Training module
Audit Programme Management
Design and govern risk-informed audit programmes across standards, group structures and programme-level reporting
Is your audit programme a disjointed calendar of activities rather than a coherent assurance portfolio?
Establish robust governance, risk-informed planning, and integrated processes to transform your audit programme into a strategic asset.
Overview
What this module is about
Many organisations manage individual audits effectively but struggle to oversee their audit programme as a cohesive system. This often leads to shifting priorities, fragmented results, and supplier audits operating in isolation.
This module focuses on the critical work of designing and governing an audit programme, from single-entity to group-level operations. Participants will learn to build practical structures for meaningful coverage, flexible scheduling, and decision-relevant reporting, ensuring consistent quality and driving continual improvement across all audits.
Audience
Who it is for
Management system implementers and coordinators
Executives and department heads accountable for management system performance
Those responsible for processes, policies, assets, risks and controls
Auditors seeking insight into management-side practice, not audit technique
Consultants working on management system design, governance or improvement
Decision supportIs this module for you?
It is a good fit if you…
are responsible for running or shaping an audit programme.
struggle to move from a calendar of audits to risk-based coverage.
need to decide when audits across multiple standards should be combined or kept separate.
need a harmonised programme model across groups or corporate structures without losing local fit.
want programme-level reporting that supports assurance decisions.
It may not be the best fit if you…
already operate a mature, risk-informed audit programme that works in practice.
are not involved in audit programme governance or coordination.
need audit execution skills such as interviewing or evidence collection.
are looking for ISO clause interpretation or audit technique training.
Agenda
What is taught
10 parts01Role and boundaries of audit programme management
How audit programme responsibility differs from individual audit responsibility, and where the boundaries of this module sit by design
02Programme governance and operating model
How to define roles, decision rights, escalation paths, and independence at programme level, and design interfaces with system owners, procurement, and leadership routines
03Risk-informed audit portfolio design across standards
How to use existing context, risks, and priorities to design multi-year and annual audit portfolios across multiple standards, and decide where combined audits create value and where separate audits provide clearer assurance
04Supplier audit integration at programme level
How to integrate supplier audits into the overall programme using segmentation by criticality, dependency, and impact, and manage coordination points such as access, confidentiality, and contractual interfaces
05Group-level harmonisation and local flexibility
How to build common programme structures, templates, reporting, and review routines across groups or corporate structures while preserving sensible local adaptation at entity and site level
06Scheduling and resource planning
How to build audit schedules that remain workable under change, and assign auditors based on competence, independence, and conflict considerations as programme controls
07Consistency and quality across audits
How to establish programme standards through templates, expectations, and calibration approaches, and maintain auditor competence while reducing variability from a programme governance perspective
08Programme monitoring, consolidation, and reporting
How to track audit coverage and delivery without turning monitoring into KPI design work, and consolidate themes and systemic issues for management visibility
09Continual improvement of the audit programme
How to apply learning loops, feedback, and periodic re-baselining, and update governance, portfolio logic, and quality controls as the programme evolves
10Case-based workshop
Applying the learned concepts, methods, and approaches in a realistic case setting
Outcomes
Learning outcomes
01
Define an audit programme charter that clarifies governance, roles, and escalation routes
02
Build a multi-year and annual audit portfolio that is risk-informed using existing organisational inputs and clear logic for combined or separate audits
03
Integrate supplier audits into the overall audit programme with clear coverage logic and interfaces
Create an audit schedule and resource plan accounting for competence, independence, and change
Set programme-level consistency controls and harmonised governance across sites and entities without dictating audit execution methods
Consolidate audit results into programme-level themes for management visibility and review
Materials
The content and the assessment
Written module
The full content in writing, complete in itself. Videos are recorded for parts of it as an alternative way through, and the written module always carries everything.
Exercises
Graded work on the case organisation's own registers: structured answers checked against the encoded case, written answers scored against a rubric traced to it, with a trainer holding the final word on every assessed item.
On completion
The assessed exercises must be passed before the certificate is issued.
Scheduling
No public run of Audit Programme Management is scheduled at the moment. Tell us you are interested and we will let you know when the next one opens, or discuss running it in-house.
Module facts
- Module ID
- HAM-AG-AC-04
- Discipline
- Cross-discipline
- Part of tracks
- Management System Auditor
Case organisation
You work inside a company that already has the problem
Exercises run on one case organisation, carried across modules rather than restarted, so what you build here is what the next module finds.
Northstar Integrated Services AG is a group headquartered in Zurich, providing digital operations platforms and managed services to regulated organisations across Europe. It has not always been that. It began in 2008 as a field-operations firm of about twenty-five people, and what first forced documented decisions and named accountability on it was not growth but a single regulated customer. It now runs an acquired business in Poland and the Czech Republic through a subsidiary that kept its own legal identity, which is where the interesting failures live: group instruments rolled out operationally and never put in force by the governing bodies of the subsidiary itself.
Linked registers
Organisation and people, risks, objectives, policies and documents, findings and reviews, third parties, processes
Not a case study
Nothing is summarised for you; the evidence is where it would really be
It has a history
The organisation has a timeline, and modules enter it at different points, so a structure can be studied before it broke as well as after
It crosses borders
A Swiss parent, an acquired operating business in Poland and the Czech Republic under its own legal entity, and customers in several jurisdictions
Why it matters
Judgement is not trained on tidy examples, and it is not trained on a fresh one each week. Northstar is deliberately untidy, and modules enter it at different points of its history, so you see a governance structure being built, outgrown and rebuilt rather than a finished one. What you decide in one module is what the next one finds.
Delivery & dates
How this module reaches you
Delivered live online, combining conceptual framing, discussion, case work and direct interaction with the trainer. In-house and contextualised delivery is available on request.
No public run is scheduled at the moment. Most modules run on request as well as on the public calendar, so tell us the timing you need.
Want this module scheduled?
We will tell you when the next run is scheduled, or run this module in-house with your own case material.
Not sure it is the right module?
Describe your context in a short message and we will tell you honestly.