ISO 9001 clause 9.2.2: plan and maintain the audit programme

What clause 9.2.2 requires in practice

Clause 9.2.2 describes how internal audit is organised. The organisation plans, establishes, implements and maintains one or more audit programmes, covering how often audits happen, the methods used, who is responsible, what planning is needed and how results are reported. When setting the programme it takes into account how important the processes are, what earlier audits found and what changes affect the organisation. For every audit it defines objectives, criteria and scope; it selects auditors and conducts audits in a way that keeps the audit objective and impartial; it makes sure results reach relevant managers; and it takes appropriate correction and corrective action without undue delay. Documented information must be available as evidence that the programme was implemented and of the audit results. The standard refers readers to ISO 19011 for guidance on auditing management systems. It does not require every process to be audited at a set frequency, or any specific report template.

Set priorities from the QMS, not a fixed ritual

Consider where an audit can provide useful information about conformity and effectiveness. A major process change, repeated findings or an important customer-facing activity can affect the attention needed. The standard names the programme considerations but does not impose one scoring formula or the same frequency for every process.

Review the programme when circumstances change. A plan prepared months earlier may no longer fit a new delivery model or a significant organisational change. Maintaining the programme means keeping it relevant as well as recording completion. A cancelled audit should lead to a reasoned decision about the remaining need, not simply disappear from the schedule.

Choose suitable methods and responsibilities. Interviews, observation, record review and remote techniques can be useful in appropriate circumstances. The method must allow reliable evaluation of the relevant criteria. A remote document review cannot automatically replace observation where the question depends on how work is actually performed.

Define each audit clearly

For each audit, establish objectives, criteria and scope. Objectives explain what the audit is intended to achieve. Criteria identify the requirements used for evaluation. Scope establishes the boundaries, such as processes, activities, locations or relevant periods. Clear distinctions help the auditor gather appropriate evidence and avoid an unplanned expansion into unrelated work.

Select auditors and conduct the audit to ensure objectivity and impartiality. Consider competence, relationships and responsibility for the work being audited. A small organisation may need a practical cross-functional arrangement or external support. The solution should protect impartial judgement rather than rely on a title or a declaration with no effect on the actual assignment.

Why clause 9.2.2 matters to the business

A programme that follows the work helps the business find weaknesses where they matter most. Auditing a stable, low-risk activity as often as a newly changed or troubled one wastes time and leaves real exposure unchecked. A well-run programme also protects the integrity of the results, because impartial auditors and prompt follow-up make findings credible to the people who must act on them. For senior management, a coherent programme provides trustworthy evidence about the system without relying on a single external visit. For customers and assessors, it demonstrates that the organisation examines itself regularly and corrects what it finds.

How to implement clause 9.2.2

Start with a simple risk-based view and grow the programme as the system matures. A written rationale for the programme need not be long, but it should be specific enough that a newcomer understands why one process is looked at often and another less so.

1. List the processes and mark those that are critical to customers, recently changed or previously problematic.
2. Decide how often and how deeply each will be audited, and record the reasoning.
3. Assign audits to competent people who are independent of the work being examined, using external help if needed.
4. For each audit, write the objective, criteria, scope, method and timetable, and brief those involved.
5. Hold a short closing discussion and issue a factual report to the managers responsible.
6. Agree corrections and corrective actions with owners, track them, and escalate anything stalled.
7. Review the programme at least once as a whole, adjusting for changes, results and resources.

Illustrative IT example: a new managed service

Illustrative manufacturing example: recurring receiving findings

A manufacturer has repeated audit findings about incomplete incoming inspection status. The next programme considers those results and the significance of the receiving process. The audit samples the revised controls, including how restricted material is prevented from entering production, rather than checking only whether the corrective-action form was closed.

The report identifies a remaining weakness in a shift handover. Relevant managers arrange appropriate correction and corrective action without undue delay. The follow-up evidence checks the changed handover in use. This demonstrates a programme informed by previous results, not a rule that every repeated finding requires the same audit frequency or investigation method.

Report, respond and preserve evidence

Common nonconformities with clause 9.2.2

Findings at this clause often show a calendar rather than a programme.

• The programme lists dates but gives no basis for the frequency chosen for each process.
• Auditors are not independent of the activity they audit, especially in small teams.
• Audit reports are issued but there is no evidence they reached relevant managers.
• Corrective actions from audits stay open with no review of why they are late.
• Changes such as a new service or site are not reflected in the programme.