Audit Program Management and Planning
An audit program is the top-level framework that governs all audits in a cycle; a single audit plan is the tactical schedule for one audit. Candidates must distinguish program-level elements (objectives, risk criteria, audit frequency, auditor resourcing, competence records, performance monitoring) from audit-level elements (scope, criteria, team, itinerary, sampling approach).
Planning begins with determining audit objectives and criteria, then defining scope and boundaries. Risk-based scheduling is central: processes with higher risk, more complaints, prior nonconformities, or greater impact on product conformity deserve more frequent or deeper coverage. Understand the difference between scope (what is covered: sites, processes, products), criteria (the requirements audited against, e.g., API Q1, ISO 9001, contract), and objectives (why the audit is happening).
Traps in questions: confusing the audit program with the audit plan; treating scope and criteria as interchangeable; assuming a desk review substitutes for on-site verification; forgetting that planning must account for auditor independence and competence, not just availability. Another trap is the belief that a longer checklist equals better planning-planning quality is judged by coverage of risk and criteria, not document volume.
Rule of thumb: plan backwards from the objective. If the objective is "verify effectiveness of corrective actions from last cycle," the plan must specify which NCs, which evidence, which processes, and who is competent and independent to judge them.
A worked example: a facility had two customer complaints and one major NC last cycle. A sound plan raises frequency for those processes, assigns an auditor with relevant process competence, and documents the sampling rationale-rather than reusing last year's generic itinerary unchanged.