INTERNAL AND EXTERNAL AUDITS

GENERAL

Application

This procedure is applicable to all Marine & Offshore (M&O) Product Line activities' responsible persons in the network and to the activities’ responsible Head Office (HO) Departments, to QHSSE and to the M&O Internal Auditors.

For Vertical Contract Audits (VCA) refer to M&O procedure the vertical contract audits procedure.

References

Applicable to all M&O activities

As per Recognised Organisation (RO) Group Quality requirement the minimum referential to be implemented and the requirements of which are detailed in this procedure and applicable to all M&O Product Line activities is:

• ISO 9001:2015 standard.

References applicable to Class and Statutory activities only

The following additional references are applicable to Classification and Statutory Certification services:

• IMO MSC.349(92) and MEPC 237(65), as amended- RO Code;

• REGULATION (EC) No 391/2009 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 April 2009 on common rules and standards for ship inspection and survey organizations;

• IACS Procedures Volume 3: Quality System Certification Scheme (QSCS);

• IACS Quality Management System Requirements (QMSR);

Additional references applicable to other certification/accreditation

For other services performed by M&O Product Line refer to the specific certification or accreditation requirements which should be detailed in the relevant quality plan..

INTERNAL AUDIT

Audit scope applicable to all M&O activities

The M&O Product Line Internal Audits System aims to plan and implement the monitoring, measurement, analysis and improvement processes needed to demonstrate fulfilment to services requirements to ensure conformity and to continuously improve the effectiveness of the Quality Management System.

The Internal Audits system shall cover the fundamental processes of all services performed by the M&O Product Line and shall sample the activities with focus, extent, and boundary considered adequate to each activity.

HO Departments are as well submitted to internal audits covering the M&O Product Line activities.

Locations to be audited

For certified or accredited services, locations to be audited are those to be submitted to external audits as defined by the relevant certification / accreditation body from the data provided by M&O.

In principle these locations are those where key activities are managed: policy formulation, development of processes and procedures, contract review, planning of conformity assessment activities, evaluation and approval of results of conformity assessment activities, decision making on conformity assessment activities.

Also when planning the internal audits, consideration is given to the results of previous audits, flag State feedback, complaints (either related to the location or in general) and appeals including port State and flag State inspections, and to the operation of the locations.

Frequency of audits

When no specific frequency is required by an external requirements main locations should be audited as a minimum over a five year cycle as per Recognised Organisation (RO) Group requirement.

Additional requirements for Classification and Statutory activities

As per IACS QSCS requirements, Internal Audits shall sample the following activities:

• Plan approval;

• New construction survey;

• In-Service periodical survey;

• Type approval and survey of other materials and equipment;

• System audits and inspection (ISM/ISPS/MLC).

Internal VCAs are executed annually for each of the above processes, as identified in the vertical contract audits procedure.

• Internal VCA may be combined with Internal Audits

Locations to be audited

Locations to be audited are defined in IACS QMSR as:

• Controlling Offices (CO) which are those that manage and control the proper execution (and related documentation) of the processes and related procedures and work instructions, including quality management system matters;

• Survey Locations (SL) which are those that manage and execute surveys and audits;

• Plan Approval (PA) Centres which are those that carry out plan approval activities, including approval of designs, drawings, manuals etc.

For further definitions and list of locations of CO’s and SL’s within the M&O Product Line, refer to the documents attached to this procedure "Locations_Internal_Audits_CO_SL_PA_Sites.ppt" and “Main M&O Audit Locations.xlsx”.

Internal Audits may be a standalone office audit where the activities are managed as a CO / SL, or a combination of an office audit and an Expert Specialized audit (as detailed below in Section Expert Specialized audits) and/ or VCA(s), or a standalone Expert Specialized audit.

Office audits cover network offices having M&O operational activities from where these activities are managed as CO/ SL.

Expert Specialized internal audits of Marine Operational Centres (MOC), LPOs, Ships in Service, Systems Audits & Inspections, New Construction, Material and Equipment activities and VCAs are separately addressed in Sections Marine Operational Centres audits thorough Vertical Contract Audits (VCAs).

Performance and frequency of audits

Internal audits may be performed at various locations with a focus on the verification of the efficient and effective implementation of the relevant Recognised Organisation (RO) QMS at each individual location. Audits at locations may include, as considered practical and feasible, visits to selected sites which operate under the control of that location.

The internal audits interval shall ensure that each CO and SL is audited at least once per three years.

Expert Specialized audits

Expert Specialized internal audits in the scope of Class and Statutory activities may be performed alone or in addition to a general Office audit covering Recognised Organisation (RO) QMS requirements, to cover in further details the processes of classification and statutory services for the activities listed in Section Additional requirements for Classification and Statutory activities, depending on the extent and character of the activities being locally performed.

The need to perform Expert Specialized internal audits is evaluated, decided and proposed for inclusion in the M&O Internal Audits Annual Program by each responsible HO Department during the yearly program planning phase.

Marine Operational Centres audits

For further details on Marine Centres internal audits, refer to the related procedure - “Audits and Monitoring of Fleet Management Services”.

LPOs audits

For further details on LPOs internal audits, refer to the local plan approval office procedure - “Organization and Responsibilities of LPOs”.

Ships in Service, Systems Audits and Inspections, New Construction, Material and Equipment Internal Audits

Expert Specialized internal audits for Ships in Service, Systems Audits and Inspections, New Construction and Material and Equipment activities are to be performed by expert personnel on the audited activity, appointed by the responsible HO Department for the subject audit.

When an Expert Specialized internal audit is performed together with an Office audit, the Lead Auditor may also perform the expert specialized audit if he/ she has been appointed by the responsible HO Department as an expert on the subject activity being audited or, otherwise, the Lead Auditor may be assisted by an expert in such services, who doesn’t need to be a M&O Appointed Auditor as per Section M&O Internal Auditors of this procedure.

Vertical Contract Audits (VCAs)

Internal VCAs are programed by the responsible HO Departments according to procedure the vertical contract audits procedure and to the applicable provisions of this procedure. Planning, execution and reporting are also defined in the vertical contract audits procedure and in INTERNAL AUDIT PROCESS Internal Audit Process below - as applicable. Internal VCAs can be executed simultaneously with a Safety Walk Field and/or Site Inspection which are a means to record on safety performance of the surveyor and the site respectively. The execution and reporting of such is defined in the related health and safety procedure M&O HSSE Management System Procedure and “M&O Guidance for Safety Walks and Site Inspections” in ANNEXA2.

Additional requirements for Advisory Services activities

Advisory Services activities are audited as per requirements of certifications or accreditations granted to the performance of these activities. As per Recognised Organisation (RO) Group requirements these activities shall be certified against the ISO 9001:2015 scheme.

Locations to be audited

Based on the Advisory Services organization, entities to be audited are as follows:

- Recognised Organisation (RO) Solutions M&O legal entities,

- MatDan and TMC legal entities

Advisory Services organization shall map in a specific procedure the list of these entities and specificities, if any, regarding internal audits performance.

Performance and frequency of audits

Internal audits may be performed at various locations with focus on the verification of the efficient and effective implementation of the relevant Recognised Organisation (RO) QMS at each individual location. Audits at locations may include, as considered practical and feasible, visits to the selected sites which operate under the control of that location.

The internal audits interval shall ensure that each entity is audited locally the three year cycle.

Annual Internal Audits planning

Timetables are drawn up by each M&O activity responsible HO Department upon QHSSE Department request at the end of Q3 each year. Data is further consolidated and included by QHSSE Dept. in the M&O Internal Audits Annual Program, for the next year. Once the new audit program is set up into NEXUS and activated - all Lead Auditors assigned to these audits are notified by automatic message from tool. This program is regularly followed-up thereafter by the QHSSE Dept. and updated as found necessary. All timetables shall be submitted timely to QHSSE Dept. for review as well as any proposal of modification thereafter during the year. Further details are shown in the table below:

.

The M&O Internal Audits Annual Program takes into consideration, as deemed appropriate:

• relevant requirements of the concerned certification/ accreditation;

• complaints, when identified;

• results of previous internal and external audits;

• technical operation subjects related to a specific location based on the number and severity of previous findings;

• for the Class and Statutory newbuilding activity, the possibility of planning internal audits of LPOs considering the focus on a specific type of ship and thereafter planning newbuilding VCAs on the same type of ship for which the plan approval is carried out by the audited LPO, allowing cross analysis of both design review and NB surveys activities for a given type of ship.

Postponement or cancellation of a planned audit already included in the M&O Internal Audits Annual Program may be considered by QHSSE Department and shall be subject to its agreement based on adequate justification by the responsible HO Department.

Internal Audits process

For the Internal Audit detailed process, preparation, performance, reporting, corrective/ preventive actions, refer to INTERNAL AUDIT PROCESS

Escalation process

A follow-up of the M&O Internal Audits Annual Program is continuously performed by QHSSE Department during the year. A synthesis is provided to the M&O Executive Committee on a monthly basis.

Further actions may be taken by QHSSE Department in case departures from the planned program are identified.

In case the Internal Audit process, as described in INTERNAL AUDIT PROCESS to this procedure, is not fully complied with in due time as planned for any specific audit, the following actions may be taken by QHSSE Dept., depending on the type of deficiency identified as follows:

1. Audit already carried out and audit status in NEXUS remains “Scheduled”:

   • During monthly NEXUS monitoring QHSE sends a reminder to the auditor to highlighting the audit status in NEXUS should be "Performed" and audit report is missing in the system

   • A second reminder is sent by QHSSE Dept. to the auditor and to the auditees with copy to the Country Manager, and to the concerned activity responsible H.O. Department.

2. Audit carried out with status in NEXUS “Performed” and the actions to be proposed by the auditees addressing the findings are still missing:

   • During monthly NEXUS monitoring QHSSE Dept. sends a reminder to the auditees and to the auditor requesting to complete the proposals of the relevant corrective/ preventive actions;

   • A second reminder is sent by QHSSE Dept. to the auditees and to the auditor with copy to the Country Manager, and to the concerned activity responsible HO Department.

3. Audit carried out with status in NEXUS “Performed” and the actions proposed by the auditees are overdue or not yet accepted by the auditor and/ or not yet implemented:

   • During monthly NEXUS monitoring QHSSE Dept. sends a reminder to the auditor and to the auditees requesting to complete/ implement the proposed actions and to close the audit cycle within the regular time-frame of 90 days;

   • A second reminder is sent by QHSSE Dept. to the auditees and to the auditor with copy to the Country Manager, and to the concerned activity responsible HO Department.

   In addition to the regular QHSSE Department monthly monitoring in NEXUS Database - the automatic notifications are sent between auditors and auditees when the following actions are done in the system:

   - Findings assigned (Notified the user who has been assigned to the finding. It will be a daily batch that will list all findings assigned to the user the day before).

   - Actions assigned (Notified HSE Manager or Manager when corrective actions are assigned to them. It will be a daily batch that will list all findings created the day before).

   - All actions closed (Daily email sent at 2am CET. For all audits in status = Performed, check if all actions have been closed. If all actions closed then an email will be sent to the Lead Auditor to inform him that the audit can be closed).

   - Audit closed (Daily batch that run everyday at 2am CET. Send an email to all users who an Effectiveness is assigned in order to inform them that they have to perform an effectiveness check).

M&O Internal Auditors

Appointment and Responsibilities in Appointing Auditors

M&O Internal Auditors are appointed by the different HO Departments responsible for each activity subject to the analysis and agreement of QHSSE Department., the criterion being based on recognized competencies.

A list of the agreed M&O Internal Auditors is kept available and updated by QHSSE Department. This list is part of the yearly M&O management review report.

HO Departments heads are responsible to allocate the necessary availability and time for the staff they appoint as internal auditors having in mind that the corresponding duration for performing an audit is six man days (preparation, performance, reporting, follow-up without inclusion of travel time).

Training

M&O Internal Auditors (experienced & newly nominated) shall attend a refresher training organized by QHSSE Department in Q1 each year, to ensure knowledge update, objectivity and impartiality in the audit process.

Criteria to assign an auditor

It is the responsibility of each activity responsible HO Department to assign in due time a Lead Auditor from the list of agreed M&O Internal Auditors to each audit of the M&O Internal Audits Annual Program.

The HO Department's directors contact QHSSE Department with information about new internal auditor's proposal. Only QHSSE Department has a right to validate new nominated internal auditor and assign him/her "auditor's rights" in the system.

The general criteria for assigning a Lead Internal Auditor to a specific audit include, but may not be limited to:

• Independent from the Management of the Unit being audited;

• If assigned to perform an Expert Specialized Internal audit as defined in Section Expert Specialized audits, appointed by the relevant HO Department as an expert on the activity being audited;

• Being in the QHSSE Department list of agreed M&O Internal Auditors and having attended the last Internal Auditors refresher training session. All M&O Internal Auditors (experienced & newly nominated) shall attend refresher training organized by QHSSE Department in Q1 each year, to ensure knowledge update, objectivity and impartiality in the audit process.

• ISO 9001 certificate (eventually ISM, or other relevant ISO standards training)

• In case when ISO certificate missing - the minimum 5 year’s experience in the specialization area to be justified

• evidence of the practical training (audit types and audit numbers) - participation as an “observer” with other qualified experienced auditor

EXTERNAL AUDIT

Scope

External audits/ inspections are initiated by:

• Certification Bodies acting in the scope of ISO 9001;

• Accredited Certification Body like BSI acting in the scope of IACS QSCS requirements, according to an annual audit planning agreed between BSI and QHSSE Department by the end of each year, for the audits planned for the next year;

• IQARB (acting in the scope of the Tri-Partite Agreement and QIQS - QACE Interpretation of International Quality Standards), according to the annual list of BSI audits, which will be attended by an IQARB Assessor during the year as per TPA Section 3.1;

• Official bodies, such as EMSA in the scope of REGULATION (EC) No 391/2009;

• Flag Administrations in the scope of IMO MSC.349(92) - RO Code;

• Accreditation bodies in the scope of specific accreditations granted to Recognised Organisation (RO) M&O

• Clients (mainly in offshore activities).

In addition, such external audits may, on request, be attended by Observers, such as:

• IACS observers to BSI audits, in the scope of IACS QSCS;

• Flag Administration representatives;

• European Commission representatives.

Organization of External Audits

Responsibilities

For audits requested by BSI, IQARB, EMSA and other official bodies, QHSSE Department organizes, coordinates and follows-up these audits, being the sole interlocutor with the external auditors/ inspectors before and after the audits/ inspections are performed.

For audits requested by Flag Administrations, the organization of the audit is the responsibility of the local Country Manager, who shall inform in advance QHSSE Department, immediately after any such request is received for an audit of a local office or a ship in his/ her region. The outcome of the audit (summary of findings, audit report, etc.) shall then be transmitted to QHSSE Department immediately after the audit is completed.

The follow-up of all external audits/ inspections after their completion is performed by QHSSE Dept., in close liaison with the audited Unit managers and the concerned HO Departments managers, who shall provide to QHSSE Dept all necessary information to establish an action plan addressing the findings and all evidences thereafter for each proposed action, showing that they have been adequately performed and completed in due time, allowing closing of the audit cycle.

Expenses

Local travel, subsistence expenses at cost, accommodation and other sundry expenses necessarily and reasonably incurred by BSI Auditors and IACS Observers during the audit are borne by each Unit being audited, which may later on send an internal invoice to QHSSE Department.

BSI Auditors and IACS Observers international travel is covered by QHSSE Department.

Expenses incurred by representatives of HO Departments participating to these audits are covered by each responsible HO Department.

For the expenses of EMSA Inspectors, IQARB Assessors and other external bodies' representatives (such as the European Commission), all expenses incurred during these audits are borne by each participant to the concerned audit/ inspection themselves.

For the expenses of Flag Administrations, the rule is the same as above, all expenses are normally borne by the Administration itself. QHSSE Department and C&R_STAT are the focal contact points in that respect.

If the support of a HO Department is requested by an audited Unit prior to an external audit/ inspection, the related expenses for travel, accommodation of HO personnel and local expenses are supported by the audited Unit.

External Audits process

For further details, refer to EXTERNAL AUDIT PROCESS

Appendix — TERMINOLOGY

The following terms are used throughout this procedure and are defined hereunder:

ACB (Accredited Certification Body)

Organization accredited to comply with ISO/IEC 17021 standard by an accreditation body who is signatory to the International Accreditation Forum (IAF) Multinational Recognition Agreement (MLA). IACS QSCS provides for audits and assessment of compliance with the QSCS to be carried out by independent external ACBs.

BSI (British Standards Institution)

The national standards body of the United Kingdom. BSI produces technical standards on a wide range of products and services, and also supplies certification and standards-related services to businesses. BSI is the ACB chosen by Recognised Organisation (RO) for all audits of the Marine and Offshore Division either for Classification and Statutory Certification services or non-Class services.

CO (Controlling Offices)

Those offices that manage and control the proper execution (and related documentation) of the processes and related procedures and work instructions, including quality management system matters.

Root cause analysis (RCA)

Root Cause Analysis is a structured problem-solving method used to find the fundamental, underlying reason for a non-conformance or defect so the organization can fix it permanently rather than treating just the surface symptoms.The execution of RCA is not mandatory in case of OFIs. It should be advised by the internal auditor if this activity is expected to be recorded in Nexus.

Corrective actions (CA)

Improvements to the organization's processes taken to eliminate causes of non-conformities or other undesirable situations. It focuses on the systematic investigation of the root causes of identified problems or identified risks in an attempt to eliminate the cause(s) of a non-conformity and to prevent their recurrence or to prevent occurrence. Corrective action is taken to prevent recurrence whereas preventive action is taken to prevent occurrence. Recognised Organisation (RO) recognizes that RO Code still references "preventive actions" where in line with ISO 9001:2015 we address these in the umbrella of "corrective actions" to include the former "preventive actions".

Corrective actions are implemented in response to customer complaints, unacceptable levels of product non-conformance, issues identified during an internal audit, or adverse or unstable trends in product and process monitoring such as would be identified by statistical process control (SPC) or in response to the identification of potential sources of non-conformity. To ensure that corrective are effective, the systematic investigation of the root causes is pivotal.

IACS Focus Areas

Each year, the IACS Operation Center publishes a number of Focus Areas as part of the Continual Improvement of QSCS in accordance with IACS Procedures Volume 3, Section J3 to be addressed in each ACB audit plan for the year. Other stake holders also periodically raise concerns on issues at various forums, those applicable to the QSCS are taken into account when the focus areas are formulated by IACS.

Recognised Organisation (RO) Internal Audits in line with Classification 7 Statutory Activities take into consideration these. And these are acknowledged to M&O Network beginning of the year, also reminded to internal auditors during the Yearly Refresher Training.

QHSSE

Head Office QHSSE Department, a part of the Technical & Operations Excellence, responsible for ensuring compliance with the Group and M&O guidelines and procedures through internal audits and management reviews in terms of Quality, HSE and Ethics and maintaining the recognitions obtained from the various accreditation bodies (IACS, EU, flag administrations, others).

Major and Minor Non-conformity

A Major Non-conformity is a non-conformity where, in the judgement of the Lead auditor, the robustness of the M&O QMS might be compromised. Examples of such situations are as follows:

• evidence of gross non-conformity with class/statutory requirements which may lead to potential threat of danger for the safety of life at sea or damage to the environment;

• evidence of significant failings on the part of the surveyor/auditor/ Plan approval engineers and/or inadequate scope of survey /plan review or audit;

• repetitive cases of inadequate processes of the concerned office;

• substantial lack of commitment to quality or safety either particularly at the management level of the concerned office.

All other cases than those mentioned above should be considered as Minor Non-conformity.

Opportunity for Improvement (OFI)

A statement of fact made by the auditor which is based on objective evidence, but not a non-conformity. This could be because of a lack of clarity, or ambiguity, e.g. of the referenced internal procedure, or a related document. It could be a situation where a non-conformity may exist but insufficient evidence has been found to substantiate it. It could also be an indication that there is a potential for non-conformance in the future, or the potential for the degradation of service quality. It could also be an opportunity for improvement that the auditor observes that does not fit into the other items listed above.

Best practise

Methods or techniques proven to produce superior results. These aren't mandatory rules but are widely accepted, effective approaches that organizations adopt for efficiency, quality, or risk reduction, developed through experience, research to achieve optimal outcomes, with continuous improvement being key.

PA (Plan Approval) office

Those offices that carry out design review activities, including review of designs, drawings, manuals, etc.

Process audit (see ISO 9000)

Systematic, independent and documented process for obtaining audit evidence and determine to which extend a process meets criteria; where a process is a set of interrelated or interacting activities that use input to deliver an intended result; and where and audit criteria is a set of policies, procedures and requirements used as a reference.

Product audit (see ISO 9000)

Systematic, independent and documented process for obtaining audit evidence and determine to which extend a process meets criteria; where a product is the result of a process and where and audit criteria is a set of policies, procedures and requirements used as a reference.

IQARB, QIQS, SIA, Individual and Collective Recommendations

QACE was an independent Quality Assessment and Certification entity set up by the Recognised Organisations as per Article 11 of Regulation (EC) No 391/2009 of the European Parliament and of the Council of 23 April 2009.

In line with EU Regulation (EC) No. 391/2009 Article 11 2 (c), QACE publishes its Interpretation of International Quality Standards (QIQS). QIQS completed a trial and feedback year in 2020 before implementation on 1st January 2021.

Pursuant to Article 11 of that Regulation, Recognised Organisations authorised by EU Member States were required to establish and maintain an independent quality assessment and certification entity operating in accordance with applicable international quality standards, with provision for advisory participation by relevant maritime professional associations.The entity was incorporated under the English Companies Act 2006 as a private company limited by guarantee and operated on a not-for-profit basis. In 2025, QACE was formally merged and the organisation adopted the name International Quality Assessment Review Body (IQARB), reflecting its continued development and institutional evolution.

Each year, IQARB may issue Specific Interest Areas (SIA) as part of the continual improvement of ROs practices, to be addressed in each ACB audit plan for the year.

IQARB issues on a bi-annual basis its individual and collective recommendations which are recommendations for the improvement of the processes and the internal control mechanisms of the Recognised Organisations.

QESIS (Quality Environment & Safety Information System) tool

QESIS was the Recognised Organisation (RO) Group IT tool to manage internal audits until 2023.

NEXUS tool

NEXUS is the Recognised Organisation (RO) Group IT tool one functionality of which is to manage internal audits.

This tool is to be used for all internal audits since 2023 to create, plan and perform the audits, create and follow-up findings and their associated corrective actions, verify the action’s implementation and effectiveness. NEXUS aims to help the network to manage internal audits with better quality and higher productivity within a common framework and for the benefit of both auditors and auditees.

RO (Recognized Organization)

An organization which meets the relevant conditions set forth by IMO Resolution A.739(18), as amended by Resolution MSC.208(81), and Resolution A.789(19), and has been authorized by the Flag State Administration to provide the necessary statutory services and certification to ships entitled to fly its Flag. In practice these Recognized Organizations are often the Classification Societies. IMO has adopted a mandatory Code for Recognized Organizations (MSC.349(92) - RO Code), which provides Flag States with standards mechanisms for the oversight, assessment and authorization of ROs and clarifies the responsibilities of such organizations.

Site

A place at which a surveyor conducts the survey in respect of a specific contract or a series of contracts (e.g. port, shipyard, firm, company, etc.). All sites are to be controlled by a survey location (SL).

SL (Survey Location)

Those offices that manage and execute surveys and audits.

VCA (Vertical Contract Audit)

A combination of “process audit” and “product audit” with the main purpose of assessing the effectiveness of the service delivery process in ensuring product quality. It is also a contract/order specific audit of production processes, including witnessing work during attendance at a survey, audit or plan approval in progress and, as applicable, including relevant sub-processes. A VCA is carried out at a location and/or site to verify the correct application of relevant requirements in service realization for the specific work in that contract/order, and their interactions. (Relevant sub-processes include e.g. previous part surveys or thickness measurement processes connected to the survey). Plan Approval VCA may be carried out for completed tasks.

Internal VCAs can be executed simultaneously with a Safety Walk Field and/or Site Inspection which are a means to record on safety performance of the surveyor and the site respectively. The execution and reporting of such is defined in the related health and safety procedure M&O HSSE Management System Procedure and “M&O Guidance for Safety Walks and Site Inspections” in its ANNEX A2.

Appendix — INTERNAL AUDIT PROCESS

Audit preparation

Upon assignment to an internal audit and in order to allow proper preparation, the M&O Lead Internal Auditor shall gather, as a minimum, the following information:

• updated organization chart of the audited Unit, clearly showing the lines of responsibility;

• last Management System Review (MSR) covering the audited Unit;

• results of the last internal and external audits;

• local instructions, if any.

For collecting the above information, the Lead Internal Auditor may contact the local Country Manager and/ or the other local managers who might be involved in the audit process. Additional relevant information may also be found available in M&O Quality SharePoint.

Before starting entering information in NEXUS for his/ her assigned audit, the Lead Internal Auditor shall confirm with the management of the Unit being audited, at least the following main points:

• travel, health and security information related to the place (city and country) being visited according to the requirements set in procedure;

• suitability of the audit dates/ time and any other issue which may imply in possible changes to the audit schedule (local holidays, summer vacation period, local working hours, etc.);

• availability of the local responsible personnel as per the proposed audit agenda;

• details of travel arrangements.

Entering information into NEXUS in preparation for the audit

As soon as the annual Internal Audits programme is communicated within M&O Product Line it is set in NEXUS by QHSSE Department.

Later on each Lead Internal Auditor shall perform the actions in NEXUS thanks to the detailed information on the use of NEXUS which can be found in the guidelines attached to this procedure “NEXUS_User_Guide.ppt”.

Postponement or cancellation of an audit

In case a situation of Force Majeure affecting the performance of the intended internal audit as scheduled is encountered, e.g. mainly for health and security reason (see examples of situation in procedure), the concerned HO Department manager and/or the assigned Lead Auditor have the overriding authority either to postpone the audit, to perform the audit in remote mode (see section A 2.4) or to cancel it. Postponement or cancellation of the audits is prior to QHSSE Department agreement and decision. Deletion or audit cancellation from the program must be justified in written and attached to the NEXUS as evidence, the right to update audit program in database is assigned only to M&O Admin in QHSSE Department.

Note: By definition, an event of Force Majeure is an event or circumstance which is beyond the control and without the fault or negligence of the party affected and which by the exercise of reasonable diligence the party affected was unable to prevent.

Performance of an audit in remote mode

Due to various circumstances (security, pandemic time, travel restrictions, availability of auditors, etc.) it is allowed to conduct internal audits in the remote form.

A remote audit is an audit where the auditor and the auditees are not in the same location. For such audit electronic means shall be used to remotely obtain and collect audit evidence to determine the extent of conformity to the audit criteria. The methods used to converse from a remote location should include together telephone, video-conferencing, e-mailing or online chat rooms between auditor(s) and auditees.

Not more than 30% of the yearly internal audit program may be carried out through remote audits, except in case of exceptional circumstances the decision of which is taken by QHSSE department.

Eligibility of remote audit execution according to IACS Volume 3 are; CO, PA, SL and VCA for ISM DOC and Equipment Material, any other scope is not eligible for remote internal audit execution.

In case it is decided to perform the audit in remote mode, all items A2.5, except visit to selected sites, through A2.12 remain applicable.

The complete procedure for remote audits and its two appendices (Appendix 1 - Remote audits “Risk and opportunities assessment” and Appendix 2 - “Remote audits Guideline for internal auditors”) are available in attached files.

First audits of new offices, new services and new processes should not be audited in a remote way.

Performance of the audit

Typical sequence of an office audit comprises:

• opening meeting with all participants to provide further clarifications on the audit scope and criteria;

• interviews with the participants;

• examination of previous audit reports, evidences of the actions performed and effectiveness of the results at random;

• examination of the organization’s approach to the determination of risks and opportunities as detailed in section A2.6;

• examination of selected sample files including jobs performed by sites under the control of the audited survey location; the jobs should be identified as such in the audit report

• visit to a selected site when applicable, as feasible and practical, which operates under the control of the audited location;

• closing meeting.

During the closing meeting the reporting of the audit is recommended to be started, as feasible and practical, during the time of the audit, in such a way that a draft report may be ready at site by the end of the audit and may be submitted to the participants to the audit for agreement, allowing easy understanding of the findings and further proposals of adequate commensurate actions to address them.

Examination of the approach to the determination of risks and opportunities

The audit of this approach should not be performed as a stand-alone activity. It should be implicit during the entire audit of an office, including when interviewing managers. The auditor should act in accordance with the following steps and collect evidences as follows:

• inputs used by the office for determining its risks and opportunities, which may include analysis of external and internal issues, the strategic direction of the office, the interested parties, the potential source of risks;

• the method by which risks and opportunities are evaluated;

• outputs of this approach which should be summarized as a SWOT matrix;

• the treatment of risk and opportunities through action plans set then in coherence with part or all of the SWOT matrix and which should also show how the level of risks the office wishes to accept and it is controlled.

Entering information into NEXUS on the performance of the audit

When the auditor starts the audit process, the audit status in NEXUS is to be changed to “scheduled”, allowing the interested parties to follow-up the audit during its performance. At this point, the auditor may start entering the following information into NEXUS:

• filling in the NEXUS checklist;

• recording the findings as soon as they are confirmed, even if they still need additional information to be completed, which may be left for a later time (take separate notes of all details of facts and references to relevant rules or procedures needed to complete the finding later on);

• initiating the corrective actions relevant to each finding from the checklist as detailed in the “NEXUS_User_Guide.ppt”;

• clear references are to be made to identify & trace the samples taken as applicable (Recognised Organisation (RO) No., Job No., Certificate No., dates, audit numbers checked, name of participants, locations covered during the audit, etc.);

• good practices and potential opportunities to improvements (OFI) are also to be recorded when identified.

Audit reporting

Upon completion of the audit, the audit status is to be changed in NEXUS to “Performed” by filling up the checklist inside the system. Auditor shall provide the full audit report in NEXUS within maximum 15 working days since audit closing meeting (end date of the audit).

The final Internal Audit Report is composed of the following parts in NEXUS:

- the summary of the audit including the conclusions;

- audit plan shall be attached to the audit report with clear identification of all participants (local Managers) and surveys locations audited

- the relevant filled checklist;

- the corrective actions relevant to the findings, if any.

The audit report may be generated from NEXUS in pdf format.

The audit is available to auditor and auditee and shall be distributed also by email to all concerned person.

In case of SL where multiple locations are managed - one audit report may be sufficient however in the audit scope / conclusion it must be clearly mentioned, and samples checked during the audit must covered all these locations. Also all participants (Managers) audited from different locations must be clearly mentioned in NEXUS.

Distribution of reports

When entering information for the preparation of the audit in NEXUS as per item Entering information into NEXUS in preparation for the audit above, the Lead Internal Auditor shall sent his report via email to following concerned persons:

• the Local Managers of the audited activities;

• the Country Manager (s), the Area Director, Regional SVP, for distribution within the Unit and region;

• the HO Department Managers of the audited activities;

Detected anomalies

For the detected anomalies, also called “findings”, upon completion of the audit, the Auditor shall agree with the auditees a maximum period of 3 months from the last day of the audit for the completion of the actions addressing the findings.

The period may be extended by QHSSE Department on case by case basis in NEXUS Database on the request of the Lead Auditor and providing that the reason of such request is justified (such as time needed for software development, review of procedures, or Recognised Organisation (RO) rules modifications, etc.).

Each proposed action addressing an anomaly is to be completed within the time frame agreed between the auditor and the auditee and defined in NEXUS.

Audit conclusion

In addition to the findings raised during the audit, the audit report shall also comprise a general assessment of the audited unit, summarizing the strong points identified as well as the points to be improved and additionally any observation likely to encourage the audited Unit to implement further improvements.

Major and Minor Non-conformities, Opportunities for Improvement and related actions

The detection of a non-conformity (NC), major or minor, or an opportunity for improvement (OFI) may result in some or all of the following complementary types of actions:

• correction of the anomaly (e.g. re-issuance of a wrong document), to remedy the effects of the anomaly in a simple, local and immediate way;

• corrective actions to prevention recurrence of that type of anomaly to be programed in an accepted manner and traceability followed up (such as modification of instructions, training, etc.);

• preventive action, if such a programmed action is suggested by the identification of potential sources of non-conformity.

The manager of the activity where the anomaly was identified shall then ensure that:

• he/ she understands the anomaly and is able to define, in consultation with the auditor, appropriate commensurate actions;

• he/ she designates himself or another person responsible for implementing the proposed actions;

• he / she enters in NEXUS the agreed actions to be implemented;

• he/ she remains in charge of completing the actions in NEXUS, providing the necessary evidences of completion (through attached documents), allowing the timely closing of the finding by the auditor.

The action plan addressing each finding is built, and looks as such in NEXUS, with corrective actions and preventive actions.

Follow-up of actions

Checking that the actions taken are sufficiently documented and the evidences are relevant before closing the finding is the responsibility of the Auditor.

Verification that the actions were effective may be performed during the next internal audit of that Unit or by sampling some of the findings to verify if they are repeated. This may also be done as a sampling process by the end of the year for the most relevant findings.

Checking that deadlines are complied with is the responsibility of the issuer and of the person in charge of implementation of the actions. QHSSE Department is continuously performing a follow-up of the internal audits program throughout the year (on monthly basis). Automatic reminders are sent to the persons responsible for performing the actions and a conference call may be scheduled with the auditor and the auditees approx. one month after the audit to identify departures from the original program timeframe and also any other difficulty faced by the auditor and the auditees to complete their tasks.

If, during the period agreed between the auditor and auditees for the performance of the actions, the responsible person identifies that the actions will not be completed within the agreed and fixed time-frame, the responsible person shall contact immediately the auditor, providing sound justification for such delay and agreeing on a new time-frame with the auditor and prior to QHSSE Department agreement for completion. The relevant appropriate recording in NEXUS is then mandatory; therefore the Lead auditor shall contact the NEXUS M&O administrator who is the person allowed to postpone the relevant due date with the appropriate comments.

Preventive actions may have also been performed in order to eliminate causes of potential anomalies, which may be verified by using the following relevant sources of information:

• anomaly reports;

• feedback from monitoring quality of services;

• review of corrective actions, client complaints, internal and external audit reports;

• quality system review results.

Analysis of these sources of information aims to identify trends or risk areas that might have lead to possible anomalies. The results of such analysis are used to determine appropriate preventive actions, which are defined, planned and performed. Effectiveness of such actions may be evaluated during the annual quality system review.

Appendix — EXTERNAL AUDIT PROCESS

BSI Audits

Further detailed information can be found in the guidelines attached to this procedure “Guidance on BSI Audits.pdf”.

EMSA Inspections

EMSA inspections are carried out by EMSA assessors on behalf the European Commission (EC) against requirements of Regulation n°391/2009 of the European Parliament and of the Council dated 23 April 2009 on common rules and standards for ship inspection and survey organizations (see document attached “Regulation (EC) No. 391/2009.pdf”).

EMSA inspections are relative to Recognised Organisation (RO) responsibilities as Recognized Organization (RO) vis-à-vis inspection, survey and certification of ships falling within the scope of the international conventions. EMSA inspection may include a visit to ongoing newbuilding project(s) in a nearby shipyard.

The relevant process as described here below, as well as the relationship with the Lead assessor, are managed by HO QHSSE department whatever the audited entity, HO or network location, is.

Upstream of the inspection (some weeks before) HO is informed by EMSA about the inspection to be held (location, dates) in order to confirm availability of the relevant location. When dates are fixed, the inspection is then notified to HO by EC. Conference call may be organized by QHSSE Department to explain to the audited location the inspection process.

EMSA sends a request of necessary documents and records in order to prepare the inspection (see example in the document “Example EMSA Information Request.pdf” attached to this procedure). The full set of documents is gathered by QHSSE Department in liaison with the identified audited location and HO departments. Conference calls may be organized to clarify some points.

The audited location is in charge of logistic matters relative to the performance of the inspection at Recognised Organisation (RO) office.

As locations of M&O network are not familiar with EMSA inspections an HO team attends the whole EMSA inspection in order to support the audited location, if needed. This team is led by QHSSE Department and composed of managers of departments in charge of plan approval (DT_DA), shipbuilding (DO_NCM) and ship in services (DO_FM) activities. DO_EMC department shall also send a representative when a session is dedicated to this activity.

The inspection agenda is organized by EMSA to assess how minimum criteria as set in annex 1 of the above regulation are fulfilled.

Two months after the inspection EMSA addressed to Recognised Organisation (RO) a draft report in order to get clerical comments from auditees, if any. In no case there is way to re-negotiate findings.

QHSSE department assigns inspection's findings to concerned HO departments and the audited location in order to get root cause analysis (RCA) and relevant corrective action plans on due time.

QHSSE department collects the above and draws the global Recognised Organisation (RO) corrective action plan and sends it to EMSA.

All documentation relevant to EMSA inspection is posted in the M&O Quality Share Point dealing with external audits.

Implementation of action plans is checked by concerned departments in charge of activities and verified by QHSSE department on a quarterly basis.

Effectiveness of action plans is assessed at the time of any self-assessment action, e.g. internal audits, activity monitoring.

Flag Administration Audits

General

As per the RO Code, Flag Administrations have to supervise the ROs which perform statutory services on their behalf as per the agreement they have granted.

Ways to supervise the ROs are described in the RO Code in the Chapter relative to “Oversight of Recognized Organizations”. One way to perform this supervision is to carry out audits.

Within Recognised Organisation (RO) QMS, Flag Administrations’ requirements are detailed in the whole set of procedures.

QHSSE Department is responsible for the organisation and the follow-up of Flag audits carried out at M&O HO.

Countries are responsible for the organization and the follow-up of audits performed locally. They have to inform as quickly as possible QHSSE Department which will provide appropriate guidelines, if needed.

Audit Performance and Reporting - Distribution of Reports

HO departments remain available to provide any document or answer to questions which may raise during the performance of audits.

Upon completion of the audit, output and main conclusion should be communicated to HO (QHSSE Dept).

As soon as the audit report is received, local management should transmit it in an English version to:

• the Country Manager, Area Director and the Region SVP it report;

• at HO, QHSSE Management which ensures the distribution to Statutory and Classification

• Affairs Department and the HO Department corresponding to the audited activities

Detected Anomalies

Upon completion of the audit, auditees should ask Auditor to confirm the period (normally 3 months) from the last day of the audit for the completion of the actions addressing the findings.

Each proposed action addressing an anomaly is to be completed within the time frame agreed between the auditor and the auditee.

Non-conformities, Opportunities for Improvement and related actions

Findings may result in some or all of the following complementary types of actions:

• correction of the anomaly (e.g. re-issuance of a wrong document), to remedy the effects of the anomaly in a simple, local and immediate way;

• corrective actions to prevention recurrence of that type of anomaly to be programed in an accepted manner and traceability followed up (such as modification of instructions, training, etc.);

• preventive action, if such a programed action is suggested by the identification of potential sources of non-conformity.

The manager of the activity where the anomaly was identified shall then ensure that:

• he understands the anomaly and is able to define, in consultation with the auditor, appropriate commensurate actions;

• he designates himself or another person responsible for implementing the proposed actions;

• he remains in charge of completing the actions, providing the necessary evidences of completion (through attached documents), allowing the timely closing of the finding by the auditor.

The action plan addressing each finding is built, and looks as such in a corrective action report (CAR) with corrective actions and preventive actions.

Follow-up of actions - Audit Closing

Checking that the actions taken are sufficiently documented and the evidences are relevant before closing the finding is the responsibility of the Auditor.

Checking that deadlines are complied with is the responsibility of the issuer and of the person in charge of implementation of the actions.

QHSSE Department at Recognised Organisation (RO) M&O HO continuously performs a follow-up of the audits throughout the year. Reminders are sent to the persons responsible for performing the actions and a conference call may be scheduled with auditees approx. one month after the audit to identify departures from the original programme time-frame and also any other difficulty faced by the auditees to complete their tasks.

If, during the period agreed between the auditor and auditees for the performance of the actions, the responsible person identifies that the actions will not be completed within the agreed and fixed time-frame, the responsible person shall contact immediately the auditor, providing sound justification for such delay and agreeing on a new time-frame with the auditor for completion.

Audit is closed upon Flag administration agreement on action plans and corresponding evidences.

Flags specific requirements

Specific requirements stated by Flags are presented in the following table: