Auditing Management Systems with ISO 19011

Why This Topic Matters for the CSP Exam

The Certified Safety Professional (CSP) examination places heavy emphasis on management systems and program management. A safety professional is expected not only to design and implement an occupational health and safety management system (OHSMS), but also to verify that the system is working as intended. Auditing is the primary tool for that verification. ISO 19011, Guidelines for Auditing Management Systems, is the internationally recognized framework that tells you how to plan, manage, conduct, and follow up on audits of any management system, including ISO 45001 (OH&S), ISO 14001 (environmental), and ISO 9001 (quality).

Internal audits are explicitly required by ISO 45001 (Clause 9.2), and ISO 45001 points to ISO 19011 for guidance on how to perform them. On the exam, you may see questions about audit principles, audit types, the sequence of audit activities, roles and responsibilities, auditor competence, and the difference between an audit programme and an audit plan. You may also face scenario questions asking what an auditor should do when evidence is incomplete, when an auditee becomes defensive, or when a nonconformity is discovered. Understanding ISO 19011 gives you the vocabulary and logic to answer these correctly.

Beyond the exam, auditing competence distinguishes a safety practitioner from a safety leader. Audits provide senior management with objective assurance that controls are in place, that legal and other requirements are being met, and that continual improvement is actually happening rather than being assumed.

What ISO 19011 Is (and Is Not)

ISO 19011 is a guidance standard, not a requirements standard. This is a critical distinction. You cannot be certified to ISO 19011; it contains no shall statements that an organization must meet. Instead, it offers recommended practices for anyone involved in auditing management systems: internal auditors, auditors working for customers or suppliers, and auditors working for certification bodies.

The current edition is ISO 19011:2018, which replaced the 2011 edition. Key changes in 2018 included the addition of a risk-based approach as a seventh auditing principle, expanded guidance on managing the audit programme (including programme-level risks and opportunities), greater emphasis on auditor competence, and new guidance on remote (virtual) auditing using information and communication technology (ICT).

ISO 19011 should not be confused with:
- ISO/IEC 17021-1, which sets requirements for bodies providing third-party certification of management systems.
- ISO 45001, which sets requirements for an OHSMS itself.
- ISO 9001 / ISO 14001, which set requirements for quality and environmental management systems.

Think of it this way: ISO 45001 tells you what a good safety management system looks like; ISO 19011 tells you how to audit it.

Core Definitions You Must Know

Audit: A systematic, independent, and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. Memorize the three adjectives: systematic, independent, documented.

Audit criteria: The set of requirements used as a reference against which objective evidence is compared. Criteria can include policies, procedures, legal requirements, contractual obligations, and management system standards.

Audit evidence: Records, statements of fact, or other information that is relevant to the audit criteria and verifiable. Evidence may be qualitative or quantitative.

Audit findings: The results of evaluating the collected audit evidence against the audit criteria. Findings indicate conformity or nonconformity and may identify opportunities for improvement or good practices.

Audit conclusion: The outcome of the audit after considering the audit objectives and all audit findings. The conclusion is the big-picture judgment; findings are the individual building blocks.

Nonconformity: Non-fulfilment of a requirement.

Audit programme: Arrangements for a set of one or more audits planned for a specific time frame and directed toward a specific purpose. This is the overarching, often annual, schedule and strategy.

Audit plan: Description of the activities and arrangements for an individual audit. One programme contains many plans.

Audit scope: Extent and boundaries of an audit (locations, functions, processes, time period).

Audit client: The organization or person requesting the audit.

Auditee: The organization (or part of it) being audited.

Audit team: One or more persons conducting the audit, supported if needed by technical experts. One auditor is designated the audit team leader.

Technical expert: A person who provides specific knowledge or expertise to the audit team but does not act as an auditor.

Observer: A person who accompanies the audit team but does not audit (for example, a trainee or regulator).

Guide: A person appointed by the auditee to assist the audit team (escorting, arranging interviews, clarifying site rules).

Types of Audits

First-party (internal) audit: Conducted by, or on behalf of, the organization itself for management review and other internal purposes. The auditor should be independent of the activity being audited, but may be an employee.

Second-party (external) audit: Conducted by parties having an interest in the organization, such as customers auditing suppliers, or contractors being audited by the owner organization.

Third-party (external) audit: Conducted by independent organizations such as certification or registration bodies, or regulatory agencies. Certification audits fall here.

Combined audit: Two or more management systems (e.g., ISO 45001 and ISO 14001) are audited together at a single auditee.

Joint audit: Two or more auditing organizations cooperate to audit a single auditee.

Exam questions frequently test whether you can classify a scenario correctly. A corporate safety director auditing a plant within the same company is performing a first-party audit even though the director does not work at that plant. A client auditing a contractor is second-party. A registrar granting ISO 45001 certification is third-party.

The Seven Principles of Auditing

ISO 19011:2018 rests on seven principles. The first four relate to auditors as people; the last three relate to the audit process. Expect at least one exam question on these.

1. Integrity: The foundation of professionalism. Auditors perform their work ethically, honestly, and responsibly; act within legal requirements; demonstrate competence; remain impartial; and are sensitive to influences on their judgment.

2. Fair presentation: The obligation to report truthfully and accurately. Findings, conclusions, and reports reflect the audit activities completely and accurately. Significant obstacles encountered and unresolved differences of opinion between the audit team and auditee are reported.

3. Due professional care: The application of diligence and judgment in auditing. Auditors exercise care in accordance with the importance of the task and the confidence placed in them by the audit client and other interested parties.

4. Confidentiality: Security of information. Auditors protect information acquired during the audit and do not use it inappropriately for personal gain or in a manner detrimental to the auditee.

5. Independence: The basis for impartiality and objectivity of conclusions. Auditors are independent of the activity being audited wherever practicable and free from bias and conflict of interest. For internal audits, auditors should be independent of the function being audited.

6. Evidence-based approach: The rational method for reaching reliable and reproducible conclusions. Evidence should be verifiable and is generally based on samples of available information, since audits are conducted in a finite time with finite resources. Appropriate sampling is closely related to confidence in the conclusions.

7. Risk-based approach (new in 2018): Audits consider risks and opportunities. The approach influences planning, conducting, and reporting so that audits focus on matters significant to the audit client and to achieving audit programme objectives.

How It Works: Managing an Audit Programme (Clause 5)

ISO 19011 structures audit programme management around the Plan-Do-Check-Act (PDCA) cycle. The person managing the audit programme is responsible for the following:

Establishing audit programme objectives: Objectives should align with the organization's strategic direction and management system policies. Examples include verifying conformity with requirements, evaluating effectiveness, identifying improvement opportunities, meeting customer or regulatory expectations, and evaluating supplier capability.

Determining and evaluating audit programme risks and opportunities: Risks might include poor planning, inadequate resources, unrealistic scheduling, insufficient auditor competence, ineffective communication, or ineffective monitoring. Opportunities might include conducting multiple audits in one visit or aligning audit dates with key staff availability.

Establishing the audit programme: Defining roles and responsibilities, competence of the programme manager, extent of the programme (number, types, duration, locations, schedule), resources, and procedures.

Implementing the audit programme: Defining objectives, scope, and criteria for each individual audit; selecting audit methods; selecting audit team members (considering competence, independence, and team size); assigning responsibility for each audit to the team leader; managing audit programme outcomes; and maintaining records.

Monitoring the audit programme: Evaluating whether schedules are met, objectives are achieved, auditor performance is adequate, and the programme remains aligned with changing needs.

Reviewing and improving the audit programme: Lessons learned feed back into the next cycle; results are reported to top management for management review.

How It Works: Conducting an Individual Audit (Clause 6)

The exam often tests the sequence of audit activities. Learn this order.

Step 1: Initiating the audit. The audit team leader establishes initial contact with the auditee, confirms authority, determines the feasibility of the audit (sufficient information, cooperation, time, and resources), and agrees on objectives, scope, criteria, and logistics.

Step 2: Preparing audit activities. This includes reviewing documented information (the document review may reveal gaps that should be clarified before fieldwork), planning the audit using a risk-based approach, preparing the audit plan (objectives, scope, criteria, locations, dates, times, methods, team roles, resources), assigning work to team members, and preparing work documents such as checklists, sampling plans, and forms for recording evidence. Checklists are aids, not scripts; auditors should not let them restrict the scope of inquiry.

Step 3: Conducting audit activities.
- Opening meeting: Led by the team leader; confirms the plan, introduces the team, explains methods, confirms communication channels, confirms confidentiality, reviews safety and emergency procedures for the auditors, and provides the auditee an opportunity to ask questions.
- Communication during the audit: The team meets periodically to exchange information and reassign work; the team leader communicates progress and any significant concerns to the auditee promptly. If evidence suggests an immediate and significant risk, it is reported without delay.
- Roles of guides and observers: Guides assist but must not influence or interfere with the audit.
- Collecting and verifying information: Methods include interviews, observation of activities and conditions, and review of documented information (procedures, records, training files, permits, inspection reports, incident data). Only information that is verifiable may be accepted as audit evidence. Information is sampled; the auditor chooses between judgment-based sampling and statistical sampling depending on the objective.
- Generating audit findings: Evidence is compared to criteria. Conformity is recorded. Nonconformities are recorded with supporting evidence and reviewed with the auditee to ensure the evidence is accurate and the nonconformity is understood. Attempts are made to resolve any disagreement; unresolved points are recorded.
- Determining audit conclusions: The team meets before the closing meeting to review findings, agree on conclusions, prepare recommendations if required by the plan, and discuss follow-up.
- Closing meeting: Led by the team leader; presents findings and conclusions so they are understood and acknowledged; explains that evidence was sampled and therefore some uncertainty exists; discusses the method and timeframe for the auditee's corrective action; explains post-audit activities and how to handle disputes.

Step 4: Preparing and distributing the audit report. The report should provide a complete, accurate, concise, and clear record of the audit, including objectives, scope, client, team and participants, dates and locations, criteria, findings and evidence, conclusions, and a statement on the degree to which criteria have been fulfilled. It is issued within the agreed time and distributed as defined in the plan or programme procedures.

Step 5: Completing the audit. The audit is complete when all planned activities are done or as agreed with the client. Documented information is retained or destroyed per agreement and applicable requirements. Lessons learned are fed into the improvement process.

Step 6: Conducting audit follow-up. Depending on objectives, the conclusions may indicate a need for correction, corrective action, or improvement. The auditee decides on and implements these actions within an agreed timeframe. Verification of completion and effectiveness may be part of a subsequent audit. Note: the auditor evaluates and reports; the auditee owns the corrective action.

Competence and Evaluation of Auditors (Clause 7)

Confidence in the audit process depends on the competence of those conducting it. ISO 19011 describes competence as the combination of personal behaviour plus the knowledge and skills gained through education, work experience, auditor training, and audit experience.

Desired personal behaviours include being ethical, open-minded, diplomatic, observant, perceptive, versatile, tenacious, decisive, self-reliant, able to act with fortitude, open to improvement, culturally sensitive, and collaborative.

Knowledge and skills fall into categories:
- Generic: audit principles, processes and methods; management system standards; the organization and its context; applicable legal, regulatory, and contractual requirements.
- Discipline- and sector-specific: for a safety audit, this means knowledge of hazard identification, risk assessment, hierarchy of controls, OH&S legal requirements, and industry-specific processes.
- Audit team leader: additional competence in planning, managing the team, communicating with the client and auditee, resolving conflicts, and leading the team to conclusions.

Auditor evaluation methods include review of records, feedback, interviews, observation, testing, and post-audit review. Competence should be re-evaluated periodically and maintained through continual professional development.

Audit Methods and Remote Auditing

ISO 19011:2018 recognizes a matrix of methods: on-site vs. remote, and with human interaction (interviews, meetings) vs. without human interaction (document review, observation via video, data analysis). Remote auditing using ICT is acceptable when appropriate, but the programme manager should consider risks such as data security, inability to observe actual working conditions, and reduced ability to detect undocumented practices.

Relationship to Safety Program Management

In an OHSMS context, auditing closes the Check portion of PDCA and feeds management review (Act). Audit results provide input on legal compliance status, effectiveness of risk controls, achievement of OH&S objectives, worker participation, and progress on corrective actions. Audits should be distinguished from inspections: an inspection examines physical conditions and hazards at a point in time; an audit examines whether the system (policies, processes, responsibilities, records) is adequate, implemented, and effective. A workplace can pass every inspection and still fail an audit if there is no process ensuring inspections are performed, tracked, and acted upon.

Exam Tips: Answering Questions on Auditing Management Systems with ISO 19011

1. Know the definition of audit cold. If answer choices describe a process that is systematic, independent, and documented, and compares evidence to criteria, that is an audit. If a choice omits independence or describes simply looking for hazards, it is probably an inspection or a survey.

2. Distinguish programme from plan. Programme = the overall set of audits over a period (strategic, managed by the programme manager). Plan = the arrangements for one specific audit (tactical, prepared by the team leader). Questions that mention annual scheduling, resource allocation, or programme risks point to the programme; questions about a particular site visit, agenda, or team assignments point to the plan.

3. Classify audit types by who performs them. Internal/first-party = the organization auditing itself. Second-party = an interested party such as a customer. Third-party = an independent body such as a registrar. Do not be fooled by location; a corporate auditor visiting a remote plant is still first-party.

4. Memorize the seven principles and their one-line meanings. Integrity (ethical conduct), fair presentation (truthful reporting), due professional care (diligence and judgment), confidentiality (protect information), independence (free from bias), evidence-based approach (verifiable, sampled evidence), risk-based approach (focus on what matters). If a question asks which principle is violated when an auditor shares auditee data with a competitor, the answer is confidentiality. If an auditor reports only favorable findings, fair presentation is violated. If an auditor audits a department she manages, independence is compromised.

5. Evidence must be verifiable. A statement in an interview is a lead until corroborated by records or observation. If a question asks what the auditor should do when an employee claims training was completed but no record exists, the correct response is to seek additional evidence (records, demonstration, other witnesses), not to accept the claim or immediately write a nonconformity without further inquiry.

6. Findings vs. conclusions. Findings are individual results against specific criteria; conclusions are the overall judgment considering all findings and the audit objectives. A question asking about the overall effectiveness of the OHSMS is asking about conclusions.

7. Know the sequence. Initiate, prepare (document review, plan, work documents), conduct (opening meeting, collect and verify, findings, conclusions, closing meeting), report, complete, follow up. If asked what happens first when a nonconformity is identified, the auditor reviews it with the auditee to confirm the evidence is accurate before it is finalized.

8. Opening and closing meetings are led by the audit team leader. The opening meeting confirms the plan and logistics; the closing meeting presents findings and conclusions. Both involve the auditee's management.

9. Corrective action belongs to the auditee. The auditor identifies nonconformities and may verify corrective action later, but does not design or implement the fix. An answer choice that has the auditor writing the auditee's corrective action plan is wrong (and would also compromise independence).

10. Technical experts do not audit; guides do not influence. If a scenario describes a guide steering auditors away from an area or answering questions on behalf of workers, recognize this as interference the team leader must address.

11. ISO 19011 is guidance, not requirements. If an answer choice says an organization must be certified to ISO 19011, eliminate it. Certification bodies follow ISO/IEC 17021-1; organizations seeking OHSMS certification conform to ISO 45001.

12. Immediate hazards are reported immediately. If an auditor observes an imminent danger during fieldwork, the correct action is to notify the auditee promptly (and the audit client as appropriate), not to wait for the closing meeting or the written report.

13. Sampling implies uncertainty. The closing meeting should acknowledge that evidence was sampled. An answer stating the audit proves there are no other nonconformities is incorrect.

14. Watch for the 2018 updates. If asked which principle was added most recently, it is the risk-based approach. If asked about auditing via video conference or shared electronic records, recall the ICT/remote auditing guidance and its associated risks.

15. Connect to PDCA and management review. Questions linking audits to the broader OHSMS usually want you to recognize that audit results are a required input to management review and a driver of continual improvement, and that internal audits are a requirement of ISO 45001 Clause 9.2 that is performed using ISO 19011 methodology.

16. Use elimination on scenario questions. Discard any answer that compromises independence, relies on unverified evidence, has the auditor doing the auditee's job, skips a step in the sequence, or treats guidance as a mandatory requirement. The remaining choice is usually correct.

Quick Review Summary

- ISO 19011:2018 = guidelines for auditing any management system; not certifiable.
- Audit = systematic, independent, documented process comparing objective evidence to audit criteria.
- Seven principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach.
- Audit types: first-party (internal), second-party (customer/interested party), third-party (certification body/regulator); combined and joint audits.
- Audit programme (many audits, PDCA-managed) vs. audit plan (one audit).
- Audit flow: initiate, prepare, conduct (opening meeting, collect/verify evidence, findings, conclusions, closing meeting), report, complete, follow up.
- Evidence must be verifiable and is sampled; findings feed conclusions.
- Auditee owns corrective action; auditors verify.
- Auditor competence = personal behaviour + knowledge and skills (generic, discipline-specific, team leader); evaluated and maintained continually.
- Audits verify the system; inspections check conditions. Audit results feed management review and continual improvement.