Audit Programme Management, Auditor Competence, and Ethics
Programme versus plan
An audit programme is the strategic, multi-audit arrangement: objectives, risks and opportunities, roles and responsibilities, resources, procedures, schedule, and records across a cycle. An audit plan is the tactical document for one audit. ISO 19011 organises programme management as establish → implement → monitor → review → improve, with the programme sized by the risk and importance of the processes audited and by prior results.
Competence
Competence is demonstrated ability, not a certificate. A medical device auditor needs knowledge of audit principles and procedures; the QMS standard and reference documents; the organization's context, products, and processes; applicable legal and regulatory requirements; and sector practices such as sterilization, packaging, and software. Personal behaviours matter too: ethical, open-minded, diplomatic, observant, tenacious, decisive, and culturally sensitive. Competence is evaluated through records of education and training, interviews, observation, and feedback from audit team members and auditees.
Ethics
Expect integrity, fair presentation, due professional care, confidentiality, and independence. Practical rules: no gifts or hospitality that could influence judgement; no disclosing auditee information; no auditing work you performed; and no drifting into consultancy. Certification bodies typically bar auditors from auditing an organization they consulted for recently - a two-year separation is the common benchmark.
Traps
Questions dangle attractive options that look helpful but breach impartiality, such as “explain how to fix it” or “accept the sample as a courtesy.” Others confuse a busy auditor with a competent one, or assume certification alone proves competence.
Rule of thumb
The auditor's only deliverable is a truthful, defensible statement about conformity. If an action would compromise that statement, it is the wrong answer.