Audit Program Management
An audit program is the governing framework that turns individual audits into a managed, repeatable process. Candidates must distinguish the program (multi-year strategy, resourcing, risk prioritization, competence management, oversight, performance monitoring) from the audit (a single engagement with its own scope and plan). Know the drivers of program design: organizational context, compliance obligations, significant environmental aspects, legal and other requirements, previous audit results, and the maturity of the EMS.
Understand how a program establishes objectives, selects audit criteria, defines frequency and methods, allocates auditors, and evaluates program performance through indicators such as schedule completion, finding recurrence, and closure timeliness. Recognize the PDCA loop: plan the program, implement audits, monitor and review, improve. Roles matter - the program manager ensures impartiality and resourcing; the lead auditor executes; top management provides authority.
Common traps: confusing program review with individual audit review; assuming more audits always mean a better program; ignoring competence gaps when scheduling; treating the program as static rather than risk-based and revisable. Watch for questions that imply the auditor sets program scope - that is management's role.
Worked example / rule of thumb: If an organization has had three repeat findings on waste segregation, the program should re-prioritize that area and increase frequency or depth - not merely repeat the same checklist. Rule: program decisions follow risk and performance data, not habit.