ISO/UNDP 53001 audit, findings and nonconformities: frequently asked questions

An ISO/UNDP 53001 auditor combines four methods: interviews with top management and staff, review of documented information, observation of activities and sampling of records. They cross-check these sources to establish objective evidence. ISO 19011 provides guidelines for this practice; ISO/IEC 17021-1 sets the rules specific to certification audits.

Four sources of evidence

Each method yields a different kind of evidence:

• interviews reveal how well the SDG priorities are really understood and how decisions are made;
• document review shows what the organisation has decided and recorded: policy, objectives, indicator results, minutes;
• observation compares what is written with what happens, for instance during a steering meeting or at an operating site;
• sampling checks, across a selection of records, that a practice is applied consistently.

Evidence from a single source remains weak. The auditor looks for corroboration: an objective mentioned in an interview should also appear in the documents and in the results being tracked.

Remote or on site

Part of the audit can be conducted remotely, especially the stage 1 document review and some interviews. Observing activities and meeting teams lend themselves less well to remote work. The audit plan, sent in advance, specifies how each session will be run.

The auditor does not propose solutions to the nonconformities identified. They describe each one, link it to a requirement of the ISO/UNDP 53001 standard and leave the organisation to choose its corrections.

An auditor cannot examine everything. They select a sample of records, decisions, people and sometimes sites, broad and varied enough to be representative. The selection combines judgement, directed at the most significant SDG issues and past nonconformities, with an element of chance that prevents the organisation from assembling the sample itself.

What gets sampled

In an audit based on the ISO/UNDP 53001 standard, the sample covers many kinds of item: indicator readings for the priority SDGs, management review minutes, corrective action files, investment or purchasing decisions in which the SDGs were supposed to be considered, internal audit reports, and people to interview across departments.

The auditor decides what they want to see. When asking for recent executive committee decisions, they do not settle for the ones the organisation considers most convincing.

What a sample allows the auditor to conclude

A nonconformity found in the sample is not an accident to be set aside. The auditor seeks to know whether it is isolated or systemic and may widen the sample to find out. A recurring defect across several randomly chosen items weighs more than a one-off omission and can move the finding from minor to major.

Conversely, a clean sample does not rule out a defect elsewhere: audit evidence is always partial. That is one reason the cycle includes annual surveillance audits that vary the items examined.

The auditor interviews top management because ISO/UNDP 53001 places the contribution to the SDGs at governance level. They seek to establish that top management decided which SDGs to prioritise, follows the results, allocates resources and takes the commitments into account in strategic decisions. Delegating everything to a sustainability manager is not enough.

What the interview seeks to establish

Clause 5 of the ISO/UNDP 53001 standard, on leadership, calls for demonstrable commitment from top management. The interview is not about reciting the policy. The auditor asks concrete questions. Which recent decisions were changed because of the chosen SDGs? Which results were presented at management review, and what was concluded? Which resources were granted, or refused, and why?

The answers are then compared with minutes and budgets. A management team that discovers its own system's indicators during the interview gives a strong sign of weak oversight.

When the gap becomes serious

Lack of top management involvement is not a formality. If SDG priorities are never discussed where decisions are made, the system cannot achieve its intended results. The auditor may then raise a major nonconformity, even when the documentation is complete.

The interview with top management takes place at stage 2, at every recertification and, depending on the programme, during surveillance audits. The other techniques are covered in the question on audit methods.

An ISO/UNDP 53001 audit can produce four kinds of finding: conformity with a requirement, minor nonconformity, major nonconformity and observation, also called an opportunity for improvement. Each finding is tied to a specific requirement and backed by objective evidence. Only nonconformities call for a formal response from the organisation.

The four categories

• Conformity: the evidence shows that a requirement of the ISO/UNDP 53001 standard is met. It is not always spelled out in the report, but it has been established.
• Minor nonconformity: a requirement is not fully met, without compromising the system's ability to achieve its intended results.
• Major nonconformity: the gap does compromise that ability, for example a requirement not addressed at all or serious doubt about control of a process.
• Observation: a point to watch or a possible improvement, which is not a nonconformity.

Grading is the audit team's call. It is presented at the closing meeting, where the organisation may put forward further evidence, but it is not open to negotiation.

How a finding is written

A nonconformity statement brings together the requirement concerned, the evidence observed and the gap between the two. It contains no recommendation. “Objectives linked to the chosen SDG have no monitoring indicator” is a finding; suggesting a dashboard would be advice, which a certification body may not give.

This wording lets the organisation address the cause and lets the certification body verify the correction later. The line between minor and major is the subject of a separate question.

A major nonconformity compromises the SDG management system's ability to achieve its intended results: a requirement not addressed, or serious doubt about control of a process. A minor one does not. A major must be corrected, and the correction verified, before any positive decision; for a minor, the certification body accepts a corrective action plan.

The tipping point

The difference does not lie in how many lines are missing from a document but in the effect on the system. The auditor asks: if this gap persists, can a system built on the ISO/UNDP 53001 standard still produce the intended results for the chosen SDGs?

Generic examples:

• an indicator poorly recorded over a short period, while monitoring exists and has resumed: more likely minor;
• no objective set for an SDG the organisation describes as a priority: more likely major, because a requirement is not addressed;
• a management review held but incomplete: minor, unless it allows no decision on priorities.

Several minor nonconformities affecting the same requirement or process may together reveal a breakdown and be combined into a major.

Consequences for certification

Before initial certification or recertification, a major nonconformity blocks the decision until the correction and corrective action have been verified. Verification may require an additional visit. During the cycle, a major left unresolved past the deadline exposes the organisation to suspension.

For a minor nonconformity, the organisation submits a cause analysis and an action plan; their effectiveness is checked at the next audit at the latest. See how nonconformities are closed.

No. An observation, or opportunity for improvement, is not a nonconformity: no requirement of ISO/UNDP 53001 has been breached. The auditor is flagging a point to watch. The organisation does not have to respond formally, but an observation left unattended can turn into a nonconformity at a later audit if the risk it described materialises.

Why auditors record observations

An observation flags a weakness before it becomes a defect. Examples: an SDG indicator whose calculation method is known to only one person; an interested-party analysis not reviewed since a change of activity; a management review that discusses results but barely touches on risks.

In each case the requirement of the ISO/UNDP 53001 standard is met at the time of the audit. The auditor cannot raise a nonconformity but considers it useful to name the risk.

What an observation is not

An observation is not advice. It describes a situation, never how to remedy it: the certification body cannot propose solutions without compromising its impartiality. Nor does it count in the certification decision.

At the next audit, the auditor checks what became of earlier observations. If the risk has materialised, for instance an indicator that became unusable after someone left, the finding will this time be a nonconformity. The other grades are set out in the findings of an audit.

An ISO/UNDP 53001 nonconformity is closed once the certification body has verified both the correction of the gap and the corrective action that addresses its cause. The organisation submits a cause analysis, the corrections made and an action plan. For a major, verification comes before the decision; for a minor, effectiveness is checked at the next audit at the latest.

Correction, cause analysis, corrective action

Closure rests on three separate elements, which the auditor examines one by one:

• the correction removes the gap found: the missing indicator is filled in, the management review is completed;
• the cause analysis explains why the gap occurred; a cause such as “oversight”, with no explanation of how it happened, is rarely accepted;
• the corrective action acts on the cause so that the gap does not recur elsewhere or later.

A correction without corrective action does not close a major nonconformity. The ISO/UNDP 53001 standard applies the same logic to internal nonconformities in clause 10.

Verification on documents or on site

Depending on the nature of the gap, verification is done on documents or during a follow-up visit. A gap in a record can be checked remotely. A gap in a practice, or in top management involvement, often means meeting the people concerned again.

The auditor gives an opinion on what has been submitted. If it falls short, the organisation can add to it within the time allowed. Time limits are covered in the question on deadlines for nonconformities.

ISO/IEC 17021-1 requires the certification body to set the time allowed for correction and corrective action, and to verify that major nonconformities have been dealt with before any positive decision. The exact deadline appears in the certification rules and is restated in the audit report. Missing it can prevent certification or lead to suspension.

A framework each certification body sets

ISO/IEC 17021-1, which governs the bodies that certify conformity with the ISO/UNDP 53001 standard, does not lay down a single deadline for every case here. It requires each body to define its rules, communicate them in advance and apply them consistently. Three phases are usually distinguished:

• the response expected after the audit: cause analysis and action plan;
• for a major nonconformity, implementation and evidence of correction, without which no positive decision is possible;
• for a minor one, verification that the actions are effective, which can wait until the next audit.

At an initial audit, if majors are not resolved in time, the body may have to repeat stage 2 before deciding.

Response times planned by Gardiant

Gardiant Certification's certification rules will set these deadlines. The planned commitments are an audit report within 10 working days and a decision no more than 3 weeks after the audit, once major nonconformities have been closed.

When a correction objectively cannot be completed in time, for instance because it depends on an investment, the certification body judges whether the interim measure and the plan submitted are sufficient. What it checks is described in closing a nonconformity.

ISO/UNDP 53001 certification is refused when the certification body cannot conclude that the SDG management system meets the requirements: a major nonconformity not corrected in time, an inadequate action plan for minor ones, missing evidence, or inaccurate information about the scope. The decision and its reasons are given in writing.

Situations that lead to refusal

Refusal is not a penalty but the outcome of an assessment. It occurs in particular when:

• a major nonconformity raised at stage 2 has not been corrected, or its correction could not be verified, within the set deadline;
• the cause analysis and action plan for minor nonconformities are not acceptable;
• the audit could not be completed for lack of access to people, sites or information;
• information supplied turns out to be inaccurate, for instance on headcount or activities covered.

Those who decide did not conduct the audit. They examine the report and the organisation's responses and may ask for more before reaching a decision.

After a refusal

The decision states its reasons, linked to the requirements of the ISO/UNDP 53001 standard. The organisation can challenge it through an appeal. It can also apply again; the certification body then determines whether all or part of the initial audit has to be repeated.

A refusal is not made public. It does not stop the organisation from pursuing its SDG work, but rules out any communication implying certification. Ways to challenge a decision are covered in appealing a decision.

Yes. An organisation can appeal against an unfavourable ISO/UNDP 53001 certification decision: refusal, suspension, withdrawal or scope reduction. ISO/IEC 17021-1 requires the certification body to run a documented appeals process, handled by people who took part neither in the audit nor in the decision being challenged.

Appeal or complaint

Two routes need to be told apart. An appeal targets a certification decision and asks for it to be reconsidered. A complaint concerns broader dissatisfaction: an auditor's conduct, a missed deadline, how the audit was run, or a third party's grievance against a certified organisation.

In both cases the certification body acknowledges receipt, investigates and communicates its conclusion in writing. For Gardiant Certification, the planned commitments for complaints are an acknowledgement within 5 working days and a response within 30 days. The procedure is set out on the complaints and appeals page.

What the appeal reviews

An appeal is not a new audit. Those examining it check that the findings rest on evidence, that they are correctly linked to the requirements of the ISO/UNDP 53001 standard and that the decision follows logically from the file. The organisation can submit material it believes was not properly considered.

Unless the certification rules say otherwise, an appeal does not suspend the contested decision. It leads to no adverse measure against the organisation that lodges it. The usual grounds for a negative decision are described in refusal of certification.