Managing an ISO 22000 audit program
What the domain tests
Domain 7 tests managing an audit programme: objectives, risk, scheduling, competence, resources, monitoring, review and records, including certification-cycle concepts.
Core rules
- The audit programme is a set of audits planned for a period, with objectives, extent, risks and opportunities, resources and schedule. It is not the same as an audit plan.
- Assign a programme manager with competence and authority. Determine audit frequency and duration by risk, size, complexity, product groups, performance and changes.
- Select auditors for competence and independence; evaluate competence against the audit programme's needs, not just certificates.
- Monitor the programme: progress, findings trends, auditor performance, timelines and complaints; review it at planned intervals and adjust.
- Maintain records of the programme, audits, competence and follow-up.
- In certification, the programme follows the certification cycle: initial certification, surveillance audits, recertification. Multi-site sampling and integrated audits need a documented rationale.
Worked example
A programme covers three sites: a high-risk chilled foods site, a dry goods site and a warehouse. The high-risk site is audited twice a year, the dry goods site once, and the warehouse once with a reduced scope. The rationale uses risk, previous findings and volume. After a recall at the chilled site, the programme manager adds a short-notice audit and reviews the frequency. The reasoning shows the programme is a living risk-based plan, not a fixed calendar.
Traps
Confusing programme and plan; scheduling audits only for convenience; ignoring auditor competence; failing to review the programme after changes or incidents; and treating surveillance as a full recertification audit.