Audit · ISO 19011 · ISO/IEC 17021-1
Audit services
In auditing, the party is what matters: a first party audit produces an internal record, a second party audit an input to the buyer's decision. Only a third party audit under an accredited scheme leads to a certificate — not every audit becomes one.
- ISO 19011
- guidance
Find the audit type you are looking for
Type a name; go straight to the relevant page.
Audit Parties
Who performs the audit determines what its result means. These three pages explain which audit can produce which output; every other type of audit is carried out by one of these three parties.
Audits by Scope
Audits distinguished by what is audited: a supplier, a site, a process or a product. The audit criteria differ in each case and are set out in writing before the audit.
Supplier AuditAssessment of a supplier's capability and continuity against the buyer's criteria.
Factory AuditOn-site examination of a plant's capacity, quality system and working conditions.
Process AuditIn-depth assessment of the capability of a single production process.
Product AuditChecking product taken from series production against the specification, from the customer's viewpoint.
Quality AuditAuditing of the quality management system and its practices.
Compliance AuditAssessment of compliance with legislation, contracts and internal rules.
Technical AuditAssessment of technical capability, infrastructure and engineering practice.
Supply Chain AuditAssessment of several tiers of the chain as a whole.
Subject-specific Audits
Audits focused on a particular area of risk. Most are conducted against a management system standard or a customer code of conduct; some lead to certification, others only to a report.
Social Compliance AuditAssessment of working conditions against ILO conventions and customer rules.
Environmental AuditAuditing of environmental impacts, permits and legal obligations.
OHS AuditAuditing of occupational health and safety practice and legal compliance.
Energy AuditAnalysis of energy consumption and identification of savings potential.
Cybersecurity AuditAssessment of information security controls and technical measures.
Data Protection AuditAuditing the compliance of personal data processing activities with legislation.
ESG AuditAssessment of environmental, social and governance performance and reporting.
Assessment Services
These are not audits in the classical sense. Due diligence is a pre-transaction risk review; a gap analysis is preparatory work measuring the distance between the present state and the target. The output of both is a findings report.
If you are not sure which audit is required
Tell us who is requesting the audit and against which criteria it will be conducted; let's clarify the scope and number of days together.