Managing an ISO/IEC 27001 Audit Programme
Programme vs plan
An audit programme is the set of arrangements for a set of audits, planned for a specific time frame, directed at a specific purpose. An audit plan covers a single audit. The programme manager establishes programme objectives, determines the extent (number, type, duration, locations) of audits, identifies risks and opportunities to the programme, defines responsibilities and procedures, secures resources, ensures auditor competence, monitors and reviews performance, and improves the programme.
Risk-based programme design
Frequency, duration and depth should follow risk: critical processes, high-risk locations, complex outsourced arrangements and areas with past nonconformities are audited more often. Inputs include previous audit results, management review outputs, incident history, change activity and performance indicators. For certification bodies the programme follows a three-year cycle with initial certification, surveillance audits and recertification; for internal audit, Clause 9.2 requires a planned programme that considers the importance of processes and previous results.
Competence is a programme responsibility: define required knowledge and skills, evaluate auditors against those criteria, and maintain records of education, training, experience and audit performance.
Traps
- Presenting 'a list of audits for the year' as a full programme - objectives, risks, resources and monitoring are missing.
- Assuming internal audits may be unplanned or one-off.
- Ignoring auditor competence and impartiality when assigning teams.
- Confusing programme records (competence, programme reviews) with audit records (plans, reports).
Rule of thumb
Build the programme backwards: objectives → risks → audit frequency and depth. A calendar without a risk rationale is just a diary.