Build an audit programme around the decisions that matter

Build an internal audit programme by identifying which business decisions need more reliable evidence, then choose the processes, locations and samples that can resolve that uncertainty. A calendar remains useful, but a calendar alone does not explain why a quiet process is sampled lightly while a recently changed service receives deeper attention.

ISO lists ISO 19011:2026 as its current auditing guidance. The standard does not itself provide a route to certification. The method below is our practical proposal for a Singapore-based team coordinating regional operations, not a reproduction of ISO requirements. Confirm your applicable audit criteria and licensed standards separately. 1

Distinguish the programme, which coordinates a set of audits, from the plan for one audit. Make selection reasons visible. Where access, competence or sample coverage is inadequate, record a limitation rather than issue a confident conclusion.

Ask process owners what may need to change in the next operating cycle. A new subcontractor, a software migration or repeated rework may justify a closer examination. Write the question in observable terms: can staff complete the revised approval route during the evening shift? “Check compliance” is too broad to guide a useful sample.

Use a simple selection record. The entries below are suggested fields, not a scoring formula. A serious consequence can warrant attention even when the number of incidents is small.

Do not let a process owner supply only their best recent files. Agree how records will be selected, including exceptions and ordinary transactions. Explain why that sample can answer the audit question and what it cannot establish. A small purposeful sample can reveal a control failure; it cannot automatically establish a failure rate across the whole population.

For a Singapore headquarters with overseas delivery teams, separate regional policy from local execution. Confirm access permissions and whether the auditor can interpret the records, working calendar and customer obligations at the sampled location. A remote interview may explain a process without proving that an inaccessible control operated.

Assume a fictional service company has stable billing controls but recently moved customer approvals to a shared platform. It initially allocates equal audit time to both. The coordinator instead proposes deeper sampling of the changed approval route, including delegated approvals and rejected requests, while documenting the basis for lighter billing coverage.

During preparation, the overseas team cannot provide access to the approval history. The coordinator records that limitation, names an owner and postpones the affected conclusion. The programme does not label the process effective merely because the headquarters demonstration worked. These are invented circumstances, not a client result or a required audit frequency.

Fictional programme decision. A coordinator has eighteen auditor-hours for two planned reviews. The starting allocation is nine hours each. The new approval platform has changed access and routing; billing has a stable process and recent relevant evidence.

The shift is three hours from billing to approvals, not a claim that risk has been measured numerically. Record the justification, competence needs and limits before approving the allocation. Six hours is not a universal minimum for billing, and twelve hours does not guarantee adequate approval-route coverage.

If overseas history remains inaccessible, the extra hours cannot manufacture evidence. The audit can report what the accessible location showed, explicitly reserve the missing conclusion and request access or another suitable procedure. Management then decides whether to provide more resources or accept a bounded delay through its authorised process.

This example separates a programme resource decision from an engagement finding. Retain the original question and scope so that a completed schedule cannot be mistaken for complete assurance over the process.

After each audit, compare the evidence obtained with the original question. If an important dependency was omitted, revise the programme and explain the change. Assign an appropriately competent person who is sufficiently independent of the work to evaluate contested evidence; avoid assigning someone to approve their own unchallenged account.

Carry material limitations into management-review decisions. Leaders may need to fund access, change the scope or accept a clearly bounded delay. Track that decision separately from the completion of the audit report.

This guide sets no universal frequency. Determine coverage from applicable requirements, operational circumstances and the evidence needed; retain the rationale.

Do not infer that from publication. ISO directs certified organisations to their certification body for transition information. Keep the confirmed advice and relevant dates with the programme. 2

Take one planned audit and write the decision, selection reason, sample boundary and unresolved limitation before allocating more interviews.

AI assisted research and drafting. This article is general information; verify current requirements and obtain competent advice for consequential decisions.

1. ISO 19011 official edition and scope — ISO 19011:2026, edition 4, published 27 May 2026; public catalogue, not the licensed clauses.

2. ISO 9001 official edition and transition overview — ISO 9001:2026, edition 6, published September 2026; transition arrangements require confirmation.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.