Managing an ISO 9001 audit programme
Programme design, risk and performance
An audit programme is the set of arrangements for a group of audits planned over a time frame for a specific purpose. The programme manager establishes objectives, defines the extent (number, duration, sites, methods), identifies and allocates resources, ensures auditor competence, and monitors, reviews and improves the programme. ISO 19011 provides the generic framework; certification bodies also apply ISO/IEC 17021-1, which adds requirements for competence management, impartiality analysis, time determination and a three-year certification cycle with surveillance audits.
Scheduling must be risk-based: process importance, complexity, size, changes, results of previous audits, complaints, regulatory exposure, performance data and the maturity of the QMS. Clause 9.2 requires internal audits at planned intervals to determine whether the QMS conforms and is effectively maintained, with the programme considering the importance of processes, changes and previous results - and results reported to management. Note what the standard does not fix: frequency, number of auditors, or a per-clause cycle. Those are the organization's risk-based decisions, and 'annual full-system audit' is not a requirement.
Traps: confusing programme with plan; a programme that never changes after an incident or restructuring; auditors auditing their own work (independence); competence recorded once and never reassessed; records of audits and auditor competence not retained.
Worked example: after two customer complaints and a new production line, the programme manager shortens the next internal audit interval for those processes, adds an auditor with manufacturing competence, and reports the change at management review - evidence of a managed, risk-based programme.