Audit programme

ISO 27001 and ISO 9001 ask in clause 9.2 for a programme of internal audits. It must consider how important each process is and the results of earlier audits. ISO 9001 also asks it to consider changes affecting the organization. Certification bodies usually expect it to cover the whole management system within the three-year cycle. Audits → Programme shows your programme as a grid: the clauses of one framework down the side, and the internal audits of the cycle across the top. Each cell shows whether that audit examines that clause.

The tasks below follow the order of the work:

• Open the programme
• Read the grid
• Close the gaps

The audits and their findings themselves are described on the Audits page.

Open the programme

1. Open Audits → Programme.
2. Choose the Framework. The page may open on another framework, so check this first. Only adopted frameworks are offered.
3. Choose the Year the cycle starts and the Cycle: 1, 2 or 3 years.

An audit is a column in the grid when all three of these are true:

1. Its Type is Internal. Certification, recertification and external audits do not appear here.
2. Its Framework is the framework you chose in the programme.
3. Its Started at date is inside the years you chose. An audit without a start date is placed by the date it was created.

Read the grid

A clause is in an audit's column when the audit's scope names the clause or a control under it. The cell shows where that audit stands:

A clause counts as audited once an audit with it in scope has ended. Each chapter row shows how many of its clauses are audited and how many are planned. "Audited" only means that the end date has passed. Record at least one conformity or nonconformity per clause, so the grid shows what was actually examined.

Cells also show findings. A nonconformity or an observation on a clause shows as a marker with its count in the cell. Conformities and opportunities for improvement are listed in the cell's tooltip. If a finding is on a clause that the audit did not plan, the cell still shows it, and the tooltip says it was outside the scope. Findings with no control, or with a control of another framework, are counted below the grid.

Annex A is planned separately. In devguard, the Annex A controls of ISO/IEC 27001 are a separate framework that is adopted together with it (a companion framework). An audit whose Framework is ISO/IEC 27001 can only have clauses 4 to 10 in its scope, and its findings on Annex A controls count as not mapped. That is why the three A.5 findings in the picture above are counted below the grid. To plan Annex A coverage, add internal audits whose Framework is the Annex A framework (ISO/IEC 27002:2022 - Information Security Controls in the list), and choose that framework in the programme. Its grid works the same way.

Each clause also has a badge with its implementation status from Coverage: Full, Partial, None, Not assessed or Not applicable. This is your own assessment, not audit evidence. It never makes a clause count as audited.

Close the gaps

A clause that no audit in the grid has in scope is marked Not in this cycle's programme. To close a gap, add the clause to the scope of a planned internal audit, or plan a new one. When the grid has no audit yet, choose Plan an audit. The audit form opens with the type Internal and the framework already set. Add an audit shows the other steps.

When you tick clauses in the audit form, the list helps you plan. The list counts in certification cycles. A cycle is three years. It starts when your last certification or recertification audit of the framework ended. If you have recorded none, the cycles start in the year of your first internal audit. These dates are close to your certificate's dates, but not the same.

• Each clause shows when it was audited, or which audit plans it. Hold the pointer on it to see the audit. A finding in an audit that has ended also counts the clause as audited.
• A clause with a nonconformity in the cycle is marked Nonconformity.
• Choose Not yet audited to list only the gaps. Search by identifier or name, and use Select all shown to tick all of them.

The audit you are editing does not count towards its own plan.

Reference

Everyone who can read audits can open the programme. It has no API. The audits and their scope are in the audits API.