Audit planning, scope, criteria, documentation review and programme management
Programme versus plan
The audit programme (clause 9.2) is the set of audits arranged over a period, with objectives, frequency, methods, responsibilities and resourcing. The audit plan covers one audit: schedule, activities, team, sampling approach and logistics. Conflating these is the most common exam trap.
Scope, criteria, objectives
Scope defines boundaries - organisational units, locations, technologies, interfaces - and is agreed with the client; the auditor does not unilaterally set or extend it. Criteria are the requirements used for comparison: ISO/IEC 27001, the organisation's own policies and procedures, contracts, legislation. Objectives state why the audit is being performed. Know which is which; questions frequently swap them.
Planning inputs
Review documented information before and during the audit: ISMS scope, policy, risk assessment and treatment records, Statement of Applicability, internal audit and management review outputs, previous findings, incident and performance data. Documentation review is a planning aid, not the audit itself - conformity on paper is not implementation.
Certification context
Initial certification has Stage 1 (readiness, documentation, ISMS understanding, risk process logic, internal audit and management review completed) and Stage 2 (implementation and effectiveness). Stage 1 findings are usually reported as issues to be resolved, not as a certificate-blocking verdict.
Traps
- Treating a documented procedure as proof of operation.
- Ignoring multi-site sampling rules or the need to sample across shifts, sites and processes.
- Writing a plan so detailed it presumes findings before evidence is gathered.
Rule of thumb
Plan the audit around processes and risks, not around the clause list. Trace a thread - risk → SoA entry → implemented control → evidence of effectiveness → monitoring data - and the clause coverage follows naturally.