Key takeaways
- 1Application review, which determines the competence the audit team needs, selects the team and sets audit time. It needs knowledge of the standard, the body's processes, the client's business sector, and the client's products and processes.
- 2Reviewing audit reports and making certification decisions. Knowledge of audit principles, the standard, the body's processes and the client's sector, sufficient to understand a report and decide on it.
- 3Auditing and leading the audit team. All eleven areas apply, from knowledge of the standard and the client's sector to interviewing, report writing and audit management.
An accredited certification body has to show that the people who audit and decide are competent for the work. ISO/IEC 17021-1 requires it to write down the knowledge and skills each certification function needs, to evaluate people against those criteria before they take responsibility, and to keep monitoring them afterwards. The accreditation body then checks the result, partly by watching audits.
What competence means
ISO/IEC 17021-1 §3.7 defines competence as the "ability to apply knowledge and skills to achieve intended results". NOTE 2 to §7.1.2 of ISO 22003-1:2022 makes a related point: qualifications and experience can form part of the criteria, but competence is not based on them alone.
Criteria for each standard, technical area and function
Under ISO/IEC 17021-1 §7.1.2, a certification body determines competence criteria for each type of management system standard, for each technical area, and for each function in the certification process, and documents them. Where a standard or scheme has additional criteria of its own, those apply too.
Table A.1 in the normative Annex A names three functions:
- Application review, which determines the competence the audit team needs, selects the team and sets audit time. It needs knowledge of the standard, the body's processes, the client's business sector, and the client's products and processes.
- Reviewing audit reports and making certification decisions. Knowledge of audit principles, the standard, the body's processes and the client's sector, sufficient to understand a report and decide on it.
- Auditing and leading the audit team. All eleven areas apply, from knowledge of the standard and the client's sector to interviewing, report writing and audit management.
The decision-makers are measured too
Those who take the certification decision did not carry out the audit (§9.5.1.1) and need competence of their own. §7.2.8 requires them to understand the standard and the certification requirements, and to have demonstrated competence to evaluate the audit's outcomes, including the audit team's recommendations. At application review, §9.1.2.3 requires the body to determine the competences needed in the audit team and for the decision.
Why the technical area matters
§3.10 defines a technical area by commonalities of processes relevant to a type of management system and its intended results. The note to §7.1.2 says it covers what different disciplines call scopes, categories or sectors.
Annex A asks for knowledge of the client's products and processes sufficient to understand how the organization can apply the standard's requirements (A.2.6). The standard-specific documents add detail:
- Quality (ISO 9001). ISO/IEC 17021-3:2017 §5.4 requires the audit team to know the terminology and technology of the technical area, the statutory and regulatory requirements for the product or service, and the characteristics of the products, services and processes.
- Environment (ISO 14001). ISO/IEC 17021-2:2016 requires competence requirements for each relevant environmental technical area (Clause 4), including knowledge of site factors such as hydrogeology and prior use of the site (§5.11) and of specific aspects, from emissions to air to waste and use of space (Clause 6).
- Food safety (ISO 22000). ISO 22003-1:2022 §7.1.2 requires technical areas to be defined using the food chain categories of its Annex A, and §7.1.3 looks in particular at knowledge of prerequisite programmes, hazards and control measures for the categories a person works in.
- Energy (ISO 50001). ISO 50003:2021 does not use technical sectors. Its Foreword records that technical areas were removed and technical competency requirements added. Its Table 1 sets energy knowledge instead, including energy principles, performance indicators and baselines, and common energy-using systems.
Not every auditor has to hold all of it. §9.2.2.1.1 requires the team as a whole to hold the totality of the competences identified at application review; a sole auditor must be competent to perform the team leader's duties. Technical experts may supplement the team under the direction of an auditor (§9.2.2.1.3), but do not act as auditors (§9.2.2.2.2).
Initial evaluation
§7.1.3 requires documented evaluation processes, and the body has to demonstrate that its evaluation methods are effective.
For auditors, §7.2.4 adds that the initial evaluation includes the ability to apply the required knowledge and skills during audits, as determined by "a competent evaluator observing the auditor conducting an audit". An auditor-in-training takes part only where an auditor is appointed as evaluator, with final responsibility for the trainee's findings (§9.2.2.1.4).
Informative Annex B lists five kinds of method: review of records, feedback, interviews, observations and examinations. Records alone are not likely to be sufficient, feedback alone is not satisfactory, and no single method is likely to confirm competence on its own.
Monitoring after authorization
§7.2.9 requires documented monitoring of everyone involved, based on how often they are used and the risk linked to their work. Under §7.2.10, each auditor is monitored for each type of management system they are deemed competent for, through on-site evaluation, review of audit reports, and feedback from clients or the market. §7.2.11 requires periodic on-site evaluation, at a frequency set by what the monitoring shows.
Witnessing by the accreditation body
Global ACI TECH-3-014 (formerly IAF MD 17) defines witnessing as an accreditation body observing, without interfering, an audit performed by a certification body's audit team. Its objective is assurance of the certification body's competence across its scope of accreditation. It also verifies how competent audit teams are assigned. Before a witnessed audit, the accreditation body receives the audit plan, the team's competence records and the justification for the audit time.
This is why ISO/IEC 17021-1 §8.5.1 has certification bodies require clients to accommodate observers, where applicable, such as accreditation assessors or trainee auditors.
What this means for you
If you are applying for certification: describe your products, processes and sites fully. The competence your audit team needs is determined from that information.
If you are certified: an accreditation assessor on one of your audits is part of how competence is checked. TECH-3-014 does not expect the certification body to change its team, plan or audit duration because of the witnessing.
If you are a buyer: accreditation is how auditor competence is checked from outside. The accreditation body's public register shows what each certification body is accredited for.
This is generic information about the requirement, not advice on any particular management system.
CAS — An EGAC accredited MS certification body No. 012418. Accredited scope: ISO 9001, ISO 14001, ISO 45001, ISO 22000, ISO 50001 and ISO 22301. Certificates accredited for ISO 9001, 14001, 45001, 22000 and 50001 fall within EGAC's IAF MLA scope; ISO 22301 is accredited by EGAC and sits outside that scope.
Verify any certificate: cas.com.eg/certsearch
Read next