Managing an ISO 22301 Audit Programme
Domain 7 tests the difference between an audit programme and an audit plan, and how to schedule, resource, monitor and improve a programme over time.
Programme management
- An audit programme is the set of audits planned for a defined period, with objectives, scope, risks, schedule, resources and competence requirements.
- An audit plan covers one audit; a programme covers many.
- Schedule by risk, importance, changes, prior results and site criticality; ensure clause and site coverage over the cycle.
- Assign competent, independent auditors; manage conflicts of interest; use technical experts where needed.
- Monitor programme performance: delivery, findings, timeliness, competence; update it when the BCMS, risks or regulations change.
- For certification bodies, ISO 17021-1 adds stage 1 and stage 2, surveillance and recertification rules; internal programmes use ISO 19011.
Worked example
A manufacturer has four sites and a three-year internal programme. The high-risk site is audited annually; low-risk sites every two years; all Clause 8 processes are covered each year. When a new supplier dependency is identified, the programme manager adds a focused audit of 8.2 and 8.3. Reasoning: the programme is risk-based and responsive, not a fixed rotation.
Traps
Treating a single audit as the programme; never updating the schedule; using auditors to audit their own work; ignoring competence gaps; confusing programme objectives with audit objectives.