Planning a 14-Campus Certification Audit
You are lead auditor for an initial certification audit of a K-12 school network with 14 campuses, 9,200 learners and a central curriculum office. The audit is five days with two auditors. The proposed plan gives 3.5 days to the central office and 1.5 days to one campus chosen because it is closest to the airport. The plan states: 'All campuses follow the same LMS and curriculum, so one campus is representative.' You have last year's internal audit report covering only four campuses; 212 parent complaints across the network, of which 96 concern campus safety drills at six campuses; and a state requirement for site-specific emergency drills. The network's scope statement includes 'campus-based delivery and learner safeguarding.' The certification body's procedure requires sampling of sites where activities are performed, considering risk and previous results.
1. Critique the audit plan and propose a defensible site-sampling approach.
Read the worked answer
The plan is not defensible as written. Choosing the nearest campus is convenience sampling, not risk-based sampling. The central office may control curriculum and the LMS, but safeguarding, emergency drills, learner supervision and parent complaints are delivered at campus level. The scope also includes campus-based delivery and safeguarding. The 96 safety-drill complaints across six campuses are a strong risk signal, and the internal audit covered only four of 14 campuses.
I would discuss with the certification programme manager and revise the plan to include a documented sample of campuses based on risk. That should include at least two high-complaint campuses, one campus not previously audited, and, if available, one campus with different learner demographics or regulatory history. I would allocate more time to campus-level evidence and less to central office, or add audit days.
The sampling rationale must be recorded, and the plan should show how central functions and site-level controls interact. I would also check the certification body's multi-site rules before finalizing.
2. What preparation activities are missing, and how would you adjust the audit plan before the opening meeting?
Read the worked answer
Missing preparation includes review of internal audit reports and previous findings, complaint analysis by campus, legal and regulatory requirements for drills and safeguarding, the site risk profile, and auditor competence for safeguarding and campus operations. The plan also lacks learner and parent interview time and a clear sampling rationale.
Before the opening meeting, I would revise the audit plan, reallocate days to at least two or three campuses, add interviews with learners and safeguarding leads, and confirm auditor competence or add a technical expert. I would send the revised plan to the auditee and programme manager, explain the risk basis, and document the change.
If time cannot be added, I would narrow the audit scope or defer certification sampling rather than pretend one campus is representative. I would also verify that the audit objectives, criteria and scope are still met.