How to Plan an Internal Audit Programme

An internal audit programme is the backbone of any credible management system. Yet many organisations treat it as a compliance checkbox rather than a strategic tool for continuous improvement. The difference between a programme that merely satisfies auditors and one that actually drives organisational performance comes down to deliberate, structured planning. This guide walks you through the practical steps to design and implement an internal audit programme that works in the real world.

Why Planning Your Internal Audit Programme Matters

ISO standards require internal audits, but they do not prescribe exactly how to deliver them. That flexibility creates a common trap. Without a coherent programme plan, organisations end up running audits that are reactive, inconsistent, and often poorly timed. Auditors scramble to find auditees, scheduling conflicts mount, and findings fail to connect meaningfully to business priorities.

A properly planned internal audit programme ensures you cover all relevant processes at appropriate intervals, deploy auditors with the right capability, and generate intelligence that senior management actually uses. It also reduces the scramble. When your programme is planned annually and communicated clearly, departments can prepare professionally rather than treating audits as unwelcome surprises.

From a certification perspective, external auditors assess your internal audit programme as evidence of your commitment to meeting the standard. An organisation that can articulate why it audits certain processes at certain times demonstrates genuine systems thinking. An organisation that cannot explain its audit logic looks like it is simply ticking boxes.

Defining Your Audit Programme Scope

The starting point is scope. You must decide which processes, locations, and functions your internal audit programme will cover. This is not the same as the scope of your management system certification, though they are related.

For most organisations, internal audit scope includes all processes that significantly affect the organisation's ability to meet its objectives. Under ISO 9001, that means processes across the entire quality management system. Under ISO 14001, it encompasses all activities and operations with potential environmental impacts. Under ISO 45001, it covers all work areas where health and safety risks exist.

In a multi site organisation, you need to decide whether to audit all locations equally or apply risk based sampling. A manufacturing business with identical processes across ten depots might audit two or three locations per year and rotate through a three year cycle. A professional services firm with five offices offering different services might audit each office on a different schedule based on staff turnover and service complexity.

Document this scope clearly in your audit programme plan. For example: "Internal audits will cover all processes defined in the quality management system documentation. For manufacturing facilities, one facility will be audited annually on a rotating basis. For head office functions including finance, human resources, and procurement, audits will be conducted every two years."

Assessing Risk and Audit Frequency

Not all processes carry equal risk. A critical manufacturing process that produces product nonconformities regularly presents higher risk than a support function that rarely changes. Your audit frequency should reflect this reality.

Start by listing all major processes. Then assess each using a simple framework. Consider factors such as: how often processes change; how many people depend on them; whether they directly affect product or service delivery; whether they have been sources of problems in the past; and whether they are heavily regulated or audited externally.

A high risk process might warrant annual auditing. A stable, well performing process might need auditing only every three years. A medium risk process typically fits a two year cycle. In a three year audit cycle, if you have 15 key processes, you audit five processes per year. Some years that might be three high risk processes and two lower risk ones. Other years the distribution differs. This creates rhythm and manageability.

Document your frequency decisions and the reasoning behind them. This protects your programme from being seen as arbitrary. If an auditor asks why Process A is audited annually but Process B only every three years, you have a documented rationale based on risk assessment, not guesswork.

Also consider business seasonality. If your organisation is flat out in certain months, do not schedule audits then. Auditees who are busy and stressed perform poorly in interviews and produce weak evidence. Schedule audits when teams can give proper attention.

Determining Audit Duration and Scope Per Audit

Planning the programme includes deciding how long each individual audit will run. A two hour audit is not the same as a two day audit. The audit schedule in your programme plan should specify approximate duration for each scheduled audit.

Duration depends on process complexity, the number of staff involved, the volume of documentation to examine, and the depth of audit required. ISO 9001 Clause 9.2 does not dictate audit duration, but it requires audits to be "conducted at planned intervals". This suggests that audits should be long enough to be meaningful.

As a rough guide, auditing a single function with 5 to 10 staff might take 4 to 6 hours. Auditing a manufacturing production cell might take 8 hours across two days. Auditing a major cross functional process like supplier management might require two to three days. A half hour audit is rarely sufficient to gather meaningful evidence.

When planning duration, factor in time for opening and closing meetings, interviews with relevant personnel, document review, observation of work in progress, and time to record findings. Many auditors underestimate how long it takes to conduct interviews properly and document observations accurately.

Building Your Annual Audit Schedule

With scope, frequency, and duration determined, you can now build a realistic annual schedule. This is a practical document that shows what will be audited, when, by whom, and for how long.

A simple spreadsheet works well. Columns should include: process name or area to be audited; planned audit date or month; planned duration; planned lead auditor; and any special notes (such as "includes remote observation of off site operations"). Rows represent individual audits scheduled throughout the year.

Spread audits evenly across the year if possible, rather than bunching them in one quarter. This creates consistent involvement and distributes the workload. It also means that if an audit must be rescheduled, you have buffer time rather than scrambling at year end.

Be realistic about what your organisation can handle. If you have only two trained internal auditors and one is on maternity leave for six months, you cannot schedule audits for four days a week. Work within your constraints. It is better to plan four quality audits per year that actually happen than to plan ten that repeatedly get postponed.

Share the draft schedule with relevant department heads and get their input on timing. If the finance manager says March is absolutely impossible due to tax deadlines, move that audit. Involving auditees in scheduling improves engagement and reduces defensiveness when audits arrive.

Defining Audit Objectives and Scope for Each Audit

Your annual programme plan identifies what will be audited. Now you need to define the objectives and specific scope for each planned audit. These provide clarity to auditors and auditees alike.

Audit objectives answer the question: why are we auditing this process? For example, the objective might be "to verify that the recruitment process operates in accordance with the documented procedure and legal employment requirements" or "to assess whether environmental aspects are being correctly identified and evaluated in operations".

Specific scope statements detail what aspects of the process will be examined. For a procurement audit, the scope might include "supplier selection and approval, purchase order issuance, goods receipt and inspection, and payment processing" but explicitly exclude "IT systems administration". This prevents scope creep and manages auditor and auditee expectations.

Many organisations pre populate audit plans for routine audits, creating templates that require only minor customisation each year. This saves time and ensures consistency. Each plan typically includes the audit objective, scope, planned audit date, lead auditor name, estimated duration, and key personnel to be interviewed.

Selecting and Preparing Internal Auditors

Your audit programme is only as good as the people delivering it. Selecting capable auditors and ensuring they have appropriate training is critical to programme success.

Internal auditors must understand the ISO standard you are implementing, the organisation's systems and processes, and fundamental audit skills. Becoming an ISO internal auditor requires formal training in audit techniques, the relevant standard, and often practical experience. Many organisations invest in sending personnel to external training courses, which provide structured learning and formal recognition.

When selecting auditors, look for people with enquiring minds, good interpersonal skills, and credibility within the organisation. Someone who is respected and well liked will gather better evidence and be better received than someone seen as a company spy. Avoid assigning someone to audit their own department, as this creates conflicts of interest and undermines audit independence.

In larger organisations, consider developing a pool of trained auditors rather than relying on one or two people. This provides resilience when people are unavailable and distributes knowledge widely. It also helps people develop professionally and understand other departments' operations.

Once auditors are trained, provide them with resources. This includes audit protocols or checklists tailored to your systems, access to relevant documentation, and time to prepare before audits commence. An auditor who has read the current procedure, reviewed previous audit findings, and prepared questions in advance will conduct a more effective audit than someone who shows up unprepared.

Establishing Audit Protocols and Documentation Standards

Consistency matters. If one auditor records findings in great detail while another provides vague observations, your audit data becomes unreliable. Establish audit protocols that guide how audits will be conducted and documented.

Protocols should specify how auditors will gather evidence, the types of records they will examine, how many people they will interview, and how much observation they will conduct. They should describe what constitutes a nonconformity versus an observation, how findings will be recorded, and when findings become formal reports.

Document templates support this. A standardised audit checklist helps auditors think systematically through requirements. An observation recording sheet captures evidence location and details consistently. A findings summary template ensures all nonconformities include the same key information: what was required, what was actually found, who needs to address it, and supporting evidence.

Using audit checklists effectively requires balancing structure with critical thinking. A checklist should prompt auditor thinking, not replace it. The most useful protocols are concise, tailored to your specific processes, and periodically reviewed to ensure they remain relevant.

Integrating Risk Assessment and Audit Priorities

Strategic internal audit programmes align audit activity with organisational priorities. If your organisation is facing a major change such as new equipment installation, system migration, or regulatory change, your audit programme should reflect this.

Review your organisation's risk register and strategic priorities. If supply chain disruption is identified as a critical risk, perhaps your supplier audit schedule should increase. If data security is a business priority, perhaps your audit plan includes a dedicated IT security audit. If customer complaints have risen in a particular area, that process warrants earlier audit attention than originally scheduled.

Build flexibility into your programme plan to accommodate reactive audits triggered by specific events. Allow for 20 to 30 percent of your audit capacity to be reserved for issues that emerge during the year. This might include follow up audits of processes where significant nonconformities were found, rapid response audits after incidents, or additional audits when major changes occur.

Communicating the Programme to the Organisation

An audit programme that people do not know about cannot deliver its benefits. Communication is a key part of programme planning.

Produce a summary document that outlines what will be audited, approximately when, and what the audit looks for. This is not the detailed audit plan; it is a high level overview. Share this with all relevant departments. When people know audits are coming and understand their purpose, they prepare more thoughtfully.

For each scheduled audit, provide auditees with at least four weeks notice. Include the audit objectives, scope, planned date, lead auditor name, and expected duration. Ask them to nominate a point of contact who can facilitate access to people and documents. Provide them with the audit protocol or checklist so they understand what will be examined.

Some organisations hold a brief information session before each major audit cycle to explain the internal audit process and answer questions. This is particularly valuable in organisations where people are unfamiliar with audits or have had negative experiences with external audits.

Planning for Audit Reporting and Follow Up

Your programme plan should clarify how audit findings will be reported and what happens next. This creates accountability and ensures findings drive action.

Specify when audit reports will be completed after each audit concludes. A typical timeframe is within two weeks. Identify who will receive audit reports. Usually this includes the process owner, the relevant department head, and senior management responsible for corrective action.

Establish a clear process for managing findings. Who is responsible for raising nonconformities into the corrective action system? What is the timeframe for organisations to propose corrective actions? Who approves proposed actions? When are corrective actions closed? Managing corrective actions effectively requires clear ownership, adequate resources, and verification that actions actually address root causes.

Plan for management review of audit data. Many organisations review audit findings and trends in their quarterly management review meeting. This ensures audit outcomes influence business decisions rather than disappearing into a filing system. It also demonstrates to certification auditors that internal audits genuinely drive improvement.

Allocating Resources and Budget

Effective audit programmes require resources. Plan realistically for what you need and ensure you have budget authority to deliver.

Resource requirements typically include: auditor time for conducting audits and reporting, travel costs to reach multiple locations if applicable, training to keep auditors current, tools and templates, and potentially time or funding for external audit assistance if you cannot manage the full programme internally.

In a business with 50 to 100 staff and perhaps 12 to 15 key processes, allocating one to two days per month for internal audit activity is often realistic. This covers planning, conducting audits, reporting, and following up on corrective actions. In larger organisations, the proportion might be lower because infrastructure and systems can handle more efficient scheduling.

If your organisation operates across multiple sites or geographies, factor travel time into resource planning. A site audit that requires four hours of flight time plus accommodation should be scheduled during a period when auditors can be spared from their regular duties.

Reviewing and Updating Your Audit Programme

Your annual audit programme is not fixed. Review it regularly, at least at management review, to check whether it is working as planned and remains appropriate.

Track metrics such as: percentage of planned audits completed versus postponed, average time taken to complete audits, number of findings per audit, and time to close corrective actions. If significant audits are repeatedly delayed, your plan is unrealistic. If audits consistently run over time, adjust future duration estimates.

Also review whether your audit focus remains aligned with organisational priorities. If circumstances change materially—for example, a major acquisition or a shift to new manufacturing technology—your audit programme should evolve accordingly.

At the end of the year, hold a brief review meeting with your audit team. What worked well? What would you change? What new risks emerged that next year's programme should address? Use these insights to refine next year's plan.

Audit Workshop offers accredited ISO Internal Auditor training that covers internal audit planning, execution, and reporting in depth. Our courses are recognised by Exemplar Global and designed for working professionals who need practical skills they can apply immediately.