A policy on its own does not show that people follow it. An audit is how you check. A programme is how you decide what to check, when, and what happens when something does not hold.
What an audit is for
An audit asks a set of questions about a defined scope and records the answer with evidence. Conform means the requirement is met. A non-conformity means it is not. An observation records something worth noting without calling it a failure. Not applicable means the question does not apply to this audit.
The useful part is the trail. Later, an auditor, a customer, or your own management review can see what was looked at, what was found, and whether the finding was raised as a non-conformity, an opportunity for improvement, or a risk.
Why a programme, not a one-off
- Coverage. One audit cannot examine every control. A programme spreads questions across the year so the same standard is not always sampled in the same place.
- Timing. Due dates make overdue work visible. A checklist left half finished is still an open audit.
- Independence of the record. Internal audits are yours. External audits are someone else’s. Both belong on the same register so the year is one story.
- Follow-up. Findings only help if they are raised into the registers you already use for non-conformities, improvements, and risks.
What good looks like
You can point to a question bank, a schedule of audits, and completed checklists. You can see which standards were audited this year and which questions have never been planned. You can open an overdue audit and finish it, rather than reconstructing it from email.
How ISMSVision helps with auditing describes the product. The Auditing category explains how to change the overview, schedule, calendar, question bank, plan, and checklist.