We evaluate on-site implementation of company-specific management systems and its effectiveness by moving away from documentation audit, focusing on assessing the effectiveness of the company-specific risk management efforts and practices, and performance of the management systems.
Our audit approach covers evaluation on:
- Compliance with requirements of the International Standard from a practical point of view, audit on documentation will be minimal and typically on examining relevant information and data as determined by the company’s risk based thinking process, to substantiate the operational controls and performance; and those documented information as required by the International Standard.
- Integration of the management systems into the actual business practices.
- Adoption of process approach and risk based thinking.
- Demonstration of risk based thinking to address strategic risks and opportunities that may have detrimental or beneficial impacts on the organization’s business purpose, objectives and sustainability.
- Demonstration of risk based thinking to address operational risks and opportunities that may have detrimental or beneficial impacts on customer satisfaction, process efficiency, conformity of products and services, including other compliance obligations.
- Incorporation of the expectations and requirements of relevant interested parties into the risk based thinking process.
- Operational controls and action plans to mitigate detrimental impacts or capitalize beneficial impacts of those risks and opportunities, and to achieve specific objectives relating to the identified significant risks and opportunities.
- Risk based internal auditing with process approach.
- Alignment of the management review to the organization’s strategic direction.