3 Year Audit Cycle (ISO 17021:2011)

P

PaulChad69

Hi,

I'm just after a bit of clarification over the 3 year audit cycle and this relates largely to 17021:2011 rather than 19011.

I'm aware the cycle is that of Initial Certification, Surveillance and Re-Certification and this is within a 3 year cycle.

The Cycle starts on the Certification decision date (Clause 9.1.1.2).

Surveillance audits shall be conducted at least once a year. The date of the first surveillance audit following initial certification shall not be more than 12 months from the last day of the stage 2 audit.(clause 9.3.2.2)

Fine I get that, however when does the subsequent Surveillance Audit(s) in the 2nd year begin or rather required to be completed by?

Does the second year surveillance audit require completing 2 years from the certification decision date or from 12 months of the first surveillance audit?

As an example;

If a Company has a Stage 2 Completed on the 1st Jan 2012, and the certification decision is not completed until the 1st Feb 2012 (the start of the 3 year audit cycle).

A 1st year surveillance must be completed by 31st Dec 2012 and the re-cert audit must be completed by the 31st Jan 2015.

However, if the surveillance was completed 6 months after the S2, on the 1st June 2012, is the 2nd year Surveillance due by 31st May 2013 (12 Months after 1st Surveillance), 1st Jan 2014 (24 Months after Stage 2) or 1st Feb 2014 (24 Months after Certification Decision)?

And if this 2nd year audit was thus completed earlier, then what repercussions does this have the 3rd year, would a surveillance be due prior to the Re-Certification.

I appreciate most Companies this would be combined, but I'm finding it difficult to understand the cycle and how audit dates impact upon future audits within the same cycle.

Your help in finding clarity would be much appreciated.
 
Last edited by a moderator:

Paul Simpson

Trusted Information Resource
The Cycle starts on the Certification decision date (Clause 9.1.1.2).

Surveillance audits shall be conducted at least once a year. The date of the first surveillance audit following initial certification shall not be more than 12 months from the last day of the stage 2 audit.(clause 9.3.2.2)

Fine I get that, however when does the subsequent Surveillance Audit(s) in the 2nd year begin or rather required to be completed by?

Does the second year surveillance audit require completing 2 years from the certification decision date or from 12 months of the first surveillance audit?

Hi, Paul and welcome to the Cove. :bigwave:

The aim of the three year cycle and the definition of timelines between visits is to provide a consistent framework for certification. It is never going to be perfect and there will still be some variability in its application but the overall principle is that the initial certification date drives everything. The first visit should be within 12 months of cert date and visit 2 should be within 12 months of visit 1 (and 24 months of cert date) and visit 3 should be within 12 months of visit 2 (and 36 months of cert date). There is an added complication that visit 3 should be around 3 months before certificate expiry date (to allow for any corrective actions to be carried out and evaluated by the CB before the certificate expires).

Hope this helps. :)
 
Top Bottom