IAF MD 4 – Use of information and communication technology (ICT) in audits

Audits (initial certifications, recertifications and surveillance audits) have been and continue to be characterised by a correspondingly high proportion of on-site work. The most important aspect, whether on site or remote, is that the effectiveness and efficiency of an audit process is ensured and that its integrity is guaranteed and can be maintained.

Information and communication technology (ICT) can be one option used in the course of an audit. However, this is not possible in all cases. Based on the IAF and the ISO/IEC standards to which a certification body is subject, there are requirements that must be taken into account when deciding "ICT: yes/no" or "remote audit: yes/no".

For the use of ICT, in 2023 the IAF published an updated mandatory document governing the use of ICT for audit purposes – IAF MD 4:2023.

Definition – delimiting the term "site"

IAF MD 1:2023 (Auditing and certification of management systems in organisations with multiple sites) already distinguishes between permanent, temporary and virtual sites, among others. IAF MD 4:2023 also defines the virtual site, with both definitions being very similar. The definition from IAF MD 4:2023 is as follows:

"Virtual location where a client organisation performs work or provides services in an online environment that allows individuals to carry out processes irrespective of physical locations."

This means that ICT cannot be used across the board for all organisations and industries. Where processes require a physical environment – for example in medical device manufacturing, warehousing, physical testing laboratories or the installation of physical products – ICT cannot be used in full.

One example of a virtual site is a design and development organisation in which all employees perform their work remotely and operate in a cloud environment. However, a virtual site can also be an organisation's intranet or SharePoint, for example.

What does this mean for organisations seeking certification?

The assessment of whether an audit at an organisation can be carried out using ICT is performed by the certification body. The following aspects are taken into account:

Security and confidentiality: It must be examined how security and confidentiality can be maintained when using ICT. It must also be established whether the use of ICT can take place in accordance with security information, data backup measures and regulations. In addition, it must be ensured that ICT is used by mutual agreement.
Procedural requirements: Risks and opportunities that may affect the effectiveness of audits for each use of ICT under the same conditions must be considered, including the selection of technologies and how they are managed. This must be documented accordingly, including a description of how ICT is used to optimise the effectiveness and efficiency of the audit while maintaining the integrity of the audit process. When ICT is used for audit purposes, this influences the total audit time, as additional planning may be necessary, which can affect the audit duration.

This entry does not claim to cover all individual requirements of IAF MD 4:2023 in full. Rather, it is intended as a summary of the key requirements – particularly from a customer perspective.

Go back

IAF MD 11 – Audits of integrated management systems to ISO/IEC 17021-1

How can organisations with several management systems – for example for quality and information security – make their audit processes more efficient? The IAF MD 11:2023 guidance provides answers to the key questions on auditing integrated management systems. In our article you will learn exactly what the "degree of integration" is, how it affects audit time, and why a high level of integration can save real money. We show you which requirements conformity assessment bodies must meet, how the audit effort is calculated, and give a concrete worked example for practice. A must for anyone looking to optimise audits and avoid unnecessary duplicate assessments.

IAF MD 1 – Auditing and certification of management systems in multi-site organisations

How does certification work for organisations with multiple sites – and what needs to be considered in multi-site audits? The IAF MD 1:2023 guidance sets out clear requirements, which we examine more closely in this article. From the definition of key terms such as "head office" and "sites", through the requirements for matrix certifications, to the question of when a sampling procedure makes sense and when it does not: we provide a comprehensive overview of the factors that influence audit effort and audit duration. Discover the key prerequisites and find out how best to prepare the certification process for your multi-site organisation. An indispensable guide for organisations looking to structure their certification effort clearly.

IAF MD 2 – Certificate transfers

Would you like to transfer your certification to a new certification body? The IAF MD 2 document governs the prerequisites and requirements to be met when transferring certificates – for example for ISO 9001 or ISO/IEC 27001. In this article you will learn under which conditions a certificate transfer is possible, how the assessment process works, and what to do if certificates cannot be transferred due to particular circumstances. We also examine the role of the issuing and the accepting certification body in the transfer process and what to bear in mind after a successful transfer. An indispensable guide for organisations aiming for a smooth change of certificate.

IAF MD 26 – Transition from DIN EN ISO/IEC 27001:2017 to ISO/IEC 27001:2022

The transition to the new ISO/IEC 27001:2022 is unavoidable for certified organisations. The IAF MD 26:2023 document defines clear requirements and deadlines to ensure the transition from DIN EN ISO/IEC 27001:2017 to the new standard. Certified organisations have a transition period until 31 October 2025 to maintain their certification. This article summarises the key points of the transition – from the requirements for updating the ISMS and the Statement of Applicability through to the minimum effort involved in the audit. An essential guide for anyone looking to master the changeover successfully.

IAF MD 29 – Transition to ISO/IEC 27006:2024

With the publication of ISO/IEC 27006:2024, certification bodies face an important transition. IAF MD 29 governs the changeover to this new standard for information security management systems and primarily affects certification and accreditation bodies, with no direct impact on certified organisations. Certification bodies such as RSM Certification GmbH have two years to complete the transition, from the gap analysis through to the final audit by DAkkS. Find out here which steps are needed for a successful transition to ISO/IEC 27006:2024.