5.3 Risk-Based Audit Planning, Sampling Strategy & Audit Plans

5.2 Risk-Based Audit Planning, Sampling Strategy & Audit Plans

Quick Answer: Audit planning under ISO 19011:2018 Clause 6.3.2 requires a risk-based approach where audit time, team competence, and investigative intensity are concentrated on significant environmental aspects (SEAs), complex regulatory emission points, past nonconformances, and high-risk outsourced processes. Audit duration is calculated using IAF MD 5, factoring in organizational headcount, environmental complexity, and multi-shift operations. Because auditors sample rather than inspect 100% of data, they balance judgment-based sampling against statistical sampling, actively managing the danger of Type II audit errors (failing to detect an active nonconformity).

---

Developing the Audit Plan (ISO 19011:2018 Clause 6.3.2)

The audit plan is the operational blueprint governing the execution of an audit. Developed by the Lead Auditor in consultation with the audit team and the auditee, it translates audit scope and objectives into a coordinated, resource-allocated schedule.

According to ISO 19011:2018 Clause 6.3.2.2, a comprehensive audit plan must explicitly document:

1. Audit objectives, scope, and criteria: Clear boundaries (physical sites, processes, divisions) and the governing reference standard (ISO 14001:2015, permits, legal codes);
2. Locations, dates, and expected duration: Specific schedule of on-site and remote activities, including opening/closing meetings, site walkthroughs, and interim management briefings;
3. Audit methods and technologies: Direct observation, physical inspection, interviews, document sampling, remote screen-sharing, or automated sensor verification;
4. Allocation of audit team roles and responsibilities: Specific assignment of auditors, technical experts, observers, and guides to processes and clauses based on competence;
5. Resource allocation: Time allocated to each operational unit, high-risk process, and management function;
6. Logistics, health & safety, and security: Mandatory personal protective equipment (PPE), site inductions, explosion-proof electronic hardware, and confidentiality agreements.

The Lead Auditor's Principle of Flexibility: An audit plan is not a static legal contract; it is a dynamic operational guide. If preliminary walkthroughs or sampling reveal unexpected evidence of severe contamination, unmonitored discharges, or permit violations, the Lead Auditor has the authority and professional duty to adjust the plan, reallocate auditor hours, and pursue critical audit trails.

---

Risk-Based Audit Planning in an EMS Context

ISO 19011:2018 places explicit emphasis on the risk-based approach (Principle 7). In environmental auditing, treating every process with equal audit intensity is an auditing failure. Auditing the administration office's paper recycling bin for two hours while allocating only thirty minutes to an industrial chemical solvent distillation column violates risk-based planning.

+-------------------------------------------------------------------------+
|                    RISK-BASED RESOURCE ALLOCATION                       |
+------------------------------------+------------------------------------+
| HIGH AUDIT INTENSITY & SAMPLING    | MODERATE / LOW AUDIT INTENSITY     |
+------------------------------------+------------------------------------+
| - Significant Aspects (SEAs)       | - Low-impact office administration |
| - Chemical storage, bunding, tanks | - Minor non-hazardous waste sorting|
| - Industrial effluent / scrubbers  | - General corporate communications |
| - Regulated stack discharge points | - Static document formatting       |
| - History of regulatory complaints | - Repetitive low-risk warehouse ops|
| - Night-shift batch operations     | - Routine procurement of stationery|
+------------------------------------+------------------------------------+

When preparing the Stage 2 plan, the Lead Auditor reviews the Stage 1 outputs and weights audit duration based on five environmental risk vectors:

1. Significance of Environmental Aspects: Processes generating hazardous emissions, toxic sludges, high volatile organic compound (VOC) releases, or high energy consumption receive prioritized time and deep sampling;
2. Regulatory and Statutory Sensitivity: Facilities operating under strict Integrated Pollution Prevention and Control (IPPC) permits or environmental agency consent orders demand intense verification of monitoring records, calibration logs, and compliance evaluation under Clause 9.1.2;
3. Process Complexity and Failure Severity: Highly automated continuous chemical syntheses vs. manual batch chemical mixing. Complex systems where human error causes immediate environmental catastrophes require extensive operational control verification (Clause 8.1);
4. Historical Environmental Performance: Past spill incidents, citizen odor complaints, regulatory enforcement warning letters, or recurring internal audit nonconformities require targeted follow-up;
5. High-Risk Outsourced Operations: Waste transportation brokers, off-site hazardous waste incinerators, and tank cleaning contractors (Clause 8.1 life-cycle and supplier control).

---

Audit Sampling Strategies: Judgment-Based vs. Statistical Sampling

Auditors cannot inspect every transaction, verify every manifest, or interview every employee. Conformity assessment relies fundamentally on sampling (governed by ISO 19011:2018 Annex A.6).

+-------------------------------------------------------------------------+
|                      AUDIT SAMPLING METHODOLOGIES                       |
+------------------------------------+------------------------------------+
| JUDGMENT-BASED (PURPOSIVE)         | STATISTICAL SAMPLING               |
+------------------------------------+------------------------------------+
| - Based on auditor expertise       | - Based on probability theory      |
| - Focuses on high-risk aspects     | - Used for large, uniform records  |
| - Samples abnormal / extreme cases | - Random or systematic intervals   |
| - Uncovers localized vulnerabilities| - Statistically defensible error   |
| - Subject to auditor bias          | - Requires large homogeneous data  |
+------------------------------------+------------------------------------+

1. Judgment-Based (Purposive) Sampling

Judgment-based sampling relies on the auditor's professional judgment, technical knowledge of the industry, and risk awareness to deliberately select sample items.

• How it is applied: The auditor intentionally targets high-risk operational windows, complex chemical reactions, equipment operating at boundary limits, or records generated during shift changes;
• EMS Applications: Selecting which environmental aspects to trace; choosing which chemical storage tanks to inspect physically; picking the emergency drill scenario involving cyanide instead of a routine fire alarm drill;
• Strength: Highly efficient at identifying weaknesses in complex, non-homogeneous processes;
• Limitation: Findings cannot be mathematically extrapolated to the total population; risk of auditor confirmation bias.

2. Statistical Sampling

Statistical sampling relies on probability theory to select sample items from a large, homogeneous population, ensuring every item has a known probability of selection.

• How it is applied: Using stratified random sampling or systematic interval sampling (e.g., inspecting every 15th consignment note across a 12-month period);
• EMS Applications: Reviewing 50 out of 2,500 hazardous waste consignment manifests; sampling 30 out of 365 daily wastewater discharge monitoring readings; sampling 25 out of 400 equipment calibration certificates;
• Strength: Provides mathematically objective, defensible conclusions with a quantified confidence level (e.g., 95% confidence level with a 5% margin of error);
• Limitation: Ineffective for small populations or highly diverse operational activities.

---

Sampling Risks: The Auditor's Dilemma (Type I vs. Type II Errors)

Because auditing relies on sampling, absolute certainty is impossible. An auditor provides reasonable assurance. This introduces sampling risk:

Lead Auditor Exam Rule: In environmental lead auditing, Type II errors are far more critical than Type I errors. If an auditor samples only five flawless waste transfer notes during a slow Tuesday morning and misses widespread illegal hazardous waste dumping occurring on Friday afternoons, the audit has failed in its fundamental purpose.

To minimize Type II risk, auditors combine random selection with risk-targeted judgment, increase sample sizes when initial variations appear, and cross-validate documentation with physical floor observations.

---

Determining Audit Duration: The IAF MD 5 Framework

Audit duration for third-party certification is not arbitrary. Accredited certification bodies must determine audit time in accordance with IAF MD 5 (Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems).

Audit duration is measured in Auditor Days (typically 8 hours per day on-site). IAF MD 5 establishes baseline audit duration based on three primary drivers:

1. Effective Number of Personnel: Headcount of all employees, full-time equivalents (FTE), temporary workers, and contractors whose activities impact environmental performance;
2. Environmental Complexity Category of the Organization: IAF MD 5 classifies industrial activities into four complexity bands:
   • High Complexity: Large chemical plants, petroleum refining, primary steelmaking, hazardous waste processing, paper pulp mills. Demands substantial audit time and specialized technical experts;
   • Medium Complexity: General manufacturing, food processing, commercial printing, textile dyeing, automotive parts assembly;
   • Low Complexity: General warehousing, light packaging, assembly of dry electronic components, retail logistics;
   • Limited Complexity: Corporate office headquarters, software development, commercial leasing.
3. Factors Increasing or Decreasing Audit Duration:
   • Increases: Complex regulatory regime; sprawling site geography; sensitive local environment (adjacent river or wetlands); multiple operational shifts (24/7 operations); history of environmental prosecutions;
   • Decreases: Highly automated repetitive processes; prior ISO 9001/ISO 45001 certification (integrated management systems); compact modern facility.

Auditing Across Shifts

If an industrial site operates on three 8-hour shifts (Day, Evening, Night), IAF MD 5 mandates that the audit plan include coverage of all operational shifts where significant environmental aspects occur. Auditing solely during normal business hours (09:00 to 17:00) is unacceptable if chemical batch processing, waste incineration, or wastewater neutralization occurs on night shifts.

---

Worked Example: 2-Day Stage 2 Audit Schedule / Matrix

The following audit matrix illustrates an operational audit schedule for a medium-complexity chemical formulator (Apex Precision Chem-Tech Ltd., 120 personnel, 2 operational shifts). The audit team consists of Auditor 1 (Lead Auditor - Environmental Systems Specialist) and Auditor 2 (Technical Auditor - Chemical Processes).

---

Realistic Audit Scenario: The Overlooked Second Shift

Scenario: A commercial metal finishing and electroplating plant operates two distinct shifts: Shift 1 (07:00 - 15:30) performs automated electroplating and chemical polishing; Shift 2 (15:30 - 24:00) performs manual tank stripping, spent acid dump neutralization, and hazardous sludge filter pressing. The Lead Auditor drafts an audit plan running strictly from 08:30 to 16:30 each day, allocating zero hours to Shift 2.

During Day 1 at 15:00, Auditor 2 interviews the daytime wastewater operator, who remarks: "We don't do any cyanide neutralization or acid bath dumping on our shift; that's all handled by the night crew after 18:00 because of the fumes."

Lead Auditor Evaluation: Under ISO 19011:2018 and IAF MD 5, the Lead Auditor committed a critical planning error by failing to allocate audit time to the second shift. The operations with the highest environmental risk (cyanide neutralization, spent acid transfers, and toxic sludge pressing) take place entirely on Shift 2.

The Lead Auditor exercises the principle of audit plan flexibility: they immediately convene an interim briefing with the Managing Director, amend the audit plan, and reschedule Auditor 2 to audit Shift 2 from 18:00 to 21:30 that evening. This uncovers that Shift 2 operators were neutralizing cyanide without secondary containment and operating the scrubber below minimum water flow rates, leading to an immediate Major Nonconformity under Clause 8.1.