Auditors do not audit their own work

Six words, in ISO/IEC 17021-1 §10.2.6.4 b), governing what a certification body shall ensure about its own internal audits.

They are worth sitting with, because the requirement immediately before them asks for something that pulls the other way.

The two conditions, and the tension between them

§10.2.6.4 requires the certification body to ensure that:

a) internal audits are conducted by competent personnel knowledgeable in certification, auditing and the requirements of this part of ISO/IEC 17021;

b) auditors do not audit their own work;

Competence and separation. In a large organisation these are easy to satisfy together. In a small one they compete directly, because the person who understands a process well enough to audit it competently is very often the person who operates it.

The clause does not resolve the tension and does not rank the two. It declines to trade either away, which leaves the resolution to be found rather than chosen from a menu.

That is a harder requirement than a preference would be.

What objectivity is defined as

ISO/IEC 17021-1 defines impartiality at §3.2 as the presence of objectivity, and its note adds that objectivity means conflicts of interest do not exist, or are resolved so as not to adversely influence subsequent activities.

Two things follow from that wording.

It is stated positively. Impartiality is not defined as the absence of a relationship. It is the presence of something that has to be there and be demonstrable.

It admits resolution. A conflict of interest does not have to be absent. It has to not exist or be resolved so as not to adversely influence what follows. The clause allows the second route explicitly, which is why "we are too small to separate everything" is a starting point for a conversation rather than the end of one.

The rest of what the clause ensures

Read them in sequence and they describe a loop rather than an event. The audit happens, the people responsible learn what it found, something is done about it within a time that is appropriate, and improvement opportunities are picked up rather than left in the report.

An internal audit that ended with a report and no fourth step satisfied the first half of that list.

Why a certification body publishes its own requirement

Because it is the same shape as the requirement a certified organisation works to, and it is the half that can be quoted.

We are not in a position to tell you what your clause says word for word — we have said so on the companion page, and it is an unusual thing for a certification body to admit in public. We are in a position to show you the clause that governs us, which was written by the same committee tradition, for the same purpose, and which anyone can open.

The transferable part is not the text. It is the construction: name what the planning considers, separate the auditor from the work, define objectivity as something present rather than something missing, and close the loop rather than filing the report.

The one number here, and whose it is

§10.2.6.3 requires a certification body's own internal audits to be performed at least once every 12 months, and allows that frequency to be reduced where the body can demonstrate its management system continues to be effectively implemented and has proven stability.

The subject matters, and it is worth stating twice: that interval binds certification bodies. It is quoted here as an example of a frequency requirement written with its condition attached, not as a figure that applies to anyone else.

Even the number moves when the evidence supports it. That is the same idea as the programme that responds to its inputs, expressed as an interval instead of a plan.

This is generic information about the requirement, not advice on any particular management system.

CAS — An EGAC accredited MS certification body No. 012418.