Compliance Audit

A compliance audit assesses whether an organisation observes the obligations it is subject to: legislation, contract terms, voluntary commitments and internal policies. It differs from a quality audit in that the focus is COMPLIANCE rather than performance.

The aim is to see the risk of enforcement action, penalties and breach of contract in advance. The price of non-compliance is usually many times the cost of putting things right.

• Organisations in heavily regulated sectors
• Groups operating across multiple countries
• Companies establishing or strengthening a compliance function
• Parties wanting to verify their contractual obligations
• Boards and audit committees

The criteria are the organisation's compliance obligations register: applicable legislation, permit and licence requirements, contract terms, sector rules and internal policies. How current this register is directly determines the validity of the audit.

• The currency and scope of the compliance obligations register
• The validity of permits, licences and authorisations
• The mechanism for monitoring legislative changes
• Tracking of contractual obligations
• Compliance with internal policies and procedures
• Fulfilment of reporting and notification obligations
• Compliance training and awareness
• The whistleblowing and concern-reporting mechanism
• Past instances of noncompliance and the measures taken
• Monitoring of compliance performance

• ISO 37301
• ISO 19011
• ISO 37001
• ISO 31000

1. 1Defining the Scope and CriteriaWhat is to be audited and against which criteria is set out in writing: a customer code of conduct, a specification, a standard or a checklist.
2. 2Preliminary Information GatheringThe size and activity of the party to be audited, its audit history and any open nonconformities are reviewed.
3. 3Audit PlanThe audit date, team and timetable are prepared; the areas to be visited and the roles to be interviewed are planned.
4. 4Opening MeetingThe purpose, scope, method and reporting format of the audit are explained; the principles of confidentiality and impartiality are confirmed.
5. 5On-site AuditProduction or service areas are walked, records are examined and workers are interviewed. Findings are recorded on the spot.
6. 6Classification of FindingsDeterminations are graded according to the classification of the scheme in use (critical / major / minor / observation).
7. 7Closing MeetingThe findings are presented to management, their justification is explained and the expectation for corrective action is set out.
8. 8Report and Follow-upThe audit report is issued; a corrective action plan is obtained and its close-out is followed up. Where necessary a follow-up audit is carried out.

Findings are classified by the severity of the noncompliance. Legal noncompliance is always the most severe category and mostly requires immediate action; deviations from internal policy can be remedied over a longer period.

• Details of the audit body, the auditor and the auditee
• Date, duration and scope of the audit
• Criteria or checklist applied
• Areas and processes audited
• Findings and their classification
• Evidence and photographs supporting the findings
• Scoring or rating, where the scheme requires it
• Corrective action plan and close-out status

This audit documents the situation observed at the time of the audit and within the scope audited. Auditing is sampling-based: the records examined and the areas visited are selected to represent the whole, but this does not mean that every record was checked. The report is neither a guarantee nor a certificate, and it does not relieve the auditee of its responsibility.

Accreditation differs with the type of audit. Third-party audits underpinning management system certification are carried out under ISO/IEC 17021-1 and those underpinning product certification under ISO/IEC 17065; these scopes are subject to accreditation. First- and second-party audits, and audits governed by a scheme owner's own rules (such as SMETA or amfori BSCI), do not fall within accredited certification; they are conducted following the ISO 19011 guidance and produce a report. EUROLAB holds internationally recognised accreditation under ISO/IEC 17021-1 and ISO/IEC 17065, granted by accreditation bodies that are signatories to the IAF multilateral recognition arrangement; which audits can be offered within accredited scope is confirmed in writing at the quotation stage.

• Supplier Audit
• Factory Audit
• Process Audit
• Product Audit
• Quality Audit
• Technical Audit
• Supply Chain Audit