Key takeaways
- 1ISO 9001 and ISO 14001: at least one shift is audited, and the reason for not auditing the others is documented.
- 2ISO 45001: in the first certification cycle, at least one shift inside and one outside regular office hours are audited. In surveillance audits of later cycles, the second shift may be left out, based on the system's maturity.
Part-time and shift workers count because Global ACI TECH-3-004 (formerly IAF MD 5) defines the effective number of personnel as everyone involved within the scope of certification, permanent, temporary or part-time, on every shift (§1.9). The figure starts the audit time for ISO 9001, ISO 14001 and ISO 45001, and it is built from facts only the applicant holds: who works on which shift, for how many hours, in which season, at which sites, and who works under its control without being on its payroll. A payroll total does not show them. ISO 22000 and ISO 50001 are timed under their own documents, ISO 22003-1 and ISO 50003.
Where the duty to tell comes from
ISO/IEC 17021-1 §9.1.1 requires an authorized representative of the applicant to provide the information the certification body needs, including its sites, processes and operations, and its human resources. Application review checks that this is sufficient to develop an audit programme and to take the time needed for audits into account (§9.1.2.1).
Under TECH-3-004, determining initial audit time correctly is an integral part of application review (§0.3). The certification body's justification for the effective number is available to the client and to the accreditation body (§2.3.2).
Part-time and partly-in-scope staff: hours, not heads
Part-time personnel, and employees only partly within the scope, can be converted to full-time equivalents depending on the hours worked, and their numbers may be reduced or increased (§2.3.3). The certification body needs the hours actually worked and, for people who also work outside the scope, the share of their time inside it. §2.3.1 also names "all categories of office staff" among the considerations.
Shifts: the number and the timing
Shifts also decide when auditing happens. The certification body determines the duration and timing that best assess the full scope, including any need to audit outside normal working hours, and agrees them with the client (§2.3.5; ISO/IEC 17021-1 §9.1.3.5).
How much of each shift is audited depends on the processes run on it and the control shown over it (§3.7):
- ISO 9001 and ISO 14001: at least one shift is audited, and the reason for not auditing the others is documented.
- ISO 45001: in the first certification cycle, at least one shift inside and one outside regular office hours are audited. In surveillance audits of later cycles, the second shift may be left out, based on the system's maturity.
Seasonal peaks
For seasonal operations the figure is based on the personnel typically present at the peak (§2.3.1). Give that number and the months it falls in, not the headcount on the day of the form.
Contractors and subcontractors
Contractors count when they are within the scope of certification. For ISO 45001 the count also takes in contractors' and subcontractors' personnel whose work is "under the control or influence of the organisation" and can affect its OH&S performance (§1.9). For ISO 45001, a temporary large presence of contractor companies, as in a plant shutdown or turnaround, is a factor for more audit time (§8 iv e). Contractor personnel working at the organization's premises on processes within the OH&S scope are interviewed to evaluate their OH&S awareness (§11.3 b).
Repetitive roles and temporary unskilled personnel
Where a high percentage of personnel do repetitive work, such as cleaning, security, sales or call centres, §2.3.4 permits a documented, consistently applied reduction in the number for ISO 9001 and ISO 14001. For ISO 45001 the same applies to roles with similar OH&S risks, but repetitive jobs that can reduce attention and raise risk, such as assembling, packaging or sorting, need any reduction documented with an assessment of the OH&S risk.
A reduction for large numbers of temporary unskilled personnel is unusual for ISO 9001 and ISO 14001 and must be justified on record; for ISO 45001 it is in principle not applicable (§2.3.6). The same people can count differently for quality and OH&S.
Temporary sites and people off site
Temporary sites are included in the audit programme, and the sample visited should reflect the sizes and types of activity and the stages of projects in progress (§9.1, §9.2). Visiting them to confirm the activities of the permanent site is a factor for more time (§8 i f). Staff working off location, such as drivers, are a factor for less time where their work can be substantially audited through records; not for ISO 45001 (§8 v g).
When the figures turn out different
Neither document sets a separate procedure for a figure that was wrong at application. The factors are examined again throughout the cycle (TECH-3-004 §3.4), and any adjustment is recorded:
- At stage 1. Stage 1 gathers information on sites, processes and equipment, and reviews the resources allocated to stage 2 (ISO/IEC 17021-1 §9.3.1.2.2 d and e). The certification body may need to revise its stage 2 arrangements, and if significant changes affect the system, it considers repeating all or part of stage 1 (§9.3.1.2.4).
- During an audit. A need to change the audit scope that appears on site is reviewed with the client and reported to the certification body (§9.4.3.3).
- At each surveillance. The certification body obtains an update of client data, reviews the planned audit time, and records the review and any adjustment (TECH-3-004 §5).
- At recertification. The time is calculated on updated information (§6).
- Between audits. The certified client informs the certification body without delay of matters such as changes to sites, scope of operations, organization and management, or major changes to the system and processes (ISO/IEC 17021-1 §8.5.3). Changes can also lead to a short-notice audit (§9.6.4.2).
What this means for you
If you are applying: give the breakdown, not one total: categories, hours, shifts, the seasonal peak, contractors, repetitive roles and temporary sites.
If you are seeking ISO 45001: list the contractors working under your control or influence, and any planned shutdown that brings many on site.
If you are already certified: expect your data to be updated at every surveillance, and report changes to sites, scope or processes when they happen.
This is generic information about the requirement, not advice on any particular management system.
CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.
Verify any certificate: cas.com.eg/certsearch
Read next