RISQS Accreditation Guide

Preview: this guide is being reviewed by Harcon Solutions and content may change.

Stage 7 of 8: Audit

Preparing for your RISQS audit

An audit is where your arrangements, and the evidence that they work, are examined independently.

What an audit is for

Where an audit applies to your scope, it is the point at which your arrangements, and the evidence that they work, are examined independently. Preparation starts well before an audit is booked: most of the work happens in the stages that come before it.

Back to contents

Harcon's illustrative audit journey

The steps below are Harcon's illustrative audit journey: the sequence this guide uses to explain preparation, audit and close-out. They are not the RISQS audit process. How your own audit is arranged and carried out depends on your scope and current RISQS requirements.

Back to contents

The general audit journey

  1. Scope confirmedYour intended activities and RICCL codes are settled.
  2. Requirements understoodYou know which requirements and audit modules apply to you.
  3. Management arrangements establishedArrangements are in place, approved and communicated.
  4. ImplementationArrangements are used in day-to-day work.
  5. Evidence generatedRecords show the arrangements being followed over time.
  6. Internal readiness reviewAn internal review tests your arrangements and evidence before audit.
  7. RISQS auditYour arrangements and evidence are examined independently.
  8. Findings, where applicableAny findings are raised and explained.
  9. Corrective actionRoot causes are addressed and actions completed.
  10. Close-outClose-out is evidenced and confirmed.

Back to contents

Before the audit

  • Confirm your registered scope and which audit modules apply to you.
  • Check that your arrangements are current, approved and in use.
  • Gather evidence that shows your arrangements working over time, not only just before the audit.
  • Carry out an internal readiness review, ideally by someone independent of the day-to-day work.
  • Make sure the people who may be interviewed understand the arrangements and can describe how they work.

Back to contents

During the audit

  • Expect documents to be reviewed, records to be sampled and people to be asked how work is actually done.
  • Show real records. Where something is not yet in place, say so plainly.
  • Note any points raised, so they can be addressed properly afterwards.
Related page: .

Back to contents

After the audit

  • Findings, where raised, need to be understood and addressed within the timescales RISQS sets.
  • Corrective action should fix the underlying cause, not only the symptom.
  • Keep the evidence that each action has been closed out, and check that the fix has worked.
Related pages: .

Back to contents

How RISQS audits are structured

The RISQS Scheme Rules describe a two-stage audit model. You upload evidence to the RISQS portal, a desktop auditor reviews it remotely, and a lead auditor then carries out the audit with you, on site or by video conference depending on the stage of the audit cycle.

The Scheme Rules also describe audits that are run differently, such as re-audits and extensions of scope, so confirm with RISQS how your own audit will be carried out.

Sources, RISQS: .

Back to contents

Audit duration, booking and close-out timescales

Confirm with RISQS

Audit durations, booking arrangements and close-out timescales are set by RISQS and are not stated in this guide. Confirm them with RISQS for your scope.

Back to contents

Guidance on this page last reviewed: .