Audit & assurance
Kellwick plans and carries out internal audits against ISO 27001, ISO 9001, ISO 42001 and integrated systems. One audit before a certification visit, or a full programme across standards, sites and the year.
The audit is yours: it tests whether your system conforms to the standard and to your own requirements, and whether it is effective. Findings are supported by objective evidence and written so your management review and your certification body can use them.
Choose your audit
Each page sets out what is audited, what you receive and how delivery works for that standard.
Who it is for
Most of our audit clients are past implementation. They need the audit done properly and objectively, by someone who is not part of the system being audited.
Checking that a procedure exists is not an audit. The useful question is whether the process follows it, and whether it achieves what it is for.
The person who owns the process audits it. Every management system standard asks for objectivity and impartiality in the audit process, and this fails both.
The easy areas get audited repeatedly while high-risk processes and remote sites are never sampled. A programme exists to stop that.
Nonconformities are raised, closed on a form, and found again a year later. Without verification of effectiveness, the audit loop never closes.
Why an external specialist
How it works
The same discipline whatever the standard. What changes is the criteria, the sample and whether we need to be on site.
We agree what the audit is for, which standards, clauses, processes, sites and entities are in scope, and the criteria: the standard, your own procedures, and any contractual or legal requirements you include.
A written plan: the auditor, the schedule, who we need to talk to, and how we will sample records. Sampling is risk-based, so the processes that matter most get looked at hardest.
Before fieldwork we read the documented information that defines the system - scope, policies, procedures, risk assessments, previous audit and management review results.
Interviews with process owners and the people doing the work, observation where it matters, and sampling of records as they actually exist. Remote for document-led processes, onsite for operations.
Every finding is graded - nonconformity, observation or opportunity for improvement - and tied to the requirement and the evidence. We walk through them with you before the report is final.
A final audit report your management review can act on. Where contracted, we verify the corrective actions later and confirm whether they were effective.
The audit loop
A programme feeds the plan, the plan produces findings, and the findings are not finished until the corrective actions are verified - which then informs the next programme.
Programme
Which processes, standards and sites are audited, when, and why.
Plan
Scope, criteria, auditor, schedule and sample for one audit.
Evidence
Records, interviews and observation, remote or on site.
Findings
Graded against a requirement, with the evidence attached.
Report
Closing meeting, final report, input to management review.
Verify
Corrective actions checked for implementation and effect.
After step 6 the results feed the next programme: areas with findings get audited sooner, stable areas less often.
What you receive
Depending on the scope you contract, you receive:
What we need from you
Audit programmes
For organisations that want the whole programme handled, not one audit. We design a risk-based programme across your standards, sites and the certification cycle, run the audits on schedule and keep the record your certification body samples.
This is a recurring engagement, usually agreed for the three-year certification cycle and reviewed each year.
Coverage of every clause, process and site over the cycle, weighted by risk and previous findings.
A sampling plan for sites and entities, with visits scheduled around your operations.
One programme for an integrated system, with each standard's requirements kept visible.
Audits that follow a process end to end - order to delivery, change to release - across departments.
The audit programme, plans, reports and follow-up kept as documented information.
The programme updated after each management review and each certification visit.
Follow-up
For findings from our audits, from your own internal auditors, or from a certification body. We review the root cause analysis and the action plan, then verify - by evidence, not by a signed form - that the actions were implemented and that the problem has not come back.
Independence
Auditors must remain independent of the activities they audit. Where Kellwick has supported implementation or ongoing management, any subsequent internal audit is subject to an independence and conflict-of-interest review. The assigned auditor must not have participated in the work being audited. Where sufficient objectivity and impartiality cannot be assured, Kellwick will decline the affected scope or recommend independent external assurance.
Scope and pricing
Audit effort is set from the scope, not from a standard day rate. The proposal states the audit days, the sites and what is excluded.
Internal audits are quoted per scope. Travel and expenses for onsite work are stated separately. Certification body fees are never part of our price - we are not a certification body.
Delivery
Boundaries
A Kellwick internal audit is the internal audit your standard requires you to carry out - first-party, on your behalf. It is not an accredited certification audit and it does not lead to a certificate. A Lead Auditor certificate shows auditor training and competence; it does not by itself authorise anyone to audit for a certification body.
Related services
Questions
They require internal audits at planned intervals, under a programme that takes into account the importance of the processes and the results of previous audits. That does not have to mean one full audit of everything every year - a programme can cover the system across the certification cycle. Many certified organisations still choose an annual audit, because the certification body visits annually and expects to see audit results since its last visit. We will recommend the pattern that fits your risk and your cycle.
No. Your internal audit is first-party: you are required to run it, and you own the findings. The certification body's audits are third-party and end in a certification decision. Part of what the certification body checks is that your internal audit happened and was objective.
Not with the same people. When Kellwick has implemented or operated part of your system, that part is audited by an auditor who had no involvement in it, and the audit plan records the separation. If independence cannot be assured for a scope, we say so and recommend another auditor.
Yes. Integrated audits share the interviews and records that are common - management review, document control, competence, corrective action - while each standard's specific requirements are still sampled. A combined audit is shorter than separate ones, but not as short as auditing only one standard.
Both. Where the evidence is digital, remote auditing works well. Where it is physical - production lines, warehouses - we audit on site. Most multi-site programmes mix the two.
You raise corrective actions for nonconformities through your own process. If you contract follow-up, we review the root cause analysis and corrective action plan, then verify later that the actions were implemented and effective, and close or re-open the finding.
We will reply within one business day, confirm the scope in a short conversation, and send a written proposal with audit days, auditor independence and price.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.