ISO 55001 audit: how does it work?

An ISO 55001 audit runs in three steps. You start with an internal audit that you organise yourself. After that comes the external audit by an accredited certification body, in two stages. Once you are certified, annual surveillance audits follow.

The external audit checks whether your system meets ISO 55001 . An independent body such as Kiwa , which carries out ISO 55001 audits in the Netherlands, does this. Your system needs to have been running for a while before that happens. For guidance, read the step-by-step plan to ISO 55001 and the costs and timeline.

An audit does not check whether your assets are in good order. It checks whether your system works: whether your policy, register, risks and decisions demonstrably fit together.

Internal audit in advance

An internal audit is a check that your own organisation carries out before the external body arrives. It must cover all the requirements of the standard. The audit itself takes a few weeks, plus the time needed to resolve findings.

The auditor must be independent of the team that set up the system. Otherwise the audit becomes a formality. An example from a fictional drinking water company: the internal auditor asks the planner for the latest decision on replacing pump 3. The planner cannot find the decision, so it is recorded as a finding. The company resolves this before the external audit starts.

Stage 1: document review

Stage 1 is the first external audit. The auditor reviews your documents. Think of the policy, the scope, the SAMP (strategic asset management plan), the asset register and the risk assessment. The minutes of the management review and the internal audit are also part of it.

Ask the certification body how long stage 1 takes and what it costs. The aim is to establish whether you are ready for stage 2. It is not an approval of your system. You receive a report listing the points that still need attention before the on-site audit can begin.

Stage 2: on-site practical audit

Stage 2 is the practical audit. Here the auditor checks whether what is written on paper also happens in practice. They walk through the locations, interview employees and check records. Ask the certification body how long stage 2 takes and what it costs.

For example: the auditor asks the operator of a pumping station how he knows the inspection was carried out on time. The operator shows the inspection report, and the auditor checks whether the report can be found in the register. If it cannot, that is a finding.

After stage 2 comes the certification decision.

Check the accreditation of the certification body in advance. It must cover ISO 55001 specifically. Otherwise you will not receive a valid certificate at the end of the process.

What the auditor checks

The auditor goes through the chapters of the standard one by one. ISO 55001 follows the High Level Structure, so chapter 4 always covers context and chapter 10 always covers improvement. The table shows what the auditor looks at in each chapter.

Chapter	What the auditor looks at
4. Context	Which internal and external factors affect your assets, and which interested parties you have. Since 2024 this also includes climate change
5. Leadership	Whether top management has adopted an asset management policy and who is responsible
6. Planning	Whether risks have been assessed, objectives are measurable and changes to the system are planned
7. Support	Whether there is enough competence, data and resources, and whether the asset register is accurate
8. Operation	How you manage outsourced work and changes to assets
9. Performance evaluation	Whether you track key figures and whether the internal audit and management review have been carried out
10. Improvement	Whether you resolve nonconformities and improve the system

Typical findings

A finding is a point where your system does not comply or does not yet convince. The most common ones concern the register, the objectives and competence.

The register has no owners. Assets without a name do not get maintenance or a risk assessment.
Objectives are not measurable. “More reliable network” is not an objective. “No more than four outages per year per district” is.
Competence is not recorded. There is no overview of who has had which training for the assets they manage.

What happens after a nonconformity?

There are roughly two types of nonconformity. A minor nonconformity can be resolved after the certificate has been issued. A major nonconformity must be resolved first, and it may mean an additional audit.

Type	Consequence
Conformity	No action needed, the auditor notes that it complies
Minor nonconformity	You resolve it within an agreed period. This can be after certification
Major nonconformity	You resolve it before the certificate is issued. This may mean a re-audit, with additional costs

A re-assessment may incur additional costs. Ask the certification body in advance how it handles nonconformities.

Surveillance and recertification

An ISO 55001 certificate is valid for three years. Every year the certification body returns for a surveillance audit. This checks whether the system still works and whether the findings have been resolved. Ask the body what a surveillance audit costs per year.

After three years comes recertification. Ask the body what that costs. Start on time, because an expired certificate has to be applied for again.

Frequently asked questions about the ISO 55001 audit

Do I choose the auditor?

You choose the certification body, not the individual auditor. The body assigns the auditors based on their experience. Ask the body for auditors with experience in your sector.

Does everything have to be ready for stage 1?

Yes, the documents must be complete. The system must also have been running for a while. Ask the body how long. Without evidence that the system works, the auditor has nothing to assess.

What if I get a major nonconformity at stage 2?

You then get time to resolve it, and the certificate is only issued once it has been resolved. Make a plan with an owner and a date. Then schedule a re-assessment, and allow for additional costs.