First Party Audit

A first-party audit is an organisation auditing its own management system, processes and practices on its own behalf — commonly known as internal audit. It may be carried out by the organisation's own staff or by an external auditor engaged on its behalf; what defines it is on whose behalf the audit is performed.

The aim is for the organisation itself to see whether the system is actually being applied. Internal audit is also a mandatory requirement of management system standards: ISO 9001, ISO 14001, ISO 45001 and others require a completed internal audit cycle before certification.

• Organisations setting up a management system and preparing for certification
• Certified organisations (a mandatory annual internal audit)
• Companies with insufficient internal-audit resources that engage an outside auditor
• The central quality functions of multi-site organisations
• Senior management required to present assurance to the board

The audit criteria are set by the organisation itself: the management system standard applied (ISO 9001, ISO 14001, etc.), the organisation's own procedures, customer requirements and applicable legislation. The criteria are defined in writing in the audit plan; a review carried out without criteria does not count as an audit.

• Coverage of every clause of the management system standard
• Whether processes are implemented as defined
• The currency of documented information and records
• The closure status of previous audit findings
• Compliance with legal and other requirements
• How risks and opportunities are addressed
• Monitoring of objectives and performance indicators
• Customer complaint and feedback management
• Interfaces between processes and information flow
• Preparation of inputs for management review

• ISO 19011
• ISO 9001
• ISO 14001
• ISO 45001
• ISO/IEC 27001

1. 1Establishing the Audit ProgrammeThe areas to be audited, the frequency and the priorities are set on a risk basis. The programme is planned annually according to the size of the organisation and the criticality of its processes.
2. 2Audit Plan and TeamThe objective, scope and criteria of the audit are defined in writing; the audit team is appointed with regard to competence and impartiality.
3. 3Document ReviewPolicies, procedures, previous audit reports and corrective action records are reviewed before the audit.
4. 4Opening MeetingThe scope, method, schedule and reporting format are communicated to the auditee.
5. 5Gathering EvidenceObjective evidence is gathered through interviews, examination of records and observation on site. A finding is not an opinion without evidence but a verifiable determination.
6. 6Evaluation of FindingsThe evidence gathered is compared against the audit criteria; nonconformities and opportunities for improvement are classified.
7. 7Closing Meeting and ReportThe findings are presented to the auditee, objections are heard and the audit report is issued.
8. 8Follow-up of Corrective ActionFor each nonconformity a root cause analysis and a corrective action plan are requested; follow-up continues until effectiveness is verified.

Findings are generally classified as a nonconformity (major/minor) or an opportunity for improvement. The organisation itself sets the classification scale; what matters is that it is applied consistently and that every finding rests on objective evidence.

• Objective, scope and criteria of the audit
• Audit team and audit date
• Areas audited and roles interviewed
• Records examined
• Findings: nonconformities and opportunities for improvement
• The objective evidence supporting each finding
• Audit conclusion and overall assessment
• The corrective action expected and its deadline

A first-party audit is the organisation's own internal record and does not produce a document that can be presented externally. A conformity claim cannot be built by telling a customer or a certification body 'we passed our internal audit'; the internal audit report is only examined during a certification audit as evidence that the system is functioning. Even if an external consultant carries out the audit, it retains its first-party character.

Accreditation differs with the type of audit. Third-party audits underpinning management system certification are carried out under ISO/IEC 17021-1 and those underpinning product certification under ISO/IEC 17065; these scopes are subject to accreditation. First- and second-party audits, and audits governed by a scheme owner's own rules (such as SMETA or amfori BSCI), do not fall within accredited certification; they are conducted following the ISO 19011 guidance and produce a report. EUROLAB holds internationally recognised accreditation under ISO/IEC 17021-1 and ISO/IEC 17065, granted by accreditation bodies that are signatories to the IAF multilateral recognition arrangement; which audits can be offered within accredited scope is confirmed in writing at the quotation stage.

• Second Party Audit
• Third Party Audit