Managing an ISO 28000 Audit Programme
This domain tests whether you can run audits as a managed portfolio - planning, resourcing, monitoring and improving - rather than as isolated events.
The audit programme
A programme sets objectives, extent, schedule and resources for a set of audits over a period. It needs documented responsibilities, procedures, records, and a risk assessment of the programme itself: which audits matter most, which sites carry the greatest security consequences, where past performance was poor. Programme risks include auditor availability, competence gaps and unrealistic scheduling.
Scheduling on risk
Frequency and depth should follow risk, the importance of the process, legal and contractual obligations, past results, incident history and organizational change. A newly acquired high-risk site, or one with repeated major nonconformities, earns more audit time; a stable, well-performing site may get less - with the rationale recorded.
Certification cycle
A typical third-party cycle is an initial certification audit in two stages, surveillance audits in the following years, and recertification before the three-year certificate expires. Combined and integrated audits can cover several standards at once but must still allocate sufficient time to each set of criteria.
Competence management
Auditors need security-specific knowledge as well as audit skills: risk assessment methods, physical and information security controls, and the sector's regulatory context. Competence is evaluated against defined criteria and development is planned.
Worked example
A programme manager runs an SMS across four sites. Site B had two major nonconformities last cycle and a theft incident this year; Site D has had no findings for two cycles. The manager schedules two days at B and one at D, adds a technical expert for cyber aspects at B, and records the reasoning in the programme review. At year end the review shows B improved, so the next cycle rebalances - that review loop is the point.
Traps
Confusing the programme with the plan; treating certification as a three-year guarantee; assigning an auditor to audit their own department; never reviewing programme effectiveness; and ignoring impartiality when auditors had prior consultancy relationships with the auditee.