What is a system audit?
A system audit evaluates, as a whole, how well an organization’s management system — quality, environment, occupational health and safety, information security or social accountability — meets the requirements of the relevant standard, legal obligations and the organization’s own rules. It does not look at a single process but at the entire system: from policy to objectives, from process interactions to management review.
At Norma Systems, we perform system audits in line with the ISO 19011 guideline, in two scopes: first party (internal audit) and second party (supplier audit).
Outsourced internal audit
ISO 9001, ISO 14001, ISO 45001, ISO 27001, IATF 16949 — every one of these standards requires regular internal audits. In practice, internal audit runs into two problems in most organizations: independence shrinks because auditors cannot audit their own area, and under daily workload the audit turns into a paperwork formality.
An outsourced internal audit solves both at once. We conduct your audits on your behalf, within your own audit programme, but with a fresh pair of eyes free of organizational blindness:
- An audit plan and question lists prepared against the standard requirements and your documented information
- The field audit: record review, interviews with process owners and on-site observation
- An audit report with graded findings based on objective evidence
- Root cause and corrective action follow-up for nonconformities
An internal audit performed before certification and customer audits significantly reduces your risk of surprises on audit day. If you would rather build your own audit team in house, take a look at the internal auditor programmes on our Academy side.
Supplier system audit (second-party audit)
The quality of your product is only as strong as the weakest link of your supply chain. A supplier system audit evaluates the management system of your current or candidate suppliers on site, against your requirements and the relevant standards. Instead of trusting a certificate on paper, you see the production conditions, process discipline and the reality behind the records with your own eyes.
Typical use cases:
- Capability evaluation before approving a new supplier
- Periodic performance audits of existing suppliers
- Cause-focused audits and improvement follow-up after quality problems
- Meeting supplier development obligations under IATF 16949
Supplier sustainability assessment
Customer expectations are no longer limited to quality; working conditions, human rights, business ethics and environmental performance are now supplier selection criteria too. Within the scope of a system audit, we also evaluate your suppliers along the sustainability dimension: on-site verification of labour and human rights, ethics, environment and sustainable procurement, using criteria aligned with the principles of SA 8000, the EcoVadis themes and the automotive SAQ / S-Rating question sets.
If your own organization has received an EcoVadis or SAQ request, see our EcoVadis / SAQ S-Rating Readiness service for the preparation side.
How do we work?
- Scope and criteria definition: the standards, processes, locations and evaluation criteria to be audited are agreed with you.
- Planning: the audit programme, schedule and question lists are prepared and shared with the auditee.
- Field audit: objective evidence is gathered through interviews, observation and record review.
- Reporting: findings are graded as strengths, improvement areas and nonconformities, and presented to management.
- Follow-up: the effectiveness of corrective actions is verified; a follow-up audit is performed on request.
Frequently Asked Questions
Is an outsourced internal audit compliant with the standards?
Yes. ISO management system standards do not restrict who performs the internal audit; they require impartiality and competence. An internal audit purchased externally is still a first-party audit as long as it is conducted within your own audit programme, and it is accepted by certification bodies.
What is the difference between a system audit and a process audit?
A system audit focuses on the management system as a whole, while a process audit focuses on the capability of a specific production or service process. For an in-depth, process-level evaluation, see our Process Audit service.
How long does an audit take?
It depends on the size of the organization, the number of standards and the scope; for a mid-sized organization with a single standard, an internal audit typically takes 1–3 days. Once the scope is clear, we provide a day-based plan.
Request a Quote
To outsource your internal audits or to have your suppliers audited along the system or sustainability dimension, get in touch with us; we will prepare an audit plan and a quote tailored to your scope.