The Difference Between an Audit and an Audit Programme
If you have ever sat down to plan your internal audits for the year and wondered whether you are doing it right, you are probably already thinking about audit programmes without using that name. An audit programme is simply the arrangement of one or more audits planned over a defined period. It tells you what will be audited, when, by whom, and to what purpose.
On this page
This is not the same as an individual audit plan, which covers the specific logistics of a single audit event. The audit programme sits above that. It is the strategic layer that ensures your organisation audits the right things, at the right frequency, with the right people, across an entire cycle, typically a year or a three year certification period.
Understanding what an audit programme is, and what it needs to contain, is fundamental whether you are managing internal audits, coordinating a supplier audit schedule, or working as a lead auditor responsible for a multi site certification programme.
What ISO 19011 Says About Audit Programmes
ISO 19011 is the international guideline for auditing management systems. It does not just define what an audit is. It dedicates an entire clause, Clause 5, to the management of audit programmes. The 2026 edition of the standard reinforced this with updated guidance on risk based scheduling, programme objectives, and new considerations like climate change and digital tools.
According to ISO 19011, an audit programme should be established, implemented, monitored, reviewed, and improved. That is the PDCA cycle applied directly to your audit function. You do not just set up a schedule and walk away. You treat the programme itself as something that needs to be managed and evaluated over time.
The standard also makes clear that the person managing the audit programme, often called the audit programme manager, must have the competence to do so. That means understanding risk, understanding the organisation, and being able to make informed decisions about where audit resources should be directed.
For a detailed look at how ISO 19011:2026 handles this, see our article on Managing an Audit Programme Under Clause 5 of ISO 19011:2026.
Exemplar Global Certified Training ProviderRTP No. 310970
The Core Elements of an Audit Programme
A well structured audit programme is not a spreadsheet with dates and names. It contains several distinct components that together give the programme its shape and purpose.
Audit Programme Objectives
Every audit programme should have defined objectives. These are not vague aspirations. They are specific statements of what the programme is intended to achieve. Common objectives include verifying conformity with a standard, evaluating the effectiveness of a management system, identifying opportunities for improvement, or fulfilling a regulatory or contractual requirement.
If you cannot articulate what your audit programme is trying to achieve, you will struggle to design it well, and you will have no basis for evaluating whether it worked at the end of the year.
Scope and Extent
The scope of the audit programme defines which management system standards, processes, sites, functions, and time periods are covered. For an organisation certified to ISO 9001, ISO 14001, and ISO 45001, the scope of the audit programme needs to address all three standards across all relevant locations and processes.
The extent of the programme, meaning how many audits are conducted and how deeply, should be proportional to the size and complexity of the organisation, the nature of its risks, and the results of previous audits.
Audit Schedule
The schedule is the operational backbone of the programme. It specifies which audits will happen, when, and in what sequence. A risk based approach to scheduling means high risk processes or areas with previous nonconformities get more frequent or more thorough audits. Lower risk, stable areas might be audited less often.
The schedule should be documented and communicated to relevant parties in advance. Surprises are generally not useful in internal audit planning.
Resources
An audit programme that is not resourced cannot be implemented. Resources include qualified auditors, time, access to documented information, and any tools or technology required. If your organisation has one internal auditor and expects them to cover twelve processes across three sites in a year, the programme needs to reflect whether that is actually achievable.
Responsibilities
Someone needs to own the audit programme. In most organisations, this is the quality manager, HSE manager, or a designated audit programme manager. Their responsibilities include establishing the programme, selecting auditors, monitoring progress, and reviewing outcomes.
Documented Information
The programme generates and relies on documented information. Audit plans, checklists, reports, nonconformity records, and corrective action follow up records are all part of the documented trail that demonstrates the programme is being implemented as intended.
Risk Based Thinking in Audit Programme Design
One of the most important concepts in modern audit programme management is the risk based approach. This means you do not audit everything with the same frequency and the same depth. You direct your audit effort towards areas of greatest risk and significance.
In practice, this involves considering factors such as:
- The results of previous audits, including any outstanding nonconformities or recurring issues
- The complexity and criticality of individual processes
- Changes to the organisation, its context, or its management system
- Customer complaints or product or service failures
- Legal and regulatory requirements applicable to the area being audited
- The maturity of the management system in different parts of the organisation
A process that has been consistently conforming for three years with no issues might be audited once per year with a standard checklist. A process that generated two major nonconformities last cycle, or that involves high hazard activities, should receive more attention.
This is not about ignoring low risk areas. It is about being intelligent with limited audit resources. For practical guidance on applying this thinking, our article on Risk Based Audit Scheduling: Deciding What to Audit First goes into useful detail.
Types of Audits Within a Programme
An audit programme can contain different types of audits depending on the organisation's needs. Understanding which types are relevant helps you design a programme that actually covers what it needs to cover.
Internal Audits (First Party)
These are conducted by or on behalf of the organisation itself. They are a mandatory requirement under most ISO management system standards, including ISO 9001 Clause 9.2, ISO 14001 Clause 9.2, and ISO 45001 Clause 9.2. The internal audit programme must be planned, implemented, and reviewed as part of the management system.
Supplier Audits (Second Party)
Organisations that rely on external providers may include supplier audits in their overall audit programme. These assess whether suppliers are meeting contractual or quality requirements. They are particularly relevant for organisations with complex supply chains or where outsourced processes affect product or service quality significantly.
Certification Audits (Third Party)
Certification bodies conduct these on behalf of accreditation schemes. While the organisation does not manage the certification body's audit programme, it does need to understand how the certification audit cycle works, including Stage 1, Stage 2, surveillance audits, and recertification audits, so that the internal programme prepares the organisation adequately.
How the Audit Programme Connects to the Management System
An audit programme does not exist in isolation. It feeds into and draws from the broader management system in several important ways.
The outputs of audits, including findings, nonconformities, and observations, become inputs to the corrective action process and to management review. If your audit programme is generating findings that nobody acts on, the programme is not functioning as intended.
Management review, in turn, should consider the results of the audit programme as a whole. Not just individual audit reports, but trends across the programme. Are the same issues recurring? Are certain processes consistently conforming? Is the audit programme itself being implemented as planned?
This connection between the audit programme and management review is one of the most underused mechanisms in management systems. Organisations that treat audit results as a compliance tick box miss the opportunity to use that data for genuine improvement.
Reviewing and Improving the Audit Programme
ISO 19011 is explicit that the audit programme must be monitored, reviewed, and improved. This is not optional. It is part of what makes an audit programme a managed activity rather than a static document.
Review of the audit programme should consider:
- Whether the programme objectives were achieved
- Whether all planned audits were conducted on schedule
- Whether audit findings were consistent with the actual state of the management system
- Whether auditors had the competence needed for the audits they conducted
- Whether the scope and frequency of audits was appropriate given the risks identified
- Feedback from auditees and audit clients about the process
This review typically happens at the end of a programme cycle, often annually, and feeds into planning for the next cycle. It is also a common focus area for certification auditors who want to see that the organisation is not just running audits, but actively managing the programme.
Common Mistakes in Audit Programme Management
Having reviewed and conducted audits across many organisations, there are patterns that come up repeatedly when audit programmes are not working as they should.
Treating the Schedule as the Programme
A schedule of audit dates is not an audit programme. Without defined objectives, clear scope, assigned resources, and a review mechanism, you have a calendar, not a programme. Certification auditors will notice the difference.
Auditing the Same Things Every Year
If your audit programme covers the same processes at the same frequency regardless of risk or previous results, it is not risk based. It is habitual. This is one of the most common findings raised against internal audit programmes during certification audits.
Not Closing the Loop on Findings
An audit programme that generates nonconformities but does not track corrective action to completion is not delivering value. The programme needs to include follow up as a defined activity, not an afterthought.
Auditor Independence Issues
Internal auditors must not audit their own work. This sounds obvious but in smaller organisations it becomes a genuine challenge. The audit programme needs to account for this when assigning auditors to specific processes or areas.
Failing to Adjust the Programme When Things Change
If the organisation undergoes significant change, a new site, a new process, a major incident, a change in regulatory requirements, the audit programme should be reviewed and adjusted. A static programme that does not respond to change is not managing risk effectively.
Audit Programme Documentation
ISO standards do not prescribe a specific format for audit programme documentation. What they require is that the programme is documented in a way that allows it to be implemented, monitored, and reviewed. In practice, this usually means maintaining:
- A documented audit programme or audit schedule covering the full cycle
- Individual audit plans for each audit event
- Audit reports for each completed audit
- Records of nonconformities and corrective actions
- Records of audit programme reviews
The level of formality should be proportional to the size and complexity of the organisation. A small business with one site and one management system does not need the same documentation infrastructure as a multinational with multiple sites and integrated management systems.
For practical support on structuring your programme documentation, our article on Building an Audit Programme That Actually Works walks through the key decisions involved.
Exemplar Global Certified Training ProviderRTP No. 310970Audit Programmes for Multiple Standards
Many organisations are certified to more than one ISO standard. Running separate audit programmes for each standard is inefficient and can create confusion. An integrated audit programme, or at minimum a coordinated programme, allows the organisation to audit related processes across multiple standards in a single audit event.
For example, auditing a maintenance process might cover ISO 9001 requirements for infrastructure and calibration, ISO 14001 requirements for environmental aspects related to maintenance activities, and ISO 45001 requirements for hazard identification and safe work procedures. One audit, three standards, efficient use of time.
The audit programme needs to be designed with this integration in mind, ensuring that combined audits are planned with auditors who have the competence to cover all relevant standards.
Getting Started: What a Practical Audit Programme Looks Like
If you are building or rebuilding an audit programme, start with the fundamentals. Define your objectives. Map the scope of your management system. Identify the processes and areas that need to be audited. Apply risk based thinking to determine frequency and depth. Assign competent auditors. Build in a review mechanism. Document it.
That is the core of a functional audit programme. Everything else, the templates, the software, the checklists, supports that core. It does not replace it.
If you want to develop the skills to build, manage, and audit against audit programmes effectively, Audit Workshop offers practical training at the Internal Auditor and Lead Auditor levels across ISO 9001, ISO 14001, ISO 45001, ISO 27001, and other standards. The training is grounded in real audit practice, not just theory, and is delivered by an experienced lead auditor who has conducted over 500 external certification audits. You can explore the available courses at auditworkshop.com.
