Internal audit and management review are two mandatory elements of every management system, and also the first things an auditor asks for during certification. The internal audit is carried out by the company itself according to a plan, so that all areas are covered over the cycle; independence is key – no one should audit their own work, so small companies use an external auditor or cross-checking between departments. The output consists of findings with corrective actions and deadlines. Management review is a meeting of management at which it is evaluated whether the system is working and what needs to change. It has prescribed inputs – audit results, risk status, incidents, feedback, achievement of objectives – and outputs in the form of decisions and resources. Without a written record of both activities, there is no point ordering a certification audit.
See also: Certification audit, AI management system, Surveillance Audit.
