4.3 Managing the Audit Programme (ISO 19011:2018 Clause 5)
Key Takeaways
- ISO 19011:2018 Clause 5 governs the audit programme; Clause 6 governs each individual audit within it.
- Clause 5.4.4 is 'Determining audit programme resources' while Clause 5.5.4 is 'Selecting audit team members' — a frequently examined distinction.
- Clause 5.3 concerns risks to the audit programme itself, such as resourcing, competence, impartiality, records and ineffective follow-up.
- ISO 14001:2015 Clause 9.2.2 requires the auditee's internal audit programme to consider environmental importance of processes, organizational changes and previous audit results.
- A programme that never covers whole ISO 14001 clauses across its full cycle is a systemic failure and normally supports a major nonconformity.
Managing the Audit Programme (ISO 19011:2018 Clause 5)
Quick Answer: An audit programme is the set of one or more audits planned for a specific time frame and directed towards a specific purpose (ISO 19011:2018 Clause 3.4). Clause 5 governs the programme; Clause 6 governs the individual audit inside it. The distinction matters for the exam because several of the most common EMS nonconformities — inadequate audit coverage, unqualified internal auditors, audits that never reach management — are programme-level failures that cannot be diagnosed by looking at any single audit report.
Programme Versus Individual Audit
AUDIT PROGRAMME (ISO 19011 Clause 5) -- the multi-audit plan
+------------------------------------------------------------------+
| Objectives (5.2) -> Risks & opportunities (5.3) -> |
| Establish (5.4) -> Implement (5.5) -> Monitor (5.6) -> |
| Review & improve (5.7) |
| |
| +------------+ +------------+ +------------+ |
| | INDIVIDUAL | | INDIVIDUAL | | INDIVIDUAL | <-- Clause 6 |
| | AUDIT 1 | | AUDIT 2 | | AUDIT 3 | |
| +------------+ +------------+ +------------+ |
+------------------------------------------------------------------+
A useful test for the exam: if the question is about frequency, coverage, resourcing, auditor selection or trend analysis across audits, it is a Clause 5 question. If it is about one opening meeting, one interview, one finding, it is a Clause 6 question.
The Clause 5 Structure
| Sub-clause | Title | What it requires in practice |
|---|---|---|
| 5.1 | General | Establish a programme covering the audits needed, with authority assigned to competent individuals |
| 5.2 | Establishing audit programme objectives | Objectives derived from management priorities, EMS requirements, compliance obligations, risks and previous results |
| 5.3 | Determining and evaluating audit programme risks and opportunities | Risks to the programme itself: planning, resources, communication, records, ineffective follow-up |
| 5.4 | Establishing the audit programme | 5.4.1 roles and responsibilities of the individual(s) managing it; 5.4.2 their competence; 5.4.3 extent of the programme; 5.4.4 programme resources |
| 5.5 | Implementing the audit programme | 5.5.1 general; 5.5.2 objectives, scope and criteria for each individual audit; 5.5.3 selecting audit methods; 5.5.4 selecting audit team members; 5.5.5 assigning responsibility to the audit team leader; 5.5.6 managing programme results; 5.5.7 managing and maintaining records |
| 5.6 | Monitoring the audit programme | Track whether schedules, objectives and team performance are being met |
| 5.7 | Reviewing and improving the audit programme | Feed results back into objectives, extent and resourcing |
Watch 5.4.4 versus 5.5.4. These are frequently confused and both are commonly examined. 5.4.4 is Determining audit programme resources — money, time, methods, travel, tooling. 5.5.4 is Selecting audit team members — the competence, impartiality and composition of a specific team. A question about whether the audit team collectively held the environmental technical competence is a 5.5.4 question.
Programme Objectives (5.2)
ISO 19011 expects programme objectives to be consistent with the audit client's strategic direction and to take into account matters such as management system priorities, requirements of the management system standard, compliance obligations, the needs of interested parties, auditee performance and maturity level, and the results of previous audits.
An EMS example, phrased the way an internal audit programme should be:
"Over the 2026 programme year, verify conformity of all Tier 1 significant environmental aspects against ISO 14001:2015 and applicable permits; verify closure effectiveness of all 2025 findings; and provide management review with evidence of compliance status across all three manufacturing lines."
Contrast that with the objective a weak auditee actually writes: "Complete four internal audits." That is a schedule, not an objective, and it cannot be monitored under Clause 5.6 because it says nothing about what the audits are supposed to achieve.
Programme Risks and Opportunities (5.3)
This clause is about risks to the audit programme, not to the environment. Typical EMS programme risks:
- Planning risk — the programme is built around the calendar rather than around the environmental importance of the processes, so the effluent plant is audited in the same depth as the stationery store.
- Resource risk — a single overloaded EHS coordinator is the entire internal audit function, so audits slip whenever operations get busy.
- Competence risk — internal auditors have EMS awareness training but no technical understanding of the permits they are supposed to verify.
- Impartiality risk — the person auditing waste management also manages waste management.
- Records risk — audit results exist in personal notebooks rather than retained documented information.
- Follow-up risk — findings are raised and never verified as effectively closed.
Corresponding opportunities include combining EMS audits with quality and OH&S audits (a combined audit, ISO 19011 Clause 3.2), and using remote audit methods for documentation-heavy processes to release on-site time for the high-risk operational areas.
What a Lead Auditor Actually Does With Clause 5
In a third-party ISO 14001 audit you are not auditing against ISO 19011 — your criteria are ISO 14001, the permits and the auditee's own documents. But ISO 14001 Clause 9.2.2 requires the auditee to run an internal audit programme, and Clause 5 of ISO 19011 is the professional benchmark you use to judge whether theirs is credible. The audit trail is:
- Ask for the programme, not the reports. A programme should show scope, frequency, methods, responsibilities, planning requirements and reporting arrangements.
- Test the risk basis. Does frequency and depth track the environmental importance of the processes concerned, changes affecting the organization, and the results of previous audits? Those three considerations are explicit in ISO 14001 Clause 9.2.2.
- Test coverage across the cycle. Has every clause of ISO 14001 and every significant aspect been covered within the stated programme period? Gaps here are systemic.
- Test auditor selection. Clause 9.2.2 b) requires auditors to be selected and audits conducted so as to ensure objectivity and the impartiality of the audit process.
- Test reporting. Clause 9.2.2 c) requires results to be reported to relevant management — not filed.
- Test the feedback loop. Do internal audit results actually appear as a management review input under Clause 9.3?
Common Findings at the Programme Level
| Observed evidence | Likely grade | Why |
|---|---|---|
| Internal audit programme exists but has never covered Clauses 4, 5 or 9.3 | Major | Whole-clause coverage gap over the full cycle indicates the programme cannot demonstrate conformity |
| Programme schedules every process at equal annual frequency regardless of aspect significance | Minor to Major depending on scale | Fails the "environmental importance of the processes concerned" consideration in Clause 9.2.2 |
| One audit of twelve was conducted a month late, with the delay authorised and recorded | Minor | Isolated slippage in an otherwise functioning programme |
| The maintenance supervisor audited the maintenance department | Minor to Major | Breaches the objectivity and impartiality requirement of Clause 9.2.2 b) |
| Findings raised in three consecutive years on the same waste stream, all closed on paper | Major | Demonstrates the programme's follow-up is ineffective and the cumulative effect indicates systemic failure |
A closing thought that examiners like: the audit programme is the auditee's own early-warning system. If it is weak, every other part of the EMS is running without instrumentation — which is precisely the reasoning that turns a coverage gap into a major nonconformity rather than a minor one.
Under ISO 19011:2018, which sub-clause covers selecting audit team members?
An auditee's internal audit programme schedules every department for one audit per year, including both an electroplating line with significant aspects and a stationery store with none. Which requirement is most directly challenged?
Which of the following is an audit programme risk in the sense intended by ISO 19011:2018 Clause 5.3?
A lead auditor finds that internal audit results are recorded in the EHS coordinator's personal notebook and are never presented to line management or to management review. Which ISO 14001:2015 requirements are engaged?