Risk-based auditing helps organizations focus audit effort on processes, activities, and controls that have greater significance to the management system.
Under ISO 19011:2026, risk-based audit planning remains an important approach for improving audit effectiveness, audit programme value, and resource allocation.
Risk-based auditing is an audit approach where audit planning, audit depth, sampling, frequency, and resource allocation are influenced by the significance and risk level of processes being audited.
Instead of giving equal audit attention to every process, risk-based auditing prioritizes areas that may have greater impact on customer satisfaction, legal compliance, occupational health and safety, environmental performance, information security, operational continuity, or certification readiness.
The purpose is not to reduce audit scope unnecessarily, but to ensure audit effort is directed where it can provide the highest value.
Audit time and resources are usually limited. Without a risk-based approach, organizations may spend too much audit effort on low-risk or stable processes while insufficiently auditing critical operational controls.
Risk-based auditing helps auditors focus on areas that matter most to management system performance and business risk.
Traditional audit planning often applies similar audit frequency and depth across processes. Risk-based auditing takes a more dynamic approach.
| Area | Traditional Audit Approach | Risk-Based Audit Approach |
|---|---|---|
| Audit Frequency | Similar frequency for most processes. | Frequency adjusted based on process risk and performance. |
| Audit Depth | Standard checklist coverage. | Deeper review of high-risk or weak processes. |
| Audit Focus | Clause-by-clause verification. | Process effectiveness, risk control, and significant evidence. |
| Audit Planning | Fixed annual schedule. | Dynamic planning based on changes, incidents, NCRs, and priorities. |
| Sampling | Same sampling depth regardless of risk. | Sampling increased for high-risk or unstable areas. |
High-risk processes are not limited to operational activities. They may include support functions, outsourced processes, regulatory controls, supplier management, emergency preparedness, or customer-critical activities.
Access practical audit planning resources covering remote audits, hybrid audits, digital evidence verification, ICT readiness, and risk-based auditing practices.
View Free ResourcesAuditors should consider both management system risks and audit-related risks when planning and conducting audits.
Risk-based auditing should not be treated as a shortcut to reduce audit coverage. It should improve audit focus by directing attention to areas with higher significance and weaker controls.
A risk-based audit programme considers the importance of each process, current performance, previous audit outcomes, changes, and available audit resources.
| Planning Element | Risk-Based Consideration |
|---|---|
| Audit Frequency | High-risk or unstable processes may require more frequent audits. |
| Audit Duration | More time may be allocated to complex or high-impact processes. |
| Auditor Competence | High-risk areas may require auditors with specific technical or sector knowledge. |
| Audit Method | Remote, on-site, or hybrid methods should be selected based on evidence needs and process risk. |
| Sampling | Sampling depth should reflect process risk, past findings, and evidence reliability. |
| Audit Priority | Critical operations, compliance controls, and previous problem areas should be prioritized. |
Audit sampling should be sufficient to support audit conclusions. In risk-based auditing, sampling is not purely about quantity. It is about selecting evidence that is relevant, representative, and significant.
Higher-risk activities may require deeper sampling, wider record review, additional interviews, or physical verification. Stable and lower-risk processes may require a lighter but still appropriate level of sampling.
| Risk Level | Possible Sampling Approach |
|---|---|
| High Risk | Increase sample size, verify multiple evidence types, conduct interviews, and observe implementation directly. |
| Medium Risk | Use representative samples and verify process controls through records and selected interviews. |
| Low Risk | Use limited sampling where performance is stable and no significant changes or findings exist. |
Risk-based auditing is an audit approach where audit frequency, depth, sampling, and focus are influenced by the significance and risk level of the processes being audited.
ISO 19011 provides guidance on audit programme management and audit planning, including the consideration of risks and opportunities when planning and conducting audits.
Audit frequency should depend on process risk, legal exposure, previous audit results, incidents, changes, and management system performance. High-risk processes may require more frequent audits.
Not necessarily. Risk-based auditing should improve audit focus, not remove necessary audit coverage. It helps determine where deeper audit effort is required.
Examples include hazardous operations, environmental controls, contractor management, customer-critical processes, regulatory compliance activities, outsourced processes, and areas with repeated nonconformities.
Access practical ISO documentation kits, audit resources, and upcoming ISO 19011:2026 training materials developed from real audit and implementation experience.
Explore ISO Kits