{"id":7613,"date":"2026-11-03T15:48:20","date_gmt":"2026-11-03T14:48:20","guid":{"rendered":"https:\/\/www.r2docuo.com\/en\/?p=7613"},"modified":"2026-11-03T15:48:20","modified_gmt":"2026-11-03T14:48:20","slug":"audit-management","status":"publish","type":"post","link":"https:\/\/www.r2docuo.com\/en\/audit-management","title":{"rendered":"Audit management: what it is, the certification cycle and how to organise it"},"content":{"rendered":"

Audit management is the set of processes an organisation uses to plan, carry out and close its audits. It includes deciding what is audited and when, assigning competent auditors, collecting the evidence, handling nonconformities until they are closed and, in certification audits, deciding on and issuing the certificate. It is carried out by certification and inspection bodies, audit firms and the quality departments that manage their internal and supplier audits. The international guideline for auditing management systems is ISO 19011, whose fourth edition was published in May 2026.<\/p>\n\n

In this guide you will find what an audit is and which types exist, the standards that govern the process (ISO 19011:2026, ISO\/IEC 17021-1, ISO\/IEC 17020, the IAF documents and the role of ENAC), the three-year certification cycle, how an audit programme is planned, who makes up the audit team, how an audit is conducted, how nonconformities are handled, how a certificate is decided and maintained, and how to digitise the whole process. It is written for people who manage audits.<\/p>\n\n

What audit management is<\/h2>\n\n

An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it to determine the extent to which a set of criteria is fulfilled: the requirements of a standard, a technical regulation, a contract or a company’s internal procedures. What sets it apart from a simple review is that the auditor does not give an opinion: they compare what they find against a written criterion and record it.<\/p>\n\n\n

\n

An audit is not an opinion: it is a documented comparison between what is found and a written criterion, whether a standard, a contract or a procedure.<\/p>\n<\/blockquote>\n\n\n

ISO 19011 distinguishes two levels. One is conducting an audit<\/strong>: preparing it, carrying it out, reporting the findings and following up. The other is managing the audit programme<\/strong>: the set of audits carried out over a period, with their objectives, risks, resources and schedule. Audit management covers both.<\/p>\n\n

An audit answers the question of whether a requirement is met; audit management ensures that every audit is done on time, with the right auditor and with every finding closed.<\/strong><\/p>\n\n

The three types of audit: first, second and third party<\/h3>\n\n

Audits are classified according to who audits whom. The distinction matters because it changes what is required of the auditor, above all in terms of independence.<\/p>\n\n

Type<\/th>Who audits<\/th>What for<\/th>Example<\/th><\/tr><\/thead>
First party (internal)<\/td>The organisation itself, with its own or contracted staff<\/td>To check its own system and prepare for certification<\/td>Annual internal audit of an ISO 9001 system<\/td><\/tr>
Second party<\/td>A customer, or someone on its behalf<\/td>To assess a supplier before or during the business relationship<\/td>A car manufacturer auditing its suppliers<\/td><\/tr>
Third party<\/td>An independent body, usually accredited<\/td>To certify, inspect or verify for third parties<\/td>ISO 27001 or National Security Framework (ENS) certification audit<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

What is audited: management systems or products<\/h3>\n\n

Most third-party audits assess a management system<\/strong>: quality (ISO 9001), environment (ISO 14001), occupational health and safety (ISO 45001), information security (ISO 27001) or Spain’s National Security Framework<\/a>. The result is a certificate stating that the system complies with the standard for a period of time.<\/p>\n\n

Others assess products, shipments or facilities<\/strong>. This is the field of inspection and product certification. One example is verification of conformity for exports<\/a>: some destination countries require an authorised body to review the documentation, inspect the goods and, if they comply, issue a certificate of conformity before they clear customs. The object and the standard that applies to the body change, but the way it is managed is the same: files, assigned inspectors, evidence, findings and a certificate at the end.<\/p>\n\n

The standards that govern audits<\/h2>\n\n

Anyone who manages third-party audits works with two kinds of standards: those that define what is audited at the client (ISO 9001, ISO 27001\u2026) and those that define how the auditing body itself must operate. The latter are the ones that govern audit management.<\/p>\n\n

Standard or document<\/th>What it regulates<\/th>Who it applies to<\/th><\/tr><\/thead>
ISO 19011:2026<\/td>Guidelines for auditing management systems: principles, programme management, conducting audits and auditor competence. It is a guideline, not a certifiable standard<\/td>Anyone who audits: internal teams, supplier auditors and bodies<\/td><\/tr>
ISO\/IEC 17021-1<\/td>Requirements for bodies that audit and certify management systems: impartiality, competence, certification cycle, decisions<\/td>Management system certification bodies<\/td><\/tr>
ISO\/IEC 17020<\/td>Requirements for bodies that perform inspections<\/td>Inspection bodies<\/td><\/tr>
ISO\/IEC 17065<\/td>Requirements for bodies that certify products, processes and services<\/td>Product certification bodies<\/td><\/tr>
IAF mandatory documents (MD)<\/td>How to apply those standards: MD 1 (multi-site sampling), MD 2 (transfer of certificates), MD 4 (use of information technology and remote audits), MD 5 (audit time), MD 11 (integrated audits)<\/td>Accredited bodies<\/td><\/tr>
ENAC accreditation<\/td>ENAC is Spain’s national accreditation body (Royal Decree 1715\/2010). It checks that each body meets its standard and accredits it for specific scopes<\/td>Bodies that want to issue accredited certificates<\/td><\/tr><\/tbody><\/table><\/figure>\n\n
\n
\"The<\/figure>\n<\/div>\n\n

What changes with ISO 19011:2026<\/h3>\n\n

The fourth edition of ISO 19011 was published in May 2026 and replaces the 2018 edition. As it is a guideline, it has no transition period: it applies from publication. It does not change the underlying method; it updates and expands three areas:<\/p>\n\n