Product Overview

Summary: This ISO Compliance and Auditing Standard Operating Procedure provides a clear, repeatable framework for planning, conducting, and closing out ISO audits within an Australian business. It helps organisations embed ISO requirements into day-to-day operations, demonstrate due diligence, and maintain certification with confidence.

This ISO Compliance and Auditing SOP is designed for Australian organisations that need a practical, documented method for managing ISO-related compliance and audits across their operations. Whether you are certified to ISO 9001 (Quality), ISO 45001 (Safety), ISO 14001 (Environment), ISO 27001 (Information Security) or are working towards certification, this procedure provides a structured, end-to-end approach that aligns with ISO management system requirements and Australian regulatory expectations. It translates the often-abstract language of ISO standards into clear responsibilities, workflows, and records that can be followed by real teams in real workplaces.

The SOP covers the full audit lifecycle: annual audit planning, auditor competence, audit preparation, conducting on-site and remote audits, reporting nonconformances, agreeing corrective actions, and verifying their effectiveness. It also embeds risk-based thinking, consultation with workers and other stakeholders, and integration with existing WHS and corporate governance processes. By implementing this procedure, businesses can reduce audit stress, avoid last‑minute document scrambles, and build a culture of continual improvement that stands up to certification bodies, regulators, and client prequalification requirements across Australia.

Key Benefits

• Standardise how ISO audits are planned, conducted, reported, and followed up across all sites and functions.
• Ensure ongoing compliance with ISO management system standards and Australian legal obligations relevant to your operations.
• Reduce the risk of nonconformances, certification suspension, and costly re‑audits by closing gaps proactively.
• Streamline evidence collection, recordkeeping, and audit trails to satisfy both external auditors and internal governance requirements.
• Support a culture of continual improvement by turning audit findings into practical, trackable corrective and preventive actions.

Who is this for?

• Compliance Managers
• Quality Managers
• WHS Managers
• Environmental Managers
• Internal Auditors
• Risk and Governance Managers
• Operations Managers
• Business Owners and Directors
• ISO Management System Coordinators
• Project Managers

Included Sections

• 1.0 Purpose and Scope
• 2.0 Definitions and Abbreviations
• 3.0 Applicable Standards, Legislation and References
• 4.0 Roles, Responsibilities and Authorities
• 5.0 Overview of the ISO Management System Framework
• 6.0 Annual Compliance and Audit Planning
• 7.0 Auditor Competence, Independence and Selection
• 8.0 Audit Preparation and Document Review
• 9.0 Conducting Internal Audits (On-site and Remote)
• 10.0 Interviewing, Sampling and Evidence Collection
• 11.0 Identifying Nonconformances, Observations and Opportunities for Improvement
• 12.0 Audit Reporting, Communication and Sign‑off
• 13.0 Corrective and Preventive Action Management
• 14.0 Verification of Effectiveness and Follow‑up Audits
• 15.0 Integration with WHS, Environmental and Information Security Obligations
• 16.0 Risk-Based Thinking and Compliance Risk Assessment
• 17.0 Consultation, Communication and Worker Participation
• 18.0 Records Management and Document Control
• 19.0 Audit Program Review and Continual Improvement
• 20.0 Appendices – Sample Audit Plan, Checklists, Templates and Forms

Legislation & References

• ISO 9001:2015 Quality management systems – Requirements
• ISO 45001:2018 Occupational health and safety management systems – Requirements with guidance for use
• ISO 14001:2015 Environmental management systems – Requirements with guidance for use
• ISO 19011:2018 Guidelines for auditing management systems
• ISO 27001:2022 Information security, cybersecurity and privacy protection – Information security management systems – Requirements
• AS ISO 19600:2015 Compliance management systems (superseded but still referenced in many governance frameworks)
• Work Health and Safety Act 2011 (Cth) and harmonised state and territory WHS Acts
• Work Health and Safety Regulations 2011 and equivalent state and territory regulations
• AS/NZS ISO 31000:2018 Risk management – Guidelines