Building an internal audit programme

The test is simple. Ask why a particular process is being audited in March rather than September, and why it is being audited twice this year rather than once. If the answer is that it fell there in the rota, there is no programme. If the answer names a risk, a change, a complaint history or a regulatory exposure, there is.

This is also the clause that gets audited. ISO 9001 clause 9.2.2 asks you to plan, establish, implement and maintain an audit programme including frequency, methods, responsibilities, planning requirements and reporting, and to take the importance of the processes concerned into account. A rota satisfies the word planned and none of the rest.

Fair presentation deserves a mention on its own, because it is the one most often quietly broken. It requires audit findings, conclusions and reports to reflect audit activities truthfully and accurately, including significant obstacles encountered. An audit report that omits the fact that the auditor could not get access to the area they came to see is not a fair presentation, and the omission usually happens to be polite rather than to deceive.

Risks to the programme are the heading people skip and the one that predicts failure. Auditor availability, access to sites and shifts, independence conflicts in a small team, and over-sampling comfortable low-risk areas are all risks to the programme rather than to the business, and none of them appear anywhere else.

A high-risk process may be audited two or three times a year while a stable support process is audited once in the three-year cycle. That is correct, and it is what a risk-based programme looks like when written down. The instinct to audit everything annually because it feels even is the instinct that produces thirty shallow audits instead of eight useful ones.

Changes are the strongest single trigger and the most often missed. A new supplier for a critical component, a line moved, a software system replaced, a key person gone: each of those invalidates part of the evidence base the last audit rested on. Put a change trigger in the programme so the schedule moves when the business does.

This is the most common structural failure in a small quality system and it is rarely deliberate. The quality manager runs document control, so the quality manager audits document control, and the audit finds nothing. The finding that gets written at the external audit is against impartiality rather than against document control, which is worse, because it calls the whole programme into question.

Competence is the other half and it needs a record per auditor, not a policy. Education, work experience, auditor training, audit experience, and knowledge of the standard, the processes and the applicable legal requirements. Plus the method used to evaluate all of that, and the result. No certificate is mandated anywhere. A documented criterion and evidence each auditor meets it is what is mandated.

Here is the shape, filled in. ISO 9001 clause 7.1.5.2 requires measuring equipment to be calibrated against traceable standards at defined intervals. Pressure gauge PG-014 on Line 2, observed 14 September 2026, carried a calibration label expired 30 June 2026 and no current certificate was available. The requirement for calibration at defined intervals is therefore not met.

The identifier is what makes it survive. PG-014, Line 2, 14 September. Six months later somebody has to verify that the corrective action worked, and without an identifier there is nothing to go back to. A finding that says calibration was found to be poor in the production area cannot be verified by anyone, including the person who wrote it.

Leaving out the proposed solution is deliberate too. The moment an auditor writes what to do, the auditee implements that and nothing else, the root cause is never found, and the auditor has quietly become the consultant for a process they will audit again next year.

The third category, opportunity for improvement, is where programmes go to die. An OFI is not a nonconformity and it is not a softer way of raising one. Downgrading a real finding to an OFI because the meeting will be easier is the most common single reason an internal audit programme stops being worth running, and external auditors recognise the pattern immediately: a log full of OFIs and no nonconformities for three years is not a sign of a healthy system.

The rule that keeps it honest: if a requirement is not met, it is a nonconformity, whatever the consequences and whoever owns it. An OFI is for something that meets the requirement and could be better.

The gap between implementation and verification is where the value is. A new form was introduced, the auditor watched it being introduced, and the finding was closed. Whether anybody is still using the form in three months is the actual question, and it can only be answered in three months.

Then feed it back. Recurring root causes are programme intelligence: they say where the schedule should weight next cycle and what belongs in management review. A programme that produces findings and never changes its own schedule in response is missing the monitor, review and improve half of ISO 19011 clause 5, which is the half that makes it a programme.