External Audits
Did you know your certification is based on a triennial cycle (three years)? Triennial cycles are a requirement of JAS-ANZ. So don’t try and ask your certification body to extend it or to ignore it. They can’t. They won’t. So what does this mean? The complete certification cycle roughly follows this sequence. As always it is unique to your circumstance, complexity, risk and certification body. So take the following as a guideline only.
Document review (1 off); precertification audit (1 off); certification audit (1 off); post certification audit; (1 every 6, 9 or 12 months) and recertification audit (triennial audit, once every 3 years). The terminology changes between certification bodies and the frequency of post certification audits is dependent on the maturity, risk and complexity. You can negotiate a certification plan within the parameters of JAS-ANZ and your certification body requirements but the recertification / triennial audit is not negotiable.
Whilst the requirement of the first three years of certification is a sample of the system split over the three years, the triennial review now requires the entire quality management system to be audited in full in one fell swoop. What value this adds to the process bewilders me, especially when you are doing it for the 6th, 7th, 8th time. However, it is part of the process. Just plan for it, experience it, deal with it.
How Long are these audits?
Third party certification audits are planned at a frequency and duration to meet the requirements of JAS-ANZ. Notice, that statement did not mention your needs. Now the overarching guideline for planning frequency and duration is whether the entire quality management system of your organisation (or more importantly, those sites and activities within the scope of your certification) can be audited over the course of three years. I have written before about this and the numbers game between FTEs, how many people are doing the same job, etc. They all impact on the final number. Once the gross number of days or hours are determined, then it is a matter of choice, but mostly your certification body’s choice.
The end result might be for a 12 auditor day certification scenario of; 3 days for certification audits (2 auditors for 1 day, 1 auditor for the 3rd), then 1 auditor for 1 day every 6 months (or 2 auditors for one day every 12 months) for the next three years. A sample plan for a multi-site system, may need all branches to be audited at half a day per site, per year, totalling 5 auditor days that year and the balance made up of annual events, more branch events, etc, etc, etc.
My head hurts just typing this stuff, so imagine what it is like to convince the certification body to meet your needs as they balance their JAS-ANZ requirements. The best thing to do is to keep the dialog open, keep the planning process fluid, and to keep your options open with other certification bodies.