Quarterly audits do not have to mean auditing the same checklist four times a year. A useful internal audit programme distributes work across a planned cycle while giving greater attention to areas that need it.
The starting point is to distinguish audit frequency from audit coverage. Frequency determines when audits take place. Coverage determines which processes, requirements and activities each audit will examine.
The key question: What should we audit, when, and why? Choosing “quarterly” answers only the timing part.
What is the difference between an audit programme and an audit plan?
An internal audit programme coordinates a set of audits over a defined period. It establishes the overall objectives, coverage, frequency, responsibilities and resources needed to organise and manage those audits.
An individual audit plan describes the arrangements for a particular audit: its objectives, scope, criteria, auditor, timing and planned activities.
For example, your annual programme might include a supplier-management audit in the third quarter. The plan for that audit would identify which supplier processes and requirements will be examined, who will conduct the audit, which people need to be available and how the work will be scheduled.
1. Define what the programme needs to cover
Identify the management system, locations, teams and activities within scope. Then establish the audit criteria: the requirements against which evidence will be assessed.
Criteria may include a selected management system standard, internal policies and procedures, contractual commitments, or other applicable requirements. Keep these specific enough for an auditor to understand what they need to evaluate.
A list of clause numbers alone is rarely a complete audit plan. Connect the requirements to the processes and people that put them into practice.
2. Group criteria into meaningful audits
Divide the programme into subjects that make operational sense. For example, supplier selection, supplier monitoring and related purchasing controls may fit together in one audit, even where they connect to several different requirements.
Grouping related criteria helps the auditor follow how work actually happens. It also reduces repeated requests for the same evidence and makes findings easier to discuss with the people responsible.
If your organisation works to more than one standard, read our guide to planning internal audits across multiple ISO standards for ways to combine related processes while keeping each standard’s requirements visible.
3. Distribute coverage across the cycle
Set a planning period that suits your organisation and its applicable requirements. If you choose a yearly programme with quarterly audits, allocate a clear purpose to each quarter.
The example below illustrates how coverage could be distributed. It is not a complete checklist or a prescribed schedule for any particular standard.
| Period | Audit focus | Example areas to examine |
|---|---|---|
| Quarter 1 | Direction and planning | Scope, responsibilities, risks, objectives and management system planning. |
| Quarter 2 | People and supporting processes | Competence, awareness, communication and control of documented information. |
| Quarter 3 | Operational delivery | Selected operational processes, supplier controls and implementation of relevant requirements. |
| Quarter 4 | Evaluation and improvement | Performance monitoring, management review, corrective actions and improvement. |
Before approving the programme, check the allocation against the full scope and criteria. Broad themes can help organise the work, but they can also hide gaps if individual requirements are never mapped to a planned audit.
4. Repeat areas where there is a reason
Repetition can be valuable. A high-risk process, a significant change or a recurring nonconformity may justify more frequent attention than a stable, lower-risk activity.
- Revisit areas with significant or recurring findings.
- Consider additional audits after important process changes.
- Check whether corrective actions have been effective.
- Adjust coverage when new risks or requirements emerge.
Record the reason for repeated coverage. This makes the programme easier to explain and distinguishes a deliberate follow-up from accidental duplication.
5. Assign auditors to individual audits
Consider competence, availability and impartiality when assigning each audit. Different subjects may need different auditors, and assignments may need to change during the cycle.
If an auditor becomes unavailable, a replacement should be able to understand the audit scope, completed work and outstanding criteria. Clear records make that handover easier.
6. Review the programme as work progresses
A programme should remain useful throughout the planning period. Review completed coverage, overdue audits, findings and changes in the organisation. Update the schedule where needed and keep a record of the decisions.
Before approving your programme, check:
- Programme objectives and responsibilities are clear.
- Every audit has defined objectives, scope and criteria.
- Planned coverage addresses the intended programme scope.
- Higher-risk areas receive appropriate attention.
- Auditor assignments reflect competence and impartiality.
- There is enough time to gather evidence and report findings.
- Follow-up work and programme changes can be tracked.
How Veqrin supports audit planning
Veqrin brings programme planning, audit schedules, individual auditor assignments, evidence, approvals and nonconformities into one workspace.
Organisations can select supported standard criteria or add their own requirements, choose a frequency and generate a proposed audit programme. Managers should review that proposal against their organisation’s scope, risks and priorities before approving it.
See the audit workflow
Explore Veqrin’s self-guided tour to see how audit planning, evidence and reporting fit together. No account or appointment is needed.
Explore the self-guided tour →