The areas of assessment and the requirements to be checked are generally defined by commercial agreements between the two organisations (if, for example, the audit is conducted within the scope of a supply contract and it is the customer, directly or through a third-party auditor, that is verifying compliance with requirements), or by standards to which the organisation has chosen to conform (as in the case of certifications).