Training module
Audit Programme Management
Design and govern risk-informed audit programmes across standards, group structures and programme-level reporting
Is your audit programme a disjointed calendar of activities rather than a coherent assurance portfolio?
Establish robust governance, risk-informed planning, and integrated processes to transform your audit programme into a strategic asset.
Overview
What this module is about
Many organisations manage individual audits effectively but struggle to oversee their audit programme as a cohesive system. This often leads to shifting priorities, fragmented results, and supplier audits operating in isolation.
This module focuses on the critical work of designing and governing an audit programme, from single-entity to group-level operations. Participants will learn to build practical structures for meaningful coverage, flexible scheduling, and decision-relevant reporting, ensuring consistent quality and driving continual improvement across all audits.
Audience
Who it is for
Management system implementers and coordinators
Executives and department heads accountable for management system performance
Those responsible for processes, policies, assets, risks and controls
Auditors seeking insight into management-side practice, not audit technique
Consultants working on management system design, governance or improvement
Decision supportIs this module for you?
It is a good fit if you…
are responsible for running or shaping an audit programme.
struggle to move from a calendar of audits to risk-based coverage.
need to decide when audits across multiple standards should be combined or kept separate.
need a harmonised programme model across groups or corporate structures without losing local fit.
want programme-level reporting that supports assurance decisions.
It may not be the best fit if you…
already operate a mature, risk-informed audit programme that works in practice.
are not involved in audit programme governance or coordination.
need audit execution skills such as interviewing or evidence collection.
are looking for ISO clause interpretation or audit technique training.
What to bring
This module assumes participants can already operate comfortably in the internal audit domain and understand the difference between programme management and audit execution. In particular:
Solid understanding of audit principles, evidence thinking, and auditor judgement
Familiarity with how audit findings are formulated, reported, and followed up
Basic familiarity with supplier/outsourced relationships (helpful for programme-level integration)
Agenda
What is taught
9 parts01Role and boundaries of audit programme management
How audit programme responsibility differs from individual audit responsibility, and where the boundaries of this module sit by design
02Programme governance and operating model
How to define roles, decision rights, escalation paths, and independence at programme level, and design interfaces with system owners, procurement, and leadership routines
03Risk-informed audit portfolio design across standards
How to use existing context, risks, and priorities to design multi-year and annual audit portfolios across multiple standards, and decide where combined audits create value and where separate audits provide clearer assurance
04Supplier audit integration at programme level
How to integrate supplier audits into the overall programme using segmentation by criticality, dependency, and impact, and manage coordination points such as access, confidentiality, and contractual interfaces
05Group-level harmonisation and local flexibility
How to build common programme structures, templates, reporting, and review routines across groups or corporate structures while preserving sensible local adaptation at entity and site level
06Scheduling and resource planning
How to build audit schedules that remain workable under change, and assign auditors based on competence, independence, and conflict considerations as programme controls
07Consistency and quality across audits
How to establish programme standards through templates, expectations, and calibration approaches, and maintain auditor competence while reducing variability from a programme governance perspective
08Programme monitoring, consolidation, and reporting
How to track audit coverage and delivery without turning monitoring into KPI design work, and consolidate themes and systemic issues for management visibility
09Continual improvement of the audit programme
How to apply learning loops, feedback, and periodic re-baselining, and update governance, portfolio logic, and quality controls as the programme evolves
Outcomes
Learning outcomes
01
Define an audit programme charter that clarifies governance, roles, and escalation routes
02
Build a multi-year and annual audit portfolio that is risk-informed using existing organisational inputs and clear logic for combined or separate audits
03
Integrate supplier audits into the overall audit programme with clear coverage logic and interfaces
Create an audit schedule and resource plan accounting for competence, independence, and change
Set programme-level consistency controls and harmonised governance across sites and entities without dictating audit execution methods
Consolidate audit results into programme-level themes for management visibility and review
Materials
The content and the assessment
Written module
The full content in writing, complete in itself. Videos are recorded for parts of it as an alternative way through, and the written module always carries everything.
Exercises
Graded work on the case organisation's own registers: structured answers checked against the encoded case, written answers scored against a rubric traced to it, with a trainer holding the final word on every assessed item.
On completion
The assessed exercises must be passed before the certificate is issued.
Scheduling
No public run of Audit Programme Management is scheduled at the moment. Tell us you are interested and we will let you know when the next one opens, or discuss running it in-house.
Module facts
- Module ID
- HAM-AG-AC-04
- Discipline
- Cross-discipline
- Part of tracks
- Management System Auditor
Case organisation
All modules share one company
Each module enters the company at a particular point in its history and finds it as that history has left it.
Northstar Integrated Services AG is a group headquartered in Zurich, operating in six European countries, with about 1,350 employees at the end of 2025. It provides digital operations platforms and managed operational services to regulated organisations in healthcare, the public sector and industrial services. Founded in 2008 as a field-operations firm serving business customers, it had about twenty-five employees when its first regulated customer, a hospital group, required documented decisions, named accountability and evidence on request. It moved into the platform business in 2016 and in 2024 acquired an operating business in Poland and the Czech Republic, whose legal entity continues inside the group.
Linked registers
Organisation and people, roles, risks, objectives, policies, documents and records, communications, findings, audits and reviews, interested parties, processes
Records, not summaries
The evidence sits in the registers and documents where a real organisation would keep it.
A history
The company has a timeline from 2008, so a structure can be examined before and after it changed.
More than one legal entity
A Swiss parent company and an acquired subsidiary in Poland and the Czech Republic, with customers in several jurisdictions
Why it matters
Judgement develops on material that is incomplete and partly contradictory, as it is in practice. Northstar is built that way on purpose. Because modules enter its history at different points, a governance structure can be seen while it is built, when it is outgrown and when it is rebuilt.
Delivery & dates
How this module reaches you
Delivered live online, combining conceptual framing, discussion, case work and direct interaction with the trainer. In-house and contextualised delivery is available on request.
No public run is scheduled at the moment. Most modules run on request as well as on the public calendar, so tell us the timing you need.
Want this module scheduled?
We will tell you when the next run is scheduled, or run this module in-house with your own case material.
Not sure it is the right module?
Describe your context in a short message and we will tell you honestly.