1. If an assurance activity is commissioned by management, it must be Line 1 or Line 2.
2. If an assurance activity is commissioned by the governing authority or audit committee, independent of management, it will be Line 3.
3. Management system audit will not be Line 3 as it is not commissioned independent of management – this applies even when an independent third party performs a surveillance audit or accreditation renewal audit of an organisational management system – it would be considered Line 1 or Line 2.
Assurance activities commissioned by an external party such as a regulator will be external assurance.