Managing an ISO 21001 Audit Programme
What this domain tests
This domain tests ISO 19011 clause 5 and the certification-body context: how a programme of audits is established, resourced, scheduled, monitored and improved - as distinct from a single audit.
Core rules
- An audit programme is the set of audits planned for a period, with its objectives, risks, resources and procedures. An audit plan covers one audit. Confusing them is the most common error.
- The programme cycle: establish objectives → identify risks and opportunities → establish the programme (processes, resources, schedule) → implement → monitor → review → improve.
- Scheduling is risk-based: audit frequency increases with learner numbers, new programmes, new sites, regulatory change, complaint trends and previous findings.
- Programme records include plans, reports, findings, corrective action status, auditor competence records and programme performance data.
- Auditor competence (ISO 19011 clause 7) covers education, training, audit experience and sector knowledge; it must be evaluated and maintained, and auditors must not audit their own work.
- For certification bodies, ISO/IEC 17021-1 adds impartiality management, defined audit time, a separate certification decision, and surveillance and recertification cycles.
- Integrated audits (ISO 21001 with ISO 9001) can share plans and teams but must still address every ISO 21001 requirement.
Worked example
A programme manager reviews performance data: one campus has rising learner complaints and a new e-learning platform went live mid-year. Reasoning: both raise the risk of the EOMS failing to meet requirements, so the manager brings forward the scheduled internal audit for that campus, adds a platform-focused special audit, and records the rationale in the programme review. The following year's schedule and auditor allocation are adjusted accordingly - that is programme monitoring leading to improvement, not a change to a single audit plan.
Traps
- Presenting a single audit plan as evidence of programme management.
- Never reviewing programme performance, so risk-based scheduling is claimed but not evidenced.
- Allocating auditors to their own department or recent work.
- Assuming competence obtained once remains valid without evaluation and development.
- Treating an integrated audit as permission to skip ISO 21001-specific requirements.