Audit programme management and audit planning
This domain tests two levels of design: the programme (a whole cycle of audits) and the plan (one audit). It also tests whether you can justify frequency, duration and sampling by risk rather than by habit.
Programme versus plan
An audit programme is a set of one or more audits planned for a specific time frame and directed toward a specific purpose. An audit plan is the description of the activities and arrangements for a specific audit. ISO 19011:2018 clause 5 covers managing the programme: establishing objectives, risk-based design, resourcing, implementation, monitoring, review, improvement and record retention.
Building the programme
- Objectives derive from the organization's strategy, compliance obligations, significant environmental aspects and previous audit results.
- Frequency and depth should reflect risk: significance of the process or aspect, complexity, regulatory change, complaints, incidents, previous nonconformities and management review outputs.
- Resources include auditor competence, time, access to information and any technical experts needed.
- Monitor implementation: was each audit performed, on time, to scope, and did it deliver its objectives? Review and improve the programme at planned intervals.
Building the audit plan (6.3.2)
Include the audit objectives, scope (units, processes, locations, time period), criteria (standard, procedures, legal requirements), dates and locations, expected duration, team roles, resource allocation, auditees, methods and sampling, and reporting arrangements. Agree it with the client and communicate it to auditees. The plan is a working document, adjusted if evidence demands - not a checklist to be forced through.
Worked example
A three-site manufacturer plans internal EMS audits. Site A stores solvents near a watercourse, had a spill last year and received a regulator warning. Site B is an office. Site C is warehousing with no significant aspects. All three currently receive one audit day per year. A risk-based programme gives Site A more frequent audits and greater depth on emergency preparedness and storage controls; Site B can be covered by a shorter audit or partly remote methods; Site C can sit on a two-year cycle if its aspects are genuinely limited. The justification is documented evidence, not "equal treatment".
Traps
- Using "programme" and "plan" interchangeably.
- Fixed calendar frequency with no documented risk rationale.
- Planning audit days only, leaving no time for preparation, reporting or follow-up.
- Letting the auditee narrow the scope to exclude problem areas.
- Merging scope and criteria into one statement so the report cannot be interpreted later.