Audit Program Management and Business Applications
What the candidate must understand
An audit program is the set of audits planned for a period, managed to meet defined objectives. Program management covers setting objectives, determining extent (size, type, frequency, method) using risk and prior results, allocating resources, ensuring auditor competence and impartiality, defining procedures, maintaining records, monitoring performance, and reviewing the program for improvement. ISO 9001 clause 9.2 requires internal audits at planned intervals considering process status, importance, and prior results, conducted impartially.
Useful metrics include on-time audit completion, finding closure rate and cycle time, coverage of critical processes, audit cost, and correlation with complaint or scrap trends. Reviewing program results is an input to management review.
Business applications you should recognize: the process approach and turtle diagram, supplier management, cost of quality (prevention, appraisal, internal and external failure), Lean, Six Sigma, 5S, kaizen, TQM, benchmarking, SPC, and risk-based thinking.
Traps that show up in questions
- Swapping program (portfolio and schedule) with plan (one audit's itinerary).
- Assuming an annual fixed frequency; frequency should respond to risk and prior performance.
- Letting a manager audit a process they own, which breaches impartiality.
- Confusing cost-of-quality categories, such as calling rework an appraisal cost when it is internal failure.
- Treating a program review as optional rather than a required improvement loop.
Rule of thumb
Raise audit frequency where risk, change, or past nonconformities are high, and lower it where performance is stable. Example: a process with three major findings and a recent line change moves from annual to semiannual audits.