Codes referenced
Cl 5 audit programme management, Cl 6 conducting an audit, Cl 7 auditor competence.
Plan, establish, implement and maintain an audit programme including the frequency, methods, responsibilities, consultation, planning and reporting.
Determine frequency and methodology, evaluate compliance and take action on non-compliance, retain records.
Evaluate OH&S performance and effectiveness of the OH&S management system; audit programme required.
Cl 5 — managing the audit programme
ISO 19011 Cl 5 specifies six linked steps for managing the audit programme, run by the person responsible for the programme (often the QMS / IMS manager):
Aligned with management-system policy, strategic direction, priorities and risks. Each objective is measurable.
Define scope, criteria, methods, frequency, resources, procedures. Consider risks to the programme itself.
Assign competent auditors, allocate resources, ensure records per Cl 7 evidence requirements.
Track performance against objectives; use KPIs (audits completed vs planned, findings ratio, closure time).
At least annually; input from management review (ISO 9001 Cl 9.3); continual improvement of the programme.
Retain records per Cl 7.3 — auditor selection, audit reports, corrective actions, follow-up results.
Cl 6 — conducting the audit (the 6-step audit process)
Each individual audit follows six sub-steps from Cl 6.2 to Cl 6.7:
Appoint audit team leader, define objectives/scope/criteria/duration, confirm feasibility.
Review documented information, prepare audit plan, assign tasks, prepare working documents (checklists, sampling plans).
Opening meeting, gather information via interviews/observation/records, evaluate against criteria, generate findings.
Closing meeting, draft report, issue final report (typically within 2 weeks), distribute to relevant parties.
Verify corrective actions taken; close findings; inform audit programme manager.
Archive records per retention schedule; learn lessons for next audit.
Cl 7 — auditor competence (knowledge + skills + behaviour)
An auditor's competence is the demonstrated ability to apply knowledge and skills, evidenced through on-the-job performance and an examination. Cl 7.2 lists six generic competence elements that the team collectively must possess:
| Element | What is required |
|---|---|
| Audit principles | Integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach. |
| Programme & process | Audit types, methods, techniques; planning, conducting, reporting, follow-up. |
| Reference standards | The audited standard (ISO 9001, 14001, 45001, 17025 etc.) and applicable normative documents. |
| Organisational context | Size, governance, structure, products, processes, language, culture, legal requirements. |
| Technical/sector competence | For an RMC audit: concrete technology, mix design, batching, QA/QC testing, IS 4926, IS 456. |
| Behavioural attributes | Ethics, open-mindedness, diplomacy, observation, perceptiveness, adaptability, tenacity, self-reliance. |
A RMC-plant audit team typically pairs an ISO 9001 lead auditor (knowledge + skills) with a concrete technologist (sector competence) — together covering all six elements.
Risk-based audit planning + audit plan contents
Cl 5.2 requires that the audit programme considers risks to the audited organisation and to the programme itself. Audit frequency is set by the significance of the process (impact on QMS, customer, environment or OH&S), complexity, changes since last audit, and prior findings. Cl 6.2.3 specifies audit-plan contents: audit objectives, scope, criteria, location, dates, durations, roles, resources, confidentiality, sampling plan, planned travel, and follow-up activities.
Source: ISO 19011:2018 §5.2 (planning the audit programme) and §6.2.3 (audit plan contents).
Worked example — annual audit programme for a 4-site RMC company
| Quarter | Audit type & scope | Risk rating | Auditor(s) |
|---|---|---|---|
| Q1 — Feb | Site A (largest) — full QMS (9001 + 14001) + RMC production (IS 4926) | High — major customer, 3 NCRs last yr | Lead + concrete tech |
| Q1 — Mar | 2nd-party supplier audit — cement supplier (IS 269/8112/12269) | Medium — single supplier, sole source | Procurement + QA |
| Q2 — May | Site B (second largest) — OH&S (ISO 45001 Cl 9.1.1) | Medium — incident in Q4 last yr | Safety auditor + lead |
| Q2 — Jun | 2nd-party supplier audit — admixture supplier (IS 9103) | Low — multi-source, prior audit clean | QA only |
| Q3 — Aug | Site C (medium) — full QMS + environmental compliance (ISO 14001 Cl 9.1.2) | Medium — recent expansion | Lead + environmental |
| Q3 — Sep | 2nd-party — aggregate supplier gradings (IS 383) | Medium — quality varied | QA + procurement |
| Q4 — Nov | Site D (small, new) — full QMS (Cl 9.2 only) | High — first audit, QMS not mature | Lead auditor only |
| Q4 — Dec | Programme review (Cl 5.5) — KPIs, lessons learned, next year's plan | Programme-level | Programme manager |
| Totals | 8 first-party + 4 second-party + 4 supplier = 16 audits/yr | 3 High · 5 Med · 2 Low | Pool of 5 auditors |
Common deviations seen on audit reports
Audits scheduled uniformly (e.g. all processes once a year) without considering significance or prior results. ISO 9001 Cl 9.2.1 and ISO 19011 Cl 5.2 both require risk consideration.
QMS lead auditor auditing an OH&S system without sector training, or auditing an RMC operation without concrete-technology competence. ISO 19011 Cl 7.2 requires collective competence coverage.
Findings state "calibration not done" without citing the specific clause (ISO 9001 Cl 7.1.5, ISO 19011 Cl 6.4.7 evidence requirement). Auditor's objectivity is undermined.
Audit programme manager issues reports but never tracks closure of corrective actions (ISO 9001 Cl 10.2 / ISO 19011 Cl 6.6). Audit value is zero if findings remain open.
Field-checklist blocks
A short questionnaire, an inspector's checklist, and three worked examples that show how a risk-based annual programme turns into a staffed audit day, a defensible finding and a closed corrective action.
Questionnaire — ask before the annual audit programme is released to the auditors
- Is the frequency set from the significance of the process, its complexity, what changed since the last audit and the prior findings, or is every process still getting one visit a year regardless of what happened last time?
- Does the programme carry the risk rating and the reason for it, so that a later auditor can see why one site sits in February and another in November?
- Does the named team collectively cover all six ISO 19011 Cl 7.2 elements: audit principles, programme and process, reference standards, organisational context, technical or sector competence, and behavioural attributes?
- Is the team leader for each High-rated audit taken from auditors with demonstrated leadership in at least three complete audits, per ISO 19011 Cl 7.2.4?
- Does the audit plan carry every ISO 19011 Cl 6.2.3 item: objectives, scope, criteria, location, dates, durations, roles, resources, confidentiality, sampling plan, planned travel and follow-up activities?
- Is every finding classified and cited, as conformity, observation, nonconformity or OFI under Cl 6.4.7, with the specific clause named?
- Who owns the closure of each finding after the report is issued, and is the Cl 6.6 follow-up tracked by the programme manager rather than assumed to be happening?
- Is the final report issued within 2 weeks of the audit date, and are the programme records retained per Cl 7.3?
Inspector's checklist — what to verify on site
- Annual programme table: quarter, scope, risk rating, the risk basis behind that rating and the named auditors against each line.
- Competence file per auditor (Cl 7.2): knowledge, skills and behaviour, evidenced through on-the-job performance and an examination, not through a training certificate alone.
- Team competence matrix per audit: which of the six elements each named auditor covers, with the collective coverage shown on one page.
- Audit plan per Cl 6.2.3: all twelve listed contents, with the sampling plan written before the audit day and not improvised in the meeting room.
- Working documents: the checklists and sampling plans actually used, dated and retained.
- Findings register: each finding classified under Cl 6.4.7 and citing the clause it breaches, with the objective evidence attached.
- Corrective action tracker: owner, due date, the Cl 6.6 verification evidence and the date the finding was closed.
- Programme KPIs and review (Cl 5.4 and Cl 5.5): audits completed against planned, findings ratio and closure time, with the at-least-annual review minuted and fed from the ISO 9001 Cl 9.3 management review.
What happens if… three worked examples
What happens. Site A is the largest site, it has a major customer, and it produced three NCRs in the last year. That is the risk input, and it produces a High rating, a full QMS audit (9001 + 14001) plus RMC production against IS 4926, and the first slot of the year in February. The team is lead auditor plus concrete technologist, and the pair is what makes the audit possible: the concrete technologist supplies the technical and sector competence (concrete technology, mix design, batching, QA/QC testing, IS 4926, IS 456) that the lead auditor does not hold, so the six Cl 7.2 elements are covered collectively.
Likely outcome. The three prior NCRs become the sampling focus, because that is what the High rating bought. Findings cite their clauses under Cl 6.4.7, the report is issued within 2 weeks of the audit date, and each corrective action lands in ISO 9001 Cl 10.2 with the Cl 6.6 verification back to the programme manager.
Preventive correction. Write the risk rating and its basis into the programme table. When a site is rated High for the third year running, that is a signal about the site, not about the auditor.
What happens. The programme totals 16 audits a year (8 first-party, 4 second-party and 4 supplier) drawn from a pool of 5 auditors, which works out at 3.2 audits per auditor per year. Three of the 16 are rated High, and each High audit needs a team leader with demonstrated leadership in at least three complete audits, per Cl 7.2.4. If only two of the five hold that evidence, one High audit cannot be staffed compliantly, and no auditor can lead two audits on the same date.
Likely outcome. The gap is a competence gap, not a scheduling gap, and it has to be closed before the programme is published rather than on the morning of the audit. The route is on-the-job evidence and an examination for the auditor who is short, then a re-plan of the schedule around the auditors who qualify. A programme that cannot be staffed compliantly on paper is a programme whose High audits will quietly get a weaker team.
Preventive correction. Keep the Cl 7.2 evidence file current per auditor and check the pool against the High-rated slots before the annual schedule goes out.
What happens. Site D is small and new, it is rated High because the QMS is not mature, and the programme gives it a full QMS audit (Cl 9.2 only) with the lead auditor only. Cl 7.2 asks for collective coverage of the six elements across the team; with one person there is no collective, so that auditor has to cover all six personally or the plan has to say how each one is supplied. Now suppose the finding comes out as "calibration not done" with no clause attached.
Likely outcome. The finding cannot be closed, because there is no criterion to close it against. Under ISO 9001 Cl 10.2 there is no defined nonconformity to raise, and under ISO 19011 Cl 6.6 there is nothing for the programme manager to verify. The Cl 5.4 KPIs go soft at the same time, because findings ratio and closure time both need a countable, citable finding to be measurable. The auditor's objectivity is undermined as well: a finding that cannot be traced to a clause cannot be defended.
Preventive correction. Put the clause in the finding before the closing meeting ends, and either add a second auditor to a single-auditor High-risk audit or record in the Cl 6.2.3 plan how each of the six competence elements is covered.
Frequently Asked Questions
What is the difference between an audit and a review under ISO 19011?
How do you select an audit team for ISO 19011?
What are the four categories of audit findings under ISO 19011?
Related articles
Amit Haridas
Founder & Proprietor, ConcreteInfo. 25+ years experience in construction QA/QC, concrete technology, RMC plant operations, consulting and technical training across India. For internal audit programme design or ISO 19011 / 9001 / 14001 / 45001 audit support, contact amit@concreteinfo.in.
Technical updates, not sales emails
One email when a new article goes out on concrete technology, QA/QC and construction quality. No promotions, and your address is never sold or passed to advertising networks. Subscribing is separate from making an enquiry.