Yes. Clause 9.2.2 makes the organisation responsible for the audit programme, whoever does the auditing.
Three kinds of document are involved, and they are easy to mix up:
- Audit programme: your multi-year schedule of which areas are audited when, how and by whom. You own it.
- Internal audit procedure: your description of how internal audits run in your company, including how auditors are chosen and how findings are handled. You own it too. The standard does not ask for a separate procedure document, but most companies keep one and certification auditors expect to see it.
- Audit plan and report: the plan for one specific audit and the report that comes out of it. The external auditor writes these.
The certification auditor asks for all of them, and a missing programme is a finding even when the audit itself was done well.
The workload is small. A programme for a small company fits on one page: a table with the three years of the certificate cycle, the areas audited each year, the planned month and the auditor. A good external auditor hands you a template in the first year and helps you fill it in. After that, updating it takes about an hour a year.