The HKZ audit process
The external HKZ audit is carried out by an accredited certification body in two phases: first a document review, then a practical check. Annual surveillance audits follow. The HKZ certificate is valid for 3 years. This follows the same structure as ISO 9001. The standards are managed by NEN .
On this page you can read how the audit runs, what an auditor looks for, how deviations are handled and how to prepare well. The step-by-step plan describes how the audit fits into the wider process.
Prepare conversations with employees using the HKZ audit questions and evidence checklist. This links each practice question to a specific file or improvement action.
How does the HKZ audit run?
The certification audit has two phases.
Phase 1: document review. The auditor reviews your documentation: are the processes described, are the right records in place, and is the system set up? This can be done remotely or on site. The outcome is a picture of what is ready and what is still missing.
Phase 2: practical check. The auditor visits your location(s) and checks whether the system works in practice. Not only on paper, but in reality.
Sometimes a few weeks pass between phase 1 and phase 2. Use that time to deal with any findings from phase 1.
What does the auditor do?
The auditor collects evidence. That goes further than reading documents.
- Holding conversations. With employees, managers and sometimes clients. Does everyone know how the incident reporting system works?
- Reviewing records. Are client records up to date and complete? Does what is written match practice?
- Checking training records. Are the BIG registrations (the Dutch register of individual healthcare professionals) up to date? Is there evidence of recent training?
- Doing a walk-through. What does the location look like? Are the hygiene and safety measures in order?
- Reviewing incident reports. Are incidents reported and followed up?
Practical example: mental health care (GGZ). An auditor at an outpatient mental health care provider takes a sample of the treatment records of five clients. She checks whether the treatment plans are up to date, whether the evaluations have been done, and whether a safety plan was drawn up and followed in case of a suicidal crisis. She then speaks to a treating clinician and asks how they handle a new referral.
Deviations (non-conformities)
If the auditor finds something that is not right, they record a deviation. There are two types.
| Type | What does it mean? | Consequence |
|---|---|---|
| Major non-conformity | A requirement is seriously or structurally not met | The certificate is not issued until this is resolved |
| Minor non-conformity | A smaller shortcoming; the system works, but this point can be improved | The certificate is sometimes issued if a fix is shown in the short term |
After the audit you receive an audit report. It lists all findings. You are given a deadline to resolve the deviations and submit evidence of the fix. Only then is the certificate issued.
A major non-conformity does not mean the end of the process. Resolving it takes time, but most organisations still complete it successfully. Take findings seriously and deal with them systematically.
The 3-year audit cycle
The cycle starts once you have obtained the certificate.
| Moment | What happens? |
|---|---|
| Year 0 | Certification audit (phase 1 + phase 2); certificate issued |
| Year 1 | Annual surveillance audit; sample check that the system works |
| Year 2 | Annual surveillance audit; sample check that the system works |
| Year 3 | Recertification; the full audit process is repeated |
During the surveillance audits, the auditor takes a sample. They check whether the system has been kept running, whether improvement actions have been taken up, and whether the management review has been carried out.
Preparing for the audit
Good preparation saves stress and findings.
The most effective preparation is an internal audit. You go through the requirements of the standard yourself, look deliberately for gaps, and close them before the external auditor arrives. This also works as a practice run: employees then know what to expect.
Alongside the internal audit is a management review: a structured look back by management at how the system is performing. For the HKZ version with an agenda and a sample report, see management review at HKZ.
Are you choosing HKZ Small Organisations? Ask your certification body whether an internal audit is required.
Practical tips for audit day:
- Make sure the right employees are available for conversations.
- Keep records and registrations in order and accessible.
- Prepare your team: explaining the purpose of the audit reduces tension.
- Be honest about what is not yet perfect; the auditor values openness.