Audit program FY2026
Integrated program across ISO 9001, ISO/IEC 27001 and CMMC L2, weighted by process risk (ISO 19011 5.3).
Approved · ActiveProgram managerMLMarcus Lee· approved by Dana Whitfield, Jan 8
Audits completed
3 of 8
1 in fieldwork · 4 planned through Dec
Findings raised
11
2 Major5 Minor4 OFI
High-risk processes covered
4 of 4
Supplier, access, logging, production (Q4)
Auditor days used
22 of 40
Jamal Carter 15 · Marcus Lee 4 · others 3
Calendar
Closed In progress Planned
Type
JanFebMarAprMayJunJulAugSepOctNovDec
Internal
Supplier
Certification
CMMC
Audits
| ID | Audit | Lead | Dates | Stage | Checklist | Findings |
|---|---|---|---|---|---|---|
| AUD-2026-01 | Document control & internal audit process ISO 9001 7.5, 9.2 · ISO 27001 7.5, 9.2 | JCJamal Carter | 02-09 → 02-11 | Closed | 18 of 18 | 1 Min2 OFI |
| AUD-2026-02 | Supplier management process audit ISO 9001 8.4 · ISO 27001 A.5.19–A.5.22 | JCJamal Carter | 06-02 → 06-06 | Closed | 24 of 24 | 1 Min1 OFI |
| SUP-2026-01 | Precision Machining Co. — supplier audit AS9100D 8.4 flow-down · DFARS 7012 flow-down | ESElena Sorokin | 08-18 → 08-19 | Follow-up | 30 of 30 | 1 Maj2 Min |
| AUD-2026-03 | Q3 Internal ISMS + CMMC readiness audit ISO 27001 cl. 4–10 · ISO 27001 A.5–A.8 · CMMC L2 AC, IA, AU | JCJamal Carter | 09-15 → 09-26 | In fieldwork | 41 of 58 | 1 Maj1 Min1 OFI |
| AUD-2026-04 | Production & calibration process audit ISO 9001 7.1.5, 8.5, 8.6 | PNPriya Natarajan | 11-03 → 11-07 | Preparing | 0 of 36 | — |
| CB-2026-01 | ISO 9001 recertification (NQA) ISO 9001:2015 all clauses | PNPriya Natarajan | 11-17 → 11-20 | Planned | CB-owned | — |
| AUD-2026-05 | Mock C3PAO readiness assessment NIST SP 800-171A (320 objectives) | JCJamal Carter | 12-01 → 12-11 | Planned | 0 of 320 | — |
| AUD-2026-06 | Management review inputs & objectives audit ISO 9001 6.2, 9.3 · ISO 27001 6.2, 9.3 | MLMarcus Lee | 12-14 → 12-15 | Planned | 0 of 14 | — |
Coverage by process
ProcessRiskQ1Q2Q3Q4
Leadership & context4, 5Low
Planning, risk & objectives6Medium
Document control7.5Medium
Production & calibration7.1.5, 8.5High
Supplier management8.4, A.5.19–22High
Access control & MFAA.5.15, A.8.5, 3.1, 3.5High
Logging & monitoringA.8.15–16, 3.3High
Internal audit & MR9.2, 9.3Low
ISO 19011 5.4 extent · Vanta e6f27c45 KPI strip · Jira a0c33552 timeline bars.
Program objectives · ISO 19011 5.2
- Verify CMMC L2 readiness before the C3PAO assessment (Mar 2027)In progress
- Maintain ISO 9001 certification — recertification Nov 2026In progress
- Audit every high-risk process at least twice a yearMet
- Close Major NCs within 90 days of issuePartial
Program risks · 5.3
- Single qualified internal auditor (Jamal Carter) — independence on GRC processesMitigation: Marcus Lee audits 9.2; external auditor for MR audit
- Fieldwork clashes with Q4 production peakMitigation: Remote sessions for document review