Chapter: 1 – Managing audit program

1. Introduction
An audit program includes audits addressing one or more management system standards or
other requirements. Such audits can be conducted either separately or in combination (also
called combined audit). This chapter aims to provide our training participants with vital
knowledge that will be helpful when managing audit program for the audit of management
systems of any organizations. The information provided in this chapter are based on ISO
19011:2018Guidelines for auditing management systems.
2. The extent of an audit program
The extent of an audit program varies and depends mainly on the size and nature of the
auditee, as well as on the nature, functionality, complexity, the type of risks and opportunities,
and the level of maturity of the management system(s) to be audited.The functionality of the
management system can be even more complex when most of the important functions are
outsourced and managed under the leadership of other organizations. Particular attention
should be paid to where the most important decisions are made and what constitutes the top
management of the management system.
In the case of multiple locations/sites, or where important functions are outsourced and
managed under the leadership of another organization, particular attention should be paid to
the design, planning and validation of the audit program.In the case of smaller or less complex
organizations, the audit program can be scaled appropriately.
Understanding the context of the auditee is very important for any audit program.Therefore, the
audit program should take into account the auditee’s organizational objectives, relevant
external and internal issues, needs and expectations of relevant interested partiesand the
information security and confidentiality requirements of the organization.
The planning of internal audit programs and, in some cases programs for auditing external
providers, can be arranged to contribute to other objectives of the organization.
The person(s) managing the audit program should ensure the integrity of the audit is
maintained and that there is not undue influence exerted over the audit.
Audit priority should be given to allocating resources and methods to matters in a management
system with higher inherent risk and lower level of performance.
Competent individuals should be assigned to manage the audit program.
The audit program should include information and identify resources to enable the audits to be
conducted effectively and efficiently within the specified time frames. The information should
include:
1. Objectives for the audit program;
2. Risks and opportunities associated with the audit program and the actions to address
them;
3. Scope (extent, boundaries, locations) of each audit within the audit program;
4. Schedule (number/duration/frequency) of the audits;
5. Audit types, such as internal or external;
6. Audit criteria;
7. Audit methods to be employed;
8. Criteria for selecting audit team members;
9. Relevant documented information.

Copyright 2023 @ Punyam Academy | [email protected] | +91-9825031523 Page 1 of 10

 Chapter: 1 – Managing audit program
Some of this information may not be available until more detailed audit planning is complete.
The implementation of the audit program should be monitored and measured on an ongoing
basis to ensure its objectives have been achieved. The audit program should be reviewed in
order to identify needs for changes and possible opportunities for improvements.
3. Establishing audit program objectives
The audit program objectives help the person(s) managing audit program to direct the planning
and conducting of audits. Therefore, the audit client should ensure to establish the audit
program objectives and also ensure that the audit program is implemented effectively. Audit
program objectives should be consistent with the audit client’s strategic direction and support
management system policy and objectives.
The following should be considered for establishing the audit program objectives:
1. Needs and expectations of relevant interested parties, both external and internal;
2. Characteristics of and requirements for processes, products, services and projects, and
any changes to them;
3. Management system requirements;
4. Need for evaluation of external providers;
5. Auditee’s level of performance and level of maturity of the management system(s), as
reflected in relevant performance indicators (e.g., KPIs), the occurrence of
nonconformities or incidents or complaints from interested parties;
6. Identified risks and opportunities to the auditee;
7. Results of previous audits.
Some examples of audit program objectivesare mentioned below:
 Determine the continuing suitability, adequacy and effectiveness of the auditee’s
management system;
 Conform to all relevant requirements, e.g., statutory and regulatory requirements,
compliance commitments, requirements for certification to a management system
standard;
 Identify opportunities for the improvement of a management system and its
performance;
 Evaluate the capability of the auditee to determine its context;
 Evaluate the capability of the auditee to determine risks and opportunities and to
identify and implement effective actions to address them;
 Obtain and maintain confidence in the capability of an external provider;
 Evaluate the compatibility and alignment of the management system objectives with the
strategic direction of the organization.
4. Determining and evaluating audit program risks and opportunities
There are risks and opportunities related to the context of the auditee that can be associated
with an audit program and can affect the achievement of its objectives. The person(s)
managing the audit program should identify and present to the audit client the risks and
opportunities considered when developing the audit program and resource requirements, so
that they can be addressed appropriately.
There can be risks associated with the following:

Copyright 2023 @ Punyam Academy | [email protected] | +91-9825031523 Page 2 of 10

 Chapter: 1 – Managing audit program
1. Planning, e.g., failure to set relevant audit objectives and determine the extent, number,
duration, locations and schedule of the audits;
2. Resources, e.g., allowing insufficient time, equipment and/or training for developing the
audit program or conducting an audit;
3. Selection of the audit team, e.g., insufficient overall competence to conduct audits
effectively;
4. Communication, e.g., ineffective external/internal communication processes/channels;
5. Implementation, e.g., ineffective coordination of the audits within the audit program, or
not considering information security and confidentiality;
6. Control of documented information, e.g., ineffective determination of the necessary
documented information required by auditors and relevant interested parties, failure to
adequately protect audit records to demonstrate audit program effectiveness;
7. Monitoring, reviewing and improving the audit program, e.g., ineffective monitoring of
audit program outcomes;
8. Availability and cooperation of auditee and availability of evidence to be sampled.
Opportunities for improving the audit program can include:
 Allowing multiple audits to be conducted in a single visit;
 Minimizing time and distances travelling to site;
 Matching the level of competence of the audit team to the level of competence needed
to achieve the audit objectives;
 Aligning audit dates with the availability of auditee’s key staff.
5. Establishing the audit program
5.1 Roles and responsibilities of the person(s) managing the audit program
The person(s) managing the audit program should:
1. Establish the extent of the audit program according to the relevant objectives (see 5.2)
and any known constraints;
2. Determine the external and internal issues, and risks and opportunities that can affect
the audit program, and implement actions to address them, integrating these actions in
all relevant auditing activities, as appropriate;
3. Ensuring the selection of audit teams and the overall competence for the auditing
activities by assigning roles, responsibilities and authorities, and supporting leadership,
as appropriate;
4. Establish all relevant processes including processes for:
 The coordination and scheduling of all audits within the audit program;
 The establishment of audit objectives, scope(s) and criteria of the audits,
determining audit methods and selecting the audit team;
 Evaluating auditors;
 The establishment of external and internal communication processes, as
appropriate;
 The resolutions of disputes and handling of complaints;
 Audit follow-up if applicable;
 Reporting to the audit client and relevant interested parties, as appropriate.
5. Determine and ensure provision of all necessary resources;
6. Ensure that appropriate documented information is prepared and maintained, including
audit program records;

Copyright 2023 @ Punyam Academy | [email protected] | +91-9825031523 Page 3 of 10

 Chapter: 1 – Managing audit program
7. Monitor, review and improve the audit program;
8. Communicate the audit program to the audit client and, as appropriate, relevant
interested parties.
The person(s) managing the audit program should request its approval by the audit client.
5.2 Competence of person(s) managing audit program
The person(s) managing the audit program should have the necessary competence to manage
the program and its associated risks and opportunities and external and internal issues
effectively and efficiently, including knowledge of:
1. Audit principles, methods and processes;
2. Management system standards, other relevant standards and reference/guidance
documents;
3. Information regarding the auditee and its context (e.g., external/internal issues, relevant
interested parties and their needs and expectations, business activities, products,
services and processes of the auditee);
4. Applicable statutory and regulatory requirements and other requirements relevant to the
business activities of the auditee.
As appropriate, knowledge of risk management, project and process management, and
information and communications technology (ICT) may be considered.
The person(s) managing the audit program should engage in appropriate continual
development activities to maintain the necessary competence to manage the audit program.
5.3 Establishing extent of audit program
The person(s) managing the audit program should determine the extent of the audit program.
This can vary depending on the information provided by the auditee regarding its context.
In certain cases, depending on the auditee's structure or its activities, the audit program might
only consist of a single audit (e.g., a small project or organization).
Other factors impacting the extent of an audit program can include the following:
1. The objective, scope and duration of each audit and the number of audits to be
conducted, reporting method and, if applicable, audit follow up;
2. The management system standards or other applicable criteria;
3. The number, importance, complexity, similarity and locations of the activities to be
audited;
4. Those factors influencing the effectiveness of the management system;
5. Applicable audit criteria, such as planned arrangements for the relevant management
system standards, statutory and regulatory requirements and other requirements to
which the organization is committed;
6. Results of previous internal or external audits and management reviews, if appropriate;
7. Results of a previous audit program review;
8. Language, cultural and social issues;
9. the concerns of interested parties, such as customer complaints, non-compliance with
statutory and regulatory requirements and other requirements to which the organization
is committed, or supply chain issues;
10. Significant changes to the auditee’s context or its operations and related risks and
opportunities;

Copyright 2023 @ Punyam Academy | [email protected] | +91-9825031523 Page 4 of 10

 Chapter: 1 – Managing audit program
11. Availability of information and communication technologies to support audit activities, in
particular the use of remote audit methods.
12. The occurrence of internal and external events, such as nonconformities of products or
service, information security leaks, health and safety incidents, criminal acts or
environmental incidents;
13. Business risks and opportunities, including actions to address them.
5.4 Determining audit program resources
When determining resources for the audit program, the person(s) managing the audit program
should consider:
1. The financial and time resources necessary to develop, implement, manage and
improve audit activities;
2. Audit methods;
3. The individual and overall availability of auditors and technical experts having
competence appropriate to the particular audit program objectives;
4. The extent of the audit program and audit program risks and opportunities;
5. Travel time and cost, accommodation and other auditing needs;
6. The impact of different time zones;
7. The availability of information and communication technologies (e.g., technical
resources required to set up a remote audit using technologies that support remote
collaboration);
8. The availability of any tools, technology and equipment required;
9. The availability of necessary documented information, as determined during the
establishment of the audit program;
10. Requirements related to the facility, including any security clearances and equipment
(e.g., background checks, personal protective equipment, ability to wear clean room
attire).
6. Implementation of audit program
After establishing the audit program, determine the resourcesneededand then implement the
audit program.
The person(s) managing the audit program should:
1. Communicate the relevant parts of the audit program, including the risks and
opportunities involved, to relevant interested parties and inform them periodically of its
progress, using established external and internal communication channels;
2. Define objectives, scope and criteria for each individual audit;
3. Select audit methods;
4. Coordinate and schedule audits and other activities relevant to the audit program;
5. Ensure the audit teams have the necessary competence;
6. Provide necessary individual and overall resources to the audit teams;
7. Ensure the conduct of audits in accordance with the audit program, managing all
operational risks, opportunities and issues (i.e., unexpected events), as they arise
during the deployment of the program;
8. Ensure relevant documented information regarding the auditing activities is properly
managed and maintained;
9. Define and implement the operational controls necessary for audit program monitoring;
10. Review the audit program in order to identify opportunities for its improvement.

Copyright 2023 @ Punyam Academy | [email protected] | +91-9825031523 Page 5 of 10

 Chapter: 1 – Managing audit program
5.1 Defining the objectives, scope and criteria for an individual audit
There should be well defined audit objectives, scope and criteria for each individual audit.
These should be consistent with the overall audit program objectives.The audit objectives
define what is to be accomplished by the individual audit and may include the following:
1. Determination of the extent of conformity of the management system to be audited, or
parts of it, with audit criteria;
2. Evaluation of the capability of the management system to assist the organization in
meeting relevant statutory and regulatory requirements and other requirements to which
the organization is committed;
3. Evaluation of the effectiveness of the management system in meeting its intended
results;
4. Identification of opportunities for potential improvement of the management system;
5. Evaluation of the suitability and adequacy of the management system with respect to
the context and strategic direction of the auditee;
6. Evaluation of the capability of the management system to establish and achieve
objectives and effectively address risks and opportunities, in a changing context,
including the implementation of the related actions.
The audit scope should be consistent with the audit program and audit objectives. It includes
such factors as locations, functions, activities and processes to be audited, as well as the time
period covered by the audit.
The audit criteria are used as a reference against which conformity is determined. These may
include one or more of the following: applicable policies, processes, procedures, performance
criteria including objectives, statutory and regulatory requirements, management system
requirements, information regarding the context and the risks and opportunities as determined
by the auditee (including relevant external/internal interested parties’ requirements), sector
codes of conduct or other planned arrangements.
In the event of any changes to the audit objectives, scope or criteria, the audit program should
be modified if necessary and communicated to interested parties, for approval if appropriate.
When more than one discipline is being audited at the same time it is important that the audit
objectives, scope and criteria are consistent with the relevant audit programs for each
discipline. Some disciplines can have a scope that reflects the whole organization and others
can have a scope that reflects a subset of the whole organization.
5.2 Selecting and determining audit methods
The person(s) managing the audit program should select and determine the methods for
effectively and efficiently conducting an audit, depending on the defined audit objectives, scope
and criteria.
Audits can be performed on-site, remotely or as a combination. The use of these methods
should be suitably balanced, based on, among others, consideration of associated risks and
opportunities.
Where two or more auditing organizations conduct a joint audit of the same auditee, the
individuals managing the different audit programs should agree on the audit methods and
consider implications for resourcing and planning the audit. If an auditee operates two or more
management systems of different disciplines, combined audits may be included in the audit
program.

Copyright 2023 @ Punyam Academy | [email protected] | +91-9825031523 Page 6 of 10

 Chapter: 1 – Managing audit program
5.3 Selecting audit team members
The person(s) managing the audit program should appoint the members of the audit team,
including the team leader and any technical experts needed for the specific audit.
An audit team should be selected, taking into account the competence needed to achieve the
objectives of the individual audit within the defined scope. If there is only one auditor, the
auditor should perform all applicable duties of an audit team leader.
To assure the overall competence of the audit team, the following steps should be performed:
1. Identification of the competence needed to achieve the objectives of the audit;
2. Selection of the audit team members so that the necessary competence is present in
the audit team.
In deciding the size and composition of the audit team for the specific audit, consideration
should be given to the following:
1. The overall competence of the audit team needed to achieve audit objectives, taking
into account audit scope and criteria;
2. Complexity of the audit;
3. Whether the audit is a combined or joint audit;
4. The selected audit methods;
5. Ensuring objectivity and impartiality to avoid any conflict of interest of the audit process;
6. The ability of the audit team members to work and interact effectively with the
representatives of the auditee and relevant interested parties;
7. The relevant external/internal issues, such as the language of the audit, and the
auditee’s social and cultural characteristics. These issues may be addressed either by
the auditor's own skills or through the support of a technical expert, also considering the
need for interpreters;
8. Type and complexity of the processes to be audited.
9. Where appropriate, the person(s) managing the audit program should consult the team
leader on the composition of the audit team.
If the necessary competence is not covered by the auditors in the audit team, technical experts
with additional competence should be made available to support the team.
Auditors-in-training may be included in the audit team, but should participate under the
direction and guidance of an auditor.
Changes to the composition of the audit team may be necessary during the audit, e.g., if a
conflict of interest or competence issue arises. If such a situation arises, it should be resolved
with the appropriate parties (e.g., audit team leader, the person(s) managing the audit program,
audit client or auditee) before any changes are made.
5.4 Assigning responsibility for an individual audit to the audit team leader
The person(s) managing the audit program should assign the responsibility for conducting the
individual audit to an audit team leader.The assignment should be made in sufficient time
before the scheduled date of the audit, in order to ensure the effective planning of the audit.
To ensure effective conduct of the individual audits, the following information should be
provided to the audit team leader:
1. Audit objectives;
2. Audit criteria and any relevant documented information;
Copyright 2023 @ Punyam Academy | [email protected] | +91-9825031523 Page 7 of 10
 Chapter: 1 – Managing audit program
3. Audit scope, including identification of the organization and its functions and processes
to be audited;
4. Audit processes and associated methods;
5. Composition of the audit team;
6. Contact details of the auditee, the locations, time frame and duration of the audit
activities to be conducted;
7. Resources necessary to conduct the audit;
8. Information needed for evaluating and addressing identified risks and opportunities to
the achievement of the audit objectives;
9. Information which supports the audit team leader(s) in their interactions with the auditee
for the effectiveness of the audit program.
The assignment information should also cover the following, as appropriate:
1. Working and reporting language of the audit where this is different from the language of
the auditor or the auditee, or both;
2. Audit reporting output as required and to whom it is to be distributed;
3. Matters related to confidentiality and information security, as required by the audit
program;
4. Any health, safety and environmental arrangements for the auditors;
5. Requirements for travel or access to remote sites;
6. Any security and authorization requirements;
7. Any actions to be reviewed, e.g., follow-up actions from a previous audit;
8. Coordination with other audit activities, e.g., when different teams are auditing similar or
related processes at different locations or in the case of a joint audit.
Where a joint audit is conducted, it is important to reach agreement among the organizations
conducting the audits, before the audit commences, on the specific responsibilities of each
party, particularly with regard to the authority of the team leader appointed for the audit.
5.5 Managing audit program results
The person(s) managing the audit program should ensure that the following activities are
performed:
1. Evaluation of the achievement of the objectives for each audit within the audit program;
2. Review and approval of audit reports regarding the fulfilment of the audit scope and
objectives;
3. Review of the effectiveness of actions taken to address audit findings;
4. Distribution of audit reports to relevant interested parties;
5. Determination of the necessity for any follow-up audit.
The individual managing the audit program should consider, where appropriate:
1. Communicating audit results and best practices to other areas of the organization, and
2. The implications for other processes.
5.6 Managing and maintaining audit program records
The person(s) managing the audit program should ensure that audit records are generated,
managed and maintained to demonstrate the implementation of the audit program. Processes
should be established to ensure that any information security and confidentiality needs
associated with the audit records are addressed.

Copyright 2023 @ Punyam Academy | [email protected] | +91-9825031523 Page 8 of 10

 Chapter: 1 – Managing audit program
Audit program records include the following:
Records related to the audit program:
 Schedule of audits;
 Audit program objectives and extent;
 Those addressing audit program risks and opportunities, and relevant external and
internal issues;
 Reviews of the audit program effectiveness.
Records related to each audit:
 Audit plans and audit reports;
 Objective audit evidence and findings;
 Nonconformity reports;
 Corrections and corrective action reports;
 Audit follow-up reports.
Records related to the audit team covering topics:
 Competence and performance evaluation of the audit team members;
 Criteria for the selection of audit teams and team members and formation of audit
teams;
 Maintenance and improvement of competence.
The form and level of detail of the records should demonstrate that the objectives of the audit
program have been achieved.
7. Monitoring audit program
The person(s) managing the audit program should ensure the evaluation of:
1. Whether schedules are being met and audit program objectives are being achieved;
2. The performance of the audit team members including the audit team leader and the
technical experts;
3. The ability of the audit teams to implement the audit plan;
4. Feedback from audit clients, auditees, auditors, technical experts and other relevant
parties;
5. Sufficiency and adequacy of documented information in the whole audit process.
Some factors can indicate the need to modify the audit program. These can include changes
to:
1. Audit findings;
2. Demonstrated level of auditee’s management system effectiveness and maturity;
3. Effectiveness of the audit program;
4. Audit scope or audit program scope;
5. The auditee’s management system;
6. Standards, and other requirements to which the organization is committed;
7. External providers;
8. Identified conflicts of interest;
9. The audit client’s requirements.

Copyright 2023 @ Punyam Academy | [email protected] | +91-9825031523 Page 9 of 10

 Chapter: 1 – Managing audit program
8. Reviewing and improving audit program
The audit program should be reviewed to assess whether its objectives have been achieved.
The person(s) managing the audit program and the audit client have to conduct the review.
Lessons learned from the audit program review should be used for the improvement of the
program.
The following should also be considered for improving the audit program:
1. Review of the overall implementation of the audit program;
2. Identification of areas and opportunities for improvement;
3. Application of changes to the audit program if necessary;
4. Review of the continual professional development of auditors, in accordance with 7.6;
5. Reporting of the results of the audit program and review with the audit client and
relevant interested parties, as appropriate.
Following need to be considered during review and improvement of the audit program:
1. Results and trends from audit program monitoring;
2. Conformity with audit program processes and relevant documented information;
3. Evolving needs and expectations of relevant interested parties;
4. Audit program records;
5. Alternative or new auditing methods;
6. Alternative or new methods to evaluate auditors;
7. Effectiveness of the actions to address the risks and opportunities, and internal and
external issues associated with the audit program;
8. Confidentiality and information security issues relating to the audit program.
Reference: ISO 19011:2011 Guidelines for auditing management systems
Note: The contents of this chapter are meant for training and learning of the participants
of our training course. For any other purposes, the users must purchase and refer to ISO
19011:2018 InternationalStandard document from ISO website or their own national
standards body.

Copyright 2023 @ Punyam Academy | [email protected] | +91-9825031523 Page 10 of 10