How to plan an internal audit programme

An internal audit programme is not just auditing each process once a year. Risky and troubled processes are audited more often, stable ones less often.

• Scope: which standard and which processes?
• Frequency: risk level and previous findings.
• Auditor: a competent person who doesn't audit their own area.
• Checklists: tied to standard clauses.
• Findings: class (major, minor, observation) and action.

From finding to closure

Each finding goes to its owner as an action and closes with evidence. The next audit asks about the effectiveness of previous findings. In supplier audits, findings can be shared through the portal and the supplier's answer lands in the same record.