The Coverage Gap That Created This Problem<\/h2>\n\n\n\n

The persistence of fixed-rotation programmes is not primarily an organisational failure. It’s a normative framework gap.<\/p>\n\n\n\n

ISO 9001:2015 Clause 9.2.2(b) requires frequency to reflect process importance. It does not define how. ISO 19011:2018 Clause 5.4 provides a risk-based programme management framework. It does not define what evidence threshold separates a defensible frequency from a default one. No IAF mandatory document addresses internal audit programme frequency methodology. No major CB \u2014 BSI, LRQA, SGS, T\u00dcV, Bureau Veritas \u2014 has published guidance defining what data inputs, scoring methodology, or evidence standard constitute an adequate risk-based frequency determination.<\/p>\n\n\n\n

The result is a structural enforcement vacuum. A quality manager presenting a procedure that references Clause 9.2.2(b) satisfies most CB audit teams. No risk score, frequency matrix, or performance data record is required. The clause is technically assessed. The intent behind it \u2014 that high-risk processes receive more audit attention than low-risk ones \u2014 is not verified.<\/p>\n\n\n\n

ISO DIS 9001:2025’s defined-objectives requirement partially addresses this gap by creating a per-audit evidence test. But the underlying methodology gap remains: even after the revision, no normative document will define what a risk-based internal audit programme must contain. Organisations that want a defensible programme will need to build the methodology themselves.<\/p>\n\n\n\n

Converting a Fixed-Rotation Audit Programme to Risk-Based Design<\/h2>\n\n\n\n

The conversion is not a documentation exercise. It requires rebuilding the frequency logic from process performance data.<\/p>\n\n\n\n

Build the Process Risk Profile<\/h3>\n\n\n\n

Map every process in the audit programme against three data streams: corrective action volume and severity over the previous two cycles, process KPI trends (scrap rates, customer complaints, delivery failures, incident rates \u2014 whatever the process measures), and changes to the process since the last audit (new equipment, personnel changes, scope expansion, supplier changes). Score each process on a simple scale \u2014 high, medium, low. The scoring methodology matters less than the fact that it exists and is documented.<\/p>\n\n\n\n

Calibrate Frequency to Risk<\/h3>\n\n\n\n

High-risk processes get audited more frequently \u2014 twice per year or quarterly, depending on severity. Medium-risk processes maintain annual frequency. Low-risk processes extend to 18-month or two-year intervals, provided no triggers (nonconformities, complaints, changes) activate an earlier audit. Document the frequency rationale per process. The rationale is the evidence Clause 9.2.2(b) requires.<\/p>\n\n\n\n

Define Per-Audit Objectives<\/h3>\n\n\n\n

For each scheduled audit, document a specific objective beyond “verify conformance.” Objectives should be performance questions: “Determine whether the revised supplier evaluation process has reduced incoming inspection reject rates since Q2 implementation.” “Evaluate whether corrective actions from the March audit have prevented recurrence of the packaging nonconformity pattern.” “Assess whether the new production line’s process controls are producing output within specification at the volumes planned.” The point is that someone reading the objective knows exactly what the auditor was sent to evaluate. Each objective is unique to the process context and the current risk profile. Identical objectives across audits are a programme design failure.<\/p>\n\n\n\n

Build the Feedback Loop<\/h3>\n\n\n\n

After each audit cycle, cross-reference results against the risk profile. Processes where audits identified nonconformities or where objectives were not met escalate in frequency or scope for the next cycle. Processes with clean results and stable KPIs may reduce frequency. Document the programme review decision \u2014 this is the evidence trail for Clause 9.2.2(d) and the “maintained” requirement in Clause 9.2.2(a). Present the programme review output at management review under Clause 9.3.<\/p>\n\n\n\n