Third Party Compliance Audits

A third-party audit is conducted by an organisation independent of both the audited party and whoever is relying on the result. That independence is the entire product — it is why a regulator, insurer or client accepts the report rather than taking the audited organisation's word for the same facts.

First, second and third party audits

The distinction is often confused, and it determines who can conduct the audit:

• First partyAn organisation auditing itself. The internal audit every management system standard requires, conducted by or on behalf of the organisation.
• Second partyA customer auditing its supplier against the customer's own criteria — contract terms, specifications and codes of conduct rather than a standard.
• Third partyAn independent body auditing against defined criteria, with no commercial relationship to either the audited organisation or the party relying on the result. Certification audits are one form of third-party audit; compliance audits are another.

What we audit against

• Management system standards, where assessment is required without certification
• Regulatory frameworks and licence conditions
• Contractual requirements and service level commitments
• Customer codes of conduct, including ethical and labour requirements
• Client-specific technical or HSE specifications
• Group or corporate standards applied across subsidiaries
• Requirements imposed by insurers or lenders as a condition of cover or finance

How the audit is conducted

Scope, criteria and sampling are agreed before the audit begins, because an audit whose criteria are settled afterwards is not an audit. ITMAD then examines documented arrangements, samples objective evidence from records, observes activities in operation, and interviews personnel at the levels where requirements are actually met. Audits follow the principles of ISO 19011, which governs auditor competence, the evidence-based approach and impartiality.

What you receive

• Findings reported against each criterion, with the objective evidence examined
• Non-conformities classified by severity
• A clear statement of what is conforming, what is not, and what could not be determined
• Reporting in the format the relying party requires
• Follow-up verification of corrective action, where included in scope

Who commissions these audits

• Boards and audit committees seeking independent assurance
• Clients imposing requirements on contractors and needing them verified
• Organisations demonstrating compliance to a regulator or licensing authority
• Insurers and lenders requiring verification as a condition
• Parent companies assessing subsidiaries or joint ventures
• Organisations preparing for an external assessment they cannot afford to fail

Impartiality and its limits

ITMAD is accredited to ISO/IEC 17020 as an inspection body and ISO/IEC 17021 as a certification body. Those accreditations carry obligations we apply strictly: we do not consult on systems we audit, we do not perform internal audits for organisations we certify, and where any prior relationship could reasonably be seen to affect impartiality we disclose it before accepting the instruction rather than after the report is issued.

An audit report is only worth the independence behind it. Anything that compromises that independence destroys the value of the work, which is why the restrictions are worth more to you than the flexibility would be.

Related services

Where the audit is of your own supply chain against your criteria, supplier audits cover that. Where it is against environmental or safety legislation, environment and safety compliance audits apply. Where the objective is certification against a management system standard, that is a certification audit rather than a compliance audit.