9.4 Terms of the Audit Engagement, Initial Contact & Cultural Considerations
Key Takeaways
- The terms of the audit engagement define scope, criteria, objectives, timing, access rights, confidentiality, reporting lines, and the handling of irregularities, and must be agreed before audit activities begin.
- Initial contact with the auditee establishes communication channels, confirms authority to conduct the audit, and requests access to documented information and relevant sites.
- Confirming that the OH&S MS scope and the audit scope are aligned is an initial-contact task: certification scope may never be narrower than the boundary of the management system it describes.
- Cultural factors including language, hierarchy, attitudes to disagreement, and workplace norms materially affect interview reliability and must be planned for, not improvised.
- ISO 19011 identifies determination of feasibility as a distinct decision point: where information, cooperation, resources, or time are inadequate, the audit should not proceed on the proposed terms.
9.4 Terms of the Audit Engagement, Initial Contact & Cultural Considerations
Before an audit plan can be written, two things must be settled: what has been agreed (the terms of the engagement) and who you are dealing with (initial contact and the cultural context). PECB examines both as distinct Domain 4 knowledge statements, and scenario questions frequently turn on an auditor who began fieldwork with an unresolved scope or access question.
1. Terms of the Audit Engagement
The terms of the audit engagement are the agreed basis on which the audit is performed. They are established between the audit client (who commissions the audit) and the auditing organization, and communicated to the auditee. Note that in third-party certification the audit client and the auditee are usually the same organization, but in second-party supplier audits they are not — and confusing them is a classic exam error.
Essential contents
| Element | What it fixes | Why it matters |
|---|---|---|
| Audit objectives | What the audit is to achieve | Determines evidence sufficiency |
| Audit scope | Sites, functions, processes, activities, time period, shifts | The boundary of the auditor's authority |
| Audit criteria | ISO 45001:2018, the auditee's own documented information, applicable legal requirements | What conformity is measured against |
| Audit type and stage | Stage 1, Stage 2, surveillance, recertification, special | Governs the applicable ISO/IEC 17021-1 rules |
| Dates, duration, resources | Audit days, team size, on-site vs remote | Prevents the audit being compressed below viability |
| Access rights | Sites, records, workers, contractor areas, night shifts | Removes ambiguity if access is later refused |
| Confidentiality and data handling | Treatment of commercially sensitive and personal data | Especially critical for worker health records |
| Reporting | Deliverables, recipients, timescales, language | Sets expectations for the closing meeting |
| Handling of irregularities | Escalation route if falsification or a serious breach is found | Avoids improvised decisions under pressure |
| Roles | Team leader, team members, technical experts, observers, guides | Establishes authority to raise findings |
| Health, safety and site induction | Auditor PPE, induction, medical or fitness requirements | The audit team is exposed to the auditee's hazards |
Health and safety of the audit team
This clause is easy to forget and specific to OH&S auditing. The audit team will walk live plant. The terms must address auditor induction, required PPE, permit requirements for restricted areas, emergency arrangements, and any medical or fitness-to-enter requirements (for example, respiratory protection fit testing). An auditor injured on site because the engagement never addressed induction is a failure of audit planning, not bad luck.
2. Initial Contact with the Auditee
ISO 19011 treats initial contact as a defined step in initiating the audit. Its purposes:
- Establish communication channels — identify the auditee's nominated contact and the authority through which arrangements will be made.
- Confirm authority — establish the auditor's mandate to conduct the audit.
- Provide information — on proposed objectives, scope, criteria, timing, team composition, and the intended method (including any remote techniques).
- Request access — to relevant documented information, records, sites, and personnel, including contractor-controlled areas.
- Determine applicable requirements — statutory, regulatory, and contractual requirements relevant to the auditee's activities and jurisdiction.
- Confirm confidentiality and disclosure arrangements.
- Arrange practicalities — site induction, security clearance, access to restricted areas, working hours, shift patterns, and whether an escort is required.
- Agree observers and guides — including whether any observer's attendance is conditional.
The scope-alignment check
A critical initial-contact task in certification auditing: confirm that the audit and certification scope is consistent with the boundary of the OH&S management system as defined under Clause 4.3.
The rule is that certification scope may not be narrower than the management system it describes in a way that misleads. Where an organization operates a single, integrated OH&S MS across two adjacent plants but wishes to certify only one for marketing reasons, that request cannot simply be accepted: the certificate would misrepresent the system, and workers at the excluded plant fall within the same system boundary. The auditor's response is to decline to proceed on those terms and to require either that the scope match the system boundary or that the organization genuinely separate the systems. This exact construct appears in published PECB-style scenario questions.
Feasibility
ISO 19011 makes determining audit feasibility an explicit decision. The audit is feasible only where there is:
- sufficient and appropriate information to plan and conduct it;
- adequate cooperation from the auditee;
- adequate time and resources.
Where feasibility fails, the team leader consults the audit client and proposes an alternative — rescheduling, extending duration, adjusting scope, or, in the last resort, not proceeding. Beginning an audit known to be infeasible and then issuing a conclusion anyway is a due-professional-care failure that can rise to gross negligence.
3. Cultural Considerations
PECB lists knowledge of the cultural aspects to consider in an audit as a Domain 4 knowledge statement. Culture is not a courtesy topic — it directly determines whether interview evidence is reliable.
Where culture distorts evidence
| Cultural factor | Effect on the audit | Auditor countermeasure |
|---|---|---|
| High power distance | Workers will not contradict a supervisor present in the room; they defer to the most senior person | Interview non-managerial workers separately from management; this also serves the Clause 5.4 evidence requirement |
| Indirect communication norms | "Yes" signals politeness or comprehension, not agreement or confirmation of fact | Use open questions and ask for demonstration: "show me how you isolate this machine" |
| Face and group harmony | Reluctance to report problems, admit error, or disagree openly | Frame questions about the process rather than the person; never ask a worker to criticise a named colleague |
| Language | Nuance lost; technical terms mistranslated; interpreter may summarise or soften | Use a competent, impartial interpreter — never the worker's own line manager; confirm understanding by paraphrase |
| Attitudes to time and scheduling | Interview slots treated flexibly; delays absorbed silently | Build contingency into the audit plan; confirm the day's schedule at each daily team meeting |
| Gender and social norms | Restrictions on who may interview whom, or on access to certain areas | Plan team composition in advance during initial contact |
| Religious observance and shift patterns | Prayer times, fasting periods, and local holidays affect availability and fatigue-related risk | Agree timing at initial contact; account for fatigue in risk-based sampling |
Practical rules
- Plan for culture at the initial-contact stage, not on arrival — team composition, interpreter arrangements, and timing all need lead time.
- Cultural sensitivity is an ISO 19011 personal behaviour (being observant of and respectful toward the culture of the auditee), but it never justifies lowering the evidence standard. Respecting a norm that workers do not speak in front of managers means restructuring the interviews — not accepting management's account of what workers think.
- Separate observation from interpretation. A worker avoiding eye contact may signal deference, not evasion. Record the observable fact; corroborate the conclusion from another source.
- Beware the reverse error. Attributing a genuine safety failure to "cultural difference" is a due-professional-care breach. A missing guard is a missing guard in every culture.
A company operates one integrated OH&S management system covering its food plant and an adjacent packaging plant it recently acquired. It asks the certification body to certify only the food plant, arguing the packaging plant should be treated as a supplier. How should the lead auditor respond?
Auditing at a site with strong hierarchical norms, an auditor notices that production workers agree with every statement made by the accompanying supervisor. What is the most appropriate response?
Which of the following is properly settled in the terms of the audit engagement rather than improvised during on-site activities?