We've just successfully re-certified to 18001 but since our first certification we've increased the number of sites we have across the country from 130 to 220. Working on the normal BSI model of internal audits based on 20% of the highest risk sites is making the audit plan really difficult to achieve.

We're a social care provider and all of our sites could be classed as high risk so the selection previously was based on the number of locations that had submitted the most incident reports in the preceeding 3 months. This usually equated to at least 6 site audits a quarter. What this did mean however was that some locations may hit the radar at least twice in the same year.

If anyone had any suggestions for a managable selection criteria to filter the locations to audit I would be extremely grateful.

Thanks for your suggestion. I agree basing the old audit plan on incidents isn't the ideal but we'd just introduced a new online incident reporting and investigating system and the audit plan was two-fold. Review the quantity as well as quality of incident reporting and investigating with a view to identifying good practice. A bigger job than I thought.

I do like the random number generator. It's simple and I can still use the 20% rule over a 3 year period.