[Preparing an ISO/IEC 42001 Audit] Which of the following competencies must at least one of the audit team members possess?

The risk-based approach is a fundamental principle of auditing management systems. It ensures that the planning, conducting, and reporting of the audit focus on matters significant to the auditee's management system and its ability to achieve its objectives. Therefore, the collective competence of the audit team must include knowledge of risk-based auditing principles and methods to effectively plan and execute the audit. At least one member, typically the team leader, must possess this competency to guide the audit's focus and resource allocation.

A. Teamwork and communication skills are generic competencies expected of all auditors, not a specialized knowledge area that only one member needs to possess.

C. Knowledge of the auditee's language is beneficial but not mandatory for a team member, as a technical expert or interpreter can be used if necessary.

1. ISO/IEC 19011:2018, Guidelines for auditing management systems, Clause 4, Principle (f), "Risk-based approach," establishes this as a core principle of auditing.

2. ISO/IEC 19011:2018, Guidelines for auditing management systems, Clause 5.3.2, requires the audit programme to consider risks and opportunities when being established. This knowledge must then be applied by the audit team.

3. ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements, Annex A, Table A.1, lists "Knowledge of risk-based auditing" as a required area of knowledge for management system auditors.