As empresas devem assegurar que as auditorias são realizadas em conformidade com as normas, especificações ou recomendações nacionais, europeias e internacionais existentes sobre a matéria, nomeadamente:
- a)ISO/IEC 17021-1:2015 (Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 1: Requirements);
- b)ISO/IEC TS 17021-5:2014 (Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 5: Competence requirements for auditing and certification of asset management systems);
- c)ISO/IEC TS 17021-6:2014 (Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 6: Competence requirements for auditing and certification of business continuity management systems);
- d)ISO/IEC 27006:2015 (Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems);
- e)ISO/IEC 27007:2017 (Information technology - Security techniques - Guidelines for information security management systems auditing);
- f)ISO 19011:2011 (Guidelines for auditing management systems);
- g)Outra norma, especificação ou recomendação nacional, europeia ou internacional adequada.