Fourteen Sites, One and a Half Auditors

Capacity reality first. At roughly 3.5 audit days per audit plus travel and reporting, 1.5 FTE cannot deliver 14 site audits in a year. Saying yes to the COO guarantees a repeat of last year's 11-of-16 outcome and loses credibility.

Risk-based allocation:

1. The three high-complaint sites - full audits, earliest in the year, because complaint rate is a direct customer-impact indicator.
2. The two acquired sites - full audits, because they carry integration and unfamiliar-process risk and have no audit history under your system.
3. The surveillance site - audit before September, so any systemic finding is corrected before the certification body arrives rather than argued about during it.
4. Remaining sites - risk-tier them. Low-risk sites get remote or hybrid audits (document and record review, video/telephone interviews) or a combined multi-site process audit, with the cycle extended and the extension formally accepted.

Correct the COO's premise. The certificate is not protected by visiting every site; the certification body audits whether the internal audit programme is effective and risk-based. If the organisation holds a multi-site certificate, check the scheme's own sampling rules rather than assuming - but either way, an audit programme that ticks boxes and misses its high-risk sites is the bigger certification risk. Confirm a documented risk acceptance with top management for any site whose cycle is extended.

Report a small balanced set:

• Risk coverage: percentage of high-risk processes/sites audited against plan - the single most important number here.
• Schedule adherence: completed versus planned, with the reasons for variance, not just the ratio.
• Effectiveness of closure: percentage of nonconformities closed with verified evidence of effectiveness, and median days from report to verified closure.
• Repeat finding rate: the clearest signal of whether the programme is changing anything.
• Efficiency: audit days per site or per process, and cost per audit.

What they miss:

• 'Audits completed' measures auditor activity, not organisational health. Maximising it rewards shallow audits and easy sites.
• A falling nonconformity count can mean improvement or weaker auditing; you need to know whether scope, sampling and auditor hours changed.
• None of these measures tell you whether auditees find the audits useful or whether findings connect to customer complaints, scrap or delivery performance. Triangulate audit results against business metrics before declaring the programme effective.
• Beware targets that distort: a 'zero repeat findings' target invites softer classification, not better corrective action.

Treat it as a risk decision owned by management, not an inconvenience absorbed silently by the auditor.

Steps:

1. Quantify the constraint. Convert the cut into audit days and coverage: which sites or processes fall out of the plan, and what is the resulting exposure at each. 'Three high-complaint sites receive no audit this year' is a decision management can weigh; 'we will do our best' is not.
2. Offer options with costs - hybrid/remote delivery, combining audits at adjacent sites to cut travel, training internal site personnel as trained auditors, trading a full audit for a focused process audit at the worst sites, deferring low-risk sites with documented acceptance.
3. Escalate for explicit acceptance of residual risk, in writing, to the COO or top management, with a review date. Unaccepted residual risk is an audit programme failure.
4. Protect what must not be traded - competence and independence of auditors, and coverage of the highest-risk areas.

In the management report, state coverage achieved against risk tier, the residual risk accepted, and the leading indicators you will watch. Avoid presenting the cut as 'we still completed X audits' - that answer hides the sites nobody looked at.