Preparing an ISO 37301 Audit
Domain 4 tests how you translate audit objectives into a workable ISO 37301 audit. The key distinction is between the audit programme (the overall set of audits over time) and the audit plan (the arrangements for one audit).
Preparation sequence
- Confirm the audit objectives, scope, criteria, and auditee, and identify the audit client.
- Review documented information: context analysis, compliance obligations, risk assessment, policy, procedures, previous findings, and management review outputs.
- Use a risk-based approach to allocate time and sampling to the highest compliance risks.
- Select an audit team with the competence needed for the sector and the compliance obligations involved; consider technical experts.
- Produce an audit plan covering schedule, sites, processes, interviews, meetings, roles, and reporting arrangements.
- Prepare working documents such as checklists and sampling plans, but keep them flexible.
Worked example
A bank's internal audit programme schedules a CMS audit. The compliance risk assessment rates third-party onboarding highest. The lead auditor plans 50% of interview time on onboarding, samples contracts across three business units, reviews the due-diligence procedure first, and includes an auditor with banking regulatory experience. The plan also reserves time for opening and closing meetings and daily team debriefs. The reasoning is risk-based: audit effort follows risk, and competence follows the subject matter.
Traps
Do not copy a generic checklist without tailoring it to the organization's compliance obligations. Do not skip document review before interviews. Do not set a scope so broad that no process can be tested. Do not confuse the audit plan with the audit programme. Do not omit the audit criteria from the plan; without criteria, findings cannot be written.