Managing subcontracted auditors without losing margin or control
How certification bodies manage subcontracted auditors: the ISO/IEC 17021-1 rules, the true cost, an internal-first allocation rule and the file to keep.
Manage subcontracted auditors with three controls: a written agreement and full competence record for each one, as ISO/IEC 17021-1 requires; an internal-first allocation rule so external days are used only where no competent internal auditor is free; and a monthly subcontracting ratio with a reason code for every external booking. Together these protect both margin and accreditation.
Key takeaways
- ISO/IEC 17021-1 treats subcontracted auditors like your own: written agreement, records, monitoring and impartiality checks all apply.
- The costly problem is avoidable subcontracting, where a competent internal auditor was free and the work went out anyway.
- An internal-first rule with a reason code for every external booking makes avoidable subcontracting visible.
- Published results show large shifts are possible, such as 28% less subcontracted work at Control Union.
Why certification bodies use subcontracted auditors
Almost every certification body relies on subcontracted auditors at some point. They cover seasonal peaks, rare IAF codes and technical areas, remote regions, languages and clients whose audit window falls when your own team is full. Used well, they let a body say yes to work it could not otherwise deliver.
The trouble starts when external days become the default rather than the exception. Each external day costs more than the marginal cost of an internal auditor who is already on the payroll, and it adds admin: contracts, competence evidence, monitoring and invoices. Margin leaks quietly, one booking at a time.
For the auditor's side of the relationship, see freelance auditor scheduling.
What does ISO/IEC 17021-1 require for subcontracted auditors?
ISO/IEC 17021-1:2015 expects the same control over external auditors as over employees. You need a written agreement in which each external auditor or technical expert commits to your policies and procedures, including impartiality and confidentiality. You need up-to-date personnel records covering qualifications, training, experience, affiliations, professional status and competence. And your monitoring of auditors, including on-site observation, covers them too. Check the current issue of the standard and your accreditation body's guidance.
| Topic | Individual external auditor | Outsourcing to another body |
|---|---|---|
| What it is | A person contracted to audit on your behalf | Another organisation performs part of the certification activity |
| Key control | Written agreement committing them to your policies | A documented process for when outsourcing may happen, plus a legally enforceable agreement |
| Competence | Evaluated and recorded by you, like employees | You remain responsible and must qualify and monitor the provider |
| Certification decision | Stays with your body | Cannot be outsourced |
The competence side is covered in depth in auditor competence under ISO/IEC 17021-1.
How much subcontracting is too much?
There is no published benchmark for the right share, and it varies with your mix of schemes and geography. The more useful split is between necessary and avoidable subcontracting. Necessary work is where no competent internal auditor was free, or where the travel would have cost more than the external day. Avoidable work is everything else.
Measure two ratios each month. Subcontracting ratio is subcontracted audit days divided by total audit days delivered. Avoidable ratio is subcontracted days where a competent internal auditor was free, divided by total subcontracted days.
ScheduleAI customer results. Index: before = 100.
A worked example makes the ratios concrete. A body delivers 5,000 audit days a year, of which 1,250 are subcontracted, a subcontracting ratio of 25%. A review of last year finds 400 external days where a competent internal auditor was free, an avoidable ratio of 32%. Bringing those 400 days in-house needs no new hires, and the margin difference on each day goes straight to the bottom line.
The Control Union case study shows how internal-first planning worked at scale.
An internal-first allocation rule
Write the rule down and apply it on every allocation. The order matters, because planners under pressure reach for whoever answered the phone last.
| Ad hoc booking | Internal-first rule | |
|---|---|---|
| Competent internal auditors checked first | Sometimes | ✓ |
| Travel cost compared with external day | ✕ | ✓ |
| Reason recorded for each external booking | ✕ | ✓ |
| Whole month visible before booking externals | ✕ | ✓ |
| External auditors still used for real gaps | ✓ | ✓ |
Use a short list of reason codes: no competent internal auditor, internal auditors fully booked, travel cost, language, client request, rotation. After one quarter the codes tell you whether to hire, train or change how you plan.
Control risks with subcontracted auditors
External auditors often work for several bodies and sometimes for consultancies. That brings specific risks to your accreditation and your clients.
Impartiality
Check for recent consultancy to the client. ISO/IEC 17021-1 bars using personnel who provided management system consultancy to a client within two years. See conflict of interest checks.
Rotation
External visits count towards your rotation history for the client. Track them in the same record as internal visits.
Competence drift
Scopes approved years ago may no longer be supported by recent audits or training. Re-evaluate on a schedule.
Availability
Freelancers take other work. Confirm dates early and hold a clear cancellation term in the agreement.
Rotation rules are explained in auditor rotation rules.
The subcontractor file: what to hold for each external auditor
Assessors will sample your external auditors just as they sample employees. Keep one file per person, reviewed at least annually and before any new scope is added.
- ✓Signed written agreement covering policies, impartiality and confidentiality
- ✓Declaration of interests, updated at least annually and before each audit
- ✓Qualifications, training and audit log supporting each approved scope
- ✓Competence evaluation record per standard and technical area
- ✓Monitoring record, including on-site observation and report review
- ✓Approved languages and regions
- ✓Availability and cancellation terms
- ✓Day rate and expenses terms held by finance
What to do this quarter
Take last quarter's subcontracted audits and, for each one, ask whether a competent internal auditor was free within reasonable travel. Most bodies find a meaningful share of avoidable days on the first pass. That number is your prize.
Then set the internal-first rule, add reason codes to your booking process and report both ratios monthly beside auditor utilisation rate. Review the approved scope of your most-used subcontracted auditors, and plan in monthly or quarterly batches so internal gaps are visible before external bookings are made.
The goal is fewer avoidable external days, with external auditors kept for the gaps only they can fill.
ScheduleAI is the audit scheduling software certification bodies use to plan ISO programmes from stage 1 to recertification.
ScheduleAI allocates internal auditors first within competence, rotation, conflict of interest and travel rules, then proposes subcontracted auditors only where a real gap remains, with the reason recorded. Planners approve every allocation.
Book a demo Estimate your savingsQuestions
Can a certification body use subcontracted auditors under ISO/IEC 17021-1?
Yes. The body must have a written agreement with each external auditor, keep competence records and monitor their performance as it does for employees.
Can the certification decision be subcontracted?
No. ISO/IEC 17021-1 does not allow the certification decision to be outsourced. It stays with the certification body.
What is avoidable subcontracting?
Subcontracted audit days where a competent internal auditor was free and travel was reasonable. It is the main source of margin leakage.
Do subcontracted auditors count for rotation?
Yes. Their visits are part of the client's audit history, so include them when you apply rotation rules.
How do I measure subcontracting?
Divide subcontracted audit days by total audit days delivered each month, and record a reason code for each external booking.
Will cutting subcontracting overload my team?
Not if you plan properly. Track a committed utilisation rate alongside the chargeable rate, and see auditor capacity planning.