8.2 Managing an Audit Programme: Planning, Risks & Resources

8.2 Managing an Audit Programme: Planning, Risks & Resources

Lead Auditor Core Concept: Under ISO 19011:2018 Clause 5 and ISO 45001:2018 Clause 9.2.2, an audit programme is an organization's strategic governance framework for evaluating management system performance over time. The programme manager must proactively evaluate risks that could undermine execution—such as insufficient competence, management resistance, or resource deficits—while leveraging opportunities like combined audits to maximize system maturity.

---

1. Audit Programme Architecture and Clause 9.2.2 Integration

ISO 19011:2018 defines an audit programme as arrangements for a set of one or more audits planned for a specific timeframe and directed towards a specific purpose. ISO 45001 Clause 9.2.2 mandates that organizations establish, implement, and maintain internal audit programmes considering:

1. The importance of the processes concerned;
2. Significant changes affecting organizational structure or operations;
3. Historical performance and results of previous audits;
4. Non-managerial worker consultation under Clause 5.4.

The programme operates across the Plan-Do-Check-Act (PDCA) cycle in ISO 19011 Clause 5:

• Plan (Clauses 5.2 & 5.3): Establish programme objectives and evaluate programme risks and opportunities.
• Do (Clauses 5.4 & 5.5): Establish governance, procedures, and resources, then implement individual audits.
• Check (Clause 5.6): Monitor execution, schedule compliance, and auditor performance.
• Act (Clause 5.7): Review results, identify improvements, and update management review (Clause 9.3).

---

2. Establishing Programme Objectives and Extent

Audit programmes must align with strategic business direction and OH&S policy. Objectives typically include:

• Verifying conformity with ISO 45001:2018 and statutory safety legislation.
• Evaluating the effectiveness of critical operational controls (e.g., lockout/tagout, chemical ventilation).
• Assessing worker participation maturity under Clause 5.4.
• Facilitating continual improvement across high-hazard operations.

Determining Programme Extent (Clause 5.4.3)

The scale and breadth of the programme depend on:

• Operational Complexity: Multi-site networks, remote field units, and shift rosters.
• Risk Profile: Inherent hazard levels (e.g., petrochemical refining vs. warehouse distribution).
• System Maturity: Newly implemented systems require more frequent, rigorous audits than mature systems.
• Internal Changes: Modifications to production technology, organizational restructuring, or regulatory changes.

---

3. Evaluating Audit Programme Risks and Opportunities (Clause 5.3)

Clause 5.3 mandates identifying and mitigating risks and opportunities that affect programme objectives:

Programme Risk Categories

1. Planning Risks: Setting unachievable objectives, allocating unrealistic durations, or scheduling during seasonal production peaks.
2. Resource Risks: Inadequate budgets, insufficient travel time, or lacking essential inspection tools (e.g., personal gas monitors, PPE).
3. Auditor Competence Risks: Deploying auditors who lack technical familiarity with specialized operational hazards (e.g., explosive dusts, high-voltage equipment) or statutory safety mandates.
4. Communication Risks: Poor stakeholder notification, delayed audit plan distribution, or language barriers across international operations.
5. Implementation & Safety Risks: Access permit delays, coordination failures across rotating shifts, and physical OH&S hazards threatening the audit team during field inspections.
6. Security & Confidentiality Risks: Cybersecurity vulnerabilities exposing proprietary designs or employee health surveillance records.

Programme Opportunities

• Combined Audits: Integrating ISO 45001 with ISO 9001 and ISO 14001 to reduce duplication and audit fatigue.
• Remote Auditing: Employing secure video streaming and electronic sampling to audit remote or low-hazard sites efficiently.
• Internal Competence Cultivation: Training frontline supervisors as internal auditors to elevate daily safety culture.

---

4. Operational Implementation: From Programme to Audits (Clause 5.5)

The programme manager translates strategic frameworks into operational execution by:

1. Defining individual audit objectives, scope, and criteria.
2. Appointing an Audit Team Leader (Lead Auditor) and qualified, independent audit team members.
3. Allocating necessary resources, travel support, and technical experts.
4. Ensuring the lead auditor prepares and distributes an individualized Audit Plan (Clause 6.3.2).
5. Engaging non-managerial worker representatives throughout the audit process.

---

5. Programme vs. Plan: The Critical Distinction

---

6. Monitoring, Reviewing, and Improving (Clauses 5.6 & 5.7)

Under Clause 5.6, the programme manager monitors schedule adherence, report quality, auditee feedback, and corrective action closeouts. Under Clause 5.7, the programme is formally reviewed to assess lessons learned, emerging safety risks, and auditor competence. Review outputs feed directly into Top Management Review under Clause 9.3, closing the continual improvement loop.

---

7. Real-World Audit Scenario: The Overextended Programme

Audit Context: During a Stage 2 surveillance audit of a heavy machinery plant, the Lead Auditor examines the internal audit programme under Clause 9.2.2.

Audit Findings:

1. The annual programme scheduled 24 departmental audits, but 10 were cancelled because the sole internal auditor was reassigned to meet production quotas.
2. Audits in high-hazard foundry and robotic welding areas lasted under two hours each.
3. The internal auditor lacked technical training in machinery functional safety and industrial hygiene.
4. The programme manager failed to assess programme risks or report execution failures during management review.

Lead Auditor Evaluation: The auditor issues a Major Nonconformity against ISO 45001 Clause 9.2.2, citing leadership failure (Clause 5.1) and inadequate management review (Clause 9.3). The organization failed to maintain an effective programme based on process importance, allocate adequate resources, and report audit performance to top management.

---

8. Common Exam Traps & Candidate Pitfalls

• Annual Audit Week Fallacy: Assuming internal audits must occur during a single annual event. Effective programmes distribute audits continuously, increasing frequency for high-hazard areas.
• Worker Exclusion Trap: Overlooking mandatory worker consultation under Clause 5.4 when developing the audit programme.
• Auditor Safety Blindspot: Failing to identify physical hazards to the audit team as an audit programme risk under Clause 5.3.
• Static Plan Assumption: Treating the audit plan as an inflexible contract rather than a dynamic operational guide that can be adjusted when critical hazards emerge.