Preparing an ISO 28000 Audit
This domain tests whether you can design an audit that will actually find something: scope, criteria, objectives, sampling and documentation.
Programme versus plan
The audit programme is the set of audits over time; the audit plan is one audit. The plan should state objectives, scope, criteria, dates and locations, expected duration, roles, resource allocation, confidentiality arrangements and reporting methods.
Preparation steps that earn marks
- Confirm objectives and criteria with the client and the auditee.
- Review the previous report and nonconformity closure, management review outputs, the risk assessment and treatment plan, internal audit results, incident logs and legal obligations.
- Build a sampling plan: sites, shifts, processes, suppliers and documents, chosen on risk and materiality, with the rationale recorded.
- Draft process-based checklists that trace inputs to outputs, not questions copied from the standard.
- Agree the schedule with the auditee, protecting time with top management and with the people who perform the work.
- Brief the team on scope, criteria, sampling and reporting conventions.
Worked example
A logistics operator with three warehouses, one handling high-value electronics, requests certification. The auditor notes the previous audit found access-control nonconformities at the electronics site. The plan samples that site for a full day and the other two for half a day each, adds interviews with top management and the transport subcontractor manager, and records the rationale: asset value, past performance, outsourced processes. That recorded rationale distinguishes a professional plan from a calendar.
Traps
Checklists that restate the standard; plans without criteria; ignoring previous results; scheduling around the auditee's convenience so night shifts are never seen; and widening scope on site without a documented decision.