NEN 7510 audit in practice: example of an audit day
In practice, a NEN 7510 audit is a series of conversations, walk-throughs and sample checks. At each step, the auditor asks you to show evidence. The general audit process is described on the page the NEN 7510 audit process. This page shows what such a day looks like in concrete terms. It uses a fictional example of a GP practice with two locations and one supplier of the electronic patient record (EPD, elektronisch patiëntendossier). See also the checklist to help you prepare.
The example is a working method. Each certification body uses its own audit plan, and the exact approach differs by organisation and by audit.
Preparation in the week before
The auditor usually sends an audit plan and a document request in advance. The example describes the day on site (phase 2). The document review (phase 1) has already been done by then. That request forms the basis of the day. In the example, the practice receives a list of fourteen documents, including the Verklaring van Toepasselijkheid (VvT, Statement of Applicability), the asset register, the risk analysis and the report of the latest internal audit.
Make a folder in advance with the documents in the order of the audit plan. That saves searching during the day, and it shows that the system is in order.
Agenda of the audit day
| Time | Item | What the auditor does | What the practice shows |
|---|---|---|---|
| 09:00 | Opening | Discusses purpose and scope | Scope and exclusions |
| 09:30 | Management | Conversation with the practice manager about policy and direction | Policy, decision log, budget |
| 10:30 | Risks | Sample check of the risk analysis | Risk register with owners |
| 11:30 | Access | Checks the authorisation matrix and a recent departure | Access revoked, logs |
| 13:00 | Technology | Walk-through and check of settings on the laptops | Encryption, updates, screen lock |
| 14:00 | Staff | Conversation with two employees in different roles | Knowledge of policy and incident process |
| 15:00 | Suppliers | Checks the processing agreement and an annual check | Contract, supplier audit report |
| 15:45 | Closing | First findings, verbally | Room for explanation |
An example of a sample check
The auditor picks an employee who recently left and asks you to show three things:
- Which access did the employee have in the EPD?
- When was that access revoked, and by whom?
- Are there log entries from after the departure that show there was no longer any access?
If the practice can pull the answer from the process and show the logs, this is a conformity. If the access was still active for a week, that becomes a finding. Note: the auditor usually also asks about the process itself, not only about one case.
An auditor rarely tests whether everything is perfect. They want to see whether the process works and whether you know what to do when something goes wrong. An honest explanation of a weak spot helps more than a document that looks perfect but does not match practice.
Example of findings
After the day, the auditor gives the findings verbally, and later in writing. In the example there are three.
| Finding | Type | Reason | Action by the practice |
|---|---|---|---|
| Access for a former trainee was still active for fourteen days | Minor nonconformity | Process for end of employment not documented | Procedure updated, link with the HR system |
| Asset register does not include the exercise app | Minor nonconformity | New service not added to the register | Line added, owner appointed |
| No documented test of the backup at location B | Minor nonconformity | Measure chosen in the VvT, evidence missing | Test report written and stored |
The difference between minor and major matters. A major nonconformity blocks certification until it is resolved. A minor nonconformity is resolved within an agreed period, which under the audit process is often 90 days.
Common mistakes on the day
- Documents that do not match practice. The policy says there is a monthly check, but the log is empty.
- Staff who do not know the policy. This is a common issue. Practise with staff what they would say if the auditor asks about the incident process.
- Trying to defend too much. Acknowledging that something is not working well, and showing what you are doing about it, is better than an explanation that makes the problem bigger.
- The owner is not there. If the person responsible for an area is absent, nobody can answer the auditor’s question. Appoint a substitute.
How do you practise yourself?
An internal mock audit on a morning, with a colleague playing the auditor, is one of the most effective ways to prepare. Use the checklist as a question list, and note for each question where the evidence is. Ideally, plan the mock audit two months or more before the real audit, so there is time to fix findings. The internal audit page explains how to approach this.
What this means for planning
The external audit is usually the last step in a longer process. Anyone who sees the day as a moment of truth often plans too late. According to the indication on costs and timeline, the process takes 3 to 6 months for a small practice. For the role of the certification body, see independent assessment or certification.
Additional points to note
- The agenda, names and findings in this example are fictional.
- The audit method and the classification of nonconformities follow the audit plan of the certification body. Always confirm this before you prepare.
- For the background to the standard and the clauses that are tested, see the requirements of NEN 7510.