ISO/IEC 19770-11:2021
Information technology — IT asset management — Part 11: Requirements for bodies providing audit and certification of IT asset management systems
This document specifies requirements and provides guidance for certification bodies providing audit and certification of an ITAMS in accordance with ISO/IEC 19770-1. It does not change the requirements specified in ISO/IEC 19770-1.
This document can also be used by accreditation bodies for the accreditation of certification bodies. However, this document does not specify requirements or provides guidance for accreditation bodies to audit certification bodies.
A certification body providing ITAMS certification is expected to be able to demonstrate fulfilment of the requirements specified in this document, in addition to the requirements in ISO/IEC 17021-1.
| Get this standard | Prices exclude GST | |
|---|---|---|
| PDF ( Single user document) |
$179.13 NZD
|
|
| HardCopy |
$214.78 NZD
|
|
| Networkable PDF |
Price varies
|
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Principles
5 General requirements
5.1 Legal and contractual matters
5.2 Management of impartiality
5.2.1 General
5.2.2 SM5.2.2 Conflicts of interest
5.3 Liability and financing
6 Structural requirements
7 Resource requirements
7.1 Competence of personnel
7.1.1 General considerations
7.1.2 Determination of competence criteria
7.1.3 Evaluation processes
7.1.4 Other considerations
7.2 Personnel involved in certification activities
7.3 Use of individual external auditors and external technical experts
7.4 Personnel records
7.5 Outsourcing
8 Information requirements
8.1 Public information
8.2 Certification documents
8.2.1 General
8.2.2 SM8.2.2 Scope definition
8.3 Reference to certification and use of marks
8.4 Confidentiality
8.4.1 General
8.4.2 SM8.4.2 Access to the client’s documents, including records
8.5 Information exchange between a certification body and its clients
9 Process requirements
9.1 Pre-certification activities
9.1.1 Application
9.1.2 Application review
9.1.3 Audit programme
9.1.4 Determining audit time
9.1.5 Multi-site sampling
9.1.6 Multiple management systems standards
9.2 Planning audits
9.2.1 Determining audit objectives, scope and criteria
9.2.2 Audit team selection and assignments
9.2.3 Audit plan
9.3 Initial certification
9.3.1 General
9.3.2 SM9.3.2 Identification of other parties
9.3.3 SM9.3.3 Integration of ITAMS documentation with that for other management systems
9.4 Conducting audits
9.4.1 General
9.4.2 Conducting the opening meeting
9.4.3 Communication during the audit
9.4.4 Obtaining and verifying information
9.4.5 Identifying and recording audit findings
9.4.6 Preparing audit conclusions
9.4.7 Conducting the closing meeting
9.4.8 Audit report
9.4.9 Cause analysis of nonconformities
9.4.10 Effectiveness of corrections and corrective actions
9.5 Certification decision
9.6 Maintaining certification
9.7 Appeals
9.8 Complaints
9.9 Client records
10 Management system requirements for certification bodies
Annex A Knowledge and skills for ITAMS auditing and certification
Bibliography
Keep me up-to-date
Sign up to receive updates when there are changes to this standard
Related Information
Similar Standards
-
AS/NZS 14756:2001
Information technology - Measurement and rating of performance of computer-based software systems
-
AS/NZS 15271:1999
Guide for AS/NZS ISO/IEC 12207 (Software life cycle processes)
-
AS/NZS 3842:1998
Guide 62: General requirements for bodies operating assessment and certification/registration of quality systems
-
AS/NZS 4417.1:2012
Regulatory compliance mark for electrical and electronic equipment - Part 1: Use of the mark
Foreword
Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Principles
5 General requirements
5.1 Legal and contractual matters
5.2 Management of impartiality
5.2.1 General
5.2.2 SM5.2.2 Conflicts of interest
5.3 Liability and financing
6 Structural requirements
7 Resource requirements
7.1 Competence of personnel
7.1.1 General considerations
7.1.2 Determination of competence criteria
7.1.3 Evaluation processes
7.1.4 Other considerations
7.2 Personnel involved in certification activities
7.3 Use of individual external auditors and external technical experts
7.4 Personnel records
7.5 Outsourcing
8 Information requirements
8.1 Public information
8.2 Certification documents
8.2.1 General
8.2.2 SM8.2.2 Scope definition
8.3 Reference to certification and use of marks
8.4 Confidentiality
8.4.1 General
8.4.2 SM8.4.2 Access to the client’s documents, including records
8.5 Information exchange between a certification body and its clients
9 Process requirements
9.1 Pre-certification activities
9.1.1 Application
9.1.2 Application review
9.1.3 Audit programme
9.1.4 Determining audit time
9.1.5 Multi-site sampling
9.1.6 Multiple management systems standards
9.2 Planning audits
9.2.1 Determining audit objectives, scope and criteria
9.2.2 Audit team selection and assignments
9.2.3 Audit plan
9.3 Initial certification
9.3.1 General
9.3.2 SM9.3.2 Identification of other parties
9.3.3 SM9.3.3 Integration of ITAMS documentation with that for other management systems
9.4 Conducting audits
9.4.1 General
9.4.2 Conducting the opening meeting
9.4.3 Communication during the audit
9.4.4 Obtaining and verifying information
9.4.5 Identifying and recording audit findings
9.4.6 Preparing audit conclusions
9.4.7 Conducting the closing meeting
9.4.8 Audit report
9.4.9 Cause analysis of nonconformities
9.4.10 Effectiveness of corrections and corrective actions
9.5 Certification decision
9.6 Maintaining certification
9.7 Appeals
9.8 Complaints
9.9 Client records
10 Management system requirements for certification bodies
Annex A Knowledge and skills for ITAMS auditing and certification
Bibliography