Audit program
An audit program is the master plan for conducting an audit or set of audits that are to be undertaken in a specific timeframe and for a specific purpose. For example, the purpose could be to certify the information security management system of a company against ISO 27001. It gives a direction for the proper execution of audits. The ISO 19011:2018 standard offers instructions on how to manage audit program improvements in a systematic manner.
The objectives of the audit program should align with the policies and goals of the management system in addition to meeting regulatory and statutory requirements.
For third-party audits, the audit program must comprise an initial audit (Stage 1 – document review and Stage 2 – evaluating the implementation and effectiveness of the management system[s]), surveillance audits in the first and second years (after certification audits), and a recertification audit in the third year prior to the expiration of certification...
