; furniture; optical equipment;
leisure and personal services.
Low risk
Where failure of the product or service is unlikely to cause injury or illness. Examples
include but are not limited to:
Textiles and clothing; pulp, paper and paper products; publishing; office services;
education; retailing, hotels and restaurants.
Note 1: It is expected that business activities defined as low risk may require less audit
time than the time calculated using Table QMS1, activities defined as medium risk will
take the time calculated using Table QMS 1, and activities defined as high risk will take
more time.
Annexure : 22 Issue No. - 02 Issue Date – 12/11/2012 Rev No. - 01 Rev. Date – 04/04/2016
QCS Management Pvt. Ltd.
Annexure 22
Annexure 22
Complexity Categories of Environmental Aspects
Complexity
Business sector
category
MINING AND QUARRYING
High
OIL AND GAS EXTRACTION
TANNING OF TEXTILES AND CLOTHING
PULPING PART OF PAPER MANUFACTURING INCLUDING PAPER RECYCLING PROCESSING
OIL REFINING
CHEMICALS AND PHARMACEUTICALS
PRIMARY PRODUCTIONS – METALS
NON-METALLIC’S PROCESSING AND PRODUCTS COVERING CERAMICS AND CEMENT.
COAL BASED ELECTRICITY GENERATION
CIVIL CONSTRUCTION AND DEMOLITION
HAZARDOUS AND NON HAZARDOUS WASTE PROCESSING E.G. INCINERATION ETC.
EFFLUENT AND SEWERAGE PROCESSING
FISHING/FARMING/FORESTRY
Medium TEXTILES AND CLOTHING EXCEPT FOR TANNING
MANUFACTURING OF BOARDS, TREATMENT/IMPREGNATION OF WOOD AND WOODEN
PRODUCTS
PAPER PRODUCTION AND PRINTING EXCLUDING PULPING
NON METALLIC’S PROCESSING AND PRODUCTS COVERING GLASS, CLAY, LIME ETC.
SURFACE AND OTHER CHEMICALLY BASED TREATMENT FOR METAL FABRICATED PRODUCTS
EXCLUDES PRIMARY PRODUCTION
SURFACE AND OTHER CHEMICALLY BASED TREATMENT FOR GENERAL MECHANICAL
ENGINEERING
PRODUCTION OF BARE PRINTED CIRCUIT BOARDS FOR ELECTRONICS INDUSTRY
MANUFACTURING OF TRANSPORT EQUIPMENT - ROAD, RAIL, AIR, SHIPS
NON COAL BASED ELECTRICITY GENERATION AND DISTRIBUTION
GAS PRODUCTION, STORAGE AND DISTRIBUTION (NOTE EXTRACTION IS GRADED HIGH)
WATER ABSTRACTION, PURIFICATION AND DISTRIBUTION INCLUDING RIVER MANAGEMENT
(NOTE COMMERCIAL EFFLUENT TREATMENT IS GRADED AS HIGH)
FOSSIL FUEL WHOLE SALE AND RETAIL
FOOD AND TOBACCO - PROCESSING
TRANSPORT AND DISTRIBUTION - BY SEA, AIR, LAND
COMMERCIAL ESTATE AGENCY, ESTATE MANAGEMENT, INDUSTRIAL CLEANING, HYGIENE
CLEANING, DRY CLEANING NORMALLY PART OF GENERAL BUSINESS SERVICES
RECYCLING, COMPOSTING, LANDFILL (OF NON HAZARDOUS WASTE)
TECHNICAL TESTING AND LABORATORIES
HEALTHCARE/HOSPITALS/VETERINARY
LEISURE SERVICES AND PERSONAL SERVICES EXCLUDES HOTELS/RESTAURANTS
Annexure : 22 Issue No. - 02 Issue Date – 12/11/2012 Rev No. - 01 Rev. Date – 04/04/2016
QCS Management Pvt. Ltd.
Annexure 22
HOTELS/RESTAURANTS
Low WOOD AND WOODEN PRODUCTS EXCLUDING MANUFACTURING OF BOARDS, TREATMENT
AND IMPREGNATION OF WOOD
PAPER PRODUCTS EXCLUDING PRINTING, PULPING AND PAPER MAKING
RUBBER AND PLASTIC INJECTION MOULDING, FORMING AND ASSEMBLY – EXCLUDES
MANUFACTURING OF RUBBER AND PLASTIC RAW MATERIALS WHICH ARE PART OF
CHEMICALS
HOT AND COLD FORMING AND METAL FABRICATION EXCLUDING SURFACE TREATMENT AND
OTHER CHEMICAL BASED TREATMENTS AND PRIMARY PRODUCTION
GENERAL MECHANICAL ENGINEERING ASSEMBLY EXCLUDING SURFACE TREATMENT AND
OTHER CHEMICAL BASED TREATMENTS
WHOLESALE AND RETAIL
ELECTRICAL AND ELECTRONIC EQUIPMENT ASSEMBLY EXCLUDING MANUFACTURING OF
BARE PRINTED CIRCUIT BOARDS
Limited CORPORATE ACTIVITIES AND MANAGEMENT, HQ AND MANAGEMENT OF HOLDING
COMPANIES
TRANSPORT AND DISTRIBUTION - MANAGEMENT SERVICES WITH NO ACTUAL FLEET TO
MANAGE
TELECOMMUNICATIONS
GENERAL BUSINESS SERVICES EXCEPT COMMERCIAL ESTATE AGENCY, ESTATE
MANAGEMENT, INDUSTRIAL CLEANING, HYGIENE CLEANING, DRY CLEANING
EDUCATION SERVICES
SPECIAL NUCLEAR
CASES NUCLEAR ELECTRICITY GENERATION
STORAGE OF LARGE QUANTITIES OF HAZARDOUS MATERIAL
PUBLIC ADMINISTRATION
LOCAL AUTHORITIES
ORGANIZATIONS WITH ENVIRONMENTAL SENSITIVE PRODUCTS OR SERVICES
FINANCIAL INSTITUTIONS
Annexure : 22 Issue No. - 02 Issue Date – 12/11/2012 Rev No. - 01 Rev. Date – 04/04/2016