Managing an ISO 18788 audit programme
Domain focus
This domain tests the audit programme: how audits are planned, resourced, sequenced and improved over time, rather than how one audit is run.
Core rules
An audit programme is a set of planned audits and related activities for a defined period, with objectives, extent, frequency, methods, resources and competent auditors. Programme design should be risk-based: consider legal and human-rights exposure, incident history, grievances, client requirements, site complexity, subcontractors, new contracts, changes and previous findings. For certification bodies, ISO/IEC 17021-1 adds impartiality, competence, complaints, appeals, surveillance and certificate control requirements.
The programme manager evaluates auditor competence - ISO 18788 knowledge, security-operations experience, human-rights awareness, local law, language and audit skills - and plans continuing development. Monitor programme performance with indicators such as finding trends, repeat nonconformities, timeliness and complaints; review the programme and adjust frequency or scope.
Worked example
A provider has one site with a rising incident rate, a grievance alleging excessive force, and a new contract in another country. The programme manager increases audit frequency at the high-risk site, adds an auditor with human-rights and local-law competence, and schedules a readiness audit before the new contract starts. The reasoning is risk-based: the programme follows exposure and change, not a fixed annual calendar.
Traps
Do not equate the programme with one annual audit. Do not assign auditors only by availability; check competence and independence. Do not ignore repeat findings, subcontractors or remote sites. Do not let the programme become static. Do not forget records, complaints, appeals and impartiality reviews.