The Auditing Process

Please can you advise if the following is correct approach when auditing the various business areas we are in the second year of ISO Certification heading toward our first Surveillance Audit:

The audit approach is this:
1. Review previous comments made during Stage 2 Audit and design question accordingly.
2. Design questions as per the process input/activity/output to establish evidence.
3. Review Quality Management Principles to establish if the business area has applied Improvement, has leadership engaged staff, managed relationships with interested parties etc. and design questions accordingly.
4. Review Risk Register to establish if the applicable risks to the area has been mitigated and if there are new risks and design questions accordingly.
5. Review Goals and Objectives to establish if the targets have been achieved (process/business area dependents) and design questions accordingly.
Other questions like do your new staff members aware of the Quality Policy and were it is situated.

We are a small company so it makes sense for us to do the audits in one go with the above mentioned approach. It also reinforces the ISO principles and what is ISO all about with middle management.  

Let me know what you think.