Managing an ISO 45001 Audit Programme
Establish, implement, monitor, review, improve
An audit programme is the set of arrangements for one or more audits planned over a period for a specific purpose. It is not an audit plan: the programme is the cycle, the plan is one audit within it. ISO 19011:2018 clause 5 gives the management cycle – establish, implement, monitor, review and improve.
Establish. Define the programme objectives (certification readiness, contractor evaluation, legal assurance), the programme manager's roles and responsibilities, the extent (number, duration, frequency, sites, remote options), resources, and the documented procedures and records. Identify risks and opportunities to the programme itself - auditor availability and competence, access restrictions, seasonal shutdowns, travel - and plan mitigations.
Implement. Schedule audits by risk: importance and complexity of processes, results of previous audits, incidents and complaints, legal changes, organizational change and worker feedback. Ensure auditor competence through education, experience, audit training and sector knowledge, supported by continuing professional development. Evaluate auditor performance, not merely attendance, and balance teams to avoid conflicts of interest and to maintain independence.
Monitor and review. Track completion, timeliness, report quality, auditor performance and stakeholder feedback. Review the programme at defined intervals and whenever the organization's context changes, and feed the results into management review under 9.3 and into 10.3 continual improvement.
Traps: confusing programme with plan; shrinking the programme to save money while risk has risen; never reviewing the programme; assigning an auditor work they previously consulted on; assuming an internal audit programme satisfies 9.2 when it fails to cover all requirements and interfaces.
Rule of thumb: higher risk, prior nonconformity or recent change buys more audit time - frequency is a risk decision, not an equal slice of the calendar.