Risk based internal audit planning is one of those concepts that sounds straightforward in a training room but gets complicated fast when you are sitting down to build an actual audit programme. Clause 5 of ISO 19011:2026 gives you the framework for managing an audit programme, and at its core, the whole thing is built around risk. Not just the risks your organisation faces, but the risks that affect the audit programme itself. Getting this right is the difference between an audit schedule that adds genuine value and one that just ticks boxes in a cycle.
On this page
This article works through what Clause 5 actually requires, how risk factors into every decision you make when planning internal audits, and what that looks like in practice. If you have ever wondered why your audit programme feels like it is missing something, this is likely where the gap is.
What Clause 5 of ISO 19011 Is Actually Asking You to Do
ISO 19011:2026 Clause 5 covers the management of an audit programme. It is not just about scheduling. The clause asks you to establish the programme with clear objectives, consider the risks and opportunities that affect the programme, and then manage, monitor, review, and improve it over time.
The key shift that many internal auditors miss is this: the audit programme itself must be planned with risk in mind. That means you are not just auditing risks within the management system. You are also applying risk thinking to decisions about what to audit, how often, how deeply, and with what resources.
Clause 5.3 specifically requires that audit programme risks and opportunities are considered when establishing the programme. These include things like:
- The significance of processes to the organisation
- The complexity of processes and their interactions
- Previous audit results and findings
- Changes in the organisation or its context
- Interested party requirements and expectations
- Risks to the organisation from particular processes or areas
In practical terms, this means your audit schedule should not look the same every year unless your organisation and its risk profile have stayed exactly the same. They almost never do.
Exemplar Global Certified Training ProviderRTP No. 310970
The Risk Factors That Should Drive Your Audit Schedule
When you sit down to plan internal audits for the year, you need to make deliberate decisions about where to focus audit effort. That focus should come from a genuine assessment of risk, not habit or convenience.
Previous Audit Findings
This is the most obvious risk signal and the one most audit programmes already use, at least partially. If a process generated nonconformities in the last cycle, it warrants more attention in the next one. Not just a follow up on corrective actions, but a deeper look at whether the root cause has actually been addressed and whether the process is now performing as intended.
Where audit programmes often fall short is in tracking patterns across multiple cycles. A process that has had minor observations in three consecutive audits without generating a formal nonconformity might look clean on paper, but the pattern tells a different story. That process should be on your high priority list.
Significance of Processes and Their Outputs
Not all processes carry equal weight. A process that directly affects product conformity, customer safety, environmental compliance, or worker health deserves more audit attention than a low risk administrative process.
For an ISO 9001 system, this might mean your production, inspection, and customer complaint handling processes get audited more frequently or more thoroughly than, say, your document control process. For ISO 45001, high risk work activities like working at heights, confined space entry, or plant operation should feature prominently in your audit planning.
The point is to match audit intensity to process significance. Spending equal time on every process is not efficient and it is not risk based.
Organisational Changes
Changes in the organisation are one of the strongest signals that audit attention is needed. New processes, new sites, new equipment, new key personnel, restructured teams, changes to suppliers, or shifts in the regulatory environment all introduce risk that the existing audit programme may not have accounted for.
A practical example: a construction company that has recently taken on a new type of project, say tunnelling work when they previously only did above ground civil works, has introduced a raft of new hazards and process requirements. Their audit programme should reflect that shift immediately, not wait for the next annual planning cycle.
This is where the requirement to monitor and review the audit programme throughout the year becomes important. The programme is not a fixed document you set in January and forget until December. It needs to be responsive.
Interested Party Requirements and Expectations
Customers, regulators, and other interested parties often signal where risk lies. A customer who has raised concerns about delivery performance is telling you something about your fulfilment process. A regulator who has issued guidance on a particular compliance area is flagging where scrutiny will fall. These signals should feed into your audit planning.
For organisations operating under contracts that require specific quality or safety performance, the contractual requirements themselves can drive audit focus. If a client contract requires that supplier management be audited quarterly, that needs to be in your programme regardless of what your standard risk assessment might suggest.
Translating Risk Assessment into an Audit Plan
Once you have identified the risk factors relevant to your organisation, you need to translate that into practical audit planning decisions. This involves three main choices: what to audit, how often, and how deeply.
What to Audit
Your audit programme needs to cover the entire scope of the management system over the audit cycle, but it does not have to cover everything equally in every period. High risk processes should appear more frequently. Lower risk processes can be covered less often, provided the overall cycle still gives you confidence that the system is effective.
One approach that works well in practice is to categorise your processes into tiers based on risk. Tier one processes, those with the highest risk or significance, are audited at least annually or more frequently. Tier two processes are audited annually. Tier three processes, lower risk and stable, might be covered every 18 months or across a two year cycle.
This approach needs to be documented and defensible. If a certification auditor asks why a particular process has not been audited in 18 months, you need to be able to show the risk reasoning behind that decision.
How Often to Audit
Frequency decisions should be dynamic, not fixed. A process that was low risk last year might have moved up the risk scale because of a change in personnel, a spike in nonconforming outputs, or a new regulatory requirement. Your audit programme should have a mechanism for adjusting frequency in response to these signals.
ISO 9001 Clause 9.2 requires that the audit programme take into account the importance of the processes concerned and the results of previous audits. This is not a one time assessment. It is an ongoing consideration that should be revisited at minimum annually, and ideally whenever a significant change occurs. For a deeper look at what the standard requires here, the article on ISO 9001 Clause 9.2 and internal audit requirements covers the specifics in detail.
How Deeply to Audit
Audit depth is about how much time and scrutiny you apply to a given process. A high risk process might warrant a full day of audit time with multiple interviews, document reviews, and physical observation. A low risk, stable process might be adequately covered in 90 minutes with a targeted checklist and a couple of interviews.
The depth of your audit should also reflect the complexity of the process. A simple process with a single output is easier to audit thoroughly in a short time than a complex process with multiple inputs, subprocesses, and interactions with other parts of the system.
Common Mistakes in Risk Based Audit Planning
Most internal audit programmes that fall short do so in predictable ways. Knowing these patterns helps you avoid them.
Treating the Schedule as a Fixed Template
The most common mistake is creating an audit schedule at the start of the year and treating it as untouchable. Real organisations change constantly. A schedule that does not adapt to those changes stops being risk based almost immediately.
Build a review trigger into your programme. Any time a significant change occurs, a nonconformity is raised, a customer complaint is received, or a new risk is identified, someone should ask whether the audit schedule needs to be adjusted.
Auditing What Is Easy Instead of What Matters
There is a natural tendency to audit the processes that are well documented, cooperative, and easy to navigate. These processes rarely generate findings and they give auditors an easy day. But they are often not where the real risk lies.
Audit planning based on risk sometimes means deliberately choosing the difficult areas. The processes where documentation is thin, where there has been staff turnover, where outputs have been inconsistent, or where management attention has been low. These are the areas where internal audit adds the most value.
Ignoring the Audit Programme Risks
Clause 5 of ISO 19011 asks you to consider risks to the audit programme itself, not just risks within the management system. These include things like auditor availability, auditor competence gaps, resource constraints, and the risk that auditors are not sufficiently independent from the areas they are auditing.
A common programme risk is over reliance on a single internal auditor. If that person leaves, goes on extended leave, or is unavailable during a critical audit period, the whole programme is at risk. Building redundancy into your auditor pool is part of managing programme risk. The article on how to build an internal audit programme from scratch covers this and other structural considerations in detail.
Not Linking Audit Findings Back to the Risk Assessment
Audit findings are data. They tell you whether your risk assessment was accurate and whether your controls are working. If you are not feeding audit findings back into your risk based planning process, you are missing a critical feedback loop.
After each audit cycle, review what was found and ask whether the findings are consistent with your risk assessment. If high risk processes generated no findings and low risk processes generated multiple nonconformities, your risk assessment needs to be revisited.
Practical Steps for Building a Risk Based Audit Programme
Here is a practical sequence for building a risk based internal audit programme that actually reflects what Clause 5 requires.
- Map your processes. Start with a clear picture of all the processes within your management system scope. Use a process map or turtle diagram if it helps.
- Assess risk factors for each process. Consider significance, complexity, previous findings, recent changes, and interested party requirements. Score or categorise each process by risk level.
- Allocate audit frequency and depth based on risk. High risk processes get more frequent and more thorough audits. Lower risk processes get proportionally less.
- Identify programme risks. Consider auditor availability, competence, independence, and resource constraints. Build contingencies where needed.
- Document the rationale. Your audit programme should show not just what will be audited and when, but why. The risk reasoning should be visible.
- Build in review triggers. Identify the conditions under which the programme will be reviewed and adjusted outside of the annual planning cycle.
- Review and improve after each cycle. Use findings, programme performance data, and feedback to improve the programme for the next cycle.
This is not a complicated process, but it does require discipline. The temptation to default to a simple rotating schedule is strong, especially when audit resources are limited. Resist it. A risk based programme is more work upfront but it delivers far more value.
Exemplar Global Certified Training ProviderRTP No. 310970How Risk Based Planning Changes What You Look for in an Audit
Risk based planning does not just affect the schedule. It also changes how you approach individual audits. When you know a process is high risk, you go in with sharper questions, broader sampling, and a specific focus on the controls that are supposed to manage that risk.
For example, if you are auditing a procurement process that has been flagged as high risk because of recent supplier performance issues, your audit should be focused on how those risks are being managed. Are suppliers being evaluated against the right criteria? Are nonconforming deliveries being captured and actioned? Is the supplier approved list current? These are not generic questions. They are driven by the specific risk profile of that process.
This is where risk based thinking and risk based thinking in practice become directly relevant to how you conduct audits, not just how you plan them.
Similarly, when you are auditing a process that has been assessed as lower risk, you can be more targeted. You are not trying to audit everything. You are confirming that the controls are in place and working, and that nothing significant has changed since the last audit. If something has changed, that is your signal to dig deeper.
Connecting Audit Planning to Management Review
One of the signs of a mature internal audit programme is a clear connection between audit planning, audit findings, and management review. The audit programme should be an input to management review, and the outputs of management review should feed back into audit planning.
If management review identifies a new risk or a performance gap, that should trigger a review of the audit programme. If the audit programme consistently finds the same issues in the same areas, management review should be asking why those issues are not being resolved and whether additional audit attention is needed.
This connection is what turns internal audit from a compliance activity into a genuine improvement tool. The audit programme becomes part of the organisation's risk management process, not a separate administrative exercise.
If you are developing your skills in this area, Audit Workshop offers practical internal auditor and lead auditor training across ISO 9001, ISO 14001, ISO 45001, and other standards. The training is built around real audit practice, including how to plan audit programmes that are genuinely risk based rather than just formally compliant. You can explore the available courses at auditworkshop.com.
