SC QUALITY GUILDRisk-based audit program and schedule
SCQUALITYGUILD.COM/TOOLS/AUDIT-PROGRAM-RISK-SCHEDULE.HTML
Score each process on importance, past results and change, turn the score into an audit frequency, and lay out the year with auditor independence and workload checked.
ON THE EXAM · CQA IV.A.2, IV.A.5, IV.A.8 · FREE · NOTHING YOU TYPE LEAVES YOUR BROWSER
Q-BotClick for an explanation of this tool.For educational use. This page is a study aid. The method behind it has far more depth and detail than one page and one tool can cover, and what you see here is not everything the method offers or everything this site offers. For full understanding and application, use the governing standards and texts, and seek further education, training or qualified advice. Results depend on the data you enter, so check them before relying on them.
Program versus audit
An audit program is the set of audits planned for a period, usually a year, with the resources, schedule and methods needed to carry them out. An audit plan describes one audit: its objectives, scope, criteria, team and timetable. The program decides which areas get audited, how often and by whom; each plan then works out one of those audits in detail. ISO 19011:2018 treats managing the program (clause 5) and performing an audit (clause 6) as separate jobs, and the CQA exam expects you to keep them apart.
Why frequency should follow risk
ISO 9001:2015 clause 9.2.2 a) requires the program to take into account the importance of the processes concerned, changes affecting the organization and the results of previous audits. This tool scores each area 1 to 3 on each factor and multiplies them, so an area that is important, performing poorly and changing rises quickly (3 × 3 × 3 = 27) while a stable, low-impact area stays low (1). The bands that turn a score into a 6, 12 or 24 month interval are yours to set; they are a planning convention, not a requirement of any standard.
- Importance: consequence for customers, patients, safety, regulatory compliance or revenue.
- Past results: audit findings, complaints, nonconformance trends and process measures.
- Change: new equipment, people, methods, suppliers, sites or requirements.
Independence and resources
Auditors must be selected so the audit is objective and impartial (ISO 9001 9.2.2 c). ISO 19011 adds that auditors should, where practicable, be independent of the activity audited; in a small organization where full independence is not possible, the program should show how bias is avoided. The tool flags any auditor assigned to an area in their own department. It also adds up the days each auditor is scheduled for and compares them with the days their manager has agreed to release. Slipping high-risk audits are a finding against the program itself.
Reading the result
Look at the red dots first: these areas are audited twice in the year. Then check the warnings for overdue and never-audited areas, own-department assignments and over-capacity auditors. Revisit the scores after each audit, complaint trend or significant change.
On the CQA exam
Expect questions that ask what should drive audit frequency (risk, importance, change and previous results, not convenience), how to staff a program fairly, who owns the program (management, through an audit program manager), and how to tell a program from a plan.