Managing an ISO 55001 Audit Program
What the domain tests
Managing an audit program covers program objectives, risks, resources, procedures, schedule, competence, monitoring, review, and records; it also tests the distinction between program and plan.
Core rules
- An audit program is the set of arrangements for audits over time; an audit plan is the arrangement for one audit.
- Establish program objectives, risks and opportunities, resources, procedures, and schedule; consider asset criticality, results, changes, and complaints.
- Select competent auditors and ensure independence; evaluate performance and provide development.
- Monitor implementation, review the program for suitability and effectiveness, and improve it.
- Maintain records of program activities and audit results; ISO 55001 clause 9.2 requires an internal audit program.
Worked example
A three-year program audits every site once. After a critical pump failure, the audit manager adds a focused audit of that asset class in the same year. The reasoning: program frequency should respond to risk and change, not remain fixed. The program review records the trigger, revised schedule, resources, and criteria.
Traps
- Confusing the program with a single audit plan.
- Scheduling audits by convenience only, ignoring risk.
- Using auditors without evaluating competence or independence.
- Never reviewing program effectiveness.
- Losing records of findings and follow-up.