How to plan a risk-based audit programme
A practical method for building a year's internal audit programme around process importance, recent changes and earlier results, with a worked example from a metals manufacturer.
An internal audit programme that rotates every clause on a fixed calendar is easy to defend and easy to run, but it spends the same effort on the canteen procedure as on the welding process that produced last year’s customer complaint. A risk-based programme puts audit time where problems are most likely and would cost the most. This guide shows how to build one, how to justify it to a certification auditor, and what a year of it looks like in practice.
What the standards ask for
ISO 9001:2015 clause 9.2 requires an internal audit programme that sets the frequency, methods, responsibilities, planning requirements and reporting of audits. In setting it, you are expected to take account of three things: the importance of the processes concerned, changes affecting the organisation, and the results of previous audits. The same requirement appears in near-identical form in ISO 14001, ISO/IEC 27001 and ISO 45001, because all of them share the harmonized structure.
ISO 19011:2018 is the guideline that fills in the detail. It treats the audit programme as something to be managed in its own right: objectives, risks and opportunities to the programme itself, resources, implementation, monitoring and review. It is guidance rather than a certifiable standard, but certification auditors often use its vocabulary, and following it gives you a ready answer when asked how the programme was put together.
Neither standard tells you to audit everything every year. They ask you to show that your choices follow from importance, change and results. That is what risk-based thinking means for internal audit.
Start with an audit universe
Before you can rank anything, list what could be audited. Work from the process map, not the clause list. A typical audit universe for a manufacturer might include:
- Sales and contract review
- Design and development (if in scope)
- Purchasing and supplier control
- Goods in and inspection
- Production, by line or cell
- Calibration and measurement
- Warehouse, despatch and traceability
- Customer complaints and returns
- Training and competence
- Document control and records
- Management review and leadership
Add sites, shifts and outsourced processes as separate entries where they genuinely behave differently. A night shift run by a different supervisor is a different risk from the day shift, even under the same procedure.
Then map clauses to processes. Most clauses land naturally in one or two processes; the cross-cutting ones (7.5 documented information, 6.1 risks and opportunities, 10.2 corrective action) are best sampled inside every process audit rather than audited on their own.
Score each process for risk
Keep the scoring simple enough that the team will actually use it and explain it. Three factors, each scored 1 to 3, match what clause 9.2 asks you to consider:
- Importance. Impact on product conformity, customer satisfaction, legal compliance or safety if the process fails. A process with a direct route to the customer scores 3.
- Change. New equipment, new people, reorganisation, new products, new software, a site move. Recent or planned change scores 3.
- Previous results. Open nonconformities, repeat findings, complaints, incidents, supplier failures, poor KPIs. A process with repeat problems scores 3.
Add the three for a score of 3 to 9, then band it: 7 to 9 is high, 5 to 6 is medium, 3 to 4 is low. Record the reasoning in a sentence next to each score. When a certification auditor asks why goods-in was only audited once in three years, “scored 3, no changes, no complaints, clean audit in 2025” is a complete answer.
Revisit the scores at least once a year, usually as an input to management review, and whenever something significant happens. A major customer complaint in June should move the related process up straight away, not next January.
Set frequency and scope from the score
The band drives how often a process is audited and how deep each audit goes. A starting point that many teams adapt:
| Risk band | Frequency | Typical scope | Typical duration |
|---|---|---|---|
| High (7–9) | Twice a year | Full process, all shifts or sites, trace samples end to end | 1 day |
| Medium (5–6) | Once a year | Full process, sampled shifts | Half a day |
| Low (3–4) | Once every 2–3 years | Key controls only | 2–3 hours |
Frequency is only half of it. Audit scope matters as much: a high-risk process does not need the same checklist run twice, it needs the second audit aimed at whatever the first one exposed. Set audit criteria for each audit as well, such as the clauses, the internal procedure, the customer specification or legal requirement it is tested against.
Make sure that over the cycle every clause of the standard and every process in scope is covered at least once. A simple matrix of processes against clauses, with the planned audit dates in the cells, shows the gaps quickly.
Allocate auditors you can defend
Clause 9.2 expects auditors to be selected so the audit is objective and impartial. In practice that means three checks for each audit:
- Independence. The auditor does not work in, or manage, the area being audited. A production supervisor can audit purchasing; they should not audit their own line.
- Competence. The auditor understands audit technique and enough of the process to ask good questions. Keep a record of training, audits observed and audits led, since competence evidence is something certification auditors routinely ask for.
- Load. Spread audits so no one auditor carries more than they can do well alongside their day job. Four to six audits a year is a realistic load for a part-time internal auditor.
Rotate auditors across processes every year or two. Fresh eyes find different things, and rotation builds bench strength for when someone leaves. Pair an experienced lead with a trainee on high-risk audits.
Small organisations struggle most with impartiality. Options include auditing across a sister site, swapping auditors with a local non-competing business, or contracting an external auditor for the one or two areas nobody can audit independently, typically the quality function itself.
A worked example for one year
Kestrel Metals is a fictional 140-person fabrication business with two production lines, a warehouse and a small design team, certified to ISO 9001. In late 2025, R. Patel, the quality manager, scored the processes for 2026:
| Process | Importance | Change | Results | Score | Band |
|---|---|---|---|---|---|
| Welding (line 2) | 3 | 3 | 3 | 9 | High |
| Purchasing and suppliers | 3 | 2 | 3 | 8 | High |
| Customer complaints | 3 | 1 | 2 | 6 | Medium |
| Calibration | 2 | 2 | 2 | 6 | Medium |
| Warehouse and despatch | 2 | 2 | 1 | 5 | Medium |
| Design | 2 | 1 | 1 | 4 | Low |
| Training and competence | 2 | 1 | 1 | 4 | Low |
| Document control | 1 | 1 | 1 | 3 | Low |
The reasons were recorded alongside: line 2 had a new robot cell and two new welders, and produced the year’s largest customer return; purchasing had finding FND-0142 open against the approved supplier list; the warehouse was moving to a new stock system in the autumn.
The resulting programme:
- February: welding line 2, full process, both shifts. Lead J. Okafor, trainee K. Lewis.
- March: purchasing and suppliers, including a check on the corrective action for FND-0142. Lead A. Mensah.
- May: customer complaints and returns. Lead J. Okafor.
- June: calibration. Lead K. Lewis, supervised.
- September: welding line 2 again, scoped on the robot cell and the effectiveness of February’s actions. Lead A. Mensah.
- October: purchasing again, scoped on new suppliers onboarded during the year. Lead J. Okafor.
- November: warehouse and despatch, timed for six weeks after the stock system go-live. Lead K. Lewis.
- Design, training and document control: audited in 2025, next due in 2027, with document control sampled inside every process audit in the meantime.
R. Patel cannot audit quality’s own processes impartially, so the management review and the internal audit process itself are audited each year by an external auditor.
When a supplier failure hit in July, purchasing was already scheduled twice; the October audit was brought forward to August and widened. That kind of documented change is exactly what an auditor wants to see. If you keep the programme in software, planned audits in Orisynx carry a priority and a risk level and can be marked as moved, which keeps that history visible.
Want a head start? Download the free audit programme template: one row per audit, grouped into plans, with owners, dates and status.
Keep the programme alive
A programme is only risk-based if it reacts. Build a short review into the year:
- Quarterly: check progress against plan, and look at new complaints, incidents and audit results for anything that should change a score.
- After every audit: if the findings were serious, consider an extra or brought-forward audit, often a follow-up audit on the corrective actions.
- At management review: present the programme’s results and the proposed scores for next year. Clause 9.3 expects the results of audits as an input, and this is the natural point to confirm resources.
Record each change and the reason for it. Moving or cancelling an audit is not a nonconformity; moving it without a reason, or letting a high-risk audit lapse, usually is. For more on what happens once the audits produce findings, see writing audit findings, and for how the programme is examined from the outside, see preparing for a certification audit.