The visit of the ISO assessor seems to be shrouded in mystery.

Apart from what we wrote here, there’s very little on-line to explain what actually happens.

As a former ISO Assessor myself, I thought I’d share what makes for a good assessment visit. And I’ve produced an ISO Audit Free Download Checklist PDF. It provides an easily-printable and edited version of what I’ve written below. It is based on my experience.  Some of what I recommend is pretty basic, and may surprise you! Drop us a line if you need it.

Determine Which Type of Visit is Taking Place. There are three main types of visits ISO assessors complete:-

• Stage 1 assessments
• Stage 2 assessments
• Surveillance or Continuing Assessment visits.

If you’ve got to a Surveillance Visit then you should be familiar with how auditors behave, but stage 1 and 2 assessments (for companies who aren’t used to external surveillance of their activities) can be unnerving, so here’s a brief explanation of what should happen at them.

Each certification body has a slightly different way of doing these visits, and although the certification bodies will try to deny this, there’s also a fair amount of variation between the auditors/client managers/assessors who turn up at your premises to complete them. They are human, after all.

So, What’s a Stage 1 Assessment About? The purpose of a stage 1 assessment is really to compare the documentation you have prepared against the standard you want to be approved against, and make sure all the various clauses have been met and the right documents produced.

Think About Some Practical Things! Its worth thinking about the practical needs of the auditor who is about to walk through your door. They might have travelled a fair distance; will they be able to find your premises easily ? Will they be able to find somewhere to park ? Generally speaking, auditors call companies before their visit to confirm details. Try and have some correct and understandable directions ready for the call.  So, “second left after the pub and turn right at the post box” might be fine for people who know the area, but such explanations are not always that helpful to the stranger. On the day of the visit, try and reserve a parking space for the auditor. Yes, these things really matter.  

The Essential Creature Comforts When the person arrives, it’s nice to have somewhere quiet to have an opening discussion, and I’ve never heard of an auditor turning down a drink when they arrive, so be prepared for making a tea or coffee.

Some Standard Procedural Questions. The opening discussion will cover specific issues. Some of these are requirements placed on the certification bodies by their approver (UKAS) so they are said as a matter of procedure. Generally the auditor will:-

• Confirm the purpose of the visit
• Confirm your intended scope of approval and the standard you are seeking (ISO9001, ISO 14001,ISO 27001 etc.)
• Remind you that your contract with the certification body includes confidentiality agreements, so anything you tell them can’t be repeated outside the visit to third parties.
• Ask for your working times
• Talk you through a programme for the day
• Tell you when the closing meeting for the visit will take place
• Explain the audit process and the classification of findings
• Ask if there are any significant Health and Safety issues on your property that they need to be aware of
• They will also ask for the names of those present.

Your Assessor Would Value Some Background Information (But Not Too Much…) This could be the first time this auditor has ever heard the name of your company, so having a SHORT presentation explaining what you do and who your market is can be useful. But a 50 slide presentation on the intricacies of your latest product will not be welcomed – the auditor has a set of things to be covered and generally little time to do it so they don’t welcome time wasting.

The Start of Stage One – Reading, and Personal Space. The main part of the visit should then start. As a stage 1 is primarily a comparison of your documented procedures with the requirements of the relevant ISO standard, the auditor is likely to spend the majority of this visit reading and occasionally asking questions to clarify what they don’t understand. Sitting quietly and letting this happen (while providing additional drinks!) is useful and positive. If you have people who can’t stand quiet and insist on rambling on, its best to get them out of the way at this point.

More Creature Comforts. Lunch. Some certification bodies have the provision of lunch built into the contract. Whether they have or not, providing a few sandwiches usually goes down well, and means work can continue while you eat if necessary.

Can You Fail At This Point? (And How Your Auditor Can Help You) A point to note : you can’t fail a stage 1 as the approval decision is only given at the end of the stage 2. The more you can get out of the auditor at stage 1 the better, so the more potential issues they raise the better because it gives you the chance to address them before the stage 2. A stage 1 which finds nothing wrong is not always good news, as the stage 2 can still find things, even things which should have been identified at stage 1.

So the best strategy for stage 1 is to give the auditor access to everything, ask him about anything you aren’t clear about, and make sure he writes down any issues and includes them in the report.

Findings may be graded as:-

• “Non-conformances”,or…
• “Non-compliances”.

The grading doesn’t really matter at this stage.  But it is vital that any issue the auditor has identified for action before stage 2 is recorded clearly.  And you must understand what you need to do before stage 2. If in doubt, ask.

Important! NEVER let the auditor leave non-compliances or non-conformances that you don’t thoroughly understand, and wherever possible agree the actions you are going to take before they leave your premises.

Closing Actions and The Need for Comprehension. Before they leave, they should hold a closing meeting at which they summarise the day and go through all their findings. Again, make sure you understand what they think is wrong and what they expect you to do about it.

And So To The Stage 2 Assessment A stage 2 visit will begin in a very similar manner to the stage 1, with the auditor commencing with a formal meeting at which he should announce that this is a stage 2 assessment and confirm the scope of activities and the standard the assessment will be completed against.

A Programme of Activities. You should already have a programme of the days activities and the auditor should confirm that you have appropriate people available to explain the various processes and procedures.

Planning The Auditor’s “Tour”. Technically speaking, the auditor should be allowed to choose who he audits in each department, but it is wise that you give consideration to this. The audited person (“auditee”) needs to be able to explain the processes clearly, and preferably with the minimum fuss and time wasting. It’s also worth explaining to the auditee that he should just answer the questions he’s asked in as concise a way as possible. (Personal footnote:- While completing audits I have been provided with auditee’s who’ve just been made redundant and auditee’s with grievances against their employer. In both cases they did the best they could to portray their employers badly and I was given information which the respective companies found embarrassing)

The “Tour” Begins. The audit should then begin, with the auditor going to see the various departments within your business and verifying by a series of questions that the practices described in your documented procedures are being followed. Where issues were raised at the stage one as inadequate or non-compliant the auditor will try and assess the actions you have taken as the audit progresses.

The Closing Meeting. A stage 2 assessment should always finish with a formal closing meeting at which the findings are explained and a recommendation to approve (or otherwise) is given.

So, The Auditor’s Word is Final?  Not really, but.. All the paperwork from the visit, the report and various forms have to be submitted to the management of the certification body for an independent technical review. The auditors recommendation can actually be overturned by this review, although this is fairly unusual, but that is why the auditor should say he is “recommending you for approval”, rather than “granting/giving approval.”

There’s an airline pilot’s saying regarding good landings:- “A good landing starts 150 miles from the airfield”. Simply, if everything is in place, all important staff are briefed, and actions done in a timely and coordinated manner, then the final stage is made much, much smoother, and is a natural consequence of good preparation, planning and handling. This is certainly true of an ISO Audit.

I am “gamekeeper turned poacher”, in that I used to conduct audits before becoming an independent ISO Consultant. I know what both parties feel. So, if I can help, even at a late stage, please get in touch!.

There’s much more to a successful audit than simply “An ISO Audit Checklist Download PDF”

It seems that many people look for an ISO 27001 PDF Download Checklist on the web.

We’ve created our own. Contact us for details. However, it shows how wide the scope of ISO 27001 is.

We are not in favour of the approach behind an ISO 27001 PDF Download Checklist  as we wrote here. Like most ISO standards, successful approval will involve the whole business. Not a checklist in the IT department. Or anywhere else.

We do, however, make our key ISO 27001 PDF download templates available for sale via our shop page. These are not checklists, but the solid foundations for system design.  And they are fully remote-supported by our staff .

However, as an ISO Consultant, I’m frequently asked the same question about ISO 27001:-

“So ISO 27001 is all about IT Security isn’t it ?”

Well, “yes”. But mainly “no”.

What Is It About, Then?

The standard is about installing a quality management system.  This manages the security of all information held by the organisation (IT security does, of course, play a part in this), As a result has a significantly wide wide reach across a business.

But just how wide?

Here’s a list of the documentation used by us for a recently approved company. Are you sitting comfortably?  And this isn’t even the complete version.

Policy for all Staff

Information Security Policy Statement – Statement of system requirements

Information Security – Objectives Table – Progress in implementing the IS Policy Statement

Information Security Management System Manual – System explanation & responsibilities for all staff

Supporting Documentation

Company Organisation Chart

Management Responsibility Statements and Job Descriptions – Documented responsibility statements for those holding security responsibilities

Network and Server Architecture Diagram – Diagram of all the IT network and services covered by the Information Security Management System

Approved Software – Software which can be installed on PS’s as required

Network Capture/Analysis/Scanning Tools – List of network tools that can only be used by IT Support staff

Control of Non-Conformance and Corrective Action Procedure – What to do if you think there is a security breach,and what will be done subsequently. .

Use of Email, Internet, and Social Media – Specifics on use of email, social media etc.

( Possible Addition to the Employee Handbook)

IT Support Procedure – How to log security breaches or any other IT issues you need help with.

Control of Documented Policy & Procedures, – How to update/get a policy or procedure updated

Data and Records

Human Resources Index – Staff Handbook and HR related procedures

Information Security Risk Assessment & Treatment Plan – What the risks are to our information

Statement of Applicability for ISO 27001 – Responses with evidence for the Appendix Compliance Questions

Register of Legislation and Handling – Register of applicable legislation

Business Continuity Plan – How to keep the business running if an emergency occurs.

Supplier and Sub-Contractor Management – How to select sub-contractors and suppliers and what security practices affecting them should be in place

Purchasing Procedure 

Approved suppliers and sub-contractors list-  List of those who have confirmed acceptance of your security practices.

Internal and External Audit Procedure – How to complete ISO audits

ISO 27001 Audit Plan – Schedule/Plan for audits

Audit Report Form Template – Template for audit results

Preventive Action and Management Review-  Planning the development of the security system and implementing a full review of the system by management.

Management Procedure for Training and Competence    –Description of how staff are trained and make themselves familiar with the management system and competent with security issues.

Information Systems Continuous Improvement plan

Data Protection Registration

Requirements for Specific Roles

IT Support

IT Network Managers Security Procedures – Security procedures specific to the Network Management Role

Backup Procedures – Procedures for backing up information and records

Assets and Services – List of all IT and Information Assets

New Joiners

Induction Checklist Evidence that new joiners are made aware of information security system practices and requirements.

Marketing

PR process – Process to ensure press releases etc. are suitable approved prior to release.

Phew!  Yes, it really is that involved. I think that this is outside the scope of most ISO DIY-ers with their ISO 27001 PDF Download Checklist . We’ve even left some things out of this.

However, this is simply a “to-do list”. A “how to do” approach is what is really needed.

All ISO standards should be bespoke to the business. Otherwise, they don’t “fit” it’s aims, activities, and culture. And, if they don’t fit, they don’t work. Hence why you need an ISO consultant to help.

Successful approval to ISO 27001 and it’s is way more than what you’d find in an ISO 27001 PDF Download Checklist. If you think we could help, please drop us a line!.

We’re often contacted by companies wanting to bid for a tender, but faced with the requirement for ISO Certification. To make life easier, we’ve put together an ISO Certification Tenders PDF that answers the main points. Contact us for details.

However, we thought we’d expand this a little, looking at some background, plus wider benefits for your business. (And yes, I’ve struggled with tender responses myself, too.)

ISO Certification for a Tender is Not a “Nice To Have”. Some companies seem to believe that holding a particular standard such as ISO9001 will give the tender issuer a “warm feeling” about their company, rather like charity and community involvement, sponsorship of a donkey sanctuary, brass band etc, etc. It indicates in a vague sense that the company has a “conscience” about quality, a vague intention.

Quite the opposite is true. Tendering bodies now place a huge weight on an organisation holding ISO Certification, for reasons I’ll outline below, so holding the appropriate approval needs to be given serious consideration. This is more than a framed certificate on the reception wall, or a logo on a letterhead. ISO Certification is taken very seriously indeed by those wishing to place, long-term business, and seeking a reliable supplier. Understandably so.

ISO Certification Makes The Tender Process Easier For All. Quite simply, if you hold a specific and current approval, it immediately benchmarks your company in the eyes of the procurement department. There’s not always a need to go into detail about some of your key quality structures and routines – they are already implicit in the the standard, because that’s what the standard is about. And an external verifier has checked that you’re actually telling the truth, too. Approvals can be hard-won, but once in place, are regarded as significant by those wishing to trade with your company.

And conversely, if you don’t hold ISO9001 or similar, it is highly likely that, even if it’s not explicit in the pre-tendering requirements, your bid, (however well-written), will be put to the back of the queue, or worse. Faced with a heap of bid documents to process, staff will look for the easiest excuse to exclude bidders.

You Can’t Do-It-Yourself and Beat The System. In theory, you could try and impress the procurement person with your own framework of quality, and even still be successful. However, the heart of ISO Certification is risk management, and the key control measure is the Quality Management System (QMS). This is the document (and process!) that determines what you do, why you do it, and how this is measured in respect of quality.

Sadly, most organizations would not know where to start in putting a QMS together. Even the ones working within classic ISO guidelines still sometimes struggle! And, in my previous life as an ISO assessor, I could spot a “downloaded from the internet” or D.I.Y. attempt instantly. If you plan to devote some staff management resource at all to the subject of quality within the company, then you might as well do it within the ISO framework, helped by a friendly consultant, and gain a recognised approval at the end of your hard work.

Beyond The Tender, ISO Certification is A Jolly Good Investment! Once installed and working, the approval simply needs revalidating, amending to the changing needs of your business. Furthermore ISO9001, contains elements and frameworks that can be used in other, more specific standards, such as ISO 14001, and ISO 27001. Seeing it as a tool to win a single bid will make certification seem very expensive and risky in terms of potential return. Longer-term, you have all the benefits of an internationally-recognised, independently-verified standard of working.

And It Might Actually Do Your Business Good! I fight a continuing battle to convince managers of all levels that this is more than a “paper exercise”. In the rush to try and compete on a major tender bid, the key fact that ISO Certification is actually highly beneficial to daily business life is often lost. Less waste, more productivity, greater customer satisfaction, all results of working smarter, based on a bespoke Quality Management System.

And Next Time, You’ll be Ready… Sadly, companies often approach me in a bit of a panic in order to comply with a deadline, and have a chance of winning a highly lucrative bid. Sadly, there’s no “Approval Wizard” in the style of a Microsoft Word application that will achieve your certification in five days. Approval takes time. But it then opens up many new opportunities.

And The The Major Point Is…? Start Now. Drop us a line. We’d love to help.