Managing an ISO 14001 audit program
What a programme is
An audit programme is the set of audits planned for a specific time frame and directed toward a specific purpose. It is not a single audit plan and not merely a schedule. Programme management covers objectives, risks and opportunities, extent, responsibilities, resources, procedures, monitoring, review and improvement.
Design
Base frequency and depth on the environmental importance of processes, significant aspects, compliance obligations, changes, previous audit results, complaints and incidents. Define auditor competence and how auditors are evaluated. Maintain records: programme documents, audit reports, nonconformities, corrective action follow-up and auditor competence.
Traps
Confusing programme (strategic, covering many audits) with plan (one audit). Assuming every clause must be audited every year-ISO 14001 requires internal audits at planned intervals, and the programme defines coverage and cycle. Ignoring outsourced processes or remote sites. Failing to monitor programme performance, such as completion rates, finding trends and auditor performance. Allowing the same auditor to audit their own area. Confusing the certification body's programme with the client's internal programme.
Rule of thumb
Tier sites by risk: high-risk sites with significant aspects or permits annually, medium risk every two years, low risk every three years, with triggered audits after incidents, complaints or major changes. Review the programme at least annually and adjust it using results.