The additional requirement for management system audits (not found explicitly in the ISO definition) is auditor competence – or as ISO 19011:2011 puts it – “competence of those individuals involved in planning and conducting audits.”
As stated in ISO 19011 – “Confidence in the results of an audit depends on the competence of the individuals conducting the audit.”
ISO 19011:2011 identifies three components of auditor competence –
- Personal behavior
- Auditing Knowledge and Skills
- Technical Knowledge and Skills
Auditors need to possess the appropriate qualities, knowledge and skills in all three of these areas.
The key is determining the qualities, knowledge and skills needed by each individual auditor in order to achieve the objectives established for the audit and the audit program.
There are a number of considerations that may go into this determination.
As stated in Section 7.2.1 of ISO 19011, these include –
- the nature of the organization, or activities, that are to be audited
- the type, nature and complexity of the audit to be performed
- the size and composition of the audit team
- the role of the auditor – the nature of his or her audit assignment
- any specific requirements imposed by external parties
Not every auditor needs to be equally qualified to audit every area included within the scope of an audit.
The important thing is that the combined competence of the audit team members is appropriate for the defined objectives of the audit. It is up to the individual who is tasked with the responsiblity of assembling the audit team to ensure that this is accomplished. Usually this is either the audit program manager or the audit team leader.
Annex A of ISO 19011 provides illustrative examples of discipline-specific knowledge and skills of auditors for several different types of management system audits. These include –
- transportation safety management
- environmental management
- quality management
- records management
- resilience, security, preparedness and continuity management
- information security management
- occupational health and safety management