This International Standard does not state requirements, but provides guidance on the management of an
audit programme, on the planning and conducting of an audit of the management system, as well as on the
competence and evaluation of an auditor and an audit team.
Organizations can operate more than one formal management system. To simplify the readability of this
International Standard, the singular form of “management system” is preferred, but the reader can adapt the
implementation of the guidance to their own particular situation. This also applies to the use of “person” and
“persons”, “auditor” and “auditors”.
This International Standard is intended to apply to a broad range of potential users, including auditors,
organizations implementing management systems, and organizations needing to conduct audits of management
systems for contractual or regulatory reasons. Users of this International Standard can, however, apply this
guidance in developing their own audit-related requirements.
The guidance in this International Standard can also be used for the purpose of self-declaration, and can be
useful to organizations involved in auditor training or personnel certification.
The guidance in this International Standard is intended to be flexible. As indicated at various points in the text,
the use of this guidance can differ depending on the size and level of maturity of an organization’s management
system and on the nature and complexity of the organization to be audited, as well as on the objectives and
scope of the audits to be conducted.
This International Standard introduces the concept of risk to management systems auditing. The approach
adopted relates both to the risk of the audit process not achieving its objectives and to the potential of the
audit to interfere with the auditee’s activities and processes. It does not provide specific guidance on the
organization’s risk management process, but recognizes that organizations can focus audit effort on matters of
significance to the management system.