IAF MD 5 audit time: how audit duration is calculated

What is IAF MD 5 audit time?

IAF MD 5 audit time is the time a certification body needs to plan and complete a full, effective audit of a client's quality, environmental or occupational health and safety management system. It is set by IAF MD 5, Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems. The current issue is Issue 4, Version 3 (IAF MD 5:2023), issued 14 June 2023. Check the IAF website for the current issue before you update your procedure.

For planners, MD 5 decides how many auditor days each client needs across the whole three-year cycle. Get it wrong and you either under-audit (an accreditation finding) or overcharge and lose the client. It also sets how much capacity your programme needs, which is why it sits at the start of every auditor capacity plan.

How is audit time calculated under IAF MD 5?

MD 5 is a method. The table gives a starting point, and the certification body then justifies every change. ISO/IEC 17021-1:2015 requires documented procedures for determining audit time and a record of the duration and its justification for each client (clause 9.1.4).

Each step has its own traps. The count is where most errors start, because the table is only as good as the number you read it with.

Who counts in the effective number of personnel?

The effective number of personnel covers everyone involved within the scope of certification: permanent, temporary and part-time staff, including those on every shift. For OH&S, contractors whose work is under the organisation's control also count.

MD 5 then allows the number to be adjusted, provided the method is documented.

• Part-time staff can be converted to a full-time equivalent. Two people at half time count as one.
• Repetitive, similar processes carried out by a high percentage of staff can justify a reduction, with the method documented and risk considered.
• Shift work does not reduce the count. The auditor still has to see the full scope, which may mean auditing outside normal hours.
• Temporary unskilled staff: MD 5 describes a reduction as unusual for QMS and EMS, and not applicable in principle for OH&S.

A common mistake is using the headcount on the application form without asking about shifts, contractors or seasonal peaks. Ask for the numbers in scope by shift and by site, and refresh them before every recertification.

IAF MD 5 audit time tables: the starting figures

The tables give initial certification audit time (stage 1 plus stage 2) in auditor days. The QMS table uses headcount only. The EMS table adds complexity categories (high, medium, low, limited) and the OH&S table adds risk categories (high, medium, low). MD 5 notes that personnel numbers should be seen as a continuum rather than a stepped change.

Above 10,700 people, MD 5 says time should follow the progression of the table in a consistent way. Auditors-in-training, observers and technical experts do not count towards these figures.

What factors increase or reduce audit time?

Section 8 of MD 5 lists factors that add time and factors that remove it. Additive factors may be offset by subtractive ones, and each subtractive factor may be used only once per calculation. However many factors apply, the total reduction cannot exceed 30% of the table figure.

Each factor needs a reason on file. Accreditation assessors often sample client files and ask why a reduction was taken, so "regular client" is not a justification.

A worked example

A food packaging plant applies for ISO 9001. It has 180 permanent staff over two shifts, 40 part-timers at half time and no design responsibility.

1. Count180 permanent plus 40 part-timers converted to 20 full-time equivalents gives 200 effective personnel.
2. Read the table200 falls in the 176 to 275 band of Table QMS 1: 9 auditor days.
3. AdjustNo design responsibility justifies a reduction. Two shifts justify planning some time outside day hours. The body settles on 8 days, an 11% reduction, well inside the 30% limit.
4. Plan on siteAt least 80% of 8 days, so at least 6.4 days on site across stage 1 and stage 2, with stage 2 the larger share.
5. Plan the cycleSurveillance about one third of 8 days each year (roughly 2.5 to 3 days). Recertification about two thirds of a freshly calculated initial figure.

The planning consequence is clear: this client needs a lead auditor with the right IAF code for at least 6.4 site days in year one, then roughly 2.5 to 3 days a year. That demand feeds your annual audit programme.

How does IAF MD 5 audit time affect scheduling?

Audit time becomes auditor days, and auditor days become bookings. MD 5 says the number of audit days shall not be reduced at the planning stage by programming longer working hours. A normal audit day is 8 hours. So a 6.4 day on-site audit cannot be squeezed into four long days to save a hotel night.

Split the on-site time across the team with care. Two auditors for 3.2 days each gives 6.4 auditor days, but only if both are competent for the parts they audit. For combined QMS and EMS clients, the time for each standard is calculated separately first, then adjusted under IAF MD 11 for integrated audits. For clients with many sites, IAF MD 1 sampling takes precedence where the two conflict.

• ✓Effective personnel refreshed at every recertification
• ✓Every reduction linked to a named MD 5 factor
• ✓Total reduction checked against the 30% limit
• ✓On-site duration at least 80% of audit time, unless justified
• ✓No days removed by planning longer hours
• ✓Trainees and technical experts booked on top of audit time
• ✓Justification recorded on the client file

Common mistakes with MD 5

Most of these errors are caught only at accreditation assessment. Building the rules into quotation and scheduling, so the calculated days travel with the audit, stops them earlier. See ISO/IEC 17021 audit scheduling requirements for the wider picture.

ScheduleAI is audit scheduling software built for testing, inspection and certification (TIC) organisations, with a planner approving every plan.