SIST EN ISO 19011:2018
(Main)Guidelines for auditing management systems (ISO 19011:2018)
Guidelines for auditing management systems (ISO 19011:2018)
This document provides guidance on auditing management systems, including the principles of auditing, managing an audit programme and conducting management system audits, as well as guidance on the evaluation of competence of individuals involved in the audit process. These activities include the individual(s) managing the audit programme, auditors and audit teams.
It is applicable to all organizations that need to plan and conduct internal or external audits of management systems or manage an audit programme.
The application of this document to other types of audits is possible, provided that special consideration is given to the specific competence needed.
Leitfaden zur Auditierung von Managementsystemen (ISO 19011:2018)
Dieses Dokument bietet eine Anleitung zum Auditieren von Managementsystemen, einschließlich der Auditprinzipien, der Steuerung eines Auditprogramms und der Durchführung von Audits von Management¬systemen sowie zur Beurteilung der Kompetenz derer, die in den Auditprozess einbezogen sind. Diese Tätigkeiten beziehen die Person(en), die das Auditprogramm steuert (steuern), Auditoren und Auditteams mit ein.
Es ist auf alle Organisationen, die interne oder externe Audits von Managementsystemen planen und durchführen oder ein Auditprogramm steuern müssen, anwendbar.
Die Anwendung dieses Dokuments auf andere Arten von Audits ist möglich, vorausgesetzt, besondere Aufmerksamkeit wird der speziellen Kompetenz, die erforderlich ist, beigemessen.
Lignes directrices pour l'audit des systèmes de management (ISO 19011:2018)
Le présent document fournit des lignes directrices sur l'audit de systèmes de management, comprenant les principes de l'audit, le management d'un programme d'audit et la réalisation d'audits de systèmes de management. Elle donne également des lignes directrices sur l'évaluation de la compétence des personnes impliquées dans le processus d'audit. Ces activités concernent le(s) responsable(s) du management du programme d'audit, les auditeurs et les équipes d'audit.
Il est applicable à tous les organismes qui doivent planifier et réaliser des audits internes ou externes de systèmes de management ou manager un programme d'audit.
Le présent document peut, en principe, s'appliquer à d'autres types d'audits, à condition toutefois d'accorder une attention toute particulière aux compétences spécifiques requises.
Smernice za presojanje sistemov vodenja (ISO 19011:2018)
Ta dokument opisuje smernice za presojanje sistemov vodenja, vključno z načeli presojanja, vodenjem programa presoje in izvajanjem presoj sistemov vodenja ter smernicami za oceno usposobljenosti posameznikov, vključenih v postopek presoje. Te dejavnosti zajemajo posameznike, ki vodijo program presoje, presojevalce in skupine za presojo.
Uporablja se za vse organizacije, ki morajo načrtovati in izvajati notranje ali zunanje presoje sistemov vodenja ali voditi program presoje.
Ta dokument se lahko uporablja za druge vrste presoj, če je posebna pozornost namenjena posebni usposobljenosti, ki je potrebna zanje.
General Information
Relations
Standards Content (Sample)
SLOVENSKI STANDARD
01-oktober-2018
1DGRPHãþD
SIST EN ISO 19011:2011
Smernice za presojanje sistemov vodenja (ISO 19011:2018)
Guidelines for auditing management systems (ISO 19011:2018)
Leitfaden zur Auditierung von Managementsystemen (ISO 19011:2018)
Lignes directrices pour l'audit des systèmes de management (ISO 19011:2018)
Ta slovenski standard je istoveten z: EN ISO 19011:2018
ICS:
03.100.70 Sistemi vodenja Management systems
03.120.10 Vodenje in zagotavljanje Quality management and
kakovosti quality assurance
13.020.10 Ravnanje z okoljem Environmental management
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
EN ISO 19011
EUROPEAN STANDARD
NORME EUROPÉENNE
July 2018
EUROPÄISCHE NORM
ICS 03.100.70; 03.120.20 Supersedes EN ISO 19011:2011
English Version
Guidelines for auditing management systems (ISO
19011:2018)
Lignes directrices pour l'audit des systèmes de Leitfaden zur Auditierung von Managementsystemen
management (ISO 19011:2018) (ISO 19011:2018)
This European Standard was approved by CEN on 18 June 2018.
CEN members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this
European Standard the status of a national standard without any alteration. Up-to-date lists and bibliographical references
concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CEN
member.
This European Standard exists in three official versions (English, French, German). A version in any other language made by
translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC Management
Centre has the same status as the official versions.
CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania,
Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and United Kingdom.
EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION
EUROPÄISCHES KOMITEE FÜR NORMUNG
CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2018 CEN All rights of exploitation in any form and by any means reserved Ref. No. EN ISO 19011:2018 E
worldwide for CEN national Members.
Contents Page
European foreword . 3
European foreword
This document (EN ISO 19011:2018) has been prepared by Technical Committee ISO/PC 302
"Guidelines for auditing management systems" in collaboration with CCMC.
This European Standard shall be given the status of a national standard, either by publication of an
identical text or by endorsement, at the latest by January 2019, and conflicting national standards shall
be withdrawn at the latest by January 2019.
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. CEN shall not be held responsible for identifying any or all such patent rights.
This document supersedes EN ISO 19011:2011.
This document has been prepared under a mandate given to CEN by the European Commission and the
European Free Trade Association.
According to the CEN-CENELEC Internal Regulations, the national standards organizations of the
following countries are bound to implement this European Standard: Austria, Belgium, Bulgaria,
Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia,
France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta,
Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland,
Turkey and the United Kingdom.
Endorsement notice
The text of ISO 19011:2018 has been approved by CEN as EN ISO 19011:2018 without any modification.
INTERNATIONAL ISO
STANDARD 19011
Third edition
2018-07
Guidelines for auditing management
systems
Lignes directrices pour l'audit des systèmes de management
Reference number
ISO 19011:2018(E)
©
ISO 2018
ISO 19011:2018(E)
© ISO 2018
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Fax: +41 22 749 09 47
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii © ISO 2018 – All rights reserved
ISO 19011:2018(E)
Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Principles of auditing . 5
5 Managing an audit programme . 6
5.1 General . 6
5.2 Establishing audit programme objectives . 9
5.3 Determining and evaluating audit programme risks and opportunities . 9
5.4 Establishing the audit programme .10
5.4.1 Roles and responsibilities of the individual(s) managing the audit programme .10
5.4.2 Competence of individual(s) managing audit programme .11
5.4.3 Establishing extent of audit programme .11
5.4.4 Determining audit programme resources .12
5.5 Implementing audit programme .12
5.5.1 General.12
5.5.2 Defining the objectives, scope and criteria for an individual audit .13
5.5.3 Selecting and determining audit methods .14
5.5.4 Selecting audit team members .14
5.5.5 Assigning responsibility for an individual audit to the audit team leader.15
5.5.6 Managing audit programme results .16
5.5.7 Managing and maintaining audit programme records .16
5.6 Monitoring audit programme .17
5.7 Reviewing and improving audit programme .17
6 Conducting an audit .18
6.1 General .18
6.2 Initiating audit .18
6.2.1 General.18
6.2.2 Establishing contact with auditee .18
6.2.3 Determining feasibility of audit .19
6.3 Preparing audit activities .19
6.3.1 Performing review of documented information.19
6.3.2 Audit planning . . .19
6.3.3 Assigning work to audit team .21
6.3.4 Preparing documented information for audit .21
6.4 Conducting audit activities .21
6.4.1 General.21
6.4.2 Assigning roles and responsibilities of guides and observers .21
6.4.3 Conducting opening meeting .22
6.4.4 Communicating during audit .23
6.4.5 Audit information availability and access .23
6.4.6 Reviewing documented information while conducting audit .23
6.4.7 Collecting and verifying information .24
6.4.8 Generating audit findings .25
6.4.9 Determining audit conclusions .25
6.4.10 Conducting closing meeting .26
6.5 Preparing and distributing audit report .27
6.5.1 Preparing audit report .27
6.5.2 Distributing audit report .27
6.6 Completing audit .28
6.7 Conducting audit follow-up.28
ISO 19011:2018(E)
7 Competence and evaluation of auditors .28
7.1 General .28
7.2 Determining auditor competence . .29
7.2.1 General.29
7.2.2 Personal behaviour .29
7.2.3 Knowledge and skills .30
7.2.4 Achieving auditor competence .32
7.2.5 Achieving audit team leader competence .33
7.3 Establishing auditor evaluation criteria.33
7.4 Selecting appropriate auditor evaluation method .33
7.5 Conducting auditor evaluation .33
7.6 Maintaining and improving auditor competence.34
Annex A (informative) Additional guidance for auditors planning and conducting audits .35
Bibliography .46
iv © ISO 2018 – All rights reserved
ISO 19011:2018(E)
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www .iso .org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: www .iso .org/iso/foreword .html.
This document was prepared by Project Committee ISO/PC 302, Guidelines for auditing management
systems.
This third edition cancels and replaces the second edition (ISO 19011:2011), which has been technically
revised.
The main differences compared to the second edition are as follows:
— addition of the risk-based approach to the principles of auditing;
— expansion of the guidance on managing an audit programme, including audit programme risk;
— expansion of the guidance on conducting an audit, particularly the section on audit planning;
— expansion of the generic competence requirements for auditors;
— adjustment of terminology to reflect the process and not the object (“thing”);
— removal of the annex containing competence requirements for auditing specific management
system disciplines (due to the large number of individual management system standards, it would
not be practical to include competence requirements for all disciplines);
— expansion of Annex A to provide guidance on auditing (new) concepts such as organization context,
leadership and commitment, virtual audits, compliance and supply chain.
ISO 19011:2018(E)
Introduction
Since the second edition of this document was published in 2011, a number of new management system
standards have been published, many of which have a common structure, identical core requirements
and common terms and core definitions. As a result, there is a need to consider a broader approach
to management system auditing, as well as providing guidance that is more generic. Audit results can
provide input to the analysis aspect of business planning, and can contribute to the identification of
improvement needs and activities.
An audit can be conducted against a range of audit criteria, separately or in combination, including but
not limited to:
— requirements defined in one or more management system standards;
— policies and requirements specified by relevant interested parties;
— statutory and regulatory requirements;
— one or more management system processes defined by the organization or other parties;
— management system plan(s) relating to the provision of specific outputs of a management system
(e.g. quality plan, project plan).
This document provides guidance for all sizes and types of organizations and audits of varying scopes
and scales, including those conducted by large audit teams, typically of larger organizations, and
those by single auditors, whether in large or small organizations. This guidance should be adapted as
appropriate to the scope, complexity and scale of the audit programme.
This document concentrates on internal audits (first party) and audits conducted by organizations
on their external providers and other external interested parties (second party). This document can
also be useful for external audits conducted for purposes other than third party management system
certification. ISO/IEC 17021-1 provides requirements for auditing management systems for third party
certification; this document can provide useful additional guidance (see Table 1).
Table 1 — Different types of audits
st nd rd
1 party audit 2 party audit 3 party audit
Internal audit External provider audit Certification and/or accreditation
audit
Other external interested party Statutory, regulatory and similar
audit audit
To simplify the readability of this document, the singular form of “management system” is preferred,
but the reader can adapt the implementation of the guidance to their own situation. This also applies to
the use of “individual” and “individuals”, “auditor” and “auditors”.
This document is intended to apply to a broad range of potential users, including auditors, organizations
implementing management systems and organizations needing to conduct management system audits
for contractual or regulatory reasons. Users of this document can, however, apply this guidance in
developing their own audit-related requirements.
The guidance in this document can also be used for the purpose of self-declaration and can be useful to
organizations involved in auditor training or personnel certification.
The guidance in this document is intended to be flexible. As indicated at various points in the text,
the use of this guidance can differ depending on the size and level of maturity of an organization’s
management system. The nature and complexity of the organization to be audited, as well as the
objectives and scope of the audits to be conducted, should also be considered.
vi © ISO 2018 – All rights reserved
ISO 19011:2018(E)
This document adopts the combined audit approach when two or more management systems of different
disciplines are audited together. Where these systems are integrated into a single management system,
the principles and processes of auditing are the same as for a combined audit (sometimes known as an
integrated audit).
This document provides guidance on the management of an audit programme, on the planning and
conducting of management system audits, as well as on the competence and evaluation of an auditor
and an audit team.
INTERNATIONAL STANDARD ISO 19011:2018(E)
Guidelines for auditing management systems
1 Scope
This document provides guidance on auditing management systems, including the principles of auditing,
managing an audit programme and conducting management system audits, as well as guidance on
the evaluation of competence of individuals involved in the audit process. These activities include the
individual(s) managing the audit programme, auditors and audit teams.
It is applicable to all organizations that need to plan and conduct internal or external audits of
management systems or manage an audit programme.
The application of this document to other types of audits is possible, provided that special consideration
is given to the specific competence needed.
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https: //www .iso .org/obp
— IEC Electropedia: available at http: //www .electropedia .org/
3.1
audit
systematic, independent and documented process for obtaining objective evidence (3.8) and evaluating
it objectively to determine the extent to which the audit criteria (3.7) are fulfilled
Note 1 to entry: Internal audits, sometimes called first party audits, are conducted by, or on behalf of, the
organization itself.
Note 2 to entry: External audits include those generally called second and third party audits. Second party audits
are conducted by parties having an interest in the organization, such as customers, or by other individuals on
their behalf. Third party audits are conducted by independent auditing organizations, such as those providing
certification/registration of conformity or governmental agencies.
[SOURCE: ISO 9000:2015, 3.13.1, modified — Notes to entry have been modified]
3.2
combined audit
audit (3.1) carried out together at a single auditee (3.13) on two or more management systems (3.18)
Note 1 to entry: When two or more discipline-specific management systems are integrated into a single
management system this is known as an integrated management system.
[SOURCE: ISO 9000:2015, 3.13.2, modified]
ISO 19011:2018(E)
3.3
joint audit
audit (3.1) carried out at a single auditee (3.13) by two or more auditing organizations
[SOURCE: ISO 9000:2015, 3.13.3]
3.4
audit programme
arrangements for a set of one or more audits (3.1) planned for a specific time frame and directed
towards a specific purpose
[SOURCE: ISO 9000:2015, 3.13.4, modified — wording has been added to the definition]
3.5
audit scope
extent and boundaries of an audit (3.1)
Note 1 to entry: The audit scope generally includes a description of the physical and virtual-locations, functions,
organizational units, activities and processes, as well as the time period covered.
Note 2 to entry: A virtual location is where an organization performs work or provides a service using an on-line
environment allowing individuals irrespective of physical locations to execute processes.
[SOURCE: ISO 9000:2015, 3.13.5, modified — Note 1 to entry has been modified, Note 2 to entry has
been added]
3.6
audit plan
description of the activities and arrangements for an audit (3.1)
[SOURCE: ISO 9000:2015, 3.13.6]
3.7
audit criteria
set of requirements (3.23) used as a reference against which objective evidence (3.8) is compared
Note 1 to entry: If the audit criteria are legal (including statutory or regulatory) requirements, the words
“compliance” or “non-compliance” are often used in an audit finding (3.10).
Note 2 to entry: Requirements may include policies, procedures, work instructions, legal requirements,
contractual obligations, etc.
[SOURCE: ISO 9000:2015, 3.13.7, modified — the definition has been changed and Notes to entry 1 and
2 have been added]
3.8
objective evidence
data supporting the existence or verity of something
Note 1 to entry: Objective evidence can be obtained through observation, measurement, test or by other means.
Note 2 to entry: Objective evidence for the purpose of the audit (3.1) generally consists of records, statements of
fact, or other information which are relevant to the audit criteria (3.7) and verifiable.
[SOURCE: ISO 9000:2015, 3.8.3]
3.9
audit evidence
records, statements of fact or other information, which are relevant to the audit criteria (3.7) and
verifiable
[SOURCE: ISO 9000:2015, 3.13.8]
2 © ISO 2018 – All rights reserved
ISO 19011:2018(E)
3.10
audit findings
results of the evaluation of the collected audit evidence (3.9) against audit criteria (3.7)
Note 1 to entry: Audit findings indicate conformity (3.20) or nonconformity (3.21).
Note 2 to entry: Audit findings can lead to the identification of risks, opportunities for improvement or recording
good practices.
Note 3 to entry: In English if the audit criteria are selected from statutory requirements or regulatory
requirements, the audit finding is termed compliance or non-compliance.
[SOURCE: ISO 9000:2015, 3.13.9, modified — Notes to entry 2 and 3 have been modified]
3.11
audit conclusion
outcome of an audit (3.1), after consideration of the audit objectives and all audit findings (3.10)
[SOURCE: ISO 9000:2015, 3.13.10]
3.12
audit client
organization or person requesting an audit (3.1)
Note 1 to entry: In the case of internal audit, the audit client can also be the auditee (3.13) or the individual(s)
managing the audit programme. Requests for external audit can come from sources such as regulators,
contracting parties or potential or existing clients.
[SOURCE: ISO 9000:2015, 3.13.11, modified — Note 1 to entry has been added]
3.13
auditee
organization as a whole or parts thereof being audited
[SOURCE: ISO 9000:2015, 3.13.12, modified]
3.14
audit team
one or more persons conducting an audit (3.1), supported if needed by technical experts (3.16)
Note 1 to entry: One auditor (3.15) of the audit team (3.14) is appointed as the audit team leader.
Note 2 to entry: The audit team can include auditors-in-training.
[SOURCE: ISO 9000:2015, 3.13.14]
3.15
auditor
person who conducts an audit (3.1)
[SOURCE: ISO 9000:2015, 3.13.15]
3.16
technical expert
person who provides specific knowledge or expertise to the audit team (3.14)
Note 1 to entry: Specific knowledge or expertise relates to the organization, the activity, process, product,
service, discipline to be audited, or language or culture.
Note 2 to entry: A technical expert to the audit team (3.14) does not act as an auditor (3.15).
[SOURCE: ISO 9000:2015, 3.13.16, modified — Notes to entry 1 and 2 have been modified]
ISO 19011:2018(E)
3.17
observer
individual who accompanies the audit team (3.14) but does not act as an auditor (3.15)
[SOURCE: ISO 9000:2015, 3.13.17, modified]
3.18
management system
set of interrelated or interacting elements of an organization to establish policies and objectives, and
processes (3.24) to achieve those objectives
Note 1 to entry: A management system can address a single discipline or several disciplines, e.g. quality
management, financial management or environmental management.
Note 2 to entry: The management system elements establish the organization’s structure, roles and
responsibilities, planning, operation, policies, practices, rules, beliefs, objectives and processes to achieve those
objectives.
Note 3 to entry: The scope of a management system can include the whole of the organization, specific and
identified functions of the organization, specific and identified sections of the organization, or one or more
functions across a group of organizations.
[SOURCE: ISO 9000:2015, 3.5.3, modified — Note 4 to entry has been deleted]
3.19
risk
effect of uncertainty
Note 1 to entry: An effect is a deviation from the expected – positive or negative.
Note 2 to entry: Uncertainty is the state, even partial, of deficiency of information related to, understanding or
knowledge of, an event, its consequence and likelihood.
Note 3 to entry: Risk is often characterized by reference to potential events (as defined in ISO Guide 73:2009,
3.5.1.3) and consequences (as defined in ISO Guide 73:2009, 3.6.1.3), or a combination of these.
Note 4 to entry: Risk is often expressed in terms of a combination of the consequences of an event (including
changes in circumstances) and the associated likelihood (as defined in ISO Guide 73:2009, 3.6.1.1) of occurrence.
[SOURCE: ISO 9000:2015, 3.7.9, modified — Notes to entry 5 and 6 have been deleted]
3.20
conformity
fulfilment of a requirement (3.23)
[SOURCE: ISO 9000:2015, 3.6.11, modified — Note 1 to entry has been deleted]
3.21
nonconformity
non-fulfilment of a requirement (3.23)
[SOURCE: ISO 9000:2015, 3.6.9, modified — Note 1 to entry has been deleted]
3.22
competence
ability to apply knowledge and skills to achieve intended results
[SOURCE: ISO 9000:2015, 3.10.4, modified — Notes to entry have been deleted]
4 © ISO 2018 – All rights reserved
ISO 19011:2018(E)
3.23
requirement
need or expectation that is stated, generally implied or obligatory
Note 1 to entry: “Generally implied” means that it is custom or common practice for the organization and
interested parties that the need or expectation under consideration is implied.
Note 2 to entry: A specified requirement is one that is stated, for example in documented information.
[SOURCE: ISO 9000:2015, 3.6.4, modified — Notes to entry 3, 4, 5 and 6 have been deleted]
3.24
process
set of interrelated or interacting activities that use inputs to deliver an intended result
[SOURCE: ISO 9000:2015, 3.4.1, modified — Notes to entry have been deleted]
3.25
performance
measurable result
Note 1 to entry: Performance can relate either to quantitative or qualitative findings.
Note 2 to entry: Performance can relate to the management of activities, processes (3.24), products, services,
systems or organizations.
[SOURCE: ISO 9000:2015, 3.7.8, modified — Note 3 to entry has been deleted]
3.26
effectiveness
extent to which planned activities are realized and planned results achieved
[SOURCE: ISO 9000:2015, 3.7.11, modified — Note 1 to entry has been deleted]
4 Principles of auditing
Auditing is characterized by reliance on a number of principles. These principles should help to make
the audit an effective and reliable tool in support of management policies and controls, by providing
information on which an organization can act in order to improve its performance. Adherence to these
principles is a prerequisite for providing audit conclusions that are relevant and sufficient, and for
enabling auditors, working independently from one another, to reach similar conclusions in similar
circumstances.
The guidance given in Clauses 5 to 7 is based on the seven principles outlined below.
a) Integrity: the foundation of professionalism
Auditors and the individual(s) managing an audit programme should:
— perform their work ethically, with honesty and responsibility;
— only undertake audit activities if competent to do so;
— perform their work in an impartial manner, i.e. remain fair and unbiased in all their dealings;
— be sensitive to any influences that may be exerted on their judgement while carrying out an audit.
b) Fair presentation: the obligation to report truthfully and accurately
Audit findings, audit conclusions and audit reports should reflect truthfully and accurately the
audit activities. Significant obstacles encountered during the audit and unresolved diverging
ISO 19011:2018(E)
opinions between the audit team and the auditee should be reported. The communication should
be truthful, accurate, objective, timely, clear and complete.
c) Due professional care: the application of diligence and judgement in auditing
Auditors should exercise due care in accordance with the importance of the task they perform
and the confidence placed in them by the audit client and other interested parties. An important
factor in carrying out their work with due professional care is having the ability to make reasoned
judgements in all audit situations.
d) Confidentiality: security of information
Auditors should exercise discretion in the use and protection of information acquired in the course
of their duties. Audit information should not be used inappropriately for personal gain by the
auditor or the audit client, or in a manner detrimental to the legitimate interests of the auditee.
This concept includes the proper handling of sensitive or confidential information.
e) Independence: the basis for the impartiality of the audit and objectivity of the audit conclusions
Auditors should be independent of the activity being audited wherever practicable, and should in
all cases act in a manner that is free from bias and conflict of interest. For internal audits, auditors
should be independent from the function being audited if practicable. Auditors should maintain
objectivity throughout the audit process to ensure that the audit findings and conclusions are
based only on the audit evidence.
For small organizations, it may not be possible for internal auditors to be fully independent of the
activity being audited, but every effort should be made to remove bias and encourage objectivity.
f) Evidence-based approach: the rational method for reaching reliable and reproducible audit
conclusions in a systematic audit process
Audit evidence should be verifiable. It should in general be based on samples of the information
available, since an audit is conducted during a finite period of time and with finite resources. An
appropriate use of sampling should be applied, since this is closely related to the confidence that
can be placed in the audit conclusions.
g) Risk-based approach: an audit approach that considers risks and opportunities
The risk-based approach should substantively influence the planning, conducting and reporting of
audits in order to ensure that audits are focused on matters that are significant for the audit client,
and for achieving the audit programme objectives.
5 Managing an audit programme
5.1 General
An audit programme should be established which can include audits addressing one or more
management system standards or other requirements, conducted either separately or in combination
(combined audit).
The extent of an audit programme should be based on the size and nature of the auditee, as well as on
the nature, functionality, complexity, the type of risks and opportunities, and the level of maturity of
the management system(s) to be audited.
The functionality of the management system can be even more complex when most of the important
functions are outsourced and managed under the leadership of other organizations. Particular
attention needs to be paid to where the most important decisions are made and what constitutes the
top management of the management system.
6 © ISO 2018 – All rights reserved
ISO 19011:2018(E)
In the case of multiple locations/sites (e.g. different countries), or where important functions are
outsourced and managed under the leadership of another organization, particular attention should be
paid to the design, planning and validation of the audit programme.
In the case of smaller or less complex organizations the audit programme can be scaled appropriately.
In order to understand the context of the auditee, the audit programme should take into account the
auditee’s:
— organizational objectives;
— relevant external and internal issues;
— the needs and expectations of relevant interested parties;
— information security and confidentiality requirements.
The planning of internal audit programmes and, in some cases programmes for auditing external
providers, can be arranged to contribute to other objectives of the organization.
The individual(s) managing the audit programme should ensure the integrity of the audit is maintained
and that there is not undue influence exerted over the audit.
Audit priority should be given to allocating resources and methods to matters in a management system
with higher inherent risk and lower level of performance.
Competent individuals should be assigned to manage the audit programme.
The audit programme should include information and identify resources to enable the audits to be
conducted effectively and efficiently within the specified time frames. The information should include:
a) objectives for the audit programme;
b) risks and opportunities associated with the audit programme (see 5.3) and the actions to
address them;
c) scope (extent, boundaries, locations) of each audit within the audit programme;
d) schedule (number/duration/frequency) of the audits;
e) audit types, such as internal or external;
f) audit criteria;
g) audit methods to be employed;
h) criteria for selecting audit team members;
i) relevant documented information.
Some of this information may not be available until more detailed audit planning is complete.
The implementation of the audit programme should be monitored and measured on an ongoing basis
(see 5.6) to ensure its objectives have been achieved. The audit programme should be reviewed in order
to identify needs for changes and possible opportunities for improvements (see 5.7).
Figure 1 illustrates the process flow for the management of an audit programme.
ISO 19011:2018(E)
NOTE 1 This Figure illustrates the application of the Plan-Do-Check-Act cycle in this document.
NOTE 2 Clause/subclause numbering refers to the relevant clauses/subclauses of this document.
Figure 1 — Process flow for the management of an audit programme
8 © ISO 2018 – All rights reserved
ISO 19011:2018(E)
5.2 Establishing audit programme objectives
The audit client should ensure that the audit programme objectives are established to direct the
planning and conducting of audits and should ensure the audit programme is implemented effectively.
Audit programme objectives should be consistent with the audit client’s strategic direction and support
management system policy and objectives.
These objectives can be based on consideration of the following:
a) needs and expectations of relevant interested parties, both external and internal;
b) characteristics of and requirements for processes, products, services and projects, and any changes
to them;
c) management system requirements;
d) need for evaluation of external providers;
e) auditee’s level of performance and level of maturity of the management system(s), as reflected
in relevant performance indicators (e.g. KPIs), the occurrence of nonconformities or incidents or
complaints from interested parties;
f) identified risks and opportunities to the auditee;
g) results of previous audits.
Examples of audit programme objectives can include the following:
— identify opportunities for the improvement of a management system and its performance;
— evaluate the capability of the auditee to determine its context;
— evaluate the capability of the auditee to determine risks and opportunities and to identify and
implement effective actions to address them;
— conform to all relevant requirements, e.g. statutory and regulatory requirements, compliance
commitments, requirements for certification to a management system standard;
— obtain and maintain confidence in the capability of an external provider;
...
SLOVENSKI SIST EN ISO 19011
STANDARD oktober 2018
Smernice za presojanje sistemov vodenja (ISO 19011:2018)
Guidelines for auditing management systems (ISO 19011:2018)
Lignes directrices pour l'audit des systèmes de management (ISO 19011:2018)
Leitfaden zur Auditierung von Managementsystemen (ISO 19011:2018)
Referenčna oznaka
ICS 03.100.70; 03.120.10; 13.020.10 SIST EN ISO 19011:2018 (sl,en)
Nadaljevanje na straneh II in od 1 do 80
© 2020-04. Slovenski inštitut za standardizacijo. Razmnoževanje ali kopiranje celote ali delov tega standarda ni dovoljeno.
SIST EN ISO 19011 : 2018
NACIONALNI UVOD
Standard SIST EN ISO 19011 (sl,en), Smernice za presojanje sistemov vodenja (ISO 19011:2018),
2018, ima status slovenskega standarda in je enakovreden evropskemu standardu EN ISO 19011,
Guidelines for auditing management systems (ISO 19011:2018), 2018.
NACIONALNI PREDGOVOR
Besedilo standarda EN ISO 19011:2018 je pripravil Projektni odbor ISO/PC 302, Smernice za presojanje
sistemov vodenja. Slovenski standard SIST EN ISO 19011:2018 je prevod angleškega besedila
evropskega standarda EN ISO 19011:2018. V primeru spora glede besedila slovenskega prevoda v tem
standardu je odločilen izvirni evropski standard v angleškem jeziku. Slovensko-angleško izdajo
standarda je pripravil SIST/TC VZK Vodenje in zagotavljanje kakovosti.
Odločitev za privzem tega standarda je dne 28. 8. 2018 sprejel SIST/TC VZK Vodenje in zagotavljanje
kakovosti.
ZVEZA S STANDARDI
Standard se ne sklicuje na druge standarde.
OSNOVA ZA IZDAJO STANDARDA
– Privzem standarda EN ISO 19011:2018.
PREDHODNA IZDAJA
– SIST EN ISO 19011:2011.
OPOMBE
– Povsod, kjer se v besedilu standarda uporablja izraz "mednarodni standard", v SIST EN ISO
19011:2018 to pomeni "slovenski standard".
– Nacionalni uvod in nacionalni predgovor nista sestavni del standarda.
– Ta nacionalni dokument je istoveten EN ISO 19011:2018 in je objavljen z dovoljenjem
Upravni center
CEN-CENELEC
Rue de la Science 23
B-1040 Bruselj
This national document is identical with EN ISO 19011:2018 and is published with the permission
of
CEN-CENELEC
Management Centre
Rue de la Science 23
B-1040 Brussels
II
EVROPSKI STANDARD EN ISO 19011
EUROPEAN STANDARD
NORME EUROPÉENNE
julij 2018
EUROPÄISCHE NORM
ICS 03.100.70, 03.120.20 Nadomešča EN ISO 19011:2011
Slovenska izdaja
Smernice za presojanje sistemov vodenja
(ISO 19011:2018)
Guidelines for auditing Lignes directrices pour l'audit Leitfaden zur Auditierung von
management systems des systèmes de management Managementsystemen
(ISO 19011:2018) (ISO 19011:2018) (ISO 19011:2018)
Ta evropski standard je CEN sprejel 18. junija 2018.
Člani CEN morajo izpolnjevati določila notranjih predpisov CEN/CENELEC, s katerimi je predpisano,
da mora biti ta evropski standard brez kakršnih koli sprememb sprejet kot nacionalni standard.
Seznami najnovejših izdaj teh nacionalnih standardov in njihovi bibliografski podatki so na zahtevo
na voljo pri Upravnem centru CEN-CENELEC ali kateremkoli članu CEN.
Ta evropski standard obstaja v treh uradnih izdajah (angleški, francoski in nemški). Izdaje v drugih
jezikih, ki jih člani CEN na lastno odgovornost prevedejo in izdajo ter prijavijo pri Upravnem centru
CEN-CENELEC, veljajo kot uradne izdaje.
Člani CEN so nacionalni organi za standarde Avstrije, Belgije, Bolgarije, Cipra, Češke republike,
Danske, Estonije, Finske, Francije, Grčije, Hrvaške, Irske, Islandije, Italije, Latvije, Litve,
Luksemburga, Madžarske, Malte, Nekdanje jugoslovanske republike Makedonije, Nemčije,
Nizozemske, Norveške, Poljske, Portugalske, Romunije, Srbije, Slovaške, Slovenije, Španije,
Švedske, Švice, Turčije in Združenega kraljestva.
CEN
Evropski komite za standardizacijo
European Committee for Standardization
Comité Européen de Normalisation
Europäisches Komitee für Normung
Upravni center CEN-CENELEC: Rue de la Science 23, B-1040 Bruselj
© 2018 CEN Lastnice avtorskih pravic so vse države članice CEN Ref. oznaka EN ISO 19011:2018 E
SIST EN ISO 19011 : 2018
VSEBINA StranCONTENTS Page
Predgovor k evropskemu standardu . 5 European foreword . 5
Predgovor . 6 Foreword . 6
Uvod . 8 Introduction . 8
1 Področje uporabe . 11 1 Scope . 11
2 Zveza s standardi . 11 2 Normative references . 11
3 Izrazi in definicije . 11 3 Terms and definitions . 11
4 Načela presojanja . 17 4 Principles of auditing . 17
5 Vodenje programa presoj . 19 5 Managing an audit programme . 19
5.1 Splošno . 19 5.1 General . 19
5.2 Določitev ciljev programa presoj . 23 5.2 Establishing audit programme
objectives . 23
5.3 Določitev in ovrednotenje tveganj ter 5.3 Determining and evaluating audit
priložnosti programa presoj . 24 programme risks and opportunities . 24
5.4 Določitev programa presoj . 25 5.4 Establishing the audit programme . 25
5.4.1 Vloge in odgovornosti posameznikov, 5.4.1 Roles and responsibilities of the
ki vodijo program presoj. . 25 individual(s) managing the audit
programme . 25
5.4.2 Kompetentnost posameznikov, 5.4.2 Competence of individual(s)
ki vodijo program presoj . 26 managing audit programme . 26
5.4.3 Določitev obsega programa presoj . 26 5.4.3 Establishing extent of audit
programme . 26
5.4.4 Določitev virov za program presoj . 28 5.4.4 Determining audit programme
resources . 28
5.5 Izvedba programa presoj . 28 5.5 Implementing audit programme . 28
5.5.1 Splošno . 28 5.5.1 General . 28
5.5.2 Določitev ciljev, obsega in kriterijev 5.5.2 Defining the objectives, scope and
za posamezno presojo . 29 criteria for an individual audit . 29
5.5.3 Izbira in določitev presojevalnih 5.5.3 Selecting and determining audit
metod . 31 methods . 31
5.5.4 Izbira članov presojevalne skupine . 31 5.5.4 Selecting audit team members . 31
5.5.5 Dodelitev odgovornosti za posamezno 5.5.5 Assigning responsibility for an individual
presojo vodji presojevalne skupine . 32 audit to the audit team leader . 32
5.5.6 Vodenje rezultatov programa 5.5.6 Managing audit programme results . 34
presoj . 34
5.5.7 Vodenje in vzdrževanje zapisov 5.5.7 Managing and maintaining audit
programa presoj . 34 programme records .34
5.6 Nadzorovanje programa presoj . 35 5.6 Monitoring audit programme . 35
5.7 Pregledovanje in izboljševanje programa 5.7 Reviewing and improving audit
presoj . 36 programme . 36
6 Izvajanje presoje . 37 6 Conducting an audit . 37
6.1 Splošno . 37 6.1 General . 37
6.2 Začetek presoje . 37 6.2 Initiating audit . 37
6.2.1 Splošno . 37 6.2.1 General . 37
6.2.2 Vzpostavitev stika s presojancem . 37 6.2.2 Establishing contact with auditee . 37
6.2.3 Ugotavljanje izvedljivosti presoje . 38 6.2.3 Determining feasibility of audit . 38
SIST EN ISO 19011 : 2018
6.3 Priprava aktivnosti presoje . 38 6.3 Preparing audit activities . 38
6.3.1 Pregled dokumentiranih informacij . 38 6.3.1 Performing review of documented
information . 38
6.3.2 Načrtovanje presoje . 39 6.3.2 Audit planning . 39
6.3.3 Dodelitev dela presojevalni skupini . 41 6.3.3 Assigning work to audit team . 41
6.3.4 Priprava dokumentiranih informacij 6.3.4 Preparing documented information for
za presojo . 42 audit .42
6.4 Izvajanje aktivnosti presoje . 42 6.4 Conducting audit activities . 42
6.4.1 Splošno . 42 6.4.1 General . 42
6.4.2 Dodelitev vlog in odgovornosti 6.4.2 Assigning roles and responsibilities of
spremljevalcem in opazovalcem . 42 guides and observers . 42
6.4.3 Izvedba uvodnega sestanka . 43 6.4.3 Conducting opening meeting . 43
6.4.4 Komuniciranje med presojo . 45 6.4.4 Communicating during audit . 45
6.4.5 Razpoložljivost in dostop do 6.4.5 Audit information availability and
informacij o presoji . 45 access . 45
6.4.6 Pregledovanje dokumentiranih 6.4.6 Reviewing documented information
informacij med izvedbo presoje . 46 while conducting audit . 46
6.4.7 Zbiranje in preverjanje informacij . 46 6.4.7 Collecting and verifying information . 46
6.4.8 Oblikovanje ugotovitev presoje . 48 6.4.8 Generating audit findings . 48
6.4.9 Določanje sklepov presoje . 48 6.4.9 Determining audit conclusions . 48
6.4.10 Izvedba zaključnega sestanka . 49 6.4.10 Conducting closing meeting . 49
6.5 Priprava in razdelitev poročila o presoji . 50 6.5 Preparing and distributing audit report . 50
6.5.1 Priprava poročila o presoji . 50 6.5.1 Preparing audit report . 50
6.5.2 Razdelitev poročila o presoji . 52 6.5.2 Distributing audit report . 52
6.6 Dokončanje presoje . 52 6.6 Completing audit . 52
6.7 Izvajanje aktivnosti po presoji . 52 6.7 Conducting audit follow-up . 52
7 Kompetentnost in vrednotenje 7 Competence and evaluation of auditors . 53
presojevalcev . 53
7.1 Splošno . 53 7.1 General .53
7.2 Ugotavljanje kompetentnosti 7.2 Determining auditor competence. . 54
presojevalcev . 54
7.2.1 Splošno . 54 7.2.1 General . 54
7.2.2 Osebno vedenje . 54 7.2.2 Personal behaviour . 54
7.2.3 Znanje in veščine . 55 7.2.3 Knowledge and skills . 55
7.2.4 Doseganje kompetentnosti 7.2.4 Achieving auditor competence . 59
presojevalcev . 59
7.2.5 Doseganje kompetentnosti vodje 7.2.5 Achieving audit team leader
presojevalne skupine . 60 competence . 60
7.3 Določitev kriterijev za vrednotenje 7.3 Establishing auditor evaluation criteria . 60
presojevalcev . 60
7.4 Izbira ustrezne metode za vrednotenje 7.4 Selecting appropriate auditor evaluation
presojevalcev . 60 method . 60
7.5 Izvedba vrednotenja presojevalcev . 62 7.5 Conducting auditor evaluation . 62
7.6 Vzdrževanje in izboljševanje 7.6 Maintaining and improving auditor
kompetentnosti presojevalcev . 62 competence . 62
SIST EN ISO 19011 : 2018
Dodatek A (informativni): Dodatni napotki Annex A (informative) Additional guidance
presojevalcem za načrtovanje in izvajanje for auditors planning and conducting
presoj . 63 audits . 63
Bibliography . 80
Literatura . 80
SIST EN ISO 19011 : 2018
Predgovor k evropskemu standardu European foreword
Ta dokument (EN ISO 19011:2018) je pripravil This document (EN ISO 19011:2018) has been
tehnični odbor ISO/PC 302 "Smernice za prepared by Technical Committee ISO/PC 302
presojanje sistemov vodenja" v sodelovanju s "Guidelines for auditing management systems" in
CCMC. collaboration with CCMC.
Ta evropski standard mora z objavo istovetnega This European Standard shall be given the status
besedila ali z razglasitvijo dobiti status of a national standard, either by publication of an
nacionalnega standarda najpozneje do januarja identical text or by endorsement, at the latest by
2019, nacionalne standarde, ki so v nasprotju s January 2019, and conflicting national standards
tem standardom, pa je treba umakniti najpozneje shall be withdrawn at the latest by January 2019.
do januarja 2019.
Opozoriti je treba na možnost, da je lahko nekaj Attention is drawn to the possibility that some of
elementov tega dokumenta predmet patentnih the elements of this document may be the subject
pravic. CEN ne prevzema odgovornosti za of patent rights. CEN shall not be held responsible
identifikacijo katerihkoli ali vseh takih patentnih for identifying any or all such patent rights.
pravic.
Ta dokument nadomešča EN ISO 19011:2011. This document supersedes EN ISO 19011:2011.
Ta dokument je bil pripravljen v okviru mandata, This document has been prepared under a
ki sta ga Evropska komisija in Evropsko združenje mandate given to CEN by the European
za prosto trgovino (EFTA) dala CEN. Commission and the European Free Trade
Association.
V skladu z notranjimi predpisi CEN-CENELEC According to the CEN-CENELEC Internal
morajo ta evropski standard obvezno uvesti Regulations, the national standards organizations
nacionalne organizacije za standardizacijo of the following countries are bound to implement
naslednjih držav: Avstrije, Belgije, Bolgarije, this European Standard: Austria, Belgium,
Cipra, Češke republike, Danske, Estonije, Finske, Bulgaria, Croatia, Cyprus, Czech Republic,
Francije, Grčije, Hrvaške, Irske, Islandije, Italije, Denmark, Estonia, Finland, Former Yugoslav
Latvije, Litve, Luksemburga, Madžarske, Malte, Republic of Macedonia, France, Germany,
Nekdanje jugoslovanske republike Makedonije, Greece, Hungary, Iceland, Ireland, Italy, Latvia,
Nemčije, Nizozemske, Norveške, Poljske, Lithuania, Luxembourg, Malta, Netherlands,
Portugalske, Romunije, Srbije, Slovaške, Norway, Poland, Portugal, Romania, Serbia,
Slovenije, Španije, Švedske, Švice, Turčije in Slovakia, Slovenia, Spain, Sweden, Switzerland,
Združenega kraljestva. Turkey and the United Kingdom.
Razglasitvena objava Endorsement notice
Besedilo ISO 19011:2018 je CEN odobril kot EN The text of ISO 19011:2018 has been approved
ISO 19011:2018 brez kakršnih koli sprememb. by CEN as EN ISO 19011:2018 without any
modification.
SIST EN ISO 19011 : 2018
Predgovor Foreword
Mednarodna organizacija za standardizacijo ISO (the International Organization for
(ISO) je svetovna zveza nacionalnih organov za Standardization) is a worldwide federation of
standarde (članov ISO). Mednarodne standarde national standards bodies (ISO member bodies).
ponavadi pripravljajo tehnični odbori ISO. Vsak The work of preparing International Standards is
član, ki ga zanima področje, za katero je bil normally carried out through ISO technical
ustanovljen tehnični odbor, ima pravico biti committees. Each member body interested in a
zastopan v tem odboru. Pri delu sodelujejo tudi subject for which a technical committee has been
mednarodne vladne in nevladne organizacije, established has the right to be represented on that
povezane z ISO. V vseh zadevah, ki so povezane committee. International organizations,
s standardizacijo na področju elektrotehnike, ISO governmental and non-governmental, in liaison
tesno sodeluje z Mednarodno elektrotehniško with ISO, also take part in the work. ISO
komisijo (IEC). collaborates closely with the International
Electrotechnical Commission (IEC) on all matters
of electrotechnical standardization.
Postopki, uporabljeni pri pripravi tega dokumenta, The procedures used to develop this document
in predvideni postopki za njegovo vzdrževanje so and those intended for its further maintenance are
opisani v Direktivah ISO/IEC, 1. del. Posebna described in the ISO/IEC Directives, Part 1. In
pozornost naj se nameni različnim kriterijem particular the different approval criteria needed for
odobritve, potrebnim za različne vrste the different types of ISO documents should be
dokumentov ISO. Ta dokument je bil pripravljen v noted. This document was drafted in accordance
skladu z uredniškimi pravili Direktiv ISO/IEC, 2. with the editorial rules of the ISO/IEC Directives,
del (glej www.iso.org/directives). Part 2 (see www.iso.org/directives).
Opozoriti je treba na možnost, da je lahko nekaj Attention is drawn to the possibility that some of
elementov tega dokumenta predmet patentnih the elements of this document may be the subject
pravic. ISO ne prevzema odgovornosti za of patent rights. ISO shall not be held responsible
identifikacijo nekaterih ali vseh takih patentnih for identifying any or all such patent rights. Details
pravic. Podrobnosti o morebitnih patentnih of any patent rights identified during the
pravicah, opredeljenih med pripravo tega development of the document will be in the
dokumenta, bodo navedene v uvodu in/ali na Introduction and/or on the ISO list of patent
seznamu patentnih izjav, ki jih je prejela declarations received (see www.iso.org/patents).
organizacija ISO (glej www.iso.org/patents).
Morebitna trgovska imena, uporabljena v tem Any trade name used in this document is
dokumentu, so informacije za uporabnike in ne information given for the convenience of users
pomenijo podpore blagovni znamki. and does not constitute an endorsement.
Obrazložitev prostovoljne narave standardov, For an explanation on the voluntary nature of
pomena specifičnih terminov in izrazov ISO, standards, the meaning of ISO specific terms and
povezanih z ugotavljanjem skladnosti, ter expressions related to conformity assessment, as
informacije o tem, kako ISO spoštuje načela well as information about ISO's adherence to the
Svetovne trgovinske organizacije (WTO) v World Trade Organization (WTO) principles in the
Tehničnih ovirah pri trgovanju (TBT), je na voljo Technical Barriers to Trade (TBT) see the
na povezavi: www.iso.org/iso/foreword.html. following URL: www.iso.org/iso/foreword.html.
Ta dokument je pripravil Projektni odbor ISO/PC This document was prepared by Project
302, Smernice za presojanje sistemov vodenja. Committee ISO/PC 302, Guidelines for auditing
management systems.
Ta tretja izdaja razveljavlja in nadomešča drugo This third edition cancels and replaces the second
izdajo (ISO 19011:2011), ki je tehnično edition (ISO 19011:2011), which has been
revidirana. technically revised.
Glavne razlike v primerjavi z drugo izdajo so: The main differences compared to the second
edition are as follows:
SIST EN ISO 19011 : 2018
– k načelom presojanja je dodan pristop na – addition of the risk-based approach to the
podlagi tveganj; principles of auditing;
– razširjeni so napotki o vodenju programa – expansion of the guidance on managing an
presoj, vključno s tveganjem programa audit programme, including audit
presoj; programme risk;
– razširjeni so napotki o izvajanju presoje, – expansion of the guidance on conducting
zlasti razdelek o načrtovanju presoje; an audit, particularly the section on audit
planning;
– razširjene so splošne zahteve glede – expansion of the generic competence
kompetentnosti presojevalcev; requirements for auditors;
– terminologija je prilagojena tako, da odraža – adjustment of terminology to reflect the
proces in ne predmeta ("stvari"); process and not the object ("thing");
– odstranjen je dodatek, ki vsebuje zahteve – removal of the annex containing
glede kompetentnosti za presojanje competence requirements for auditing
specifičnih strok sistema vodenja (ker specific management system disciplines
obstaja veliko posameznih standardov s (due to the large number of individual
področja sistemov vodenja, ne bi bila management system standards, it would
praktična vključitev zahtev glede not be practical to include competence
kompetentnosti za vse stroke); requirements for all disciplines);
– razširitev dodatka A, da se zagotovijo – expansion of Annex A to provide guidance
napotki o presojanju (novih) konceptov, kot on auditing (new) concepts such as
so kontekst organizacije, vodenje in organization context, leadership and
zavezanost, virtualne presoje, skladnost in commitment, virtual audits, compliance and
oskrbovalna veriga. supply chain.
SIST EN ISO 19011 : 2018
Uvod Introduction
Od objave druge izdaje tega dokumenta v letu Since the second edition of this document was
2011 je bilo objavljenih več novih standardov s published in 2011, a number of new
področja sistemov vodenja, od katerih imajo management system standards have been
mnogi skupno strukturo, enake temeljne zahteve published, many of which have a common
ter skupne izraze in osnovne definicije. Zato je structure, identical core requirements and
treba razmisliti o širšem pristopu k presojanju common terms and core definitions. As a result,
sistemov vodenja, pa tudi o splošnejših there is a need to consider a broader approach
navodilih. Rezultati presoje lahko prispevajo k to management system auditing, as well as
vidiku analize poslovnega načrtovanja ter k providing guidance that is more generic. Audit
opredelitvi potreb in aktivnosti za izboljševanje. results can provide input to the analysis aspect
of business planning, and can contribute to the
identification of improvement needs and
activities.
Presojo je mogoče izvesti glede na vrsto An audit can be conducted against a range of
kriterijev presoje, ločeno ali v kombinaciji, kar audit criteria, separately or in combination,
med drugim vključuje: including but not limited to:
– zahteve, določene v enem ali več – requirements defined in one or more
standardih s področja sistemov vodenja; management system standards;
– politiko in zahteve, ki jih določijo zadevne – policies and requirements specified by
zainteresirane strani; relevant interested parties;
– zakonske in regulativne zahteve; – statutory and regulatory requirements;
– enega ali več procesov sistema vodenja, ki – one or more management system
jih določi organizacija ali druge stranke; processes defined by the organization or
other parties;
– načrt(-i) sistema vodenja v zvezi z – management system plan(s) relating to the
zagotavljanjem specifičnih rezultatov provision of specific outputs of a
sistema vodenja (npr. plan kakovosti, management system (e.g. quality plan,
projektni načrt). project plan).
Ta dokument podaja napotke za organizacije This document provides guidance for all sizes
vseh vrst in velikosti ter presoje različnih and types of organizations and audits of varying
obsegov, vključno s tistimi, ki jih izvajajo velike scopes and scales, including those conducted by
presojevalne skupine, ponavadi v okviru večjih large audit teams, typically of larger
organizacij, in s presojami posameznih organizations, and those by single auditors,
presojevalcev, ki se izvajajo v okviru večjih ali whether in large or small organizations. This
manjših organizacij. Ti napotki naj se ustrezno guidance should be adapted as appropriate to
prilagodijo obsegu, kompleksnosti in obsežnosti the scope, complexity and scale of the audit
programa presoj. programme.
Ta dokument se osredotoča na notranje presoje This document concentrates on internal audits
(prva stranka) in presoje, ki jih izvajajo (first party) and audits conducted by
organizacije pri svojih zunanjih ponudnikih in organizations on their external providers and
drugih zunanjih zainteresiranih straneh (druga other external interested parties (second party).
stranka). Ta dokument se lahko uporablja tudi za This document can also be useful for external
zunanje presoje, ki se ne izvajajo z namenom audits conducted for purposes other than third
certificiranja sistemov vodenja tretjih strank. party management system certification. ISO/IEC
ISO/IEC 17021-1 podaja zahteve za presojanje 17021-1 provides requirements for auditing
sistemov vodenja za certificiranje tretjih strank; v management systems for third party certification;
tem dokumentu so lahko podani uporabni this document can provide useful additional
dodatni napotki (glej preglednico 1). guidance (see Table 1).
SIST EN ISO 19011 : 2018
Preglednica 1: Različne vrste presoj
Presoja prve stranke Presoja druge stranke Presoja tretje stranke
Notranja presoja Presoja zunanjega ponudnika Presoja za certificiranje in/ali
akreditacijo
Presoja druge zunanje Zakonska, regulativna in
zainteresirane strani podobna presoja
Table 1 – Different types of audits
1st party audit 2nd party audit 3rd party audit
Internal audit External provider audit Certification and/or accreditation
audit
Other external interested party Statutory, regulatory and similar
audit
audit
Za poenostavitev berljivosti tega dokumenta je To simplify the readability of this document, the
uporabljena edninska oblika "sistem vodenja", singular form of "management system" is
bralec pa lahko izvajanje napotkov prilagodi preferred, but the reader can adapt the
svojim razmeram. To velja tudi za uporabo implementation of the guidance to their own
izrazov "posameznik" in "posamezniki" ter situation. This also applies to the use of
"presojevalec" in "presojevalci". "individual" and "individuals", "auditor" and
"auditors".
Ta dokument je namenjen širokemu krogu This document is intended to apply to a broad
morebitnih uporabnikov, vključno s presojevalci, range of potential users, including auditors,
organizacijami, ki izvajajo sisteme vodenja, in organizations implementing management
organizacijami, ki morajo izvajati presoje systems and organizations needing to conduct
sistemov vodenja iz pogodbenih ali regulativnih management system audits for contractual or
razlogov. Uporabniki tega dokumenta lahko te regulatory reasons. Users of this document can,
napotke uporabljajo tudi za pripravo lastnih however, apply this guidance in developing their
zahtev v zvezi s presojo. own audit-related requirements.
Napotki iz tega dokumenta se lahko uporabljajo The guidance in this document can also be used
tudi za samodeklariranje in lahko koristijo for the purpose of self-declaration and can be
organizacijam, ki so vključene v usposabljanje useful to organizations involved in auditor
presojevalcev ali certificiranje osebja. training or personnel certification.
Uporaba napotkov v tem dokumentu se lahko The guidance in this document is intended to be
prilagaja. Kot je razvidno iz različnih delov flexible. As indicated at various points in the text,
besedila, se lahko uporaba teh napotkov the use of this guidance can differ depending on
razlikuje glede na velikost in stopnjo zrelosti the size and level of maturity of an organization’s
sistema vodenja organizacije. Upoštevajo naj se management system. The nature and
tudi narava in kompleksnost presojane complexity of the organization to be audited, as
organizacije ter tudi cilji in obseg predvidenih well as the objectives and scope of the audits to
presoj. be conducted, should also be considered.
V tem dokumentu je uporabljen kombiniran This document adopts the combined audit
pristop k presoji, v okviru katerega se hkrati approach when two or more management
izvaja presoja dveh ali več sistemov vodenja iz systems of different disciplines are audited
različnih strok. Kadar so ti sistemi povezani v en together. Where these systems are integrated
sistem vodenja, so načela in procesi presojanja into a single management system, the principles
enaki kot pri kombinirani presoji (to se včasih and processes of auditing are the same as for a
imenuje integrirana presoja). combined audit (sometimes known as an
integrated audit).
SIST EN ISO 19011 : 2018
Ta dokument podaja napotke za vodenje This document provides guidance on the
programa presoj, načrtovanje in izvajanje presoj management of an audit programme, on the
sistemov vodenja ter za kompetentnost in planning and conducting of management system
vrednotenje presojevalca in presojevalne audits, as well as on the competence and
skupine. evaluation of an auditor and an audit team.
SIST EN ISO 19011 : 2018
Smernice za presojanje sistemov Guidelines for auditing management
vodenja systems
1 Področje uporabe 1 Scope
Ta dokument podaja napotke o presojanju This document provides guidance on auditing
sistemov vodenja, vključno z načeli presojanja, management systems, including the principles of
vodenjem programa presoj in izvajanjem presoj auditing, managing an audit programme and
sistema vodenja ter tudi napotke za vrednotenje conducting management system audits, as well
kompetentnosti posameznikov, zajetih v proces as guidance on the evaluation of competence of
presoje. Te aktivnosti vključujejo posameznike, individuals involved in the audit process. These
ki vodijo program presoje, presojevalce in activities include the individual(s) managing the
presojevalne skupine. audit programme, auditors and audit teams.
Uporaben je v vseh organizacijah, v katerih It is applicable to all organizations that need to
obstaja potreba po načrtovanju in izvajanju plan and conduct internal or external audits of
notranje ali zunanje presoje sistemov vodenja ali management systems or manage an audit
vodenja programa presoj. programme.
Ta dokument se lahko uporablja pri drugih vrstah The application of this document to other types
presoj, če je pri tem posebna pozornost of audits is possible, provided that special
namenjena specifični kompetentnosti, ki je consideration is given to the specific
potrebna zanje. competence needed.
2 Zveza s standardi 2 Normative references
Ta dokument se ne sklicuje na druge standarde. There are no normative references in this
document.
3 Izrazi in definicije 3 Terms and definitions
V tem dokumentu se uporabljajo naslednji izrazi For the purposes of this document, the following
in definicije. terms and definitions apply.
ISO in IEC vzdržujeta terminološke zbirke ISO and IEC maintain terminological databases
podatkov za uporabo v standardizaciji na for use in standardization at the following
naslednjih naslovih: addresses:
– brskanje po spletni strani ISO: na voljo na – ISO Online browsing platform: available at
https://www.iso.org/obp https://www.iso.org/obp
– IEC Electropedia: na voljo na – IEC Electropedia: available at
http://www.electropedia.org/ http://www.electropedia.org/
3.1 3.1
presoja audit
sistematičen, neodvisen in dokumentiran proces systematic, independent and documented
pridobivanja stvarnih dokazov (3.8) in njihovega process for obtaining objective evidence (3.8)
objektivnega vrednotenja, da bi se določil obseg, and evaluating it objectively to determine the
v katerem so izpolnjeni kriteriji presoje (3.7) extent to which the audit criteria (3.7) are fulfilled
Opomba 1: Notranje presoje, včasih imenovane presoje Note 1 to entry: Internal audits, sometimes called first party
prve stranke, izvaja organizacija sama ali audits, are conducted by, or on behalf of, the
nekdo v njenem imenu. organization itself.
Opomba 2: Zunanje presoje vključujejo to, kar se Note 2 to entry: External audits include those generally
običajno imenuje presoja druge in tretje called second and third party audits. Second
stranke. Presoje druge stranke izvajajo party audits are conducted by parties having
stranke, ki so zainteresirane za organizacijo, an interest in the organization, such as
npr. odjemalci, ali drugi posamezniki v customers, or by other individuals on their
njihovem imenu. Presoje tretje stranke behalf. Third party audits are conducted by
izvajajo neodvisne presojevalne independent auditing organizations, such as
SIST EN ISO 19011 : 2018
organizacije, kot so organizacije, ki izvajajo those providing certification/registration of
certifikacijo/registracijo skladnosti, ali vladne conformity or governmental agencies.
agencije.
[VIR: ISO 9000:2015, 3.13.1, spremenjen – [SOURCE: ISO 9000:2015, 3.13.1, modified —
Opombi sta spremenjeni] Notes to entry have been modified]
3.2 3.2
kombinirana presoja combined audit
presoja (3.1), ki se pri enem samem presojancu audit (3.1) carried out together at a single
(3.13) izvaja hkrati na dveh ali več sistemih auditee (3.13) on two or more management
vodenja (3.18) systems (3.18)
Opomba 1: Kadar sta dva ali več sistemov vodenja za Note 1 to entry: When two or more discipline-specific
specifično stroko združena v en sistem management systems are integrated into a
vodenja, se to imenuje integriran sistem single management system this is known as
vodenja. an integrated management system.
[VIR: ISO 9000:2015, 3.13.2, spremenjen] [SOURCE: ISO 9000:2015, 3.13.2, modified]
3.3 3.3
skupna presoja joint audit
presoja (3.1), ki jo pri enem presojancu (3.13) audit (3.1) carried out at a single auditee (3.13)
izvajata dve ali več presojevalskih organizacij by two or more auditing organizations
[VIR: ISO 9000:2015, 3.13.3] [SOURCE: ISO 9000:2015, 3.13.3]
3.4 3.4
program presoj audit programme
ureditve za skupek ene ali več presoj (3.1), arrangements for a set of one or more audits
načrtovanih v specifičnem časovnem okviru in (3.1) planned for a specific time frame and
usmerjenih v specifičen namen directed towards a specific purpose
[VIR: ISO 9000:2015, 3.13.4, spremenjen – [SOURCE: ISO 9000:2015, 3.13.4, modified —
Definiciji je dodano besedilo] wording has been added to the definition]
3.5 3.5
obseg presoje audit scope
obseg in meje presoje (3.1) extent and boundaries of an audit (3.1)
Opomba 1: Obseg presoje navadno vključuje opis Note 1 to entry: The audit scope generally includes a
fizičnih in virtualnih lokacij, funkcij, description of the physical and virtual-
organizacijskih enot, aktivnosti in procesov locations, functions, organizational units,
ter tudi časovni okvir. activities and processes, as well as the time
period covered.
Opomba 2: Virtualna lokacija je mesto, kjer organizacija Note 2 to entry: Virtual location is where an organization
opravlja delo ali zagotavlja storitev z performs work or provides a service using an
uporabo spletnega okolja, ki posameznikom on-line environment allowing individuals
omogoča izvajanje procesov ne glede na irrespective of physical locations to execute
fizične lokacije. processes.
[VIR: ISO 9000:2015, 3.13.5, spremenjen – [SOURCE: ISO 9000:2015, 3.13.5, modified —
Opomba 1 je spremenjena; dodana je opomba Note 1 to entry has been modified, Note 2 to
2] entry has been added]
3.6 3.6
plan presoje audit plan
opis aktivnosti in ureditev za presojo (3.1) description of the activities and arrangements for
an audit (3.1)
[VIR: ISO 9000:2015, 3.13.6] [SOURCE: ISO 9000:2015, 3.13.6]
SIST EN ISO 19011 : 2018
3.7 3.7
kriteriji presoje audit criteria
skupek zahtev (3.23), ki se uporabljajo kot set of requirements (3.23) used as a reference
referenčna podlaga, s katero se primerjajo against which objective evidence (3.8) is
stvarni dokazi (3.8) compared
Opomba 1: Če so kriteriji presoje zakonske zahteve Note 1 to entry: If the audit criteria are legal (including
(vključno z regulativnimi), se besedi statutory or regulatory) requirements, the
"skladnost" oziroma "neskladnost" pogosto words "compliance" or "non-compliance" are
uporabljata v ugotovitvi presoje (3.10). often used in an audit finding (3.10).
Opomba 2: Zahteve lahko vključujejo politike, postopke, Note 2 to entry: Requirements may include policies,
navodila za delo, zakonske zahteve, procedures, work instructions, legal
pogodbene obveznosti itd. requirements, contractual obligations, etc.
[VIR: ISO 9000:2015, 3.13.7, spremenjen – [SOURCE: ISO 9000:2015, 3.13.7, modified —
Definicija je spremenjena, dodani sta opombi 1 the definition has been changed and Notes to
in 2] entry 1 and 2 have been added]
3.8 3.8
stvarni dokazi objective evidence
podatki, ki podpirajo obstoj ali resničnost nečesa data supporting the existence or verity of
something
Opomba 1: Stvarni dokazi se lahko dobijo z Note 1 to entry: Objective evidence can be obtained through
opazovanjem, merjenjem, preskusi ali z observation, measurement, test or by other
drugimi sredstvi. means.
Opomba 2: Stvarne dokaze za namen presoje (3.1) na Note 2 to entry: Objective evidence for the purpose of the
splošno sestavljajo zapisi, navedbe dejstev audit (3.1) generally consists of records,
ali druge informacije, ki so v zvezi s kriteriji statements of fact, or other information
presoje (3.7) in so preverljive. which are relevant to the audit criteria (3.7)
and verifiable.
[VIR: ISO 9000:2015, 3.8.3] [SOURCE: ISO 9000:2015, 3.8.3]
3.9 3.9
dokazi presoje audit evidence
zapisi, navedbe dejstev ali druge informacije, ki records, statements of fact or other information,
so v zvezi s kriteriji presoje (3.7) in jih je mogoče which are relevant to the audit criteria (3.7) and
preveriti verifiable
[VIR: ISO 9000:2015, 3.13.8] [SOURCE: ISO 9000:2015, 3.13.8]
3.10 3.10
ugotovitve presoje audit findings
rezultati vrednotenja zbranih dokazov presoje results of the evaluation of the collected audit
(3.9) glede na kriterije presoje (3.7) evidence (3.9) against audit criteria (3.7)
Opomba 1: Ugotovitve presoje pokažejo skladnost Note 1 to entry: Audit findings indicate conformity (3.20) or
(3.20) ali neskladnost (3.21). nonconformity (3.21).
Opomba 2: Ugotovitve presoje lahko vodijo k opredelitvi Note 2 to entry: Audit findings can lead to the identification of
tveganja, priložnostim za izboljševanje ali risks, opportunities for improvement or
zapisovanju dobrih praks. recording good practices.
Opomba 3: Če so kriteriji presoje izbrani na podlagi Note 3 to entry: In English if the audit criteria are selected
zakonskih ali regulativnih zahtev, se v from statutory requirements or regulatory
angleščini ugotovitev presoje imenuje requirements, the audit finding is termed
skladnost oziroma neskladnost. compliance or non-compliance.
[VIR: ISO 9000:2015, 3.13.9, spremenjen – [SOURCE: ISO 9000:2015, 3.13.9, modified —
Opombi 2 in 3 sta spremenjeni] Notes to entry 2 and 3 have been modified]
SIST EN ISO 19011 : 2018
3.11 3.11
sklep presoje audit conclusion
izid presoje (3.1) po preučitvi ciljev presoje in outcome of an audit (3.1), after consideration of
vseh ugotovitev presoje (3.10) the audit objectives and all audit findings (3.10)
[VIR: ISO 9000:2015, 3.13.10] [SOURCE: ISO 9000:2015, 3.13.10]
3.12 3.12
naročnik presoje audit client
organizacija ali oseba, ki zahteva presojo (3.1) organization or person requesting an audit (3.1)
Opomba 1: Pri notranji presoji je naročnik presoje lahko Note 1 to entry: In the case of internal audit, the audit client
tudi presojanec (3.13) ali posameznik can also be the auditee (3.13) or the
oziroma več posameznikov, ki vodijo individual(s) managing the audit
program presoj. Zahteve za zunanjo presojo programme. Requests for external audit can
lahko izhajajo iz virov, kot so zakonodajalci, come from sources such as regulators,
pogodbene stranke ali morebitni oziroma contracting parties or potential or existing
obstoječi naročniki. clients.
[VIR: ISO 9000:2015, 3.13.11, spremenjen – [SOURCE: ISO 9000:2015, 3.13.11, modified —
Dodana je opomba 1] Note 1 to entry has been added]
3.13 3.13
presojanec auditee
organizacija kot celota ali njeni deli, ki se organization as a whole or parts thereof being
presojajo audited
[VIR: ISO 9000:2015, 3.13.12, spremenjen] [SOURCE: ISO 9000:2015, 3.13.12, modified]
3.14 3.14
presojevalna skupina audit team
ena ali več oseb, ki izvajajo presojo (3.1), po one or more persons conducting an audit (3.1),
potrebi ob podpori strokovnih izvedencev (3.16) supported if needed by technical experts (3.16)
Opomba 1: En presojevalec (3.15) v presojevalni skupini Note 1 to entry: One auditor (3.15) of the audit team (3.14) is
(3.14) je imenovan za vodjo presojevalne appointed as the audit team leader.
skupine.
Opomba 2: V presojevalni skupini so lahko presojevalci Note 2 to entry: The audit team can include auditors-in-
pripravniki. training.
[VIR: ISO 9000:2015, 3.13.14] [SOURCE: ISO 9000:2015, 3.13.14]
3.15 3.15
presojevalec auditor
oseba, ki izvaja presojo (3.1) person who conducts an audit (3.1)
[VIR: ISO 9000:2015, 3.13.15] [SOURCE: ISO 9000:2015, 3.13.15]
3.16 3.16
strokovni izvedenec technical expert
oseba, ki presojevalni skupini (3.14) person who provides specific knowledge
zagotavlja specifično znanje ali strokovnost or expertise to the audit team (3.14)
Opomba 1: Specifično znanje ali strokovnost se nanaša Note 1 to entry: Specific knowledge or expertise relates to
na organizacijo, aktivnost, proces, proizvod, the organization, the activity, process,
storitev, stroko, ki je predmet presoje, ali na product, service, discipline to be audited, or
jezik ali kulturo. language or culture.
Opomba 2: Strokovni izvedenec v presojevalni skupini Note 2 to entry: A technical expert to the audit team (3.14)
(3.14) nima vloge presojevalca (3.15). does not act as an auditor (3.15).
[VIR: ISO 9000:2015, 3.13.16, spremenjen – [SOURCE: ISO 9000:2015, 3.13.16, modified —
Opombi 1 in 2 sta spremenjeni] Notes to entry 1 and 2 have been modified]
SIST EN ISO 19011 : 2018
3.17 3.17
opazovalec observer
posameznik, ki spremlja presojevalno skupino individual who accompanies
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.
Loading comments...