Managing an Audit Program (ISO 19011 Clause 5)

Introduction

An audit program is a set of one or more audits planned for a specific time frame and directed towards a specific purpose. Managing it effectively ensures that audits add value and aren’t just a “tick-box” exercise.

The PDCA Cycle

The management of an audit program follows the Plan-Do-Check-Act cycle.

Plan: Establish the Audit Program

1. Objectives: What do you want to achieve? (e.g., verify compliance, identify improvement opportunities, evaluate supplier performance).
2. Risks and Opportunities: What could affect the program? (e.g., auditor availability, travel restrictions, critical process failures).
3. Scope: What is the extent of the program? (e.g., all sites, specific departments, key suppliers).
4. Resources: Budget, time, and qualified auditors.

Do: Implement the Audit Program

1. Schedule: Define the dates and teams for each audit.
2. Competence: Ensure auditors have the necessary skills and knowledge.
3. Conducting Audits: Execute the individual audits according to Clause 6.
4. Records: Manage the records of audit activities.

Check: Monitor the Audit Program

1. Performance: Are audits being done on time? Are reports issued promptly?
2. Feedback: What do auditees and auditors say?
3. Effectiveness: Are the audit objectives being met?

Act: Review and Improve

1. Review: The audit program manager and the audit client should review the program.
2. Improve: Update the program for the next cycle based on lessons learned.

Key Roles

• Audit Client: The person or organization requesting the audit (usually top management).
• Audit Program Manager: The person responsible for managing the audit program.
• Audit Team Leader: The person leading a specific audit.