Glossary

Independent confirmation that a certification body (or laboratory, or inspection body) is competent to do its work. In the UK, UKAS accredits certification bodies. Organisations are certified; certification bodies are accredited.

An annex at the back of a standard. In ISO/IEC 27001 and ISO/IEC 42001 it lists reference controls; in ISO 9001:2026 it is new guidance explaining concepts and intent.

A systematic, independent and documented process for obtaining evidence and evaluating it objectively to decide how far audit criteria are met.

The overall outcome of an audit, reached by the audit team after considering the audit objectives and all the findings.

What you audit against: the requirements of the standard, the organisation’s policies and procedures, contracts or legal requirements.

Records, statements of fact or other information that is relevant to the audit criteria and can be verified.

The result of evaluating audit evidence against audit criteria — showing conformity, nonconformity or an opportunity for improvement.

The description of the activities and arrangements for one audit: objectives, scope, criteria, schedule, team and logistics.

The arrangements for a set of audits planned over a period of time for a particular purpose — for example a year of internal audits.

Following one item (an order, an incident, a change) through a process and its records to test how the system works in practice.

The organisation, or part of it, being audited.

In business continuity, the analysis of how a disruption would affect activities over time, used to set priorities and timeframes for resuming them.

An independent organisation that audits management systems and issues certificates when they conform to a standard. Also called a registrar in some countries.

In environmental management, the legal requirements an organisation must meet and other requirements it has to or chooses to meet.

Fulfilment of a requirement.

The internal and external issues that affect what an organisation is trying to achieve and how its management system works. Clause 4.1 in the Harmonized Structure.

Recurring activity to enhance performance. Clause 10.1 in the latest Harmonized Structure.

Action to fix a detected nonconformity — for example replacing an out-of-date document. It does not address the cause.

Action to eliminate the cause of a nonconformity and prevent it happening again, usually after a root cause analysis.

Continuing professional development — learning and activities that keep your skills current. Schemes such as IRCA and PECB ask for CPD to maintain registration.

Information an organisation must control and maintain, and the medium it is held on. Replaced the older terms “documents” and “records” in ISO standards.

A quantitative reference point against which energy performance is compared.

A measure of energy performance chosen by the organisation, such as energy used per unit produced.

An element of an organisation’s activities, products or services that interacts or can interact with the environment — for example emissions to air or use of water.

A change to the environment, harmful or beneficial, resulting from an environmental aspect.

An internal audit carried out by, or on behalf of, the organisation itself.

The common clause structure (clauses 4–10), core text and definitions that ISO uses for its management-system standards. Formerly called the high-level structure or Annex SL.

A source with the potential to cause injury and ill health.

The order in which to reduce OH&S risk: eliminate, substitute, engineering controls, administrative controls, then personal protective equipment.

A person or organisation that can affect, be affected by, or believe itself affected by a decision or activity — customers, staff, regulators, neighbours and so on. Also called a stakeholder.

The auditor who leads an audit team and is responsible for the audit plan, the team’s work and the report. Also the name of the five-day course that teaches this role.

Top management’s planned review of whether the management system is suitable, adequate and effective. Clause 9.3.

The set of related elements an organisation uses to establish policies, objectives and processes to achieve them.

Non-fulfilment of a requirement. Often graded major or minor in audits, using definitions set by the scheme or certification body.

Data that shows something exists or is true, obtained by observation, measurement, testing or other means — the basis of every audit finding.

The meeting at the start of an audit to confirm the plan, introduce the team and agree arrangements with the auditee.

An audit finding that does not show a nonconformity but suggests something could work better.

The improvement cycle behind management-system standards: plan the system, do it, check performance, act to improve.

In food safety, the basic conditions and activities needed to maintain a hygienic environment throughout the food chain.

Managing activities as interrelated processes that work together as a system. One of the seven quality management principles.

The effect of uncertainty — which can be positive or negative. ISO 31000 relates it to objectives.

One of the principles of auditing: considering risks and opportunities when planning and carrying out audits so that effort goes where it matters most.

The boundaries of a management system (sites, activities, products, services), or of an audit.

An audit by a party with an interest in the organisation — typically a customer auditing a supplier.

An energy use that accounts for substantial consumption or offers considerable potential for improvement, identified in the energy review.

The two parts of an initial certification audit: stage 1 checks readiness (documentation, scope, planning); stage 2 evaluates implementation and effectiveness.

In ISO/IEC 27001 and ISO/IEC 42001, the document listing the controls needed, whether they are implemented, and the justification for including or excluding each Annex A control.

A periodic audit by the certification body between initial certification and recertification to check the system is maintained.

An audit by an independent organisation, such as a certification body or regulator.

The person or group who directs and controls an organisation at the highest level.

The time allowed, after a new edition of a standard is published, for certified organisations to move to it.