List the processes of the management system, rate each one and answer a few questions. You set how the points turn into an audit frequency. The tool then spreads the audits across the months so the load is even.
Score = risk (1 to 3) plus one point each for recent nonconformities, a significant change, and being overdue by your measure. The cut-offs and intervals are your own rules. Check what your certification body and the relevant standard expect.
| Process | Score | Every | Audit months |
|---|---|---|---|
| Design and development | 5 | 6 mo | Jan 1, Jul 1 |
| Purchasing and supplier control | 3 | 12 mo | Feb 1 |
| Production and service delivery | 3 | 12 mo | Mar 1 |
| Management review | 2 | 12 mo | Apr 1 |
| Document and record control | 1 | 12 mo | May 1 |
A process whose interval is longer than the programme length may fall outside it. Lengthen the programme to see it. Add auditor names, scope and criteria in the Excel file.
Management system standards expect internal audits to be planned, taking into account the importance of the processes, changes affecting the organisation and the results of earlier audits. A programme that audits every process once a year regardless of risk satisfies the calendar but not the intent. Scoring each process, deciding in advance what the score means, and spreading the audits across the year gives a programme you can explain to a certification auditor.
Each process gets a score from its risk rating (1 to 3) plus one point for recent nonconformities, one for a significant change and one if the time since its last audit is more than the figure you set.
You choose the score cut-offs and the interval in months for each band. A process is then planned every so many months across the programme length. The first audit for each process goes in the least busy month of its first interval, which keeps the load level.
The tool plans timing only. Scope, criteria, auditors and independence of the auditor from the area audited are for you to record.
High risk, recent nonconformities, not audited for 14 months. Overdue threshold 12 months, high cut-off 5 points, high interval 6 months.
