Audit planning and program management
This domain tests whether you can distinguish an audit programme from an audit plan and design both around risk. An audit programme is the set of audits planned for a period, including objectives, resources, schedules, and competence needs. An audit plan is the detailed arrangement for one audit: scope, criteria, objectives, team, schedule, and sampling approach. ISO 19011 emphasizes risk-based programming and planning.
Core rules and concepts
- Define the three anchors first: audit objective (why), scope (what and where), and criteria (against what). They must align.
- Use risk inputs: compliance history, significant aspects, incident trends, regulatory changes, and prior findings should drive frequency and depth.
- Plan resources and competence: team size, technical knowledge, language, and site access must match the audit.
- Prepare for evidence collection: review documents in advance, design sampling, and allocate time for site observation and interviews.
- Communicate: confirm logistics, opening meeting, safety rules, and reporting arrangements.
Worked example
A company operates three sites. Site A had two permit exceedances and an unresolved major nonconformity; Site B has stable performance; Site C is newly acquired. A risk-based programme might schedule Site A twice in the year, Site C once with a full compliance focus, and Site B once with a narrower surveillance scope. The audit plan for Site A should include the wastewater treatment process, calibration records, regulatory reporting, and follow-up of prior corrective actions. The reasoning is that frequency and depth follow risk, not equal treatment.
Traps that cost marks
Confusing scope with criteria; copying last year’s plan without reassessing risk; using a checklist as a substitute for planning; and allocating no time for document review or sampling. Another trap is scheduling an auditor without the technical competence for a complex process.