How Is IAF MD 5 Audit Time Managed in System Certification Software?

How is IAF MD 5 audit time managed in software?

IAF MD 5 audit time is managed as a versioned calculation record that starts from effective personnel count, is adjusted in a justified manner with risk/complexity and organization-specific factors, is approved and is re-reviewed every cycle.

The right system does not just show the user a "how many auditor/days?" result. It keeps, in the same calculation file, which document version was used, the input data, site and shift structure, increasing and decreasing factors, the rounding step, the Stage 1 and Stage 2 split, team composition and the authorized approval. Thus when the result changes, not just the new number but the reason for the change is traceable.

For which audits is IAF MD 5 used?

IAF MD 5:2023 provides mandatory provisions and guidance for the consistent application of the relevant ISO/IEC 17021-1 requirements in quality, environmental and occupational health and safety management system audits.

As this article was prepared, the current official document is IAF MD 5:2023, Issue 4, Version 3, published on 14 June 2023. The document uses effective personnel count as the starting point but explicitly states it is not the sole consideration. Initial certification is the sum of Stage 1 and Stage 2; the time needed for surveillance and recertification must be determined for each client individually. [1]

TÜRKAK's management system certification application page also shows that, alongside ISO/IEC 17021-1 and the related normative documents, IAF mandatory documents will apply, and that IAF MD 5 is the document for determining audit time for quality, environmental and occupational health and safety management systems. This shows that the software rule must not be stored under a generic "ISO calculation" name: program, scope and document version must be selected explicitly. [2]

In what order should the calculation be made?

The calculation proceeds through selecting the applicable system type, determining effective personnel, finding the base duration, evaluating factors, rounding the time and justified approval.

Skipping this order leads to two types of risk. Looking only at the personnel band loses the organization-specific complexity; writing the target days first and then fitting the factors to that result reverses the justification. The system must show the base duration and corrections in separate fields and explain to the user the difference between the previous and the new calculation.

Why isn't effective personnel count the same as the payroll total?

Effective personnel is the technical input that accounts for the full-time, temporary and part-time personnel, shifts and, where applicable, in-scope contractors participating in the activities within the certification scope.

IAF MD 5 requires the evaluation of permanent, temporary and part-time employees; in-scope shifts, administrative/office personnel and similar or repetitive processes in the effective personnel calculation. Under OH&SMS scope, contractor/subcontractor employees under the organization's control or influence who can affect performance gain importance too. In seasonal activities, audit time must be planned in a period where the activities can be represented. [1]

In software, the source may come from the HR system; but the raw count must not be accepted as the technical result. Each personnel group's relation to the scope, part-time ratio, shift, repetitive-process justification and outsourcing status must be visible. A manual technical correction after the HR integration must also be recorded with user, date and explanation.

• Head office and sites should be kept with a separate personnel distribution.
• A shift should be evaluated not just as a total count but by the difference of processes that must be audited.
• For seasonal personnel, the period used and the evidence should be noted.
• The justification for reductions regarding out-of-scope personnel must be explicit.
• Contractor and subcontractor assessment should be treated separately in the QMS, EMS and OH&SMS contexts.

How is the risk and complexity selection made?

For QMS the risk of product/service failure, for EMS the complexity of environmental aspects, and for OH&SMS the nature and severity of occupational health and safety risks are evaluated.

IAF MD 5's approach is not the same for the three systems. On the QMS side there are high, medium and low risk examples; on the EMS side five basic complexity categories for environmental aspects; on the OH&SMS side sector examples related to risk complexity. Software must not just auto-select a class from the sector code and lock the field. The actual activity, processes, product/service, environmental conditions and risk context must be verified by an authorized person.

For example, within the same broad sector one organization may run limited, low-complexity activities while another may carry chemical processes, multiple shifts or a heavy regulatory load. A default suggestion can be given; but the justification for the selected class and any deviation from the default must be stored. When the activity changes at the next surveillance, the old class must not be silently used; a reassessment task must be opened.

Which factors change the base duration?

Site and logistics complexity, language, large areas, high regulatory density, unique processes, temporary sites and outsourced processes are the main factors that can affect duration.

IAF MD 5 states that situations such as multiple buildings or locations, different languages and the need for interpreters, very large sites relative to headcount, heavily regulated activities, highly complex or unique processes and temporary site visits can increase duration. For QMS, EMS and OH&SMS there are additional system-specific factors. If a reduction is considered, its basis—such as the system's maturity, repetitive/low-complexity processes or the limited scope—must be recorded explicitly; the effectiveness of the audit must not be weakened. [1]

A good data model does not keep factors merely as "increase/decrease" checkboxes. Factor type, source information, amount, explanation, attachment, proposing person, approving person and effective date are stored together. This way it is visible whether a reduction in the previous cycle is still valid for today's organization.

How should a simple QMS example be read?

In the IAF MD 5 QMS table, the starting value for 26–45 effective personnel is 4 auditor/days as the sum of Stage 1 and Stage 2 for the initial audit; this is not the final quotation value.

Suppose in an example organization the effective personnel count is verified as 38. Table QMS 1 gives a QMS initial value of 4 auditor/days. If the organization operates in two separate buildings, the design process is at a different location and two languages will be used during the audit, these conditions are evaluated additionally. In contrast, most processes being repetitive may raise a reduction discussion. The basis of each increase and decrease is written separately; the result is arranged to the nearest half day and submitted for authorized approval. [1]

This example is not a ready result for a specific client. Saying "38 people equals 4 days" is incomplete without knowing the risk class, scope, shifts, sites, outsourcing, integrated systems and program rules. The software may show the example for training purposes; in a real calculation it must re-verify every input.

Are auditor/days, calendar days and team size the same thing?

No. Auditor/day is total effort; calendar duration and team size show how that effort is distributed and must also be planned for effectiveness.

According to IAF MD 5, an audit day is normally eight hours. If the calculation result is a decimal, it is adjusted to the nearest half day; for example 5.3 days goes to 5.5, 5.2 days goes to 5. Reducing the initial number of audit days by planning longer working days is not an appropriate approach. Team size is not a mechanical division either: an activity run by two auditors in half a day may not, in every case, produce the same effect as one auditor's full day. [1]

The software should show separately the total auditor/days, calendar days spent on site, remote activity, travel and the duration assigned per team member. Overlapping sessions or one person appearing at two sites at once should be caught at plan validation. When the plan changes, even if the calculation result does not, the distribution version must be renewed.

How are remote, multi-site and integrated audits handled?

These scenarios add rules on top of the base calculation; the software must check suitability, sampling, the remote activity boundary and integrated time adjustment separately.

IAF MD 5 requires that when remote audit techniques are used, the IAF MD 4 requirements be applied and the activities be defined in the plan. For OH&SMS, remote activities are limited to document/record review and interviews; process control and OSH risk control cannot be audited with remote audit techniques. In software this boundary must be established not just with a "remote" label but with activity type and justification. [3]

In multi-site structures, each site, head-office function, personnel, activity and sampling decision is kept linked. In integrated systems, the applicable durations of different management systems, the level of integration and team competence are evaluated together. IAF ID 14:2023 is a current informative document explaining the suitability, sampling, effective personnel, complexity, correction and total duration steps for determining audit time for integrated multi-site audits; it does not replace the mandatory IAF MD 5 or program requirements. [4]

How are surveillance and recertification durations updated?

Instead of copying the old day count, surveillance and recertification durations should be re-reviewed against the client's current data and system performance.

IAF MD 5 offers a framework where, in the first three-year cycle, the time spent on annual surveillance is about one third of the initial certification duration, and the recertification duration is about two thirds of a current initial audit performed at that time. The recertification calculation is not a direct two thirds of the time actually spent in the past initial audit. Changes in organization, scope, personnel, sites, shifts, processes and system maturity must be considered. [1]

Therefore the software should open a client update form before each surveillance, compare the new data with the previous calculation and flag differences requiring reassessment. Even if nothing changed, the reviewing person and date must be recorded. This prevents "it was two days last year too" from being used instead of a technical justification.

Which controls must the calculation engine have?

The calculation engine must manage version, input snapshot, explainable intermediate steps, authorized approval, locking and recalculation triggers together.

• Rule version: "IAF MD 5" alone is not enough; issue, version, publication/implementation date and the internal rule version must be visible.
• Source data: From whom and on what date the personnel, site and activity information was obtained must be recorded.
• Intermediate results: The base duration, each correction, rounding and distribution must be traceable by the user.
• Role check: Preparing and approving the calculation must be separated per the organization's authorization matrix and procedure.
• Lock: A calculation linked to a quotation or an approved plan must not change silently; a new revision must be opened.
• Trigger: A change in personnel, scope, sites, shifts or processes must produce a reassessment task.
• Report: The duration and justification presented to the client and the internal technical calculation detail must be shown at the correct access level.

This approach supports ISO/IEC 17021-1's competence, consistency and impartiality framework; but it does not replace the standard's full set of requirements. The calculation screen is only one control gate of the system certification file from application to certificate . [5]

What are the most common mistakes in IAF MD 5 software?

The most frequent mistakes are accepting the payroll count directly as effective personnel, not recording factor justifications, and copying old calculations without change control.

• Using the same risk/complexity selection for QMS, EMS and OH&SMS.
• Melting shift and site distribution into just the total personnel.
• Applying a reduction factor without assessing the audit's effectiveness.
• Writing remote activity time without showing which process was assessed and how.
• Dividing auditor/days into calendar days without additionally assessing team effectiveness.
• Automatically copying the first year's figure at surveillance and recertification.
• Silently recalculating past files with the new rule when a new document version arrives.

How can the IAF MD 5 process be set up within Vizyon Alia?

In Vizyon Alia the calculation can be configured as a record tied to application data, with the rule version and factor justifications visible, linked to the quotation-plan-decision files and authorized approval.

In the Vizyon Alia solution client, scope, site, auditor and certificate cycle are linked to the same operations file. Activating a generic formula without analyzing the organization's current IAF MD 5 calculation sheet, approval flow and program differences would not be right. During the pilot, a few anonymized files completed in the past should be recalculated with the new engine; whether the differences stem from rules, data or old practice should be examined by the technical team.

Demo and process analysis Preparing a QMS, an EMS/OH&SMS, a multi-site and a scope-change example ensures the calculation engine is evaluated not only in the normal scenario but also in exceptions.

Frequently asked questions