As empresas devem assegurar que as auditorias são baseadas nas normas, especificações ou recomendações nacionais, europeias e internacionais existentes sobre a matéria, nomeadamente:
- a)ISO/IEC 17021-1:2015 (Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 1: Requirements) e suas revisões;
- b)ISO/IEC TS 17021-5:2014 (Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 5: Competence requirements for auditing and certification of asset management systems) e suas revisões;
- c)ISO/IEC TS 17021-6:2014 (Conformity assessment - Requirements for bodies providing audit and certification of management systems - Part 6: Competence requirements for auditing and certification of business continuity management systems) e suas revisões;
- d)ISO/IEC 27006:2015 (Information technology - Security techniques - Requirements for bodies providing audit and certification of information security management systems) e suas revisões;
- e)ISO/IEC 27007:2017 (Information technology - Security techniques - Guidelines for information security management systems auditing) e suas revisões;
- f)ISO 19011:2018 (Guidelines for auditing management systems) e suas revisões;
- g)Outra norma, especificação ou recomendação nacional, europeia ou internacional adequada.