A Three-Year Cycle for a Group That Just Bought 40% of Its Billing

Clause 9.2 requires an audit programme planned with regard to the importance of processes and the results of previous audits, with defined criteria and scope for each audit, auditor objectivity and impartiality, and results reported to relevant management. Several elements fail:

1. Frequency insensitive to importance. A uniform three-year cycle at equal duration treats 40% of group billing, held by an entity acquired eleven months ago and therefore outside any prior cycle, the same as a low-risk unit. Importance of process is explicitly a planning input; a 31-month wait is not a risk-based decision.
2. Objectivity. An auditor who designed the access-control process he now audits is reviewing his own work - self-review, not audit. The metering operations manager auditing IT shared services is acceptable only if he has no responsibility for the audited activity; that needs to be evidenced, not assumed.
3. Competence. Four auditors for four units says nothing about competence criteria or evaluation.
4. Follow-up. Improvements closed by the auditee's own manager means no independent verification that actions were taken or effective.

A cycle with zero nonconformities and self-closed actions suggests the audits are not finding things, which is itself a programme risk.

Re-prioritisation is a documented risk judgement, not a reshuffle for convenience:

• Billing company: audit before or immediately after integration completes - certainly within the current cycle, not month 31. Newly acquired, high transaction volume, unknown control environment, and likely different systems and culture. It should also trigger a review of whether group ISMS scope and risk assessment still describe reality.
• IT shared services and access control: higher frequency, since every unit depends on it and it carries the identity risk.
• Retail energy / metering: can remain on a longer cycle if the risk picture supports it, but duration and depth should vary with complexity, not be a flat two days.
• Central functions: scope, risk, supplier and incident processes audited at group level, since unit-level audits will not see cross-cutting failures.

I would also build in follow-up of previous findings as a standing objective, verified by someone other than the action owner, and define competence criteria per audit area with a record of how each auditor was evaluated. Revised programme goes to the CISO with written rationale.

External surveillance says something about the sampled evidence at the moment of sampling, nothing about whether internal audit is capable of finding problems. The two are not substitutes; internal audit is a required process the organization must operate and improve, and its effectiveness is judged on its own criteria.

The pattern is the evidence: zero nonconformities across a cycle, only two improvements, and every action closed by the auditee's own manager. Combined with an unqualified auditor pool, self-review assignments and a frequency unrelated to risk, the most likely explanation is not excellence but weak detection and weak verification. Continuing absence of findings in a group that has just absorbed a billing platform is a red flag, not an assurance.

My recommendation: audit a known-weak area deliberately as a test of the programme's sensitivity; review the last cycle's working papers for evidence of depth; introduce independent verification of actions; reassess auditor competence and assignment; and report programme performance to management review. If the group lacks internal capability for the billing and IT areas, source competent auditors externally for those audits - the requirement is objectivity and competence, not employment status.