ISO 19001:2018 Clause 5.4.4 Determining audit programme resources

When determining resources for the audit programme, the individuals managing the audit programme should consider:
a) the financial and time resources necessary to develop, implement, manage and improve audit activities;
b) audit methods;
c) the individual and overall availability of auditors and technical experts having competence appropriate to the particular audit programme objectives;
d) the extent of the audit programme and audit programme risks and opportunities ;
e) travel time and cost, accommodation and other auditing needs;
f) the impact of different time zones;
g) the availability of information and communication technologies (e.g. technical resources required to set up a remote audit using technologies that support remote collaboration);
h) the availability of any tools, technology and equipment required;
i) the availability of necessary documented information, as determined during the establishment of the audit programme ;
j) requirements related to the facility, including any security clearances and equipment (e.g. background checks, personal protective equipment, ability to wear clean room attire).

When determining resources for the audit programme, the individuals managing the audit programme should consider the financial and time resources necessary to develop, implement, manage and improve audit activities. Determining resources for an audit program involves careful consideration of the financial and time resources required for the entire lifecycle of audit activities. Here’s how financial and time considerations play a crucial role in developing, implementing, managing, and improving audit activities:

1. Development of the Audit Program: The initial development of the audit program requires resources for planning, designing audit processes, defining scope and objectives, and establishing criteria for evaluation. Adequate financial resources are needed for training auditors, acquiring necessary tools and technologies, and ensuring that the program aligns with organizational goals.
2. Implementation of Audit Activities: Conducting audits involves a commitment of time and financial resources. This includes the allocation of auditors’ time, travel expenses (if onsite audits are required), and any technology or software tools necessary for efficient audit execution. Proper funding ensures that audits are thorough and conducted in accordance with the planned program.
3. Management of Audit Program: Ongoing management of the audit program necessitates resources for monitoring progress, tracking findings, and maintaining communication with auditors and stakeholders. Financial resources are required for continuous training, communication tools, and technology infrastructure to support effective program management.
4. Continuous Improvement of Audit Processes: Resources are essential for the continuous improvement of audit processes. This includes evaluating the effectiveness of the audit program, incorporating lessons learned, and implementing improvements. Both time and financial resources are needed to adapt the program to changes in organizational context, industry standards, and emerging risks.
5. Training and Skill Development: Financial resources are required for training auditors and developing their skills. Continuous improvement in auditing capabilities ensures that auditors are equipped to address new challenges and changes in audit methodologies. Allocating time for training is equally important to keep auditors informed and up-to-date.
6. Technology and Tools: Investing in appropriate technology and tools is crucial for efficient audit activities. This may involve financial allocations for acquiring audit management software, data analytics tools, or other technologies that enhance the effectiveness of the audit program. Time is also needed to implement and integrate these tools into the audit process.
7. Response to Findings and Corrective Actions: Addressing audit findings and implementing corrective actions requires both financial and time resources. The organization needs to allocate funds for rectifying non-conformities and improving processes based on audit recommendations. The timely resolution of issues ensures the effectiveness of the audit program.
8. Documentation and Reporting: Adequate time and financial resources are necessary for the documentation and reporting aspects of audit activities. This includes the creation of audit reports, tracking key performance indicators, and maintaining an audit trail. Proper documentation is critical for transparency, accountability, and meeting compliance requirements.

By carefully considering financial and time resources throughout the audit program lifecycle, those managing the program can ensure its effectiveness, sustainability, and continuous improvement. This strategic approach helps organizations derive maximum value from their audit activities and enhances the overall management system.

When determining resources for the audit programme, the individuals managing the audit programme should consider audit methods. The choice of audit methods can significantly impact the amount of resources required. Here’s how the consideration of audit methods plays a role in resource allocation:

1. Onsite Audits vs. Remote Audits: The decision between onsite and remote audit methods has implications for resource allocation. Onsite audits may require additional resources for travel, accommodation, and logistical arrangements. Remote audits, on the other hand, may require investments in technology, communication tools, and secure platforms.
2. Sampling Techniques: The choice of sampling techniques, whether statistical or judgmental, can influence the time and financial resources needed for the audit. Statistical sampling may require specialized skills and tools, while judgmental sampling may rely more on the expertise of the auditor.
3. Data Analytics: Incorporating data analytics into the audit process can enhance efficiency but may also require additional resources. This includes financial investments in data analytics tools and technologies, as well as time for training auditors on data analysis techniques.
4. Interviews and Observations: Methods involving interviews and direct observations may require more time from auditors. Adequate resources should be allocated for planning, conducting interviews, and observing processes. The financial investment may involve training auditors in effective interview techniques.
5. Document Review: Document review is a fundamental part of many audit methods. Allocating resources for document review involves ensuring access to relevant documents, tools for document management, and time for thorough examination. Financial resources may be required for document storage and retrieval systems.
6. Risk-Based Audit Approach: A risk-based audit approach involves focusing on high-risk areas. This method requires a careful assessment of risks, which may involve additional time and financial investments in risk analysis tools and methodologies.
7. Integrated Audits: Integrated audits that cover multiple management system standards or functional areas may require more comprehensive planning and coordination. This approach may impact both financial and time resources due to the complexity of auditing multiple aspects simultaneously.
8. Continuous Monitoring and Auditing: Continuous monitoring and auditing methods require ongoing attention and resources. This involves investing in technologies for real-time monitoring, setting up automated alerts, and dedicating time for regular checks and assessments.
9. Specialized Audits: Specialized audits, such as environmental or information security audits, may demand additional resources. These could include financial investments in training auditors with specialized knowledge and acquiring tools specific to the subject matter.
10. Audit Follow-Up Activities: The chosen audit methods influence the nature and extent of follow-up activities. Resources need to be allocated for tracking corrective actions, conducting follow-up audits, and ensuring the effectiveness of the corrective measures.

The selection of audit methods is a critical factor in resource determination. It involves finding a balance between the depth of the audit, the expertise required, and the technologies and tools needed to support the chosen methods. By carefully considering these factors, those managing the audit program can optimize resource allocation for effective and efficient audit activities.

When determining resources for the audit programme, the individuals managing the audit programme should consider the individual and overall availability of auditors and technical experts having competence appropriate to the particular audit programme objectives

1. Individual Availability of Auditors: Assessing the individual availability of auditors is essential to ensure that there are sufficient personnel to conduct the planned audits. This includes considering factors such as workload, existing commitments, and any scheduling constraints that may impact the availability of auditors.
2. Overall Availability of Auditors: Evaluating the collective availability of auditors is crucial for managing the audit program’s overall schedule. Balancing the workload and ensuring that there are enough auditors available to cover the planned audits helps in avoiding bottlenecks and delays in the audit process.
3. Technical Expertise Matching Audit Objectives: Ensuring that auditors possess the technical expertise required for specific audit objectives is vital. The audit program should be designed to match the competence of auditors with the complexity and technical nature of the audit subjects. This involves considering the skills, knowledge, and experience of auditors in relation to the audit scope.
4. Competence Criteria for Technical Experts: When technical experts are required for specific aspects of the audit, it’s important to define competence criteria. This includes assessing their qualifications, experience, and expertise in the relevant technical areas. The audit program should allocate resources to secure the participation of technical experts who meet these criteria.
5. Training and Development Needs: Identifying any gaps in the competence of auditors or technical experts is crucial. The audit program should allocate resources for training and development to address these gaps. Continuous improvement in skills and knowledge ensures that the audit team remains effective and up-to-date.
6. Rotation of Auditors: Considering the rotation of auditors is important for maintaining independence and bringing fresh perspectives to the audit program. Resource allocation should include plans for rotating auditors to different areas within the organization or to different types of audits.
7. Succession Planning: Succession planning involves ensuring that there is a pipeline of qualified auditors to take on new roles. The audit program should allocate resources for identifying and developing future auditors, ensuring the continuity of audit capabilities.
8. Coordination and Communication Resources: Adequate resources are needed for coordinating and communicating with auditors and technical experts. This involves managing schedules, providing clear instructions, and facilitating effective collaboration. Proper communication resources contribute to the smooth execution of the audit program.
9. Audit Program Flexibility: Building flexibility into the audit program is crucial. Unexpected changes in auditor availability or the need for additional technical expertise may arise. Resources should be allocated to manage unforeseen circumstances without compromising the overall effectiveness of the audit program.

When determining resources for the audit programme, the individuals managing the audit programme should consider the extent of the audit programme and audit programme risks and opportunities

1. Extent of the Audit Program:
   • The scope and scale of the audit program directly impact the resources required. Considerations for the extent of the program include:
     • Geographical Coverage: If the audit program spans multiple locations or regions, additional resources may be needed for travel, coordination, and communication.
     • Number and Complexity of Audits: A larger number of audits or audits in complex areas may require additional resources in terms of time, personnel, and specialized skills.
     • Depth of Audits: The depth to which audits are conducted, including the level of detail and thoroughness, influences the time and expertise needed.
2. Audit Program Risks:
   • Identifying and assessing risks associated with the audit program is essential. This includes:
     • Operational Risks: Risks related to the execution of the audit program, such as scheduling conflicts, unexpected resource constraints, or logistical issues.
     • Technical Risks: Risks associated with the technical aspects of the audits, such as the complexity of the subject matter, the need for specialized knowledge, or the availability of relevant documentation.
     • Human Resource Risks: Risks related to the availability, competence, and workload of auditors and technical experts.
     • Timeline Risks: Risks associated with the timeframes set for the audit program, including potential delays and scheduling conflicts.
3. Audit Program Opportunities:
   • Identifying opportunities within the audit program is just as important. This involves recognizing areas where the audit program can add value and contribute to overall improvement. Opportunities may include:
     • Efficiency Improvements: Streamlining processes within the audit program to optimize resource utilization and enhance efficiency.
     • Innovation in Audit Methods: Exploring innovative audit methods or technologies that can improve the effectiveness of the program.
     • Skill Development: Opportunities for auditors to enhance their skills and knowledge, contributing to the professional development of the audit team.
     • Process Optimization: Identifying opportunities to improve audit planning, execution, and reporting processes.
4. Resource Allocation Strategies:
   • Based on the identified risks and opportunities, resource allocation strategies should be developed:
     • Contingency Planning: Allocating resources for contingency planning to address unforeseen challenges or risks that may arise during the audit program.
     • Training and Development: Allocating resources for training and development to capitalize on opportunities for skill enhancement and process improvement.
     • Technological Investments: Considering investments in technology or tools that can mitigate risks and enhance the efficiency of the audit program.
5. Alignment with Organizational Objectives:
   • Ensuring that the audit program aligns with overall organizational objectives is critical. Resources should be allocated to support audits that contribute directly to organizational goals, compliance requirements, and strategic priorities.

When determining resources for the audit programme, the individuals managing the audit programme should consider travel time and cost, accommodation and other auditing needs; and the impact of different time zones;

1. Travel Time and Cost, Accommodation, and Other Auditing Needs:
   • Travel Logistics: If audits involve on-site visits, individuals managing the audit program should consider the travel time and associated costs. This includes transportation expenses, whether by air, ground, or other means. Efficient planning can help optimize travel routes and minimize costs.
   • Accommodation: For audits requiring overnight stays, accommodation costs need to be factored into the budget. Considerations should include the location of auditee sites, accommodation options, and any specific requirements for lodging.
   • Other Auditing Needs: Additional auditing needs, such as access to specific tools, equipment, or facilities, should be identified. This includes ensuring that auditors have the necessary resources to conduct thorough assessments during on-site visits.
2. Impact of Different Time Zones:
   • Scheduling Challenges: The impact of different time zones can create scheduling challenges for both auditors and auditees. Coordinating activities, such as interviews or meetings, across time zones requires careful planning to accommodate participants in various locations.
   • Communication Timing: Effective communication is essential for successful audits. Considering the time zones helps in determining the most suitable timing for virtual meetings, updates, and other communication channels to ensure that all stakeholders can actively participate.
   • Work Hours and Productivity: Understanding the work hours in different time zones is crucial for managing the productivity of auditors. Adjustments may be necessary to align audit activities with the typical working hours of auditees in various locations.
   • Fatigue and Well-being: The potential for auditor fatigue due to irregular working hours caused by time zone differences should be considered. Managing the well-being of auditors is important to maintain the quality and effectiveness of the audit program.
3. Mitigation Strategies:
   • Technology Solutions: Leveraging technology, such as virtual meeting platforms, can mitigate the impact of different time zones. Virtual collaboration tools enable asynchronous communication and reduce the need for simultaneous participation.
   • Flexible Scheduling: Adopting flexible scheduling approaches, such as staggered work hours for auditors or adjusting audit activities to align with the working hours of different locations, can help accommodate time zone differences.
   • Clear Communication: Establishing clear communication protocols and expectations regarding response times and availability helps minimize misunderstandings and ensures effective collaboration despite time zone variations.
4. Budgetary Considerations:
   • Financial Planning: Considering the impact of travel and time zone differences is essential for accurate budgeting. Adequate financial resources should be allocated to cover travel expenses, accommodation costs, and any additional expenses associated with managing time zone disparities.
   • Resource Optimization: Exploring cost-effective alternatives, such as virtual audits or using local auditors when feasible, can help optimize resources and reduce the financial impact of travel and time zone challenges.

When determining resources for the audit programme, the individuals managing the audit programme should consider 1) the availability of information and communication technologies (e.g. technical resources required to set up a remote audit using technologies that support remote collaboration); and 2) the availability of any tools, technology and equipment required;

1. Availability of Information and Communication Technologies (ICT):
   • Technical Resources for Remote Audits: If remote audits are part of the audit program, the availability of technical resources for remote collaboration becomes paramount. This includes:
     • Video Conferencing Tools: Ensuring access to reliable video conferencing platforms for virtual meetings, interviews, and discussions.
     • Collaboration Platforms: Providing access to collaboration tools that facilitate document sharing, real-time editing, and collaborative work among auditors and with auditees.
     • Secure Communication Channels: Ensuring the use of secure communication channels to protect sensitive information exchanged during remote audits.
   • Accessibility and Training: Confirming that all auditors are equipped with the necessary devices (e.g., computers, cameras, microphones) and have the skills and training to effectively use the selected ICT tools.
2. Availability of Tools, Technology, and Equipment:
   • Audit Management Software: If applicable, ensuring that there is access to audit management software to streamline audit planning, execution, and reporting.
   • Data Analytics Tools: If data analytics is part of the audit program, providing access to relevant tools and technologies for analyzing large datasets and extracting meaningful insights.
   • Document Management Systems: Ensuring the availability of a document management system for efficient storage, retrieval, and sharing of audit-related documents.
   • Mobile Devices: Assessing the need for mobile devices, such as tablets or smartphones, if audits involve on-site inspections or data collection in the field.
   • Specialized Equipment: Identifying any specialized equipment required for specific audits, such as environmental monitoring devices, testing equipment, or other tools related to the audit scope.
3. Technological Infrastructure:
   • Internet Connectivity: Verifying that auditors have reliable and high-speed internet connectivity, especially for remote audit activities.
   • IT Security Measures: Ensuring the implementation of robust IT security measures to protect audit data, information, and communication channels.
   • Backup and Redundancy: Establishing backup and redundancy measures for critical ICT components to minimize disruptions in case of technical failures.
4. Vendor Support and Maintenance:
   • Vendor Relationships: If relying on third-party vendors for ICT tools or software, ensuring that there are reliable vendor relationships and support mechanisms in place.
   • Maintenance Plans: Implementing maintenance plans for ICT tools and equipment to address any technical issues promptly and ensure optimal performance.
5. Integration with Existing Systems:
   • Compatibility: Confirming that the chosen ICT tools and technologies are compatible with existing systems and technologies within the organization.
   • Integration Planning: Developing plans for seamless integration of ICT tools into the audit program workflow to avoid disruptions and enhance efficiency.
6. Contingency Planning:
   • Technical Support: Allocating resources for technical support to address unforeseen technical challenges during the audit program.
   • Backup Solutions: Implementing backup solutions and contingency plans to address ICT failures or disruptions, ensuring the continuity of audit activities.

When determining resources for the audit programme, the individuals managing the audit programme should consider the availability of necessary documented information, as determined during the establishment of the audit programme

1. Documented Information Requirements:
   • Identification of Required Information: During the establishment of the audit program, it’s essential to clearly identify the specific documented information required for each audit. This includes considering the scope, objectives, and criteria of the audit and determining the relevant documents needed for thorough assessments.
2. Communication with Auditees:
   • Early Communication: Establish effective communication channels with auditees early in the audit planning process. Clearly communicate the types of documents and information that will be requested during the audit. This allows auditees to prepare and ensures that the necessary information is available when needed.
3. Document Review and Accessibility:
   • Audit Program Design: Design the audit program to include a systematic review of documented information. Consider the accessibility of documents, whether they are electronic or hard copies, and plan accordingly for document retrieval during audits.
   • Technological Solutions: If applicable, leverage technology to facilitate document sharing and review. This may involve using secure online platforms for document exchange or providing auditors with access to document management systems.
4. Audit Criteria and Standards:
   • Alignment with Standards: Ensure that the audit program is aligned with relevant management system standards or other criteria. This alignment guides the identification of necessary documented information based on the requirements of the standards or criteria.
5. Documentation Quality and Completeness:
   • Quality Control Measures: Implement quality control measures to assess the completeness and accuracy of documented information. This ensures that auditors have access to reliable and relevant documents during the audit process.
6. Auditor Training and Familiarity:
   • Training on Documented Information: Provide training to auditors on the types of documented information they are likely to encounter during audits. Familiarity with common documents and recordkeeping practices enhances the efficiency of the audit process.
7. Legal and Regulatory Compliance:
   • Consideration of Legal Requirements: Ensure that the audit program considers legal and regulatory requirements related to the availability of specific documented information. Compliance with legal mandates may influence the types of documents auditees are required to maintain and provide.
8. Integration with Management Systems:
   • Integration Planning: Integrate considerations for documented information into the broader context of the organization’s management systems. This involves aligning audit activities with existing processes for document control and management.
9. Continuous Improvement:
   • Feedback Mechanisms: Establish feedback mechanisms with auditees to continuously improve the efficiency of the document exchange process. Solicit input on ways to streamline information sharing and reduce any burdens associated with providing documented information.
10. Documentation Retention Policies:
    • Understanding Retention Periods: Understand the organization’s documentation retention policies. Some documents may have specific retention periods, and auditors should be aware of these timelines when planning audits.

When determining resources for the audit programme, the individuals managing the audit programme should consider requirements related to the facility, including any security clearances and equipment (e.g. background checks, personal protective equipment, ability to wear clean room attire)

1. Facility Requirements:
   • Access to Facilities: Assess the access requirements to auditee facilities. Determine whether auditors need specific permissions, identification, or security clearances to enter and conduct audits in certain areas of the facility.
   • Logistical Planning: Plan logistics related to facility access, including coordination with facility management, scheduling audits at convenient times, and obtaining any required permits or passes.
2. Security Clearances:
   • Identification of Secure Areas: Identify if certain areas within the facility require security clearances for access. Determine whether auditors need to undergo background checks or meet specific security criteria to enter secure zones.
   • Pre-Audit Clearances: If security clearances are necessary, ensure that the clearance process is initiated well in advance of the audit. This may involve coordination with security personnel and providing necessary documentation.
3. Equipment and Personal Protective Equipment (PPE):
   • Identification of Necessary Equipment: Identify any specialized equipment required for audits, such as testing devices, measurement tools, or technology-specific equipment.
   • Personal Protective Equipment (PPE): Determine whether auditors need to wear specific PPE, such as safety helmets, goggles, gloves, or cleanroom attire, based on the nature of the facility and audit scope.
   • Availability of Equipment: Confirm the availability and condition of required equipment, ensuring that auditors have access to functioning tools and resources during the audit.
4. Health and Safety Compliance:
   • Compliance with Health and Safety Regulations: Ensure that the audit program aligns with health and safety regulations. This includes confirming that auditors are aware of and comply with all relevant safety guidelines during facility visits.
   • Emergency Procedures: Establish and communicate emergency procedures to auditors, including evacuation plans, first aid locations, and contact points for facility personnel responsible for health and safety.
5. Cleanroom Attire:
   • Assessment of Cleanroom Requirements: If audits involve cleanroom environments, assess the specific requirements for cleanroom attire. This may include specialized clothing, footwear, and hygiene practices to prevent contamination.
   • Training on Cleanroom Protocols: Provide auditors with training on cleanroom protocols to ensure they are familiar with the necessary procedures for maintaining cleanliness and adhering to cleanroom standards.
6. Coordination with Facility Management:
   • Communication with Facility Managers: Establish clear communication channels with facility management. Discuss and confirm all requirements related to facility access, security clearances, equipment, and attire to avoid any misunderstandings or disruptions during the audit.
7. Audit Program Flexibility:
   • Adaptability to Facility-Specific Requirements: Design the audit program to be adaptable to facility-specific requirements. Consider variations in facility types and industries and tailor audit plans accordingly to meet the unique needs of each facility.
8. Audit Team Training:
   • Training on Facility-Specific Requirements: Provide training to audit teams on facility-specific requirements and protocols. This ensures that auditors are well-prepared and can navigate the facility efficiently and in compliance with all regulations.