Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
PD ISO IEC TS 17021 โ Competence Requirements for Auditing and Certification of Management Systems Series
Conformity Assessment โ Requirements for Bodies Providing Audit and Certification of Management Systems โ ISO/IEC TS 17021-3 to -9 (2013โ2016)
๐๏ธ PD ISO/IEC TS 17021 is the BSI technical specification series adopting ISO/IEC Technical Specifications under the title “Conformity assessment โ Requirements for bodies providing audit and certification of management systems”. While ISO/IEC 17021-1 sets the general requirements for certification bodies, the parts of this series (17021-3 to -7 and -9) set specific competence requirements for auditors, audit teams, report reviewers and certification decision-makers for particular management-system schemes. The six documents cover quality management systems (QMS), event sustainability management systems (ESMS), asset management systems (AMS), business continuity management systems (BCMS), road traffic safety management systems (RTSMS) and anti-bribery management systems (ABMS). UK adoption is handled by Technical Committee CAS/1 (Conformity assessment).
๐ก ISO/IEC 17021-1 answers “how a certification body should behave to be trustworthy”, while 17021-3 to -9 answer “what competence the people auditing these specific management systems must possess”. Together they ensure professional and credible certification outcomes.
1. Scope and Composition of the Series ๐
Each part develops the competence requirements for auditing and certifying a particular management system, combining generic competence (understanding requirements, audit principles, risk-based thinking) with scheme-specific knowledge (domain knowledge, regulations, key process technologies):
- 17021-3:2013 (Quality management systems, QMS): competence requirements for auditing and certification of QMS.
- 17021-4:2013 (Event sustainability management systems, ESMS): competence requirements for ESMS auditing and certification (e.g. large-event management).
- 17021-5:2014 (Asset management systems, AMS): competence requirements for the AMS audit team and those reviewing the report and making the certification decision.
- 17021-6:2014 (Business continuity management systems, BCMS): competence requirements for BCMS auditing and certification.
- 17021-7:2014 (Road traffic safety management systems, RTSMS): competence requirements for RTSMS auditing and certification.
- 17021-9:2016 (Anti-bribery management systems, ABMS): competence requirements for ABMS auditing and certification.
โ ๏ธ Parts 17021-6, -7 and -9 are based on scanned copies; descriptions of those parts in this article are written from publicly available domain knowledge. For the full competence clauses and knowledge requirements, confirm the current official BSI edition.
2. Technical Essentials of the Parts ๐ง
| Part | Management System | Competence Highlights |
|---|---|---|
| TS 17021-3 | Quality (QMS) | Generic competence; QMS auditor competence with process approach, PDCA, and operational requirements |
| TS 17021-4 | Event sustainability (ESMS) | Generic ESMS competence; sustainability planning of events |
| TS 17021-5 | Asset management (AMS) | Competence of the audit team, report reviewers and certification decision-makers over the asset life cycle |
| TS 17021-6 | Business continuity (BCMS) | Auditor competence: business impact analysis, recovery strategies, exercising |
| TS 17021-7 | Road traffic safety (RTSMS) | Auditor competence: organisational road traffic safety performance and risks |
| TS 17021-9 | Anti-bribery (ABMS) | Auditor competence: bribery risk assessment, compliance procedures, investigation |
3. Key Technical Requirements ๐ฅ
Structurally, each part combines “generic competence requirements” with “scheme-specific competence requirements”, sharing the same core logic:
- Generic competence: auditors must master ISO/IEC 17021-1 requirements, audit principles (independence, objectivity, evidence), risk-based thinking, communication and interviewing skills, and audit planning/reporting.
- Scheme knowledge: for each management system, auditors need matching domain knowledge โ the process approach for quality, asset life-cycle management, business impact analysis and recovery strategies for continuity, organisational performance and risk for road traffic safety, and compliance procedures and investigation for anti-bribery.
- Audit team and certification decision: some parts (e.g. 17021-5) dedicate clauses to the audit team composition, report reviewers and those making certification decisions, ensuring every link of the certification chain is staffed by qualified people.
- Continual learning and evaluation: certification bodies should operate initial evaluation and ongoing surveillance of auditor competence, keeping it in step with standard updates and industry changes.
๐จ The value of a certificate rests on the professional competence of the auditors. Under the 17021 series, certification bodies must be able to demonstrate that every member of the audit team meets the competence requirements of the relevant part โ otherwise the credibility of issued certificates is undermined.
4. Engineering Practice and Application ๐ ๏ธ
- ๐ Certification bodies: build a competence matrix (competence requirements ร personnel) per the relevant part for recruitment, audit-team assignment and certification-decision review.
- ๐ง Auditor development: individual auditors map their learning path against the competence clauses, filling gaps in domain knowledge and audit skills.
- ๐ Audited organisations: understanding the competence auditors should have helps organisations prepare thoroughly and cooperate effectively during audits.
- ๐ Accreditation bodies: during accreditation assessment, verify the certification body’s competence-management mechanism against the 17021 series to support mutual recognition of certificates.
5. Frequently Asked Questions โ
โ Q: What is the relationship between ISO/IEC 17021-1 and 17021-3 to -9?
A: 17021-1 sets the general requirements for certification bodies (impartiality, competence, audit process, certification decision); 17021-3 to -9 are supplementary technical specifications defining scheme-specific competence requirements for auditing and certifying particular management systems (QMS, AMS, BCMS, etc.).
A: 17021-1 sets the general requirements for certification bodies (impartiality, competence, audit process, certification decision); 17021-3 to -9 are supplementary technical specifications defining scheme-specific competence requirements for auditing and certifying particular management systems (QMS, AMS, BCMS, etc.).
โ Q: Why does every management system need its own competence requirements?
A: The knowledge domains differ greatly โ quality auditing needs process and product knowledge, asset management needs life-cycle knowledge, anti-bribery needs compliance and investigation knowledge. Separate competence parts ensure that the audit is fit for purpose.
A: The knowledge domains differ greatly โ quality auditing needs process and product knowledge, asset management needs life-cycle knowledge, anti-bribery needs compliance and investigation knowledge. Separate competence parts ensure that the audit is fit for purpose.
โ Q: What are “generic competence” requirements for auditors?
A: These are the domain-independent audit fundamentals, including understanding of 17021-1, audit principles (independence, objectivity, evidence), risk-based thinking, communication and interviewing, and planning and reporting โ the foundation of every part’s requirements.
A: These are the domain-independent audit fundamentals, including understanding of 17021-1, audit principles (independence, objectivity, evidence), risk-based thinking, communication and interviewing, and planning and reporting โ the foundation of every part’s requirements.
๐ Q: How can an organisation use this series?
A: Organisations can use it to understand what competence their certification body’s auditors should have and evaluate the professional level of their chosen body; they can also align internal auditor training with the competence requirements to improve internal audit quality.
A: Organisations can use it to understand what competence their certification body’s auditors should have and evaluate the professional level of their chosen body; they can also align internal auditor training with the competence requirements to improve internal audit quality.