AUDIT GUIDE 07: Preparing for On-Site Audit Activities – Planning and Documentation

Following the audit planning principles outlined in ISO 19011 (the international guideline for auditing management systems), the audit team leader develops an audit plan that sets shared expectations among the audit client, audit team, and auditee before work begins. In practice, we find the biggest source of friction isn’t the plan’s structure auditees generally understand why a plan exists it’s timing: plans distributed too close to the audit date leave little room for an auditee to flag scheduling conflicts or resource gaps before they become disruptions on audit day.

The amount of detail provided in the audit plan should reflect the scope and complexity of the audit, as well as the effect of uncertainty on achieving the audit objectives. 

Check out our blog on Conducting On-Site Audit  Execution 

In preparing the audit plan, the audit team leader should be aware of the following:

• The appropriate sampling techniques
  
• The composition of the audit team and its collective competence
  
• The risks to the organization created by the audit
  

For example, risks to the organization may result from the presence of the audit team members influencing health and safety, environment, and quality, and their presence presenting threats to the auditee’s products, services, personnel, or infrastructure (e.g., contamination in cleanroom facilities).

For combined audits, particular attention should be given to the interactions between operational processes and the competing objectives and priorities of the different management systems.

The details may differ, for example, between initial and subsequent audits and between internal and external audits.

The audit plan should cover the following:

• The audit objectives
  
• The audit criteria and any reference documents
  
• The audit scope, including identification of the organizational and functional units and processes to be audited
  
• The locations, dates, expected times, and duration of audit activities to be conducted, including meetings with the auditee’s management
  
• The expected times and duration of audit team meetings
  
• The audit methods to be used, including the extent to which audit sampling is needed to obtain sufficient audit evidence and the design of sampling program, if applicable
  
• The roles and responsibilities of the audit team members as well as guides and observers
  
• The allocation of appropriate resources to critical areas of the audit
  

The audit plan may also cover the following, as appropriate:

• Identification of the auditee’s representative for the audit
  
• The working and reporting language of the audit where this is different from the language of the auditor or the auditee or both
  
• The audit report topics
  
• Logistics and communication arrangements including specific arrangements for the locations to be audited
  
• Any specific measures to be taken to address the effect of uncertainty on achieving the audit objectives
  
• Matters related to confidentiality and information security
  
• Any follow-up actions from a previous audit
  
• Any follow-up activities to the planned audit
  

The audit plan may be reviewed and accepted by the audit client and should be presented to the auditee. Any objections by the auditee on the audit plan should be resolved between the audit team leader, the auditee, and the audit client.