Audits Overview

Year	Audit types
0	Initial Audit: - Application for Audit - Stage 1 - Stage 2
1	Surveillance Audit
2	Surveillance Audit
3	Recertification Audit
(As needed) 0-3	Special Audits Extension of Certification Scope Short-notice audits

ISO 17021 requires that the audit should follow PROCESSES e.g. SIP -> AIP -> DIP
Estimates of costs from ANAB assessors
- ISO standards like ISO 16919 have annex which gives estimate of number of "audit days" required - may depend on number of staff, sites, datasets etc. This makes for a LEVEL PLAYING FIELD i.e. audit organisations could otherwise be cheaper by estimating smaller number of days
- ISO 16919 does not have that annex currently but we hope to do so in the next version when further information on audits is gathered
- For example
  - Visit would be $1000/day plus expenses per person, so 2 people (auditor plaus technical expert) for 2 days would be $5K. Then include pre-visit work. SO $15K for first audit
  - Each surveillance audit is usually one third of that i.e. $5K
  - The re-certification audit is usually about two thirds of the first audit i.e. $10K
  - Total over 3 years is then about $30K or average $10K/year - taht should be a safe maximum

CABs are ASSESSED by Assessors - including WITNESS statements where assessors accompany the auditors for - at least once a year (in a 4 year cycle) for each standard for CAB keep status for that standard, plus an offic e assessment once a year across the board
The ASSESSORS are also assessed while doing this so it is possible that an audit may have two each of auditors, assessors, assessors for those assessors!!!

These are the types of repository audits that we are interested in and this is the typical timing for the audits. I’ll go into more detail about each of these audits in the remainder of this module, but I’ll describe each of these at a high-level now.
The Initial Audit is the first audit that you undergo to become an ISO Certified Trustworthy Digital Repository. It should be a full audit following all the processes in ISO 16919 and covering all the appropriate metrics in ISO 16363. When you successfully pass the audit, the Certification Body will provide a Certificate and will maintain a register of those repositories it certifies as successfully completing their audit. Note that a Certificate indicates that you passed an audit at the date and time and locations noted. But no company can guarantee that another organization has continued to provide services and products at the same quality level.

Following your Initial Audit, you are required to undergo Surveillance Audits at least yearly. These do not have to be full system audits, but they are required and they are required to include re-examination of weak areas from previous audits.

Then after 3 years (or whenever significant changes take place in your systems), you are once again required to undergo a full recertification audit.

(As defined in ISO/IEC 17021 Section 9.5)
Special Audits may requested if the customer desires to extend of the scope of the certification. A Short-Notice Audit may also be required if complaints are received or if questions arise regarding an organization continuing to comply with the relevant requirements. Special Audits may need to be scheduled quickly and may have some different processes that the normal requirements.
(As defined in ISO/IEC 17021 Section 9.6)
If any of these audits are required and the audit cannot be completed in a timely manner or if the organization fails the audit, the organization’s Certificate and Registration may be suspended or withdrawn or the scope of certification could be reduced

Metrics in more detail

Audits Overview