Audit Program Management and Planning
This domain tests the difference between the audit programme, the audit plan, and the audit scope, and whether you can build a risk-based schedule, select a competent team, and plan coverage that reflects how the site actually operates.
Programme, plan, scope, criteria
- Programme: the set of audits planned over a period, with objectives, resources, procedures, and review (ISO 19011).
- Plan: arrangements for one audit - dates, duration, team, processes, documents, sampling approach.
- Scope: boundaries - sites, shifts, processes, products, period.
- Criteria: the standards, regulations, customer specs, and procedures evidence is judged against.
Risk-based scheduling
Frequency and duration should follow risk: product risk (ready-to-eat versus further-cooked), process complexity, volume, number of shifts, change history (new line, new allergen), complaint and recall history, previous nonconformities, supplier criticality, and scheme rules. Some schemes prescribe minimum frequency and audit-day tables based on employee numbers; do not invent duration.
Competence is planned, not assumed: a matrix covering food safety/HACCP knowledge, product and process technology, regulation, and audit technique. Technical experts may advise but do not audit alone against criteria; the lead auditor assigns and remains accountable.
Worked example
A bakery runs two shifts; the night shift has fewer supervisors and also performs wet sanitation. The plan schedules 09:00–17:00 only. Reasoning: evidence must be representative of the scope, and shift patterns change risk. The plan should include shift handover and part of the night sanitation window, with night records and interviews included in the sample, and duration extended accordingly. Recording only day-shift records is a sampling failure, not an inconvenience.
Traps that cost marks
- Calling the annual schedule a "plan" and the individual audit a "programme".
- Building a checklist first and letting it narrow the scope.
- Sending an auditor without product competence and no technical expert to a novel process.
- Skipping the review of previous findings and corrective-action status before planning.
- Changing scope mid-audit without informing the client and recording the change.
- Forgetting the opening meeting's purpose: confirm plan, scope, criteria, and logistics - not to begin auditing.