Curriculum
- 2 Sections
- 37 Lessons
- 26 Weeks
- ISO/IEC 20000-112
- 1.1Introduction to IT Service Management and ISO/IEC 20000-1
- 1.2ISO/IEC 20000-1 Structure and Core Clauses
- 1.3Service Management System (SMS) Requirements and Integration
- 1.4Service Portfolio, Service Catalogue, and Service Level Management
- 1.5Relationship Management and Supplier Management
- 1.6Service Design, Transition, and Change Management
- 1.7Incident Management and Service Request Management
- 1.8Problem Management and Configuration Management
- 1.9Availability Management and Capacity Management
- 1.10Information Security Management and IT Service Continuity
- 1.11Performance Evaluation and Continual Improvement
- 1.12Documentation, Records Management, and Compliance
- ISO 19011: Guidelines for auditing management systems26
- 2.1Introduction to ISO19011
- 2.2Principles of Auditing
- 2.3Managing an Audit Program
- 2.4Establishing Audit Program Objectives
- 2.5Determining Audit Program Risks and Opportunities
- 2.6Establishing the Audit Program
- 2.7Implementing the Audit Program
- 2.8Monitoring the Audit Program
- 2.9Reviewing and Improving the Audit Program
- 2.10Initiating the Audit
- 2.11Determining Audit Feasibility
- 2.12Preparing Audit Activities
- 2.13Reviewing Documented Information
- 2.14Preparing the Audit Planx
- 2.15Assigning Work to the Audit Team
- 2.16Preparing Working Documents
- 2.17Opening Meeting
- 2.18Communication During the Audit
- 2.19Collecting and Verifying Information
- 2.20Generating Audit Findings
- 2.21Preparing Audit Conclusions
- 2.22Closing Meeting
- 2.23Preparing the Audit Report
- 2.24Completing the Audit
- 2.25Follow-Up Activities
- 2.26ISO 20000-1 EXAM120 Minutes40 Questions
Establishing the Audit Program
Establishing the Audit Program
The first step in establishing an audit program is defining its scope. The scope determines the boundaries and coverage of the audit activities. It identifies which management systems, processes, locations, and organizational units will be included in the audit program.
When defining the scope, organizations should consider factors such as:
- The size and structure of the organization
- The complexity of processes and operations
- The number of operational locations or sites
- Applicable legal and regulatory requirements
- The requirements of relevant management system standards
For example, organizations implementing standards such as ISO 9001, ISO 14001, or ISO 45001 must ensure that their audit programs adequately cover all relevant processes required by these standards.
Determining Audit Criteria
Audit criteria are the set of requirements used as a reference against which audit evidence is compared. Establishing clear audit criteria is essential to ensure that auditors evaluate processes consistently and objectively.
Audit criteria may include:
- Requirements of international standards
- Organizational policies and procedures
- Regulatory and legal requirements
- Contractual obligations
- Internal management system documentation
Defining these criteria helps auditors determine whether the organization’s activities conform to the specified requirements.
Selecting Audit Methods
The audit program should also define the methods that will be used to conduct audits. Audit methods may vary depending on the nature of the processes being audited and the objectives of the audit program.
Common audit methods include:
- On-site audits conducted at organizational facilities
- Remote audits using digital communication tools
- Document and record reviews
- Process observation
- Interviews with personnel
Organizations may use a combination of these methods to ensure that sufficient and reliable evidence is collected during the audit.
An important part of the audit program is the audit schedule. The schedule determines when audits will take place and which processes or departments will be audited during a specific time period.
When establishing the audit schedule, organizations should consider:
- The importance and risk level of each process
- Results of previous audits
- Organizational priorities and objectives
- Availability of auditors and resources
- Regulatory or certification requirements
High-risk or critical processes may require more frequent audits, while lower-risk activities may be audited less frequently.
Clear roles and responsibilities must be defined to ensure the successful implementation of the audit program. Typically, an audit program manager is responsible for overseeing the program and ensuring that audit activities are properly coordinated.
Responsibilities within the audit program may include:
- Planning and scheduling audits
- Selecting competent auditors and audit teams
- Ensuring that auditors have appropriate training
- Monitoring audit progress
- Reviewing audit results and reports
- Maintaining audit records and documentation
Clearly defined responsibilities help ensure accountability and consistency in audit activities.