Certification Bodies (CBs) are placing greater emphasis on companies performing “risk-based” internal audits. While this term is not defined in any ISO or AS standard that I am aware of, the “ISO 9001 Auditing Practices Group - Guidance on: Internal Audits” (dated 2020-07-19) does contain a very good description of “what” a “risk-based audit” is.

“ISO 9001 Auditing Practices Group - Guidance on: Internal Audits”, page 1-2 states:

By applying risk-based thinking, this requirement is intended to focus the internal audit program on those processes and areas where past history indicates that problems have occurred, or where problems are likely to be ongoing, or are likely to occur, because of the nature of the processes themselves. These problems may result from issues such as human factors, process capability, measurement sensitivity, changing customer requirements, changes in the work environment, etc.
The processes with higher levels of risk or nonconformities should have priority in the internal audit programme.
Special attention should be given to processes where risk is influenced by factors such as:

• severe consequences of failure on process capability.
• customer dissatisfaction.
• noncompliance with product (or process) statutory and regulatory requirements.

Expanding on the above description of a “risk-based audit”, some specific “factors” that “could” be considered when planning a “risk-based internal audit” (e.g., scheduled over the course of a year) include, but are NOT limited to area/processes:

• Where the CB issued nonconformities during their most recent audit? If so, which area and how many nonconformities (Majors/Minors) were identified?
• Where nonconformities were issued during the previous Internal Audit? (If so, which area and how many nonconformities (Majors/Minors) were identified?
• Failing to meet established Quality Objectives? If so, which areas/processes?
• That received “valid” customer complaints (since the last full internal audit)?
• That were responsible for the shipment of nonconforming product(s) to customers (“escapes”); whether or not reported by the customer as a complaint?
• Where multiple instances of nonconforming products were identified (e.g., in a Pareto Chart)?
• That have been the subject of one or more “Corrective Actions”?
• Considered to have High or Medium risk levels (particularly subject to human factors (e.g., human errors))?
• With complex processes (e.g., Unique/Special Processes, Design Responsible)?
• Requiring personnel to hold valid competency certifications (e.g., American Welding Society (AWS), Coordinate Metrology Society, Institute of Printed Circuits (IPC), Project Management Institute)?
• Requiring the use of customer-mandated suppliers?
• Experiencing high numbers of new employees and/or high employee “turn-over”?
• Where the functions and/or processes have undergone a significant change (e.g., improvement)?
• Where new processes have been implemented (e.g., a new product line introduced)?

<note important> A couple of other factors that may be worthy of consideration are processes where monitoring and measuring equipment:

• Require frequent calibration (e.g., prior to each use, on a short interval)
• Has a low “accuracy ratio” (i.e., the ratio between the instrument and the tolerance measured. Note: any “accuracy ratio” ≤3:1 should be considered “high” risk.)

</note> An “intended” benefit of promoting “risk-based” internal audits is to realize more dynamic audit planning - with companies adjusting their internal audit plans to focus on areas/processes where the most “value” can be achieved.

<note>While ISO 19011:2018, "Guidelines for auditing management systems", sec. 6.3.2.1, “Risk-based approach to planning” addresses this topic, it is too high-level and generic to be of any value.</note>

<note>Whether an AS 9100 series certified company performs “risk-based” internal audits is one of the criteria specified in SAE AS9104/1A, which requires AS 9100 CBs (Certification Bodies… i.e., Registrars) to use the “Organization Certification Analysis Process (OCAP)” for determining an overall “risk rating” (High, Medium, Low) for each certified company.</note>

While “risk-based internal audits” focus on audit planning, a higher-level component is the overall “internal audit program risks”. However, the “Internal Audit Program Risks” are rarely considered because ISO 9001/AS9100, sec. 9.2.2 defines the requirements for the internal audit program.

Nevertheless, ISO 19011:2018, "Guidelines for auditing management systems" addresses this topic by identifying the following “risks” that should be taken into “consideration” when developing an “internal audit program”.

ISO 19011:2018, sec. 5.3, “Determining and evaluating audit program risks and opportunities”
There are risks and opportunities related to the context of the auditee that can be associated with an audit program and can affect the achievement of its objectives. The individual(s) managing the audit program should identify and present to the audit client the risks and opportunities considered when developing the audit program and resource requirements, so that they can be addressed appropriately.
There can be risks associated with the following:
a) planning, e.g. failure to set relevant audit objectives and determine the extent, number, duration, locations and schedule of the audits;
b) resources, e.g. allowing insufficient time, equipment and/or training for developing the audit program or conducting an audit;
c) selection of the audit team, e.g. insufficient overall competence to conduct audits effectively;
d) communication, e.g., ineffective external/internal communication processes/channels;
e) implementation, e.g. ineffective coordination of the audits within the audit program, or not considering information security and confidentiality;
f) control of documented information, e.g. ineffective determination of the necessary documented information required by auditors and relevant interested parties, failure to adequately protect audit records to demonstrate audit program effectiveness;
g) monitoring, reviewing and improving the audit program, e.g. ineffective monitoring of audit program outcomes;
h) availability and cooperation of auditee and availability of evidence to be sampled.

Opportunities for improving the audit program can include:

• allowing multiple audits to be conducted in a single visit;
• minimizing time and distances traveling to site;
• matching the level of competence of the audit team to the level of competence needed to achieve the audit objectives;
• aligning audit dates with the availability of auditee’s key staff.

In addition, ISO 19011:2018, "Guidelines for auditing management systems", sec. 4, “Principles of auditing”, cites “auditor independence” as one of the 7 principles. And acknowledges that for “small organizations, it may not be possible for internal auditors to be fully independent of the activity being audited”.

e) Independence: the basis for the impartiality of the audit and objectivity of the audit conclusions

Auditors should be independent of the activity being audited wherever practicable, and should in all cases act in a manner that is free from bias and conflict of interest. For internal audits, auditors should be independent from the function being audited if practicable. Auditors should maintain objectivity throughout the audit process to ensure that the audit findings and conclusions are based only on the audit evidence.
For small organizations, it may not be possible for internal auditors to be fully independent of the activity being audited, but every effort should be made to remove bias and encourage objectivity.

Further, ISO 19011:2018, "Guidelines for auditing management systems", sec. 5.5.4, “Selecting Audit Team Members” addresses the “objectivity and impartiality” of the auditors.