Managing an ISO 37301 Audit Program
Domain 7 tests programme-level management: how audits are selected, scheduled, resourced, monitored, and improved over time. An audit programme is not a single audit; it is the set of arrangements for multiple audits.
Programme rules
- Define programme objectives and the risks the programme must address.
- Assign a programme manager with authority and resources.
- Determine audit frequency and scope using risk, prior results, changes, and performance data.
- Ensure auditor competence and independence, including for internal audits where auditors must not audit their own work.
- Monitor and review the programme at planned intervals, using indicators such as timely completion, repeat nonconformities, and finding trends.
- Maintain records and adjust the programme when risks or performance change.
Worked example
A manufacturer has five sites. One site had two major nonconformities and a management change; the others are stable. The programme manager schedules the high-risk site annually and the stable sites every two years, assigns a lead auditor with manufacturing compliance experience, and builds in a programme review after each cycle. The reasoning is risk-based: frequency and resources follow risk, and the programme is reviewed for effectiveness, not just completion.
Traps
Do not treat the programme as one audit plan. Do not allocate auditors without checking competence or independence. Do not over-audit low-risk areas while high-risk areas go unvisited. Do not ignore repeat findings when reviewing programme effectiveness. Do not forget that certification audits follow a cycle and that certification decisions are made by the certification body, not the audit team.