19011:2011) BSI Standards Publication …

1 Raising Standards worldwide NO COPYING WITHOUT BSI PERMISSION EXCEPT AS PERMITTED BY COPYRIGHT LAWBSI Standards PublicationBS EN iso 19011 :2011 Guidelines for auditingmanagement systems (ISO19011:2011)Licenced to BSI Training for evaluation purposes only. (c) BSIBS EN iso 19011 :2011 BRITISH STANDARDN ational forewordThis British Standard is the UK implementation of EN ISO19011:2011. It supersedes BS EN iso 19011 :2002 which is UK participation in its preparation was entrusted to TechnicalCommittee AUS/1, Revision of ISO list of organizations represented on this committee can beobtained on request to its Publication does not purport to include all the necessaryprovisions of a contract. Users are responsible for its correctapplication. BSI 2011 ISBN 978 0 580 66496 0 ICS ; with a British Standard cannot confer immunity fromlegal British Standard was published under the authority of theStandards Policy and Strategy Committee on 30 November issued since publicationDateText affectedLicenced to BSI Training for evaluation purposes only.

2 (c) BSI EUROPEAN STANDARD NORME EUROP ENNE EUROP ISCHE NORM EN iso 19011 October 2011 ICS ; Supersedes EN iso 19011 :2002 English Version Guidelines for auditing management systems ( iso 19011 :2011) Lignes directrices pour l'audit des syst mes de management ( iso 19011 :2011) Leitfaden zur Auditierung von Managementsystemen ( iso 19011 :2011) This European Standard was approved by CEN on 11 October 2011. CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references concerning such national Standards may be obtained on application to the CEN-CENELEC management Centre or to any CEN member.

3 This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC management Centre has the same status as the official versions. CEN members are the national Standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and United Kingdom. EUROPEAN COMMITTEE FOR STANDARDIZATION COMIT EUROP EN DE NORMALISATION EUROP ISCHES KOMITEE F R NORMUNG management Centre: Avenue Marnix 17, B-1000 Brussels 2011 CEN All rights of exploitation in any form and by any means reserved worldwide for CEN national Members.

4 Ref. No. EN iso 19011 :2011: ELicenced to BSI Training for evaluation purposes only. (c) BSIBS EN iso 19011 :2011EN iso 19011 :2011 (E) 3 Foreword This document (EN iso 19011 :2011) has been prepared by Technical Committee ISO/TC 176 "Quality management and quality assurance". This European Standard shall be given the status of a national standard, either by Publication of an identical text or by endorsement, at the latest by April 2012, and conflicting national Standards shall be withdrawn at the latest by April 2012. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CEN [and/or CENELEC] shall not be held responsible for identifying any or all such patent rights. This document supersedes EN iso 19011 :2002.

5 According to the CEN/CENELEC Internal Regulations, the national Standards organizations of the following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, Switzerland and the United Kingdom. Endorsement notice The text of iso 19011 :2011 has been approved by CEN as a EN iso 19011 :2011 without any modification. Licenced to BSI Training for evaluation purposes only. (c) BSIBS EN iso 19011 :2011 iso 19011 :2011(E) ISO 2011 All rights reserved iiiContents PageForeword.

6 IvIntroduction ..v1 Scope ..12 Normative references ..13 Terms and definitions ..14 Principles of auditing ..45 Managing an audit programme .. General .. Establishing the audit programme objectives .. Establishing the audit programme .. Implementing the audit programme .. Monitoring the audit programme .. Reviewing and improving the audit programme ..146 Performing an audit .. General .. Initiating the Preparing audit activities .. Conducting the audit activities .. Preparing and distributing the audit Completing the audit .. Conducting audit follow-up ..247 Competence and evaluation of auditors .. General .. Determining auditor competence to fulfil the needs of the audit Establishing the auditor evaluation criteria.

7 Selecting the appropriate auditor evaluation method .. Conducting auditor evaluation .. Maintaining and improving auditor competence ..29 Annex A (informative) Guidance and illustrative examples of discipline-specific knowledge and skills of auditors ..31 Annex B (informative) Additional guidance for auditors for planning and conducting audits ..37 Bibliography ..44 Licenced to BSI Training for evaluation purposes only. (c) BSIBS EN iso 19011 :2011 ForewordISO (the International Organization for Standardization) is a worldwide federation of national Standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee.

8 International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part main task of technical committees is to prepare International Standards . Draft International Standards adopted by the technical committees are circulated to the member bodies for voting. Publication as an International Standard requires approval by at least 75 % of the member bodies casting a is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent 19011 was prepared by Technical Committee ISO/TC 176, Quality management and quality assurance, Subcommittee SC 3, Supporting second edition cancels and replaces the first edition ( iso 19011 :2002), which has been technically main differences compared with the first edition are as follows: the scope has been broadened from the auditing of quality and environmental management systems to the auditing of any management systems; the relationship between iso 19011 and ISO/IEC 17021 has been clarified; remote audit methods and the concept of risk have been introduced; confidentiality has been added as a new principle of auditing.

9 Clauses 5, 6 and 7 have been reorganized; additional information has been included in a new Annex B, resulting in the removal of help boxes; the competence determination and evaluation process has been strengthened; illustrative examples of discipline-specific knowledge and skills have been included in a new Annex A; additional guidelines are available at the following website: 19011:2011(E) iv ISO 2011 All rights reservedLicenced to BSI Training for evaluation purposes only. (c) BSIBS EN iso 19011 :2011 IntroductionSince the first edition of this International Standard was published in 2002, a number of new management system Standards have been published. As a result, there is now a need to consider a broader scope of management system auditing, as well as providing guidance that is more 2006, the ISO committee for conformity assessment (CASCO) developed ISO/IEC 17021, which sets out requirements for third party certification of management systems and which was based in part on the guidelines contained in the first edition of this International second edition of ISO/IEC 17021, published in 2011, was extended to transform the guidance offered in this International Standard into requirements for management system certification audits.

10 It is in this context that this second edition of this International Standard provides guidance for all users, including small and medium-sized organizations, and concentrates on what are commonly termed internal audits (first party) and audits conducted by customers on their suppliers (second party). While those involved in management system certification audits follow the requirements of ISO/IEC 17021:2011, they might also find the guidance in this International Standard relationship between this second edition of this International Standard and ISO/IEC 17021:2011 is shown in Table 1 Scope of this International Standard and its relationship with ISO/IEC 17021:2011 Internal auditingExternal auditingSupplier auditingThird party auditingSometimes called first party audit Sometimes called second party auditFor legal, regulatory and similar purposesFor certification (see also the requirements in ISO/IEC 17021.)