An internal audit programme is a schedule with reasons in it. It says which processes will be audited, in which months, by whom, against which criteria and over what scope — and it says why those processes and not others. Clause 9.2.2 asks for exactly that, and it asks for the record that the programme was carried out, which is a different document from the programme itself and the one an auditor actually reads.
Most organisations hold the first document and cannot produce the second. A schedule is drawn up in January, circulated, filed, and not touched again; audits happen when an audit is convenient, in the processes that are easy to audit, conducted by whoever is available, including the person who owns the process. The programme then describes a year that did not happen, and the gap between the plan and the record is the clearest evidence that the cycle was not run.
This piece sets out what the clause requires, the inputs that should move a schedule, an illustrative year laid out as a table, the objectivity rule and what to do in an organisation too small to satisfy it comfortably, the measured cost of a programme year, the five ways programmes fail, and the decision that keeps the programme from becoming paperwork.
What the clause requires
Clause 9.2.1 requires internal audits at planned intervals, to determine whether the quality management system conforms to the organisation’s own requirements and to the standard’s, and whether it is effectively implemented and maintained.
Clause 9.2.2 then sets out the programme. It must be planned, established, implemented and maintained, and it must consider the importance of the processes concerned, the changes affecting the organisation, and the results of previous audits. It must define the audit criteria and scope for each audit. It must require auditors to be selected and audits conducted so that objectivity and impartiality are ensured. It must ensure results are reported to relevant management. And it must retain documented information as evidence that the programme was implemented and that the results were reported.
Three words in that list do most of the work: planned, maintained, evidence. Planned means the schedule exists before the year starts rather than after it. Maintained means it is updated when the organisation changes, which it will — a new product line, a reorganisation, a software migration, a customer complaint that reopens a closed finding. Evidence means each audit leaves a dated record with a scope, criteria, findings and a report that reached management.
Nothing in the clause sets a frequency. Once a year per process is a convention rather than a requirement, and an organisation with a stable process and good results can reasonably audit it less often, provided the programme says so and the reasoning is written down. Conversely, a process that has changed or that has produced repeated findings may need two audits in a year, and the programme should show that decision being made.
Programme, audit, checklist
Three documents are routinely conflated, and each has a different time horizon and a different reader.
The programme is a year. Its reader is management, and its subject is coverage: every clause in scope reaching at least one audit, every process reaching a date, every date reaching a named auditor who is not the process owner.
The audit is a day or two. Its reader is the process owner, and its subject is one process against stated criteria, ending in a report with findings.
The checklist is a fieldwork instrument for one audit. Its reader is the person standing in the room, and its subject is the evidence to be examined row by row.
A pack that holds twelve checklists and no programme has done twelve pieces of work without a plan, which is what 9.2.2 asks about first. A pack that holds a programme and no audit reports has a plan that cannot be shown to have been carried out, which fails the same clause from the other end.
The inputs that move the schedule
A programme that is built from the standard’s clauses alone produces an even rotation: one process a month, in the same order every year. That is the schedule of an organisation that has not read its own results. Clause 9.2.2 names three inputs, and a workable programme adds four more that are practical rather than prescribed.
Table 1. The inputs to an audit programme, and what each changes in the schedule. Source: clause 9.2.2 for the first three; the remainder are planning inputs used in this office’s method.
| Input | What it changes |
|---|---|
| Importance of the process | Frequency and depth: a process whose failure reaches the customer is audited more often and at both sites or shifts |
| Changes affecting the organisation | Timing: a new system, a reorganisation or a new product line pulls its process forward, and the audit is scheduled after the change has bedded in but before the next certification visit |
| Results of previous audits | Depth and repeat status: an unresolved finding is re-tested, and a repeated finding is written up as a repeat, which is a statement about the corrective action rather than the process |
| Complaints and returns | Scope: the trail from a complaint through investigation to the change it caused is the most productive object an audit can follow |
| Nonconformity trends | Frequency: a cluster of similar causes across processes argues for auditing the process that produces them all |
| Supplier and customer pressure | Timing: a customer’s second-party audit or a tender questionnaire sets a date the internal programme should precede |
| Auditor availability and competence | Sequencing: the auditor who can read a calibration regime is not necessarily the auditor who can read a design file |
The two inputs that a programme usually omits are change and auditor competence. Change is omitted because the schedule was written before the change happened, and competence because the same two people audit everything. Both omissions are visible in the record: an audit of a process that was reorganised eight months earlier, testing a procedure that no longer matches the work, and a programme in which the same initials appear on every report.
An illustrative year
The programme below belongs to an illustrative organisation with five processes and one system-level audit. It is constructed for this piece and describes no client. Its shape is the point rather than its content: a dated row per audit, a named auditor who does not own the process, stated criteria and a stated scope.
Table 2. An illustrative one-year programme: six audits across five processes, with auditor and scope stated. Source: constructed example.
| Month | Process or subject | Auditor | Criteria | Scope |
|---|---|---|---|---|
| February | Quotation and contract review | Quality manager | Clause 8.2; QP-01 | All quotations issued in January |
| April | Design and development | Peer auditor from production | Clause 8.3; QP-04 | Two active projects, from brief to design review |
| June | Purchasing and supplier control | Quality manager | Clause 8.4; QP-11 | Three suppliers, including the one that caused the March reject |
| September | Production and release | Peer auditor from quality | Clauses 8.5, 8.6; QP-20 | Two lines, both shifts |
| October | Despatch and delivery | Quality manager | Clause 8.6; QP-24 | All despatches in September, traced from order to proof of delivery |
| November | Improvement loop: nonconformity, corrective action and management review | External auditor | Clauses 9.3, 10.2; QP-30 | Every entry open in the year, and the management review that considered them |
Four design decisions are visible in that table, and each answers a question the clause asks.
The production audit is scheduled after the purchasing audit, because the reject in March is the reason purchasing is audited at all, and production will be asked what happened to the affected batch. Audits that touch the same event are better sequenced than scattered.
The improvement loop comes last, because it needs the year’s entries to review. An audit of clause 10.2 in February has almost nothing open, and its findings are about the form rather than the practice.
The auditor column changes. Three audits by the quality manager, two by peers from the functions being audited against, one by an external auditor for the loop that the quality manager operates. That distribution is the objectivity rule made visible.
The scope column names objects rather than areas: two active projects, three suppliers, all despatches in September. A scope that says the purchasing process is not a scope; it is the name of a folder.
The objectivity rule, and the small organisation
Clause 9.2.2 requires auditors to be selected and audits conducted so that objectivity and impartiality are ensured. In practice that means one thing: nobody audits their own work. The person who wrote the procedure does not test it; the person who signed the release does not judge whether the release was controlled; the quality manager who maintains the whole system does not audit the system alone.
This is where small organisations fail the clause, and not usually through bad faith. There is one quality manager, the process owners are three busy people, and the only person who knows the standard is the person being audited. The options, in order of preference, are these.
Train a second auditor from another function and give them the audits that cross their own area: a production supervisor can audit purchasing, a buyer can audit despatch. The audit takes a day, the training takes two, and both are cheaper than the alternative.
Cross-audit with another organisation of similar shape under a reciprocal arrangement, each auditing the other’s purchasing or production process against its own criteria. It is unusual and it works, provided the criteria are stated, because the auditor is external to the process even when the arrangement is informal.
Buy the hours. An external auditor for one or two audits a year covers the processes nobody internal can test, and the improvement loop is the natural candidate, since it is the audit that judges the quality manager’s own work.
Record the constraint. Where none of the above is available, the programme states which audit was conducted by the process owner and why no alternative existed. That is an honest entry and a finding that a certification body will raise; it is not a solution, and it should not be written as one.
What a year costs
The rate is measured, not listed: $0.00700 a call for deepseek-v4-flash on Base under exact with a short prompt, read from the live 402 challenge on 31 October 2026 outside the service’s weekday peak windows. The catalogue figure of $0.00875 that circulates for this service is Qwen’s rate, and it is used here only as the figure that circulates, beside its correction.
A programme year in the shape of Table 2 costs the following. Eight preparation calls an audit — reading the process’s documents, mapping the criteria, drafting the checklist, writing the report afterwards — for six audits: forty-eight calls, $0.33600. Twenty further calls across the year for the programme reviews: the quarterly look at what has been audited, what has slipped and what has changed, five calls a review, four reviews, $0.14000. The year is sixty-eight calls and $0.47600.
That is $0.05600 an audit in preparation, and $0.07933 an audit once the programme reviews are shared across the six, or $0.03967 a month across twelve. A three-year certification cycle at the same pace is three such years: 204 calls and $1.42800, which is what maintaining a programme costs at this rate rather than what one year of it costs.
Two comparisons bound the figure. Twenty-five calls at the circulated $0.00875 come to $0.21875; at the measured $0.00700 the same twenty-five calls are $0.17500 — the correction is a fifth, and it moves every derived figure in the same direction. The whole year at the circulated rate would be $0.59500, which is $0.11900, or 25 per cent, more than the measured $0.47600. At the metered ceiling of $0.00955 a call the year costs $0.64940, which is $0.17340, or 36 per cent, above the measured total.
The opening balance of 0.50 USDC buys seventy-one calls at $0.00700. A programme year of sixty-eight calls fits inside it with three calls to spare, which is a fair way to describe what the model calls in this work are: a rounding error beside the auditor’s hours, and the part of the programme that can be measured exactly.
Five ways a programme fails
The failures below are ordinary, and each one leaves a trace in the record that a certification auditor can read in an afternoon.
The programme that is never revised. A schedule written in January and untested until December cannot have considered changes, because nothing was done about them. The correction is not more planning: it is a dated review line in the programme itself, four times a year, with a note on what changed.
The rotation that avoids the hard processes. The easy process gets audited annually and the process with the repeated complaints gets audited when there is time. The programme shows this if the dates are read against the complaint log, which is where an auditor will read them.
The auditor who owns the process. Sometimes visible in the programme, more often invisible because the ownership is informal: the person who runs the quality system audits the quality system and finds it conforming. Clause 9.2.2’s objectivity requirement exists for this case, and a programme with one name in the auditor column is the evidence.
The report that reaches nobody. Clause 9.2.2 requires results to be reported to relevant management, and clause 9.3.2 requires management review to consider audit results. A report filed and never discussed satisfies neither, and the management review minutes are where the omission shows.
The programme without a repeat column. Where a finding was raised last year and is raised again this year, the entry should say so. A programme and a log that cannot show repetition cannot show whether corrective action worked, which is the one thing the cycle exists to establish.
Where the programme stops
One limit is worth stating before any of the above is adopted. A programme is a plan, and a good plan is not evidence that the cycle ran. The evidence is the dated audit report per row, the findings log with its closures, and the management review minutes that considered both. A programme that is thorough and unexecuted is worse than a thin one that ran, because it describes a system that does not exist and does so in the organisation’s own voice.
Two further limits follow.
The programme cannot create capacity. The binding constraint in internal auditing is auditor hours, not documents: six audits at eight hours each, plus the reading, is a fortnight of somebody’s year, and no amount of prepared material reduces that. The measured $0.47600 buys the drafting, not the fortnight.
The programme cannot settle the objectivity question on its own. It can state who should audit what, and it can record the cases where the rule could not be met, but it cannot supply a second auditor. Where the organisation is one competent person, the honest entry is the constraint, and the certification body will treat it as a finding rather than a plan.
The decision
Two requirements turn a schedule into a programme, and both are cheap to apply.
Write it as a dated table before the year starts, with a named auditor per audit who does not own the process being audited, and a scope that names objects rather than areas. Where the auditor column cannot be filled, that is a finding about resourcing, and it is better found in January than at a certification visit.
Then add the review line: four dates in the year at which the programme is read against what has happened, with a note on what moved and why. That single line is the difference between a plan that clause 9.2.2 can be shown to have implemented and a plan that describes a year nobody ran.
Where this goes
- The pillar: x402.review/2026/10/31/quality-and-compliance/ — the job, the six artefacts and the certificate no agent issues
- The role: studio.x402.press/roles/iso_auditor — the agent, its parts and its running cost
- The service it buys: x402.press/services/deepseek/ — the canonical price, seven chains
- The review: x402.review/2026/10/31/deepseek-review/ — the measured handshake and what it does not promise
Method note
The price was read from the live 402 challenge on Base on 31 October 2026, outside DeepSeek’s weekday peak windows of 01:00–04:00 and 06:00–10:00 UTC; the catalogue figure of $0.00875 was checked against it, found to be Qwen’s rate, and is used here only where it is named as the figure that circulates. Call counts are planning assumptions, stated in the cost section and repeated in the arithmetic. ISO 9001:2015 clause numbers follow the standard’s numbering. The illustrative organisation, its processes and its auditors are constructed for this piece; no client is described, and no figure for audit duration, coverage achieved or certification outcomes is offered, because none has been measured.
x402.review is written and edited by N.P. Vincent. The publication is connected to x402.press, which sells the services reviewed here; that interest is disclosed on every piece that touches a service, and it is stated here rather than left to inference.
Filed under Jobs
