Managing an ISO 20000 audit program
Domain 7 - Managing an ISO 20000 audit program
This domain tests programme-level thinking: how multiple audits are planned, prioritized, resourced, monitored and improved over a cycle. ISO 19011:2018 treats an audit programme as a set of audits planned for a specific time frame and purpose, not just a calendar.
Programme essentials
- Set programme objectives aligned with the SMS's risks, performance and strategic direction.
- Identify risks and opportunities to the programme: auditor availability and competence, access to sites, auditee fatigue, changes in services and supplier dependence.
- Define frequency and coverage using risk, importance, previous results, complaint trends, incident and SLA performance, and changes. High-risk or poorly performing services get more attention.
- Assign competent programme managers and audit teams; manage independence and rotate auditors where needed.
- Implement, monitor and review the programme: track completion, finding trends, corrective-action closure, audit quality and stakeholder feedback; adjust the plan.
- For certification bodies, ISO/IEC 17021-1 sets requirements for initial certification, surveillance and recertification; surveillance is normally at least once a calendar year, and recertification is planned before expiry.
Worked example
A provider runs three internal audits a year but always audits the same five processes. A service with repeated severity-1 incidents and a new supplier has never been audited. The programme manager rebalances: more time on incident, problem and supplier management; a follow-up audit of the supplier interface; fewer audits of stable, low-risk processes. The reasoning: coverage is not the same as frequency. The programme should direct scarce audit resources to where the SMS is most exposed.
Traps
- Treating the audit schedule as the programme; a programme includes objectives, risk, resources and review.
- Auditing by habit rather than by risk and change.
- Using the same auditor for every audit of the same area, weakening independence and fresh perspective.
- Measuring the programme only by the number of audits completed.
- Ignoring corrective-action closure rates and repeat findings when reviewing programme effectiveness.