11/15/13 Audit Day Table - Whittington & Associates

www.whittingtonassociates.com/2012/09/audit-day-table/ 1/3

Whittington & Associates > Newsletter > Audit Day Table

Audit Day Table

Posted on Sep 3, 2012 in Newsletter

How many audit days would a certification body (registrar) estimate for your initialstage 1 and stage 2 certification audit, ongoing surveillance visits, or re-certificationaudit?

The International Accreditation Forum (IAF) provides Mandatory Documents (MD5:2009 and MD 9:2011) to certification bodies that contain mandatory provisions andguidance on the time required to audit their clients. MD 5:2009 applies to qualitymanagement systems (ISO 9001) and environmental management systems (ISO14001). MD 9:2011 applies to medical device quality management systems (ISO13485).

The effective number of personnel indicated in the audit day table below consists ofall full-time personnel within the scope of the certification, including those working oneach shift. Non-permanent (seasonal, temporary, and contracted personnel) andpart-time personnel who will be present at the time of the audit are included in thenumbers. Dependent on the hours worked, the part-time personnel numbers can beconverted to an equivalent number of full-time personnel.

11/15/13 Audit Day Table - Whittington & Associates

www.whittingtonassociates.com/2012/09/audit-day-table/ 2/3

(Compiled from tables in Annexes A and B of MD 5 and Annex D of MD 9)

Note 1: View number of employees as continuum rather than stepped change.Note 2: High, Medium, Low, and Limited are complexity categories. See Table EMS 2in MD 9.

MD 5 states the audit duration for all types of audits includes on-site time at a client’spremises and time spent off-site carrying out planning, performing document review,interacting with client personnel, and writing the report. The off-site activities shouldnot reduce the total on-site audit duration to less than 80% of the times shown in thetables above. The audit days are based on eight hours per day. The audit days cannotbe reduced by planning on longer hours per working day.

MD 9 adds that the duration for ISO 13485 audits will be dependent on the auditscope, objectives, and specific regulatory requirements, as well as, on the range,class, and complexity of medical devices, and the size and complexity of theorganization.

Surveillance Audits

During the initial three-year certification period, surveillance audits should beproportional to the time spent on the initial certification audit. The total amount oftime spent annually on surveillance audits should be about 1/3 the time spent on theinitial certification audit (stage 1 + stage 2). Surveillance audit duration in futureperiods should take into account organizational changes and system maturity.

11/15/13 Audit Day Table - Whittington & Associates

www.whittingtonassociates.com/2012/09/audit-day-table/ 3/3

Re-Certification Audits

The re-certification audit is normally 2/3 of the time spent on the initial certificationaudit (stage 1 + stage 2). Future re-certification audits should be based on the timethat would be required for the initial certification audit if it were to be carried out atthe time of re-certification (not 2/3 of the original initial certification audit). The auditduration should also take into account the review of system performance.

Adjustment Factors

Increase the DaysMD 5 identifies factors to consider for possibly increasing the duration of ISO 9001and ISO 14001 audits as complicated logistics, multiple languages, large physical site,highly regulated, and complex processes.

MD 9 states the duration may be increased for ISO 13485 audits due to the number ofranges and/or complexity of medical devices, use of critical suppliers withoutsufficient evidence of conformity (may have to audit suppliers), manufacturers thatinstall products at customer’s premises (may have to visit customers or reviewinstallation records), and poor regulatory compliance.

Decrease the DaysMD 5 considerations for decreasing the duration for ISO 9001 or ISO 14001 auditsinclude factors such as excluded requirements, system maturity, other certifications,identical shifts, multiple sites, and low complexity. The guidance states a reduction inaudit duration would be unlikely to exceed 30% of the times established from thetables.

MD 9 states that the duration for ISO 13485 audits may be decreased based onreductions of the manufacturing product range, or design and production processes,since the last audit.

Table Intent

The tables are frameworks for audit planning and making adjustments to auditduration for all types of audits. The intent is to lead to consistency of audit durationbetween certification bodies, as well as, between similar clients of the samecertification body.

You can view or download copies of MD 5:2009 and MD 9:2011 at this IAF web page.

Copyright © 2000 - 2013 Whittington & Associates, LLC. All Rights Reserved.6175 Hickory Flat Highway, Suite 110-303, Canton, GA 30115 | 770-517-7944