Why the Audit Plan Matters More Than Most Auditors Realise
Ask a group of experienced auditors what separates a productive audit from a chaotic one, and most will point to preparation. The audit plan sits at the centre of that preparation. It is the document that tells everyone involved what will happen, when it will happen, who will be there, and what the audit is trying to achieve.
On this page
An audit plan is not the same as an audit programme. It is not a checklist. It is not a schedule on a spreadsheet. It is a specific, structured document prepared for a particular audit event, covering the scope, objectives, criteria, timing, and logistics that will govern how that audit unfolds on the day.
Get the plan right and the audit runs smoothly. Get it wrong and you will spend the first hour working out who you should be talking to, which processes are actually in scope, and whether you have left enough time to cover what matters.
This article explains what an audit plan is, what it must contain, how it differs from related documents, and how to write one that actually helps you conduct a better audit.
The Formal Definition: What ISO 19011 Says
ISO 19011 is the international guideline for auditing management systems. It defines an audit plan as a description of the activities and arrangements for an audit. That is deliberately broad, because audit plans are used across many types of audits, from a small internal audit of a single process to a multi site lead auditor certification audit covering several days and multiple standards.
What the definition captures is the idea that an audit plan is forward looking. It describes what you intend to do before you do it. It is a planning document, not a record of what happened. The audit report and working papers handle that side of things.
ISO 19011:2026 reinforces that audit plans should be communicated to the auditee in advance. This is not just a courtesy. It allows the right people to be available, gives the organisation a chance to prepare relevant documentation, and removes the element of surprise that makes auditees defensive and uncooperative.
Exemplar Global Certified Training ProviderRTP No. 310970
Audit Plan vs Audit Programme vs Audit Schedule
These three terms are used loosely in practice, which causes confusion. Here is how they differ.
Audit Programme
An audit programme covers a defined period, often a year, and sets out the overall arrangement of audits to be conducted. It includes the frequency, type, scope, and resources for multiple audits across that period. Think of it as the master plan for your entire audit activity. If you are a quality manager running internal audits across a twelve month cycle, your audit programme describes which areas will be audited, in what order, and how often.
Audit Schedule
An audit schedule is a time based view of when audits will occur. It is often a table or calendar extract showing audit dates, areas, and responsible auditors. It sits within the audit programme and gives a quick overview of timing.
Audit Plan
An audit plan is specific to a single audit event. Once the programme tells you that a particular area will be audited in a given month, the audit plan is what you prepare for that specific audit. It goes into the detail: the objectives for this audit, the criteria being applied, the processes in scope, the time allocated to each area, the names of the auditors and auditees, and the logistics of the day.
You can have one audit programme and one audit schedule, but you will have a separate audit plan for every individual audit you conduct. For a useful companion resource, see Audit Plan vs Audit Programme, which breaks down the distinction in more detail.
What an Audit Plan Must Contain
ISO 19011 provides guidance on what an audit plan should include. The level of detail will vary depending on the complexity of the audit, but the following elements should be present in any well constructed plan.
Audit Objectives
The objectives state what the audit is trying to achieve. Common objectives include determining the degree of conformity with the audit criteria, evaluating the effectiveness of the management system, identifying opportunities for improvement, and fulfilling a contractual or regulatory requirement.
Objectives should be specific to the audit in question. Writing to verify conformity with ISO 9001:2015 as your only objective for every internal audit is technically correct but not very useful. A more focused objective might be: to verify that the corrective action process is operating effectively following the major nonconformity raised in the previous cycle.
Audit Scope
The scope defines the boundaries of the audit. It describes which processes, locations, organisational units, and time periods are included. It should also be clear about what is excluded, particularly if the management system covers a wider area than this particular audit.
A clearly stated scope protects both the auditor and the auditee. It prevents scope creep during the audit and ensures the auditee knows what to prepare for.
Audit Criteria
Audit criteria are the set of requirements against which the evidence will be compared. For an ISO internal audit, the criteria typically include the relevant clauses of the standard, the organisation's own documented procedures and policies, and any legal or contractual requirements that apply to the scope.
Stating the criteria explicitly in the plan removes ambiguity. If the auditee knows you are auditing against ISO 9001:2015 Clause 8.4 and the organisation's supplier management procedure, they can prepare the right records and have the right people available.
Date, Time, and Duration
The plan should state when the audit will take place, what time it starts, and how long it is expected to run. For a multi day or multi process audit, the plan should show a time allocation for each area or activity.
This is where many new auditors underestimate the work involved. A two hour audit of a complex procurement process is rarely enough. Build in time for the opening meeting, document review, interviews, observation, and the closing meeting. If you are conducting a full day audit, a rough guide is: thirty minutes for the opening meeting, the bulk of the day for evidence gathering, and forty five minutes to an hour for the closing meeting and preparation of findings.
Audit Team Members and Their Roles
The plan should name the auditors involved and identify who is leading the audit. If there is a technical expert or observer accompanying the team, that should be noted too. For internal audits, this section is often simple. For external or certification audits, it matters more because the auditee may want to verify the credentials of the audit team.
Auditee Representatives
Identify who from the organisation will be involved in the audit. This includes the primary contact, the managers responsible for the processes in scope, and any subject matter experts who may be needed. Naming these people in the plan makes it easier to confirm availability in advance and avoids the frustrating situation where the right person is not available on the day.
Confidentiality Statement
It is good practice to include a statement confirming that information gathered during the audit will be treated as confidential and used only for audit purposes. This is particularly important for external audits and supplier audits where commercially sensitive information may be shared.
Opening and Closing Meeting Details
Note the time and location of the opening meeting and closing meeting. These are formal parts of the audit process and should be planned for, not improvised.
A Worked Example: Audit Plan Structure in Practice
To make this concrete, here is what a basic audit plan structure looks like for an internal ISO 9001 audit of a procurement process.
- Audit reference: INT-2025-04
- Standard and clause: ISO 9001:2015, Clause 8.4 Control of Externally Provided Processes, Products and Services
- Audit objectives: To verify that the organisation's supplier selection, evaluation, and monitoring processes conform to ISO 9001 Clause 8.4 and the Supplier Management Procedure SMP-001
- Audit scope: Procurement function, Brisbane office. Covers supplier qualification, approved supplier list, purchase order controls, and supplier performance review. Excludes logistics and inbound inspection (covered separately in Q3).
- Audit criteria: ISO 9001:2015 Clause 8.4; Supplier Management Procedure SMP-001; Approved Supplier List ASL-2025
- Audit date: 14 August 2025
- Lead auditor: [Name]
- Auditee contact: Procurement Manager [Name]
- Timetable: 9:00 Opening meeting; 9:30 Document review (approved supplier list, evaluation records); 10:30 Interviews with procurement team; 12:00 Lunch; 12:45 Site observation and purchase order sampling; 14:00 Auditor review and preparation of findings; 14:45 Closing meeting
- Confidentiality: All information gathered will be treated as confidential and used solely for audit purposes
This is not elaborate. It fits on one or two pages. But it gives everyone involved a clear picture of what is happening and why.
How to Write an Audit Plan That Actually Works
Start With the Objectives, Not the Timetable
Many auditors start by filling in the time slots and then work backwards. That is the wrong approach. Start with what you are trying to find out. Your objectives drive everything else. Once you know what you are testing, you can identify which processes and people are relevant, which documents you need to review, and how much time each area deserves.
Match Time Allocation to Risk
Not all processes deserve equal audit time. A risk based approach means spending more time on higher risk areas and less time on processes that have historically been well controlled. If the last three audits of a particular area found no issues and the process has not changed, a lighter touch may be appropriate. If a process has had recent nonconformities or significant changes, allocate more time.
This connects directly to how effective audit programmes are built. For more on this, Risk Based Audit Scheduling walks through how to prioritise what gets audited and when.
Communicate the Plan Early
Send the audit plan to the auditee at least one week before the audit. Two weeks is better for more complex audits. This gives the auditee time to confirm availability of the right people, pull together relevant documentation, and raise any scheduling conflicts before the day.
Sending the plan late, or not at all, is a common mistake that leads to avoidable problems on the day. You arrive to find that the key person is on leave, the records are stored offsite, or the process has changed significantly since you last looked at it.
Keep It Proportionate
A two hour internal audit of a small process does not need a ten page audit plan. A two day certification audit of a large organisation does. Match the level of detail to the complexity of the audit. The plan is a working document, not a performance of thoroughness.
Be Specific About Criteria
Vague criteria create vague audits. If you are auditing against a procedure, name the procedure and its version number. If you are auditing specific clauses of a standard, list them. This specificity helps you write better audit questions and helps the auditee prepare the right evidence.
Common Mistakes in Audit Planning
Confusing the Plan With the Checklist
An audit plan tells you what you are doing and when. A checklist tells you what questions to ask. They serve different purposes and should be separate documents. Some auditors try to combine them, which usually means the plan is too detailed in some areas and missing key structural elements in others.
Setting Objectives That Cannot Be Evaluated
If your audit objective is to improve quality, you cannot tell at the end of the audit whether you achieved it. Objectives need to be evaluable. You should be able to say, at the closing meeting, whether the objective was met or not based on the evidence gathered.
Underestimating Time for the Closing Meeting
The closing meeting is not just a formality. It is where findings are presented, classifications are explained, and the auditee has an opportunity to respond. Rushing it because you ran over time during evidence gathering is a sign of poor planning. Build in a buffer.
Failing to Confirm Auditee Availability
Sending the plan is not enough. Follow up to confirm that the named auditee representatives have received it, are available, and have noted the time commitments. A brief email confirmation a day or two before the audit saves a lot of frustration on the day.
Audit Plans for Different Audit Types
Internal Audits
Internal audit plans tend to be simpler. The auditor usually knows the organisation, has access to existing documentation, and is working in a familiar environment. The plan still needs to cover objectives, scope, criteria, timing, and people, but it can be less formal in presentation.
Supplier and Second Party Audits
Supplier audit plans need more detail because you are auditing an external organisation that may not be familiar with your expectations. Clearly state what you will and will not be looking at, what records you will need access to, and who from the supplier organisation needs to be available. A well communicated plan reduces friction and helps the supplier prepare properly.
Certification and Third Party Audits
Certification bodies prepare the audit plan and share it with the organisation being audited. These plans are typically more detailed, covering multiple days, multiple processes, and often multiple sites. As the quality manager receiving this plan, review it carefully. If the time allocated to a particular area seems insufficient, or if a key person is unavailable on the proposed date, raise it with the certification body before the audit begins, not on the day.
If you want to understand what happens across the full certification audit cycle, What to Expect During an ISO Certification Audit covers the process from initial contact through to the final decision.
Exemplar Global Certified Training ProviderRTP No. 310970Using the Audit Plan During the Audit
The audit plan is a living reference document during the audit itself. Refer to it at the opening meeting to confirm the scope, objectives, and timetable with the auditee. Use it to track progress through the day and to manage time. If you find that one area is taking longer than planned, the audit plan helps you make an informed decision about what to adjust rather than simply running out of time.
If significant changes to the plan become necessary during the audit, for example if a key process is unavailable or a new issue emerges that warrants additional time, discuss the change with the auditee and document it. Do not simply deviate from the plan without acknowledgement.
How Audit Plan Writing Is Taught in Auditor Training
Writing an effective audit plan is a core competency for any auditor, and it is one of the skills that separates auditors who have completed formal training from those who have simply picked up habits on the job.
At Audit Workshop, audit plan writing is covered in practical detail across the Internal Auditor and Lead Auditor courses. Participants work through real scenarios, develop audit plans for specific processes and standards, and receive feedback on the quality and structure of their plans. The Lead Auditor course goes further, covering how to plan complex multi day audits, how to allocate audit time across a team, and how to manage plan deviations in the field.
If you are building your auditing skills or preparing to conduct your first formal audit, the How to Become an ISO Internal Auditor guide is a useful starting point for understanding the broader competencies involved.
