Guidelines for Auditing Management Systems

ISO 19011:2018 - Guidelines for auditing management systems

5 Managing an audit programme

5.3 Determining and evaluating audit programme risks and opportunities

an audit programme and can affect the achievement of its objectives. The individual(s) managing the audit programme should identify and present to the audit client the risks and opportunities considered when developing the audit programme and resource requirements, so that they can be addressed appropriately.

There can be risks associated with the following:

a) planning, e.g. failure to set relevant audit objectives and determine the extent, number, duration, locations and schedule of the audits;

b) resources, e.g. allowing insufficient time, equipment and/or training for developing the audit programme or conducting an audit;

c) selection of the audit team, e.g. insufficient overall competence to conduct audits effectively;

d) communication, e.g. ineffective external/internal communication processes/channels;

e) implementation, e.g. ineffective coordination of the audits within the audit programme, or not considering information security and confidentiality;

f) control of documented information, e.g. ineffective determination of the necessary documented information required by auditors and relevant interested parties, failure to adequately protect audit records to demonstrate audit programme effectiveness;

g) monitoring, reviewing and improving the audit programme, e.g. ineffective monitoring of audit programme outcomes;

h) availability and cooperation of auditee and availability of evidence to be sampled.

Opportunities for improving the audit programme can include:

- allowing multiple audits to be conducted in a single visit;

- minimizing time and distances travelling to site;

- matching the level of competence of the audit team to the level of competence needed to achieve the audit objectives;

- aligning audit dates with the availability of auditee’s key staff.