Policy for Audit Process

06100-PO8-PECB MS Audit Process Approver: Compliance Director

Owner: PECB MS Approval date: 2019-06-11
Classification: Public | ACL: Public Version: 3.0
Status: Released Page 2 of 5

PURPOSE
This document serves to detail the steps and requirements of a PECB MS Audit. All auditors and
personnel involved in a MS Audit need to comply with these requirements.

GENERAL PRINCIPLES
a. All threats to impartiality are taken seriously at PECB, and all the following need to be
avoided:
 Auditing a function in an organization for which the auditor has provided consulting
services within the past two years;
 Auditing a function in an organization managed by someone with whom the auditor
has a family relationship;
 Auditing an organization that the auditor owns shares of, or is a partial owner of.
b. Potential conflicts of interests need to be reported to PECB prior to the audit, or as soon as
they are revealed. Failure to do so may result in the invalidity of the audit, termination of
auditor status and even lawsuits.
c. All PECB auditors are expected to comply with the PECB code of ethics.
d. All PECB auditors need to sign the 06100-FO11-Confidentiality and non-disclosure
declaration, and submit it to PECB, at least 5-7 business days before each audit.
e. No review will be initiated without submitting all the mandatory documents as guided in this
policy:
 General Terms and Conditions for Audit and Certification Services
 Confidentiality and Non-disclosure declaration
 Audit report stage 1
 Audit plan (Stage 2)
 Audit report stage 2
 Audit Opening and Closing Meeting
 Additional documentation (if asked by PECB)

STAGE 1 AUDIT
The following contains important instructions related to stage 1 audit that all PECB auditors need to be
aware of:
a. Neither an audit plan nor an opening meeting is required for a stage 1 audit. The auditors
may offer them to their clients, but PECB does not require the provision of such evidence or
documents;
b. The auditor needs to inform the auditee of any “on site” activities. Performing at least part of
the stage 1 audit on the auditee’s premises, can help achieve audit objectives.
c. All nonconformities or findings need to be validated by the auditor before the auditee can be
authorized to proceed to the stage 2 audit (see section below related to managing findings).
d. The 06100-FO9-Audit Report is mandatory to be submitted by the auditor to PECB, within 24
hours after the Stage 1 audit.
e. MS Certification Coordinator (MSCC) reviews and sends the report to the auditor if there are
comments to be addressed.

STAGE 2 AUDIT
a. Filled 06100-FO18-Audit Plan shall be submitted by the auditor to PECB, 2 weeks before the
audit begins.
b. MSCC reviews and sends the approved 06100-FO18-Audit Plan (or the approval notice via e-
mail) to the auditor. 06100-FO18-Audit Plan shall be submitted to the client at least 5-7

www.pecb-ms.com
 06100-PO8-PECB MS Audit Process Approver: Compliance Director
Owner: PECB MS Approval date: 2019-06-11
Classification: Public | ACL: Public Version: 3.0
Status: Released Page 3 of 5

business days before the audit commences so the client is informed about the scope that is
going to be audited and the resources he/she needs to organize to participate in the audit.
c. An opening meeting is compulsory, and needs to contain all of the following elements:
 Introduction of participants, including an outline of their roles;
 Confirmation of the certification’s scope;
 Confirmation of the audit plan (including type and scope of audit, objectives and
criteria), any changes, and other relevant arrangements with the client, such as the
date and time for the closing meeting, and interim meetings between the audit team
and the client’s management;
 Confirmation of formal communication channels between the audit team and the
client;
 Confirmation of the availability of resources and facilities necessary for the audit
team;
 Confirmation of matters relating to confidentiality;
 Confirmation of relevant work safety, emergency and security procedures for the
audit team;
 Confirmation of the presence, roles and identities of any guides and observers;
 The method of reporting, including any grading of audit findings;
 Information about the conditions under which the audit may be prematurely
terminated;
 Confirmation that the audit team leader and audit team representing the certification
body are responsible for the audit, and shall be in control of executing the audit plan,
including audit activities and audit trails;
 Confirmation of the status of the previous audit findings, if applicable;
 Methods and procedures used to conduct the audit based on sampling;
 Confirmation of the language to be used during the audit;
 Confirmation that, during the audit, the client will be kept informed of audit progress
and any concerns;
 Opportunity for the client to ask questions.
d. Stage 2 audits must be done onsite. However, off-site audits can be partially performed as
well. This can be practical when, for instance, an organization has several sites located far
apart from each other, and some of these sites are remote and contain noncritical processes.
Assessing multi-site organizations is addressed via 06100-FO33-Representative Site
Sampling which indicates the sites that shall be audited on site and the ones that can be
audited remotely. If you are not sure about any of these aspects, please contact ms@pecb-
ms.com.
e. All nonconformities or findings need to be validated by the auditor and reported to PECB so a
decision can be taken (see section below related to managing findings).
f. The filled 06100-FO10-Audit Report needs to be submitted by the auditor to PECB, within 24
hours after the Stage 2 audit.
g. MSCC reviews the submitted audit documentation and keeps in touch with the Auditor in
case additional efforts/reviews are necessary. If the compliance level of the MS is
satisfactory, Certification Committee will come up with a positive decision.
h. A Draft Certificate is sent for validation to the Lead Auditor. After receiving the validation of
the draft certificate, MS Processing Manager (MSPM) sends the congratulatory note
altogether with the Temporary Certificate to the auditee (by keeping the managing partner in
this communication – if applicable) and the hardcopy is shipped.

www.pecb-ms.com
 06100-PO8-PECB MS Audit Process Approver: Compliance Director
Owner: PECB MS Approval date: 2019-06-11
Classification: Public | ACL: Public Version: 3.0
Status: Released Page 4 of 5

SURVEILLANCE AND RECERTIFICATION AUDIT

a. An A filled 06100-FO18-Audit Plan shall be submitted by the auditor to PECB, 5-7 business
days before the audit begins.
b. MSCC reviews and sends the approved 06100-FO18-Audit Plan (or the approval notice via e-
mail) to the auditor.
c. An opening meeting is required for a surveillance or recertification audit.
d. All nonconformities or findings need to be validated by the auditor and reported to PECB so a
decision can be taken (see section below related to managing findings).
e. The filled 06100-FO10-Audit Report shall be submitted to PECB, within 24 hours after the
audit
f. MSCC reviews the audit documentation and keeps in touch with the auditor in case additional
efforts/comments need to be addressed. In cases of surveillance audits, when the reviewing
is over and the results are positive, MSCC sends the congratulatory note to the auditee by
keeping the managing partner in communication (if applicable).
i. In cases of Recertification, if the compliance level of the MS is satisfactory, Certification
Committee will come up with a positive decision; a Draft Certificate is sent for validation to the
Lead Auditor. After receiving the validation of the draft certificate, MSPM sends the
congratulatory note altogether with the Temporary Certificate to the auditee (by keeping the
managing partner in this communication – if applicable) and the hardcopy is shipped.

MANAGING FINDINGS
a. If no findings were discovered during the audit, the auditee may be certified by PECB shortly
after the audit without any additional procedures required from the auditee.
b. If any findings were discovered, the Annex A – Nonconformity Report of the Audit Report will
need to be filled out by the auditor and auditee. The auditor will need to evaluate the
adequacy of the proposed corrective actions.
 If the corrective actions are deemed to be adequate, the auditor will approve these
corrective actions and issue clearance in the respective ‘Nonconformity Report’ and
submit it to PECB, including dates for validation of the corrective actions
 If the corrective actions are deemed to be inadequate, the auditor will reject these
corrective actions and require the auditee to propose other corrective actions. This
will need to be performed until all findings have had corrective actions validated by
the auditor.
c. If, during the audit, only non-critical findings are revealed, the auditor may recommend
certification once adequate corrective actions have been approved for each finding.
d. If, during the audit, critical findings are discovered, the auditor cannot recommend
certification. The auditee will have to go through a specific process to validate that all critical
findings have been adequately resolved before the auditor is able to recommend certification.

www.pecb-ms.com
 06100-PO8-PECB MS Audit Process Approver: Compliance Director
Owner: PECB MS Approval date: 2019-06-11
Classification: Public | ACL: Public Version: 3.0
Status: Released Page 5 of 5

Revision History
NOTE: This part is for internal purposes only.
Version Change description Date
1.0 Initial release
Reviewed by DMs:
1.1  Changes applied on Header 2017-07-31
 Many changes in the content
Reviewed by DM:
2.0 2019-04-24
 New branding applied
Reviewed by Compliance Director:
 Added information about “on site” activities for stage 1 audit
 Added timeframes for auditors to submit documents to PECB
3.0  Documents sent by the auditor are sent to PECB first, and then 2019-06-11
PECB sends them to the auditor after their review
 Added steps describing provision of draft, temporary and hardcopy
certificates from PECB to the auditee

www.pecb-ms.com