Traditionally, these audits have been conducted taking a clause-based approach, focusing on adherence to specific requirements set by the ISO Standards. However, with the release of ISO 19011:2018 (Guidelines for auditing management systems) in 2018, there has been a significant shift towards a more dynamic method known as risk-based auditing. 

This approach emphasises evaluating potential risks that could impact the management system’s performance and effectiveness, aligning more closely with the business’s strategic goals and the risk-based approach outlined in the ISO Standards.

Despite this change, it’s still common to find that many auditors continue to rely on traditional clause-based auditing methods. In this blog post, we will delve into the distinctions between risk-based and clause-based auditing. You’ll learn:

What is Risk-based Auditing?

Risk-based auditing represents a more dynamic and strategic approach to auditing that focuses on identifying and evaluating the risks that could impact the effectiveness and performance of a management system. Unlike the traditional clause-based auditing, risk-based auditing prioritises areas that are of greatest risk to the organisation’s objectives and goals not being achieved. Here’s an in-depth look at risk-based auditing:

Definition and Process

Advantages of Risk-Based Auditing

Challenges of Risk-Based Auditing

What is Clause-Based Auditing?

Clause-based auditing is a traditional approach in which auditors focus on verifying conformance against the specific clauses of the relevant ISO Standard. This method is straightforward and systematic, as it clearly defines the requirements that a business must meet to achieve and maintain certification.

Here’s an expanded look at clause-based auditing:

Definition and Process

Advantages of Clause-Based Auditing

Limitations of Clause-Based Auditing

What is the best approach – Risk-Based vs Clause-Based Auditing?

In the comparative analysis between risk-based and clause-based auditing, each approach offers distinct advantages and encounters specific challenges.

Clause-based auditing has served as the backbone of ISO audits due to its structured approach and clear benchmarks. However, the clause-based approach is dated and no longer suits the current business environment. As organisations and the ISO standards evolve, there is a growing recognition of the need for a more dynamic and results-oriented approach that not only ensures the standards requirements are met, but also promotes continual improvement, effectiveness in meeting organisational goals and providing real business benefits out of the auditing process.

The risk-based auditing better suits modern business practices, where flexibility and adaptability are key to success. By focusing on risk and its management, organisations can ensure they meet the requirements of the ISO Standards for Certification while also enhancing their strategic operations and resilience against disruptions.

Businesses are increasingly recognising the benefits of adopting a risk-based approach as recommended by ISO 19011:2018, as it empowers organisations to not just survive but thrive in today’s fast-paced and often unpredictable business environment.

Our Management System Internal Auditor Training is a practical eLearning course that teaches how to conduct effective Internal Audits taking a risk-based approach in accordance with the main ISO Management System Standards. Delivered via video lessons, this training combines theory, practical real-life examples, and templates, so even those new to the internal audit world can succeed when performing management system Internal Audits. Click here to find out more, or give us a call at 1300 614 897 for more details.

The post Risk-Based vs Clause-Based Audits appeared first on ICExperts Academy.

In this blog, we’ll delve deeper into the unique applications and the difference between an audit and inspections or checks in the ISO world. You’ll learn:

A quick overview of audits, inspections and checks

Audits – The differences between Internal and External Audits

In the ISO context, audits are critical in ensuring that businesses meet the chosen ISO Standards requirements, and are mainly divided into two types: Internal Audits and External Audits.

Internal Audits:

Internal audits are conducted by or on behalf of the organisation for internal review. Their primary intent is to assess the effectiveness of a company’s processes, internal controls, and corporate governance. Internal audits are required by the ISO Management System Standards and need to be conducted regularly. Evidence of these audits (the reports) will be checked by the Certification auditor during the external audits.

Internal audits are pivotal in facilitating continual improvement of a business and its management systems by:

External Audits:

External audits, on the other hand, are performed by an independent organisation. In the context of ISO and Certification, they are conducted by a CAB (Conformity Assessment Body), a third-party accredited organisation, commonly known as Certification Bodies or Certifiers.

Certification to ISO Standards, such as ISO 9001 for Quality Management, ISO 14001 for Environmental Management, ISO 45001 for Occupational Health and Safety Management, and ISO 27001 for Information Security Management, can only be achieved if the business has a successful external/Certification Audit with a CAB. The primary purpose of these audits is to certify that the organisation’s management systems are effectively implemented and are meeting the requirements of the ISO Standard(s).

In summary, key aspects of external audits in the ISO certification context include:

Once a business has obtained ISO Certification(s), a three-year certification cycle commences. Throughout this period, the Certification Body will conduct annual Surveillance Audits to ensure that the Business Management System is still meeting the ISO Standard(s) requirements and the company’s operational needs. At the end of the three years, a re-certification audit is conducted to renew the Certification, and the cycle starts again.

Inspections – Understanding the role of these in organisations

An inspection generally involves observing a location or a product to confirm it meets applicable standards and other defined requirements. A typical example is site safety inspections, which primarily identify hazards and potential risks in a given setting and ensure that health and safety measures in a business premises are properly implemented and effective.

Inspections tend to focus on specific elements, such as physical conditions, safety, and/or equipment. 

Here are some critical aspects of inspections within the ISO framework:

Checks – Ensuring consistency on a routine basis

Checks are routine evaluations performed to ensure that the day-to-day operations of a business align with processes and relevant requirements. These are less formal than audits or inspections but are critical for maintaining consistent operational integrity. 

Regular checks help organisations monitor ongoing conformance with established protocols. They identify issues before they become significant problems and ensure that operational outputs consistently meet quality standards.

An example could be checklists that an organisation implement for verification of processes, such as a checklist for employee onboarding, to ensure all steps of the process are covered and nothing is missed.

Here are some benefits of performing checks:

If you’d like to learn more about other ISO terminology, check out this blog: Common ISO Terminology and Acronyms Explained.

Understanding common ISO terminology and the difference between an audit and inspection or checks is essential for any business aiming to uphold high standards of operational excellence. 

The effective integration of audits, inspections and checks ensures that businesses conform to the standards and are well-prepared for future challenges. Embracing these processes is not merely an ISO requirement but a strategic asset that drives continual improvement and competitive advantage.

You can learn more about Internal Audits with our Management System Internal Auditor Training. This is a practical eLearning course that teaches how to conduct effective Internal Audits of the main ISO Management System Standards. Delivered via video lessons, this training combines theory, practical real-life examples, and templates, so even those new to the internal audit world can succeed when performing management system Internal Audits! Click here to find out more, or give us a call at 1300 614 897 for more details.

The post Understand The Difference Between Audits, Inspections and Checks appeared first on ICExperts Academy.

Climate change update to ISO management system standards

Every Standards update released by ISO tends to raise a number of questions, including how it can affect the role of the internal auditor. So we prepared this blog to address the key areas you need to understand. We will explore:

Deciphering ISO’s latest climate change amendment

The climate change amendment extends to several ISO Management System Standards to which businesses can get certified. These include the core Standards: ISO 9001:2015, ISO 14001:2015, ISO 45001:2018, and ISO/IEC 27001:2022.

With this update, ISO aims to ensure that every organisation factors in climate change and environmental considerations when making decisions. The influence of climate change on those decisions will vary based on factors such as the organisation’s industry, geographical location, and operational processes.

What does the new climate change amendment entail?

The amendment is integrated into the existing clauses. See the example below extracted from the ISO 9001:2015 Quality Management Systems Standard:

4.1 Understanding the organisation and its context

The organization shall determine external and internal issues that are relevant to its purpose and that affect its ability to achieve the intended result(s) of its quality management system.

4.2 Understanding the needs and expectations of interested parties

The organization shall determine:

• the interested parties that are relevant to the quality management system.the relevant requirements of these interested parties.
• the relevant requirements of these interested parties.
• which of these requirements will be addressed through the quality management system.

The new requirement and note are integrated into clauses related to understanding the business, its context, and the needs of interested parties. This aims to ensure that climate change is really embedded in decisions and considerations (e.g. environmental objectives and targets), and management system development and implementation. 

In essence, this update seeks to raise awareness about climate change and prompt businesses to take proactive measures.

How does the climate change amendment impact businesses?

The effect of this amendment on businesses depends on the relevance of climate change to their specific business context. If deemed applicable, the management system must integrate climate change considerations into its development and implementation.

Businesses already certified to ISO Standards need to integrate climate change analysis into their current contextual assessments and processes.

Here are some examples of the implications of climate change considerations across the main ISO Management System standards:

What is the role of an internal auditor when addressing ISO’s new climate change amendment?

Internal auditors will play a crucial role in evaluating how organisations can integrate climate change considerations into their management systems. From determining relevant issues to addressing contractual and regulatory requirements related to climate change, they will assess organisational conformance to the new requirement, ensuring businesses can effectively achieve and maintain their ISO Certification.

Businesses already certified to the impacted ISO standards now need to consider climate change as part of the business continual improvement efforts.

While some existing ISO clauses already cover considerations for climate change impacts, the introduction of these amendments reflects ISO’s recognition of climate change as a crucial issue requiring the attention of all organisations across all industries, significantly contributing to a sustainable future. As an internal auditor, keeping up-to-date with industry developments and comprehending these revisions will enable you to adopt a more holistic approach.

Our Management System Internal Auditor Training offers a practical eLearning experience designed to develop the skills necessary for conducting effective internal audits against the requirements of the main ISO Management System Standards. Through this course, you’ll cultivate critical thinking skills to adapt to new ISO requirements seamlessly. By completing our training program, you can obtain three levels of internationally recognised certificates, equipping you with the expertise and tools required to execute successful internal audits.

Check out our Management System Internal Auditor training page to download the course guide, or give us a call at 1300 614 007 to find out more about the training.

The post Climate Change Update: Understanding the New Additions to the ISO Management System Standards appeared first on ICExperts Academy.

In many organisations, employees are making decisions on a daily basis, which without a proper structure in place could make or break the business, due to a lack of clarity and consistency in business operations. Human resources decide who to hire, fire and promote. Procurement decides who to buy from. IT chooses what information to secure. Each of these decisions is layered with complexities: ethics, corporate social responsibility, internal standards and regulations.

With all of this in mind, how can businesses ensure that their processes are robust enough to keep the business on track, that they will achieve objectives and targets cohesively, and that operations across the business are consistent? This is where Management Systems come into play.

What is a Management System?

A Management System is an organisational framework which enables businesses to achieve and sustain their operational and business objectives through a process of continual improvement. It is designed to identify and manage risks through a set of policies, processes, procedures, templates and other relevant documents which apply to the business.

An effective Management System is based on and controls structured and optimised processes. Ultimately, it establishes systematic continual improvement of a business through clear policies, roles, and processes. The level of complexity of the system will vary from business to business, depending on its size, type, and nature.

For context, the International Organisation of Standardisation (ISO) develops Management System Standards (MSS), which are established to reflect global best practice for specific areas. ISO has developed over 80 MSS, all containing a set of requirements, which businesses must implement into their Business Management System to achieve their goals and achieve Certification. For example, if a business wants to achieve Certification to the ISO 9001:2015 Quality Management System Standard, their management system must conform to the requirements of the quality standard. A certified business means that they are acknowledged as operating in accordance with the internationally recognised quality standard.

How can a Management System help a business?

Management Systems are an important part of a business’s operations. They ensure that the business has a solid structure that promotes growth and continual improvement, manages risks, and helps achieve the organisation’s objectives and targets.

Regardless of size, type, or industry, all businesses will benefit from an effective management system. Where a management system is actually practised and continually improved, it supports the business in preventing mistakes, identifying opportunities and risks, and meeting the requirements of all stakeholders. At the same time, it makes it easier to adapt to constantly changing conditions.

Some other benefits of an effective Management System include:

Even for businesses who are not aiming to achieve Certification to an ISO Management System Standard, they will still see benefits from implementing the requirements.

What makes up a Management System?

The information that a business includes in their Management System will depend on their objectives and which ISO Standard(s) they choose to implement. It will also depend on the nature of the business, and which industry the business operates in. For example, if a construction company wants to achieve Certification to the requirements of the ISO 9001:2015 Quality Management System Standard, they will need to develop and implement a number of documents that reflect their core operations. These documents should be made up of:

How can a business implement these documents?

A management system must reflect the business’ unique culture, vision and mission. Therefore, to be effective and valuable, it must be tailored to the business needs and be fully embedded in the business operations. To achieve that, a management system should be:

Once all the documentation required is developed, the Management System needs to be effectively implemented. Implementation of a Management System means to live by the policies and work in accordance with the processes and procedures, monitoring plans, capturing data, and analysing it for decision-making. Relevant processes and related documentation must be assigned to a respective responsible person, who ensures the process is current and followed.

Let’s take a look at an example:

A procedure about communication should outline when and how the company communicates to both internal and external parties (i.e. employees, suppliers, contractors). In order for the procedure to be effectively implemented, the organisation should also be able to show evidence that such communication happened. Evidence will depend on the item and method of communication, but it could include: signage in the office for company policies, records of emails for important announcements or memos, or meeting minutes. This evidence is checked in both internal and external audits, and failure to demonstrate them can result in issues being raised (Opportunities for Improvement or Non-conformances).

Auditing a Management System

Conducting periodic Internal Audits is a practical way to assess both the effectiveness and maturity of a management system, and continually improve the business processes and operations. One of the many benefits of auditing the management system is the identification of any gaps, so that corrective and/or preventative action can be taken to improve the system and avoid any non-conformances. Internal Audits also help businesses with continual improvement initiatives, where properly developed audit programs will help measure the results of these improvements over time, and identify opportunities for doing things more effectively.

For ISO Management System Standards, it is a requirement to complete regular Internal Audits of the Management System. Some businesses may opt to engage with an external consultant to conduct these audits, while others may choose to use their own internal resources (their employees).

However, in order for someone in the business to conduct Internal Audits, they need to be deemed competent to do so, and the first step is training. With our Management Systems Internal Auditor Training, you can study online and achieve three levels of internationally recognised certificates, including the one for competency after successful assessment of your first internal audit by one of our experts. Our Internal Auditor training also provides the tools to develop all the skills and resources needed to become a competent internal auditor.

The post What is a Management System? Do businesses need a Management System to become Certified to ISO Standards? appeared first on ICExperts Academy.

As an ever-hot topic in business conversations, effective leadership is arguably one of the most important qualities in a workplace, as it can determine a business’s success. It can be described as the ability to influence and encourage others, take risks, act decisively, communicate effectively, and the list goes on. Almost every situation in business requires a leader to vary behaviour to fit the prevailing circumstances, which will directly contribute to the success of any business. But how can you ensure that leadership commitment transpires into business improvement projects, such as the implementation of an ISO Management System Standard?

As a key requirement across all main ISO Management System Standards, Leadership and Commitment are vital contributions to the certification-readiness and maintenance process. Its importance is reinforced from top to bottom in each core standard, as the Management System must be aligned with business objectives, which are usually formed by top management.

For example, in the ISO 9000 Family of Standards, top management is defined as the person or group of people who directs and controls an organisation at the highest level. They must ensure that the chosen standard’s requirements, with its policies and objectives, are consistent with the strategic context and direction of the business.

Among other topics, Clause 5.1 in the ISO 9001:2015 Quality Management System Standard specifies that top management shall demonstrate leadership and commitment by:

The development and implementation of any Management System is a massive task for any business, which at times can be quite complex. Therefore, it should go without saying that there should be full leadership support throughout the entire process, as described above. However, leadership involvement by top management is too often overlooked, causing significant problems with the system implementation, and can become issues raised when the business has their Internal and External Audits.

What happens when leadership fails to support a Business Management System?

Although the decision to implement one or more ISO Management System Standards to achieve Certification mostly comes from top management, it’s common to find that their involvement stops there.

The Leadership and Commitment clause in the main ISO Management System Standards often ends up being neglected, as top management solely relies on their employees to develop and implement the Management System for them. In some cases, top management doesn’t even attend their Internal or External Audits, because they haven’t made it a priority to learn about the new Management System, or be involved in any part of the process.

Without involvement of top management throughout the certification process, there are some damaging consequences which could not only impact their certification, but also the business as a whole. Some of these include:

How can top management demonstrate leadership support when implementing and maintaining a Management System?

It goes without saying that a business cannot successfully operate day-to-day without effective leadership from top management. So why would it be any different when developing, implementing and maintaining a new Management System into the business?

The involvement of top management during this process is crucial, to ensure that the Management System policies, procedures and objectives directly align with the business’s strategic direction. Top management is responsible for communicating this to the team, and ensuring that these policies and procedures are being followed correctly, so that business objectives and strategic goals can be met. Regular check-ins with employees should be conducted to make certain that the Management System has been effectively integrated into the organisation’s existing processes.

The “set by example” effect is also applicable here – each person will take the policies and procedures as seriously as leadership does. This is especially sensitive as the development and implementation of the Management System can be a daunting process, one that requires motivation and encouragement, before and after achieving Certification.

Below are some of the actions top management must put into practice to support the effective implementation and use of the Management System:

By ensuring the Management System works cohesively with the organisation’s business processes, the organisation will not only meet the ISO Standard’s requirements, but also ensure it relishes all the benefits of working with an effective Management System. Reduced costs, increased productivity, continuous improvement culture, and improved staff morale are just a few of those benefits.

How can you approach the Leadership and Commitment clause when conducting Internal Audits?

As you progress your studies to become an ISO Management Systems Internal Auditor, it’s important to cover how you can approach the Leadership and commitment clause in your audit. Make sure you look for consistent evidence of a “hands-on” top management approach. This should be assessed during interviews with the staff and leadership members; key questions such as the below should help you:

Other evidence of top management involvement could be found in:

The post The Importance of Leadership Commitment for effective ISO Management Systems appeared first on ICExperts Academy.

There are many different types of audits, such as financial audits, safety audits, and operational audits. For ISO Management System Standards, audits are a major component of the Certification process, requiring different types of audits along this journey.

To be Certified, a business needs to go through Certification Audits with an Accredited Certification Body. However, the ISO Management System Standards also require Internal Audits both before a business goes for their Certification Audits, and after achieving their certification, to meet ongoing requirements and to facilitate continual improvement.

Having the Internal Audits conducted by a competent auditor will ensure that a business will get the most out of this process, where gaps, non-conformances and areas for improvement can be identified, facilitating continual improvement.

Continue reading to find out why it is important to be a competent auditor, and what the ISO 19011:2018 standard is.

What is ISO 19011:2018?

ISO 19011:2018 is a set of guidelines for auditing management systems.

ISO 19011:2018 is designed to advise organisations on how to go about auditing management systems for conformance to standards such as ISO 14001:2015 for Environmental Management Systems and ISO 9001:2015 for Quality Management Systems. The standard provides guidance on preparing audit programs, management of an audit programme, on the planning and conducting of management system audits, as well as on the competence and evaluation of an auditor and an audit team.

The ISO 19011:2018 standard focuses on applying the principles of continual improvement to audits. This will include ensuring that the audit program’s objectives align with the key objectives of the organisation being audited, guaranteeing that the needs and best interests of customers and other stakeholders are prioritised.

The guidance provided by the standard is intended to be flexible. The size and level of maturity of an organisation’s management system, as well as the nature and complexity of an organisation being audited should be considered, so that an appropriate audit schedule can be planned.

Types of audits

In a nutshell, an audit is a systematic process where objective evidence is obtained and evaluated to determine if a business has fulfilled a set of criteria or requirements.

The ISO 19011:2018 guidelines document concentrates on Internal Audits, and audits conducted by organisations on their external providers and other external interested parties. However, before we get further into the blog, let’s get you up to speed with the different types of audits.

First party audits, commonly referred to as Internal Audits, are conducted by the organisation being audited, or by someone on behalf of the organisation. The internal audit will measure effectiveness of management systems implementation and conclude if the organisation has met the requirements of the relevant ISO Management System Standard(s).

Second party audits are performed on a supplier or provider’s systems or operations by their client or a contracted organisation on their behalf. For example, an organisation might hire someone to audit its supplier’s system to ensure that an organisation meets contractual obligations and requirements.

Third party audits, also referred to as Certification Audits, are independent impartial audits with the objective of assessing the level of conformity of Business Management Systems against ISO Standards. These Audits will be conducted by a Conformity Assessment Body (CAB), who will, upon successful audit outcomes, issue the Certifications against the chosen Standard(s), e.g. ISO 9001:2015.

The seven auditing principles

It’s crucial that an audit is conducted effectively and with reliability, to support management and drive improvement across the business. In order to achieve this, ISO 19011:2018 provides 7 auditing principles that act as a prerequisite for consistent audit practices. They are as follows:

Working in accordance with these 7 principles enables auditors to reach similar audit conclusions in similar circumstances, even when working independently from one another anywhere in the world.

Competence of Internal Auditors

Like many roles and processes in organisations, confidence in the audit process and the ability to achieve its objectives depends on the competency of the individuals performing the audits. The ISO 19011:2018 Standard refers to the competence of management systems auditors.

In deciding the necessary competence for an internal audit, it’s important to consider an auditor’s knowledge and skills in relation to:

An individual’s competence should be evaluated through a process that considers personal behaviour and the ability to apply the knowledge and skills gained through education, work experience, auditor training and audit experience, which will be discussed next.

Auditors personal behaviour

Auditors need to ensure that they are always exhibiting professional behaviour while performing audit activities. Most of these personal behaviours will stem from the 7 auditing principles which were previously mentioned. The main traits of an auditor’s personal behaviour should be as follows:

Knowledge and skills

In relation to knowledge and skills, auditors should possess:

Click here to read about the 5 Key Skills of a Good Management Systems Auditor

Achieving Internal Auditor competence

Internal Auditor competence can be achieved via a combination of four aspects, including:

1. Successfully completing an Internal Auditor Training program that covers auditing theory, tools and skills;
2. Training, knowledge, and/or experience in the specific management system discipline(s) to be audited (for example, ISO 9001:2015 for Quality, ISO 45001:2018 for Safety, ISO 14001:2015 for Environmental, and/or ISO 27001:2013 for Information Security);
3. Existing experience in an organisation and/or industry which can provide organisational context and knowledge; and
4. Being deemed competent by an already-competent auditor in the same management system discipline who has supervised or witnessed the individual conducting an internal audit.

In order for someone in the business to be deemed competent to conduct Internal Audits of ISO Management Systems, the first step is training. With our Management Systems Internal Auditor Training, you can achieve three levels of internationally recognised certificates, including the one for Competency after successful assessment of your first internal audit by one of our experts. Our Internal Auditor training also provides the tools to develop all the skills and resources needed to become a competent internal auditor, in line with the guidelines of ISO 19011:2018.

The post Why is it Important to be a Competent Internal Auditor? Understand the ISO 19011:2018 Guidelines for auditing management systems Standard appeared first on ICExperts Academy.

Getting certified to one or more ISO Management System Standards can be a confusing and overwhelming process, especially if this is a brand new concept for you. What exactly are the ISO Management System Standards, and why are they important for a business? Most importantly, how can a business actually get certified to an ISO Standard?

We get it, the whole ISO world sounds complex, and can seem a bit confronting. But let’s start from the beginning, and clarify all these big questions.

What is ISO?

The International Organisation of Standardisation (ISO) is an independent, global body, made up of an extensive network of individuals that specialise in different areas. ISO is a non-governmental organisation that forms a bridge between the public and private sectors. Initially founded in Geneva, Switzerland, its memberships now extend to more than 160 countries.

ISO develops standards to ensure the quality, safety, sustainability and efficacy of products, services and systems. As technology and new markets continue to rapidly develop, new ISO Standards are drafted and implemented by ISO members globally. This ensures that businesses of all size, type and nature can benefit from International Standards.

What are ISO Standards, and how are they developed?

Essentially, an ISO Standard is an internationally proven and recognised way for a business to run its operations aligned with a particular discipline and objective. But how are ISO Standards developed?

ISO Standards are only developed once there is an identified industry need for standardisation. Experts begin working to prepare a draft, including its scope, key definitions and content. The draft is then shared with all ISO National members for review, where the approval process begins in various stages. Once all ISO members are satisfied with the standard, it will be published and available for the public to use, and in some cases, for business to work towards its Certification to that Standard when applicable.

All ISO Standards are then reviewed approximately every five years by the relevant ISO member bodies. This could result in confirmation, revision (resulting in a new updated version published), or complete withdrawal of the standard.

What are the main ISO Management System Standards?

There are over 24,000 ISO Standards available, each one developed to address different aspects or challenges that affect organisations globally. The standards serve as a framework to manage a variety of technical topics and processes throughout a business and achieve set goals and industry requirements.

The most widely-adopted ISO Management System Standards are:

ISO 9001:2015, ISO 45001:2018, ISO 14001:2015 and ISO 27001:2013.

Let’s briefly have a look at each of these standards:

Business needs – Which ISO Standard is recommended?

It can be challenging to know exactly which ISO Management System Standard a business needs, as not all businesses will require the same ISO Standards.

Some businesses will need to be certified as part of contractual or regulatory requirements. This could be imposed by a client, a regulatory body, or for a government tender. In these cases, it’s easy to know which standards a business needs certification to – simply confirm with the appropriate interested party (it could be provided on a document from the requesting party, listing the standards).

If a business needs certification for any other reason, such as business improvement in particular areas, it will then be a different process. The business will need to analyse each standard, and figure out the most suitable and beneficial one for their particular industry to meet the desired objectives. Reading and understanding the actual standards you are interested in will help you understand more to make such a decision.

How can ISO Standards actually help a business?

Not only will the implementation of an ISO Management System Standard benefit a business, but the actual Certification itself will also provide businesses with a number of benefits, including:

How to become Certified to one or more ISO Standards

Once a business decides which ISO Management System Standards to go with, the journey to achieving certification begins.

The entire Certification process can be summarised as follows:

The business will need to define the standards required, and then purchase a copy of the chosen ISO Standards (this is an actual licensed document developed by ISO that you purchase, which contains all the requirements).

If the business already has a variety of things in place that could be used for meeting the requirements (such as established processes and policies), a gap analysis could be performed. This will determine what still needs to be done, to then plan the next steps.

The business will then need to develop all documentation required to meet the requirements of the chosen ISO Standard(s). This documentation is what the Standards refer to as a Management System, and could include business processes, policies, and software or templates to capture records, etc.

Once the documentation is developed, reviewed and published (live and ready for use), the next step is implementation.

Implementing the Management System means actually putting the system into practice. This involves coaching the team on how to use it, following the new processes, populating forms, saving records, and making sure it’s fully embedded in the day-to-day business activities.

Once the system is implemented, the business will need to conduct an Internal Audit and a Management Review, to define the strategy moving forward for the monitoring of the effectiveness of its Management System.

Internal Audits are a requirement of the main ISO Management System Standards. An Internal Audit is a full review of the management system to ensure that it has met all of the ISO Standard requirements, as well as the organisation’s own requirements, before going for certification. The ISO Standards require that an auditor has to be deemed competent to conduct these internal audits. Therefore, if a business does not engage an external auditor, and decides to use its internal resources (employees) to conduct these Internal Audits, they have to make sure these people are trained and qualified to do so.

Our Management Systems Internal Auditor training is a practical eLearning course that teaches how to conduct effective Internal Audits in accordance with the core ISO Management System Standards. In addition to a Certificate of Completion, included in the course is also a competency assessment (and Verification of Competency Certificate) that will demonstrate that your are qualified to conduct internal audits.

When the business is ready for certification, they will need to be audited by an Accredited Conformity Assessment Body (CAB) – also known as Certification Body. A CAB is an organisation that is accredited to conduct audits of businesses’ Management Systems and issue internationally recognised Certifications to the ISO Standards.

The Certification Audits are split into two stages:

If all business activities prove to conform according to the requirements, the CAB will issue the Certification(s) to the audited business.

Note: The Certification Audit is also commonly referred to as a Third Party Audit.

After the business has achieved Certification(s), the 3-year certification cycle begins. During this period, the Certification Body will return to conduct yearly Surveillance Audits to verify that the Business Management System is still meeting the ISO Standard(s) requirements, as well as their own operational requirements.

Note: The business is also required to conduct Internal Audits each year. With our Internal Auditor training, your team can become qualified to conduct these.

Download a summary of the entire Certification process below!

Get your FREE Certification Process Diagram today!

Now that you know what it means to be certified to an ISO Management System Standard, it’s time to decide what your next step is and your role in this journey. Are you assisting a business in achieving certification? Is it for your own business?

The post What Exactly is Certification to ISO Standards? appeared first on ICExperts Academy.

As you start your studies in ISO Management Systems, it’s common to get confused about the key concepts and technicalities.

We’ve put this blog article together to answer common questions regarding this topic and explain the four main ISO Standards: ISO 9001:2015, ISO 45001:2018, ISO 14001:2015, and ISO 27001:2013. Even if you’re already working in this area, this is an excellent opportunity to review the core concepts and make sure nothing’s been forgotten along the way. Let’s get started!

What are ISO Management System Standards and how can a business can get certified?

ISO Management System Standards are documents that provide requirements, specifications, and guidelines that when met and used consistently, ensure that an organisation’s products, services, and processes operate to a high standard of each discipline.

The ISO Standards are developed, published and kept up to date by the International Organisation for Standardisation, also known as “ISO“. The Standards define the requirements for Business Management Systems to achieve international best practice for a chosen discipline (e.g. Occupational Health and Safety, Quality, Environment, or Information Security).

Businesses from any industry can get certified to an ISO Management System Standard. To achieve certification, the organisation needs to have its Business Management System audited by an Accredited Conformity Assessment Body (commonly called a Certification Body). They will conduct the Certification Audits to verify that the business meets the requirements of one or more ISO Management Systems Standards.

Before exploring the main ISO Standards, it’s also important to understand:

What is a Business Management System?

A Business Management System is a set of documented policies, processes and other relevant documentation that an organisation implements to guide the business towards its objectives and goals.

A Business Management System can conform with the requirements of one or more ISO Standard(s). An organisation can integrate the requirements of one or more standards into its management system and achieve certification for one or more ISO standards, as long as their management system can demonstrate that they meet the requirements for all of them.

For instance, the ISO 9001 Standard is a set of quality management requirements that a business needs to meet if aiming to achieve certification to ISO 9001:2015 Quality Management Systems. These Quality Management requirements need to be integrated throughout the business management system and its processes in order to achieve certification to ISO 9001:2015. If certified, your business will then be recognised as running according to an internationally recognised quality standard.

The level of complexity of the management system depends on the context of each organisation. Smaller businesses might not need extensive documentation, while more complex businesses operating in highly regulated sectors, for example, may need a more comprehensive set of documentation and controls to meet compliance responsibilities and their business objectives.

The main ISO Management System Standards

ISO has published more than 23,000 International Standards. Each Standard has a specific number and is followed by the year of its release.

While some are industry-focused, others are more generic and versatile across any type of organisation. The latter is the case of the four main ISO Management Systems Standards:

• ISO 9001:2015 Quality Management Systems

This is by far the most popular standard. This Standard is about developing and implementing a Quality Management System (QMS) with a risk management approach and a strong focus on customer satisfaction, leadership, motivation, process and business continuous improvement to deliver high-quality products and services, not only to the end consumer but all stakeholders.

• ISO 45001:2018 Occupational Health and Safety Management Systems

This provides a systematic approach to enable an organisation to manage Occupational Health and Safety (OH&S) risks and opportunities, eliminating hazards and minimising Occupational Health and Safety risks. The Standard’s framework helps businesses effectively prevent workers’ work-related injury and ill health and provide a safe and healthy workplace. The Safety Management Standard emphasises the responsibilities of the management and leadership team and highlights the necessity of everyone in the workplace to participate.

• ISO 14001:2015 Environmental Management Systems

This Standard provides a framework for the business to have better management control in reducing its environmental impact and achieving higher conformance with environmental legislative and regulatory requirements. By conforming with this Standard, the business can operate efficiently and lawfully while also minimising its negative influence on the environment.

• ISO 27001:2013 Information Security Management Systems

Promoting the protection, confidentiality and integrity of information is the focus of this Standard. By applying a risk management approach, ISO 27001:2013 provides a framework for assessing and treating information security threats. By developing a tailored Information Security Management System, the organisation can keep assets such as financial information, intellectual property, employee details, customer data and other information entrusted to them by third parties safe.

The post What are the main ISO Management System Standards? How can a business get certified? appeared first on ICExperts Academy.

As you go through your learning journey, the question about what makes a good auditor (and, of course, how to become one of them) might be recurring in your mind. Will the technical knowledge be enough? Should I focus on developing other skills beyond the training content?

Well, the truth is that a good auditor is made of a mix of different abilities. From non-technical attributes (the so-called “soft skills”) to industry experience, there’s a variety of factors building up an internal auditor’s performance.

A good starting point to elaborate on this subject is the 7 auditing principles as defined by the ISO 19011:2018 Guidelines for Auditing Management Systems Standard. These are the basics of what businesses should have in mind when looking for an effective auditor:

1. Integrity – the foundation of professionalism
2. Fair Presentation – the obligation to report truthfully and accurately
3. Due Professional Care – the application of diligence and judgement in auditing
4. Confidentiality – security of information
5. Independence – the basis for the impartiality of the audit and objectivity of the audit conclusions
6. Evidence-Based Approach – the rational method for reaching reliable and reproducible audit conclusions in a systematic audit process
7. Risk-Based Approach – an audit approach that considers risks and opportunities

To better understand how to integrate these auditing principles with your skills and put them into practical actions, check out our list of the 5 key skills of a good Management Systems Auditor:

1. Objective decision making

The auditor should take an evidence-based approach when making decisions to compose the audit findings summary, which should result from thorough analysis. As the management systems audit is a sampling process, the summary in the report must be a representation of what the auditor witnessed.

There shouldn’t be any conflicts of interest or anything that could influence the auditor’s decisions. The auditor must not be satisfied with imprecise responses; it’s essential to get to the bottom of any issues to present a meaningful and objective summary in the report, which will truly help address any problems.

2. Understanding different business requirements

Thorough planning, detailed preparation processes, and the adaptability to work within various business structures and environments are other important attributes of a good auditor. Auditors need to be aware of the:

In a nutshell, adaptability is the type of soft skill that, combined with technical knowledge, will help the auditor identify practical opportunities for improvement that make sense for the business.

3. Effective time management

Keeping to the proposed schedule, attending meetings on time, prompting feedback on the work progress – as basic as these actions may sound, you might be surprised by how many times they’re ignored.

Reckless behaviour with time management may impact the company’s operations by over-spending the workers time for audit interviewing, for example. Therefore, it is vital that the auditor follows their guidelines and completes the work on time.

Unexpected situations may happen, but that’s exactly where good time management will help an effective auditor to keep the client’s trust, making sure unforeseen events won’t negatively impact the audit.

4. Effective communication

Clear communication throughout the entire audit process will create a positive working setting for the auditee and the auditor. It is essential to communicate any findings during the audit to avoid surprises within the audit report. Likewise, if there’s something that’s working well in the business’ system, the auditor should make the team aware of it and acknowledge the good work.

To communicate effectively, auditors should ask open-ended questions. When listening to the auditee’s answer, the auditor must register the facts, look at what’s going on, and check the documented information. As an auditor can frequently access sensitive information, it’s also crucial to keep the business information confidential throughout the entire process.

5. Experience and training

Certainly, the more experienced the auditor, the better, as they’ll be more confident when conducting the audit. However, other factors rather than simply the number of audits performed come into play. Experience in a certain industry (even if not as an auditor) and internationally recognised training can be valuable assets of less experienced auditors.

Businesses may require an auditor’s resume/profile and verify their qualifications – so make sure to keep your CV up to date and have your certificates ready if needed.

Also, be aware that if the business aims to achieve certification to an ISO Management Systems Standard, the external Certification Auditor usually asks to see a Certificate of Competency from the auditor who conducts internal audits, as they must be deemed competent to perform internal audits. Therefore, doing internal auditor courses that provide this type of qualification can help boost your professional profile as an auditor.

The post 5 Key Skills of a Good Management Systems Auditor appeared first on ICExperts Academy.