Internal Audit Policy (ASF-QMS-001)

V3.0 — 8-row audit programme scope table, 5-stage audit process, auditor independence requirements, 4-type finding classification (Major NC/Minor NC/Observation/Best Practice), CAP linkage, 5-year records retention, 12 references

1. Purpose

This policy establishes ASF’s internal audit programme — the systematic, independent, and documented process by which ASF assesses the conformity of its own operations with its documented QMS requirements, the ISQua EEA Principles, ISO 9001:2015, and applicable legal obligations. Internal audit is about ASF’s own operations as an accreditation body, not about the organisations that ASF accredits.

2. Audit Programme Scope

The audit programme covers all QMS process areas at a minimum: standards development and review; impartiality management; confidentiality and data protection; complaints and appeals; accreditation decision process; surveyor management; accreditation cycle management; and financial and fee management. All eight areas are audited at least annually, except the accreditation cycle (biennial). The QMS Coordinator may expand scope based on risk assessment or management review findings.

3. Audit Planning

An annual audit plan is prepared by the QMS Coordinator and approved by the ASF President before the start of each calendar year, specifying process areas, auditors, criteria, methods, and planned outputs. Unplanned reactive audits may be initiated at any time by the ASF President in response to a significant complaint, regulatory inquiry, impartiality concern, or material process change — scoped and initiated within 10 working days of the trigger.

4. Auditor Independence

An auditor does not audit their own work. Where ASF’s staff size prevents full internal independence, an external auditor is engaged. Each assigned auditor completes a Declaration of Impartiality before the engagement. The QMS coordination process itself is always audited by an external or independent internal auditor.

5. Audit Process — Five Stages

(1) Notification: process owner notified ≥10 working days in advance with scope, criteria, method, and date. (2) Document review: auditor reviews QMS documents and records against criteria before interviews. (3) Execution: evidence gathered through document review, records sampling, and interviews. (4) Findings classification: Major nonconformance (systemic failure; requires root-cause analysis and CAR); Minor nonconformance (isolated gap; two or more minor NCs in the same area in consecutive cycles escalate to Major); Observation (potential weakness not yet a NC); Best practice (notable effective implementation). (5) Audit report: produced within 10 working days; includes all findings, classifications, and CARs with deadlines (15 working days for Major NC; 30 calendar days for Minor NC).

6. Corrective Action

Each CAR is responded to within the deadline by the process owner, including root cause analysis, action taken, and evidence of completion. The QMS Coordinator reviews adequacy and closes or returns with feedback. Unresolved CARs are escalated to the ASF President and tracked as standing items at the next management review. Effectiveness of corrective actions is verified at the next scheduled audit — never on the basis of a declaration alone.

7. ISQua EEA Alignment

Supports ISQua EEA Principle 10 (Quality Management System) — systematic review of the accreditation body’s own processes, independent audit, and management of nonconformances. The ASF ISQua EEA Crosswalk (ASF-EV-004) maps these provisions to the applicable EEA criteria.

Document code: ASF-QMS-001  ·  Version: V3.0  ·  Effective: 2026-09-30  · 
All governance documents

Download the approved document

ASF-QMS-001 — Internal Audit Policy · Version V3.0

Download PDF Full ASF Standards Package 2026