How to Plan an Effective Audit Programme

Published 14 September 2026

ISO 19011:2018 draws a clear line between two things people often confuse. The audit programme is the set of one or more audits planned for a specific time frame and directed towards a specific purpose. The audit plan is the description of the activities and arrangements for a single audit. Get the programme right and the individual plans almost write themselves.

Start with programme objectives

An audit programme exists to achieve something. Typical objectives include confirming that the management system conforms to the standard and is effectively implemented, supporting certification or its maintenance, evaluating suppliers, checking compliance with legal requirements, or focusing on a known weakness such as document control or customer complaint handling. Write the objectives down. Every audit in the programme should be traceable to at least one of them.

Decide the extent

The extent of the programme depends on the size and nature of the organisation, the number of sites and processes, the maturity of the system, the results of previous audits, and any changes: new products, new locations, new management, new legal requirements. A stable single site with a mature system needs less audit time than a growing multi site business that has just been reorganised.

Allocate effort by risk

The requirement that every process be audited “at planned intervals” does not mean every process gets the same attention. Rank processes by the consequence of failure and by the evidence you already have. High risk, high change or poorly performing processes are audited sooner, more often and in more depth. Low risk stable processes can be sampled less often. Record the reasoning so the programme can be defended at management review or in a certification audit.

Assign competent auditors

Each audit needs an auditor, or a team, with the right combination of knowledge of the standard, understanding of the process and the sector, and auditing skill. Auditors must not audit their own work. Where a technical expert is needed, plan for one. Where a trainee auditor is included, plan for supervision.

Build the individual audit plan

For each audit the plan should state:

• The audit objectives, scope and criteria
• The processes, functions and locations to be audited, with dates and times
• The auditee representatives for each area
• The audit methods, including remote methods if used, and the approach to sampling
• The audit team and any observers or technical experts
• Logistics, confidentiality arrangements and any health and safety requirements
• Arrangements for the opening and closing meetings and for reporting

Send the plan to the auditee in advance and agree it. A plan that is a surprise on the day produces defensive interviews and missing people.

Sequence the audit sensibly

Follow the flow of work. Start where a process begins, for example enquiry and order review, then design, purchasing, production, inspection and delivery. Auditing in process order lets you trace a single order or batch through the system, which is the fastest way to find where controls break down. Leave management review and the internal audit process itself until you have seen the rest, because by then you know what management should have been told.

Monitor and improve the programme

The programme is itself subject to review. Track whether audits happened on time, whether findings were closed, whether the same problems recur, and whether the audits achieved their objectives. Feed that into the next programme. An audit programme that does not change from year to year is not learning.

Where certification fits

Managing an audit programme is a defined competence area in QA Assessor’s Lead Auditor certification. Candidates are assessed on programme objectives, risk based allocation, team selection and the planning of multi site audits, not only on conducting an audit once it has been arranged.