4.2 Audit Types (1st, 2nd, 3rd Party) and Audit Scope, Criteria & Objectives

4.2 Audit Types (1st, 2nd, 3rd Party) and Audit Scope, Criteria & Objectives

Quick Answer: Management systems audits are classified by the relationship between the auditor and auditee: First-party (internal audits for self-assessment), Second-party (customer audits of suppliers/contractors), and Third-party (independent certification or regulatory audits). Every audit requires three foundational pillars before fieldwork begins: Objectives (why we audit), Scope (boundaries and extent), and Criteria (the standards and rules used as reference benchmarks).

---

1. Classification of Audit Types

In professional environmental auditing, recognizing the type of audit is vital because each type dictates the auditor's legal authority, reporting audience, independence constraints, and the consequences of identified nonconformities.

                         [ Management System Audits ]
                                       │
         ┌─────────────────────────────┼─────────────────────────────┐
         ▼                             ▼                             ▼
  [ 1st-Party Audits ]          [ 2nd-Party Audits ]          [ 3rd-Party Audits ]
  • Internal audits             • Supplier / vendor audits    • Certification bodies
  • Self-assessment             • Contractor evaluations      • Regulatory enforcement
  • Inputs to Clause 9.3        • Supply chain risk review    • ISO/IEC 17021-1 governance

First-Party Audits (Internal Audits)

First-party audits are conducted by, or on behalf of, the organization itself for internal purposes.

• Key Purpose: To determine whether the EMS conforms to the organization's own arrangements, meets the requirements of ISO 14001:2015, and is effectively implemented and maintained (Clause 9.2).
• Primary Audience: Internal leadership and process owners; serves as a direct input to top management review (Clause 9.3).
• Independence Standard: Auditors must be independent of the specific activity being audited wherever practicable, but they remain employees or internal contractors of the company.
• Consequences: Internal nonconformities lead to internal corrective actions (Clause 10.2). They do not directly threaten external certification unless systematic neglect is uncovered during later external surveillance.

Second-Party Audits (External Supplier / Contractor Audits)

Second-party audits are conducted by parties having an interest in the organization, such as customers, commercial clients, or parent corporations, or by external service providers acting on their behalf.

• Key Purpose: To assess the environmental capability, regulatory compliance, and risk controls of critical suppliers, outsourced service providers, or joint venture partners (Clause 8.1 operational control over outsourced processes).
• Typical Scenarios: Auditing a licensed hazardous waste disposal contractor's incineration facility; auditing an outsourced chrome plating vendor to ensure heavy metal wastewater is not dumped into public sewer lines.
• Independence Standard: The auditor represents the purchasing organization and must be independent of the supplier.
• Consequences: Major nonconformities can lead to contract termination, disqualification from approved vendor lists (AVL), or financial penalties.

Third-Party Audits (Independent Certification, Accreditation & Regulatory Audits)

Third-party audits are conducted by independent, external auditing organizations, completely detached from any commercial interest in the auditee.

• Certification / Registration Audits: Conducted by accredited Certification Bodies (CBs) / Registrars operating under ISO/IEC 17021-1. Successful completion results in accredited ISO 14001 certification.
• Accreditation Audits: Conducted by national accreditation bodies (e.g., UKAS, ANAB, DAkkS) auditing the certification bodies themselves to verify compliance with ISO/IEC 17021-1.
• Statutory / Regulatory Inspections: Conducted by environmental protection agencies (e.g., US EPA, UK Environment Agency) under legislative mandates to enforce environmental permits and statutory discharge standards.
• Independence Standard: Absolute independence; strict prohibition on consulting, past employment within two years, or shared financial interests.
• Consequences: Major nonconformities block certification or result in certificate suspension; regulatory audits can trigger criminal prosecution, stop-work orders, or statutory fines.

---

2. Contrast Table: 1st, 2nd, and 3rd Party Audits

---

3. The Core ISO 19011 Auditing Terminology

To conduct and document audits defensibly, lead auditors must master the hierarchical relationships between objectives, scope, criteria, evidence, findings, and conclusions:

[ Audit Objectives ] ──► Why we audit (purpose and desired outcomes)
[ Audit Scope ]      ──► Where and what we audit (boundaries, units, time)
[ Audit Criteria ]   ──► What we measure against (standards, permits, rules)
         │
         ▼
[ Audit Evidence ]   ──► Verifiable facts, records, observations collected
         │  (Evaluated against Criteria)
         ▼
[ Audit Findings ]   ──► Conformity, Nonconformity (Major/Minor), OFI
         │  (Synthesized against Objectives)
         ▼
[ Audit Conclusions] ──► Final outcome (recommendation regarding certification)

The Framing Triad: Objectives, Scope, and Criteria

1. Audit Objectives (set under ISO 19011:2018 Clause 5.4.2; not a defined term in Clause 3): Describe what the audit is intended to accomplish. Typical EMS objectives include:

   • Determining the degree of conformity of the management system with ISO 14001:2015.
   • Evaluating the capability of the EMS to ensure compliance with statutory environmental permits.
   • Evaluating the effectiveness of the EMS in achieving specified environmental performance targets.
   • Identifying areas for potential improvement.

2. Audit Scope (ISO 19011:2018 Clause 3.5): Defines the extent and boundaries of the audit. It includes:

   • Physical locations: Physical boundaries (e.g., "The chemical manufacturing plant at 100 Industrial Boulevard, excluding the decommissioned North Annex").
   • Organizational units: Departments, functions, and divisions included.
   • Activities and processes: Specific manufacturing lines, shipping docks, on-site effluent treatment plants.
   • Time period covered: Time window of records sampled (e.g., "Operational records generated between October 1, 2025, and September 1, 2026").
   • Note: The audit scope must be consistent with, or nested within, the overall EMS scope defined under ISO 14001:2015 Clause 4.3.

3. Audit Criteria (ISO 19011:2018 Clause 3.7): The reference against which audit evidence is compared. Criteria serve as the benchmark for determining conformity. In an EMS audit, criteria include:

   • The clauses of ISO 14001:2015.
   • Applicable environmental legislation, statutory discharge consents, and air emissions operating permits.
   • The organization's documented policies, standard operating procedures (SOPs), and emergency plans.
   • Customer-specific EHS specifications or corporate environmental guidelines.

The Evaluation Chain: Evidence, Findings, and Conclusions

• Audit Evidence (Clause 3.9): Records, statements of fact, or other information that are relevant to the audit criteria and verifiable. Evidence is obtained through interviews, physical observations, equipment readings, and sampling of documents and records. Hearsay and unverified assumptions are not audit evidence.
• Audit Findings (Clause 3.10): Results of evaluating the collected audit evidence against the audit criteria. Findings indicate either conformity or nonconformity (graded as Major or Minor) with the audit criteria, or opportunities for improvement (OFI).
• Audit Conclusions (Clause 3.11): The final outcome of an audit delivered by the audit team after considering the audit objectives and all audit findings. In a third-party audit, the conclusion states whether the EMS meets the standard sufficiently to recommend initial certification, maintain certification, or require a follow-up verification audit.

---

4. Realistic Lead Auditor Scenario: Integrated Supplier Audit

Scenario: A multinational consumer electronics corporation engages a lead auditor to conduct a second-party audit of a primary lithium-ion battery cell supplier.

• Audit Objective: Evaluate whether the supplier's EMS adequately controls heavy metal discharge risks to prevent brand reputation damage and ensure compliance with the customer's Supplier Environmental Code.
• Audit Scope: The battery electrode coating facility and wastewater treatment plant located in Facility B; covers operations and compliance records from the preceding 12 months.
• Audit Criteria: ISO 14001:2015, the Customer's Supplier Environmental Code (Revision 4.0), and Local Environmental Discharge Consent #EV-9021.

Investigation Trail:

1. Evidence Gathered: The auditor samples daily discharge logs for heavy metals (nickel and cobalt) from the wastewater plant. On 8 out of 90 operational days, cobalt concentrations were recorded at 1.8 mg/L, exceeding the local statutory consent limit of 1.0 mg/L (Audit Evidence).
2. Evaluation Against Criteria: The evidence is evaluated against Consent #EV-9021 (Clause 4.1) and ISO 14001:2015 Clause 9.1.2 (Compliance Evaluation). The supplier logged no incident report, notified no regulator, and initiated no corrective action.
3. Audit Finding Generated: A Major Nonconformity against ISO 14001:2015 Clause 9.1.2 and Clause 10.2: Failure to maintain compliance with statutory consent limits and failure to react to non-compliances with corrective action.
4. Audit Conclusion Formulated: The audit team concludes that while the manufacturing processes are modern, operational controls over wastewater abatement are ineffective. Recommendation to the client: Place the supplier on conditional probation with mandatory re-audit within 60 days before awarding high-volume production contracts.

---

5. CQI/IRCA Exam Traps: Scope, Criteria, and Findings

1. Confusing Scope with Criteria: A classic exam error occurs when candidates list "ISO 14001:2015" under Audit Scope. ISO 14001 is the Audit Criteria (the rulebook). The Audit Scope is the physical site, processes, and operational boundaries being audited.
2. Confusing Findings with Conclusions: Stating that "The audit conclusion is that the company has three minor nonconformities" is incorrect. The three nonconformities are the Audit Findings. The Audit Conclusion is the holistic synthesis: "The EMS is implemented effectively and demonstrates continuous improvement; recommendation is granted for ISO 14001 certification subject to acceptable corrective action plans."
3. Scope Creep: An auditor inspecting a certified warehouse observes an uncertified adjacent metal plating facility owned by the same parent company. The auditor cannot issue formal nonconformities against the plating facility unless the audit client and auditee formally expand the agreed Audit Scope.