Who this is for: Whoever plans the audit programme, usually the quality, health and safety or environmental manager.
An audit programme is the plan of which audits run, when and by whom over a period, usually a year. ISO 9001, 14001 and 45001 all ask for one in clause 9.2. They expect it to reflect how important each process is, changes that affect the organisation, and the results of earlier audits.
Step 1 — List what needs auditing
List the processes, sites and standard clauses in scope. Each management system clause and each significant process should be audited at least once in the certification cycle, typically three years. Most organisations aim to cover everything once a year.
Step 2 — Rate each area by risk
Give each area a simple rating such as high, medium or low, based on:
How much harm a failure would cause, to customers, people or the environment
Recent nonconformities, incidents, complaints or near misses
Recent changes: new equipment, processes, people, suppliers or legal requirements
How the area performed at its last audit
Step 3 — Set a frequency for each rating
Risk | Typical frequency |
High | Every 3–6 months |
Medium | Every 6–12 months |
Low | Every 12–36 months, within the certification cycle |
These are starting points, not rules. Increase the frequency after a major nonconformity or a significant change, and reduce it when an area performs consistently well.
Step 4 — Assign auditors who are competent and independent
Auditors should not audit their own work. Use the Auditor Register to see who is competent for each standard.
Step 5 — Put the programme into Audit365
Make sure each audit has a published template in My Audit Templates.
Schedule each audit with its planned date, location and auditor.
Use the dashboard widgets and Audit Records to track what is scheduled, in progress and overdue.
Review the programme at least once a year, and after major nonconformities, incidents or changes. Management review (clause 9.3) is a natural point to do this.
If this doesn't work
You can't schedule an audit — check the template is published and that scheduled audits are switched on in Audit Settings.
The auditor you want isn't offered — check their competence status in the Auditor Register.
You're close to your audit allowance — scheduled audits count towards it. Plan the year's numbers against your allowance before you schedule.
Related articles