Schedule - at least 1 year, preferably 2 or more years.
Trained auditors (can be internal training or such). A better word might be Qualified auditors.
The response to a nonconformance should go through a system like a corrective action system. Many companies use one database to track nonconformances from all areas. That is nonconformances found in audits (internal and external), production, customer complaints, etc. all are tracked in 1 database. The key to this methodology is well thought out defect categories. But I digress. A method of escalation when findings are not acted on must be present. Sometimes the Management Review meeting is where this takes place.
Can only be closed out after an evaluation of effectiveness is performed.
Note that many companies make up audit check lists (audit plan) and reuse them every year - revising them only when an applicable procedure / system changes.
Example Internal Audit System
Formulate Yearly Audit Schedule
Plan Individual Audit
And Assign Auditor
Audit Plan Exists?
Contact Auditee - Agree on Date, Time, Scope of Audit
Nonconformance / Corrective Action Report
Close Audit & File Results
Update Audit Schedule
Management Review Input
Track Follow Up
Schedule Follow Up
Contact Auditee - Agree on Follow Up Audit Date
Determine Appropriate Follow Up Audit Date
Perform Audit Ensuring Implementation Of and Effectiveness Of Reaction
Key: Box colour / line weight indicates responsibility
ISO 19011 - Quality and Environmental Management Systems Auditing Forum Discussions