Glossary of audit, standards and facility terms

ITF FM writes an AMC against a surveyed asset register, with four annexes: the asset register, the PPM calendar, the exclusions and the priority schedule. Each month's work is proved by the record.

A low reading checks a clean; it is not a microbiological release, so a food site's QA team decides where ATP applies and where a swab goes to a laboratory. Where the zone plan specifies ATP swabs, Hygienix MEASURE supplies them against it, and the site's own team runs the verification rounds.

A CAFM system only holds what the site survey put into it. Where a client's CAFM already holds assets and work orders well, ITF FM connects to it and adds an evidence layer on top.

ISO 9001, ISO 14001 and ISO 45001 require corrective action in clause 10.2 and handle prevention through risk planning in clause 6, while ISO 13485 keeps preventive action as its own clause. ITF Training runs a half-day NCR and CAPA course, and ITF Consult helps answer certification audit findings.

Other facility types were brought into accreditation programme by programme. ITF Health prepares the non-clinical standards: facility management and safety, document control, quality management records, staff files and information management.

Under HACCP and ISO 22000 each CCP carries its critical limit, monitoring, corrections and records, and it cannot carry a failing prerequisite programme. ITF Consult sets CCPs from the hazard analysis, in the room with production, quality and maintenance.

Check the accreditation mark on a certificate, then verify the certification body on the accreditation body's own published list. ITF Consult prepares the system and the records, and the certification body you choose runs the audit and makes the decision.

For a clinic or hospital, every private insurance claim goes through nphies. ITF Health works those claims for providers: eligibility, prior authorisation, coding, submission, rejections and reconciliation.

Every scheme answers one of two questions, which area am I in or which surface am I touching, and a food site can mix the two without noticing. ITF Hygienix records the scheme a site already runs and specifies a second control where it needs one.

Most document control nonconformities are obsolete documents still in use rather than missing ones. ITF Consult sets up the procedure and master list, ITF Training runs a document control course, and ITF Digital builds document control systems.

The standards ask for it where the system needs it to work and where evidence is required, and ITF Consult sizes a document set to that. A quality manual has not been a requirement since the 2015 edition of ISO 9001.

It binds government bodies, their affiliates and entities that own, operate or host critical national infrastructure, and it reaches many private suppliers through contract clauses. ITF Cyber prepares ECC readiness: a control-by-control position, the governance documents and a remediation plan with owners.

Retailers and global food brands write it into supply contracts, and it requires an unannounced audit within each certification cycle. ITF Consult prepares sites for it, and ITF Training runs an FSSC 22000 course.

It is also how a transition to ISO 9001:2026 or ISO 14001:2026 starts, read against the system a site already holds. ITF Consult runs it, and the report stays with the client whatever is decided next.

Large retailers and manufacturers write GFSI recognition into supply contracts so they can accept one audit instead of running their own. For a Saudi food plant that clause usually decides between ISO 22000 and a GFSI scheme, and ITF Consult reads it against what the site already holds.

Ghad accepts a food licence application only once the prior approvals from other authorities exist, so most delays start upstream of it. ITF Consult maps that chain for food plants, and ITF Health finds a device company's category first when it builds an ISO 13485 system.

SFDA's licensing guide lists a HACCP certificate from an accredited certification body among the documents for a food manufacturer operating licence, which makes HACCP a licence condition in Saudi Arabia. ITF Consult builds the plan and the records, and ITF Training runs HACCP courses.

It is why quality, environment and safety systems can share one document control, internal audit, management review and corrective action process. The 2024 climate amendment ran across the standards built on it, and ITF Consult builds integrated systems on it.

With ISO 9001 and ISO 14001 both revised in 2026, a site holding both on an integrated system makes the two transitions in the same pass. ITF Consult builds and integrates the systems.

A certification body's Stage 1 checks that internal audits are planned and being performed before it moves to Stage 2. ITF Consult builds the programme, and ITF Training runs internal auditor courses.

In Saudi Arabia certificates come from certification bodies accredited by SAAC or another IAF MLA signatory. ITF Consult builds new systems to the 2026 edition and runs transitions for certified ones.

SFDA requires device manufacturers, importers and distributors in establishment categories A and B to hold an ISO 13485 certificate from a body it recognises, and its guidance MDS-G024 maps each clause to its own requirements. ITF Health builds the system with the company's own people.

Inside Jubail or Ras Al Khair the obligations register carries the Royal Commission's RCER as well as the national rules. ITF Consult builds the system and runs transitions to the 2026 edition.

It suits a Saudi food business that needs a credible food safety system and has no GFSI requirement in its contracts, and it is the base FSSC 22000 is built on. ITF Consult implements it, and ITF Training runs an ISO 22000 awareness course.

In Saudi Arabia it is an efficient base for mapping NCA's Essential Cybersecurity Controls on top. ITF Consult builds the management system, and ITF Cyber writes the security policies its controls call for.

Certification needs a hazard identification method, a legal register, controls chosen by the hierarchy, incident investigation that reaches root cause and evidence that workers were consulted. ITF Consult builds the system, and ITF Training runs ISO 45001 courses.

A KPI with no named data source turns the monthly review into an argument about the numbers. ITF FM publishes how each KPI in its monthly pack is counted.

A water system should have a written Legionella risk assessment by a competent assessor. ITF FM cleans and disinfects tanks, keeps the water log and sends samples to an accredited laboratory for testing.

An auditor reads the minutes for decisions, not for attendance. ITF Consult prepares the inputs, runs or facilitates the meeting and writes minutes that record what was decided.

ITF FM maintains MEP systems and carries out defined works on them, with a method statement and a permit before work starts and a record after it finishes. High voltage, lifts and suppression are managed specialist work.

It shows a facility what a surveyor would find on that day, while there is still time to fix it. ITF Health runs mock surveys on the non-clinical standards.

Jubail and Ras Al Khair are Royal Commission cities instead, with their own environmental regulations. ITF FM and ITF Consult both cover Dammam 2nd Industrial City.

Its controls bind government bodies and critical national infrastructure and reach private suppliers through contracts. ITF Cyber prepares organisations for ECC and maps the other NCA control sets onto the same register.

A closure that only retrains the operator usually treats a person rather than a cause. ITF Training runs a half-day NCR and CAPA course covering ISO 9001, 14001, 45001 and 22000.

Eligibility checks, prior authorisation, claims and reconciliation all run through it, on the HL7 FHIR standard. ITF Health works a provider's claims on nphies and reports every month.

It is broader than an AMC, which maintains a listed set of assets, and broader than a warranty. ITF FM writes O&M contracts against a surveyed register.

Under ISO 22000:2018, each control measure chosen for a significant hazard is managed either as a CCP or as an OPRP, and the split should come from the hazard analysis rather than from habit. ITF Consult works the split through with production and quality.

Health data, fingerprints from an attendance clock and criminal records are all sensitive data under it. ITF Cyber prepares PDPL readiness: records of processing, notices, a rights process and a 72-hour breach procedure.

On a client's site, contractors work under the client's permit system, and ITF FM does too. ITF Training runs a one-day course on raising, authorising, issuing, closing and cancelling permits.

The PPM calendar is one of the four annexes to an ITF FM annual maintenance contract, and every task closes with evidence.

FSSC 22000 specifies them through the ISO 22002 part for your food chain category. The 2025 series comes in through the Version 7 upgrade, and the Version 6 category table applies until then. ITF Consult builds PRPs to the part that applies to your site, and ITF FM runs several of them on site, cleaning and pest control among them.

A facility in Jubail or Ras Al Khair needs an Environmental Permit to Construct and an Environmental Permit to Operate. ITF Consult writes RCER obligations into the ISO 14001 register beside the national ones, with the source of each.

In Saudi Arabia private insurance claims pass through nphies. ITF Health runs revenue cycle work remotely and reports every month on what is paid, pending and denied.

A transition to a new edition can be carried out at a recertification audit, as it can at a surveillance audit. ITF Consult's surveillance support keeps records current through the cycle so the whole period holds up.

It became an IAF MLA signatory for ISO/IEC 17021-1, including ISO 9001, on 16 January 2024, which is what lets a SAAC-accredited certificate be recognised abroad. A buyer can verify a certification body on SAAC's own published list.

The certificates are issued by SASO-approved certification bodies. ITF Consult works out which technical regulation applies and prepares the technical file and evidence those bodies review.

A Saudi factory answers to SASO through SABER for product conformity, alongside its industrial licence and its environmental permit. ITF Consult prepares the technical file.

A breach that could cause harm is notified to SDAIA within 72 hours of becoming aware of it. ITF Cyber prepares PDPL readiness against SDAIA's own published documents.

For a food manufacturer the licence needs prior approvals, a HACCP certificate from an accredited certification body and laboratory testing, and runs one to three years. ITF Consult prepares food sites, and ITF Health prepares device companies' ISO 13485 systems.

A response time means something only when the priority bands and clock rules are written down. ITF FM publishes its structure of four priorities and five clocks, and writes the windows per site.

Both stages run on the certification body's own calendar. Stage 1 checks that internal audits and management reviews are planned and being performed. Before the certificate is issued, major nonconformities need correction and corrective action the certification body has verified; for minor ones it reviews and accepts the plan. ITF Consult prepares a site to that point.

It has to follow from the risk assessment and treatment, not from a template. ITF Consult writes it as part of ISO 27001 readiness.

A transition to a new edition is normally added to a planned surveillance or recertification visit. ITF Consult's surveillance support keeps the internal audit, management review and documents current between visits.

For ISO 9001:2026 the window is expected to run to September 2029, and the slot is set by the certificate's expiry date rather than the publication date. ITF Consult runs the delta review and the internal audit before it.

It tests whether a food safety system runs on a normal day rather than on audit day. ITF Consult runs a readiness check the same way, on a normal day with no preparation.