Third Party Audit

A third-party audit is conducted by an independent body that has no commercial interest in the audited organisation or its customers. In management system certification this audit is performed under ISO/IEC 17021-1; impartiality, competence and independence of the certification decision are core requirements of that standard.

The aim is to produce assurance about the organisation's conformity that is independent of the parties and internationally recognised. That assurance reduces the need for every customer to audit separately and so lowers the total audit burden in the supply chain.

• Organisations requesting certification
• Suppliers whose customers request an accredited certificate
• Companies bidding on public tenders
• Manufacturers seeking international recognition for export
• Organisations wanting to offer the same assurance to multiple customers

The audit criteria are the standard or scheme being certified against (ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, IATF 16949, etc.), together with the organisation's own documentation and applicable legislation. The criteria are set by the scheme, not by the auditing body; this makes results comparable across organisations.

• Meeting every requirement of the standard
• The accuracy of the scope definition and its match with actual activity
• The effectiveness of process implementation
• Compliance with legal and other requirements
• Internal audit and management review records
• The effectiveness of corrective actions
• Monitoring of performance indicators and objectives
• Adequacy of resources and personnel competence
• Control of outsourced processes
• The correct use of the certificate and mark

• ISO/IEC 17021-1
• ISO/IEC 17065
• ISO 19011
• IAF mandatory documents

1. 1Establishing the Audit ProgrammeThe areas to be audited, the frequency and the priorities are set on a risk basis. The programme is planned annually according to the size of the organisation and the criticality of its processes.
2. 2Audit Plan and TeamThe objective, scope and criteria of the audit are defined in writing; the audit team is appointed with regard to competence and impartiality.
3. 3Document ReviewPolicies, procedures, previous audit reports and corrective action records are reviewed before the audit.
4. 4Opening MeetingThe scope, method, schedule and reporting format are communicated to the auditee.
5. 5Gathering EvidenceObjective evidence is gathered through interviews, examination of records and observation on site. A finding is not an opinion without evidence but a verifiable determination.
6. 6Evaluation of FindingsThe evidence gathered is compared against the audit criteria; nonconformities and opportunities for improvement are classified.
7. 7Closing Meeting and ReportThe findings are presented to the auditee, objections are heard and the audit report is issued.
8. 8Follow-up of Corrective ActionFor each nonconformity a root cause analysis and a corrective action plan are requested; follow-up continues until effectiveness is verified.

Findings are classified as a major nonconformity, a minor nonconformity or an observation. A major nonconformity shows the system fails to meet a requirement or that its effectiveness has broken down, and the certificate is not issued until it is closed. Minor nonconformities are closed within a defined period.

• Objective, scope and criteria of the audit
• Audit team and audit date
• Areas audited and roles interviewed
• Records examined
• Findings: nonconformities and opportunities for improvement
• The objective evidence supporting each finding
• Audit conclusion and overall assessment
• The corrective action expected and its deadline

A third-party audit does not always turn into a certificate: a certificate is issued only under an accredited scheme and after review by an independent decision-maker. An audit from an unaccredited body is also a third-party audit but does not carry the international recognition the accreditation chain provides. The certificate also shows the system's conformity at the time of the audit; it does not guarantee the quality of individual products.

Accreditation differs with the type of audit. Third-party audits underpinning management system certification are carried out under ISO/IEC 17021-1 and those underpinning product certification under ISO/IEC 17065; these scopes are subject to accreditation. First- and second-party audits, and audits governed by a scheme owner's own rules (such as SMETA or amfori BSCI), do not fall within accredited certification; they are conducted following the ISO 19011 guidance and produce a report. EUROLAB holds internationally recognised accreditation under ISO/IEC 17021-1 and ISO/IEC 17065, granted by accreditation bodies that are signatories to the IAF multilateral recognition arrangement; which audits can be offered within accredited scope is confirmed in writing at the quotation stage.

• First Party Audit
• Second Party Audit