How audit days are calculated under TECH-3-004 (formerly IAF MD 5)

For ISO 9001, ISO 14001 and ISO 45001, an accredited certification body calculates audit time with Global ACI TECH-3-004 (formerly IAF MD 5). It reads a starting figure from a table, using the effective number of personnel and, for environmental and OH&S audits, a complexity category. It adjusts that figure for factors specific to the organization, keeps any reduction within 30% of the table figure, and records the result with its justification. Surveillance and recertification time then follow as proportions of the initial audit.

What an audit day is

An audit day is normally 8 hours (§1.8). Audit time covers time at the client's location, physical or virtual, and time off site on planning, document review and report writing. Travel and breaks are not part of the on-site duration, which should typically be at least 80% of the calculated audit time. Days may not be cut by scheduling longer working days.

A decimal result is adjusted to the nearest half day: 5.3 becomes 5.5, and 5.2 becomes 5 (§2.2.3).

The starting point: people and complexity

The calculation starts from the effective number of personnel: everyone involved within the scope of certification, permanent, temporary or part-time, on every shift. Part-time staff can be converted to full-time equivalents, seasonal operations are counted at their peak, and for ISO 45001 the count includes contractors' personnel working under the organization's control or influence.

The second input is the category of the organization's activities. The document has one starting table for each standard:

• ISO 9001: one column. Three risk categories, based on what failure of the product or service could cause, move the time: high risk normally needs more than the table, medium the table time, low less. Food and pharmaceuticals are among the high-risk examples; office services and education among the low-risk ones.
• ISO 14001: four columns, for high, medium, low and limited complexity of the environmental aspects. A fifth category, special, is outside the table, and its audit time is developed and justified case by case.
• ISO 45001: three columns, for high, medium and low complexity of the OH&S risks.

The sector lists are examples; what counts is what the organization actually does. For ISO 14001 and ISO 45001, where the certification body places an organization in a lower category than its sector suggests, it documents that decision. The tables set no minimum or maximum audit time.

Stage 1 and stage 2

The table figure covers stage 1 and stage 2 together, and the certification body identifies the time for each. The document notes that in normal practice stage 2 takes more time than stage 1, but it does not fix a ratio.

Adjusting the starting figure

The starting figure is then adjusted for the significant factors that apply, each adding or subtracting time. The list is not closed. Factors that increase time include:

• complicated logistics across more than one building or location;
• staff speaking more than one language, so that interpreters are needed;
• a high degree of regulation, for example food, drugs or aerospace;
• highly complex processes, or many unique activities;
• outsourced functions or processes, for ISO 9001 and ISO 14001;
• for ISO 45001, members of the public on site, or accident rates above the sector average.

Factors that decrease time include:

• for ISO 9001, a client that is not design responsible;
• a very small site for the number of personnel;
• the maturity of the management system;
• prior knowledge, for example certification to another standard by the same certification body;
• a high level of automation, except for ISO 45001.

Additive factors may offset subtractive ones. Each subtractive factor may be used only once in a calculation, and every decision is justified and recorded.

The limit on reductions is direct: a reduction shall not exceed 30% of the times in the tables (§3.9). A note says the limit may not apply to individual sites of a multi-site organization, where few processes may be present.

During the first three-year cycle, the time spent each year on surveillance is about one third of the initial audit time, stage 1 plus stage 2 (§5). The planned time is reviewed at least at every surveillance and recertification audit, for changes in the organization and system maturity.

Recertification is normally about two thirds of the time an initial audit would need if it were carried out at the time of recertification, on updated information (§6). It is not two thirds of the original initial audit. Notes to both clauses say each audit is unlikely to be shorter than one audit day.

Temporary sites and multiple sites

Temporary sites, such as project or installation sites, are included in the audit programme, and the need to visit them, and how many, is based on risk. Some visits can be replaced by interviews, document review, remote access or video, with the method documented and justified; for ISO 45001, not where process control and OH&S risk control must be witnessed.

For several sites, the first question is whether sampling is permitted; for ISO 45001 the answer rests on the OH&S risks at each site. The sampling rules are in Global ACI TECH-3-001 (formerly IAF MD 1).

The calculation is a record

The certification body records the audit time and its justification, covering the entire scope of certification. It gives both to the client as part of the contract and makes them available to its accreditation body. ISO/IEC 17021-1 §9.1.4 requires documented procedures for determining audit time, and a record of the duration and its justification.

What this means for you

If you are asking for a proposal: give the effective number of personnel on every shift, the seasonal peak, every site and every outsourced process.

If you are comparing proposals: compare the calculations, not only the totals: the starting figure, the category, each adjustment and its reason.

If you are already certified: surveillance time is reviewed at every audit. Tell your certification body when personnel, sites or scope change.

This is generic information about the requirement, not advice on any particular management system.

CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.

Verify any certificate: cas.com.eg/certsearch