An ISO 9001 internal audit plan describes the arrangements for a particular audit. It turns a programme decision into a workable assignment: what will be examined, why, against which requirements, by whom and using which methods. It should be specific enough to coordinate access and evidence without preventing the auditor from following relevant findings.
The plan is different from the programme and the schedule. A programme coordinates assurance activities over time, while a schedule shows when coverage is expected. The internal audit guide connects those levels of planning.
State the objective before allocating time
An objective identifies the question the audit is intended to answer. For a changed order-management process, the objective might be to evaluate whether revised customer requirements reach purchasing and production accurately. That is more informative than stating only annual departmental audit.
Objectives should be achievable with the resources available. A short interview cannot credibly evaluate every activity at a large site. If the objective is too broad, narrow the scope, add suitable resources or divide the work into coordinated assignments. Do not solve the mismatch by making the report more confident than the evidence permits.
Avoid writing objectives that presume success or failure. The auditor should evaluate the arrangements, not collect evidence to justify a predetermined management position.
Define scope and criteria separately
The scope identifies boundaries: processes, locations, activities, organisational units and the relevant period. Criteria identify the requirements used for evaluation. Record the applicable standard edition and current internal documents where those references matter.
A fictional distribution audit might cover receipt, identification, storage and dispatch at one warehouse. Criteria might include customer handling requirements, the organisation’s stock-control procedure and applicable QMS requirements. The plan should clarify whether outsourced transport and returns are included rather than leaving the boundary implicit.
Criteria should not consist only of a checklist title. Auditors need to understand what obligation or adopted arrangement supports a conclusion. Educational guidance can inform methods, but it does not automatically become a requirement imposed on the auditee.
Coordinate people, methods and access
Identify the auditor or team, relevant process contacts and any technical expertise needed. Consider conflicts of interest as well as technical capability. Someone responsible for designing a control may provide valuable explanation without being the right person to independently evaluate it.
Confirm which activities can be observed, which records can be accessed and which working periods are relevant. A daytime plan may miss a critical handover performed by an evening shift. A remote audit requires attention to secure access, document sharing and whether an observation can be performed reliably at a distance.
| Planning field | Example entry |
|---|---|
| Objective | Evaluate control of customer order changes |
| Scope | Order acceptance through production handover at Site A |
| Criteria | Current order-review procedure and applicable QMS requirements |
| Methods | Interviews, sampled orders and observation of change approval |
| Participants | Auditor, order administrator and production planner |
| Reporting | Findings discussed at close and issued to the process owner |
This is an illustrative structure, not a mandatory ISO form. Add confidentiality, safety or specialist arrangements when the assignment requires them.
Prepare an agenda that follows the work
Allocate time for opening discussion, evidence collection, team review and closing communication. Group activities around process flow rather than forcing the audit to reproduce the standard’s clause sequence. A transaction trail may move between sales, purchasing and operations.
Build in enough flexibility to pursue contradictions. If every minute is assigned to a fixed question list, the auditor may abandon important evidence simply to stay on schedule. Explain how material changes to the plan will be agreed and communicated.
The audit schedule should show where this assignment sits within wider coverage. The individual plan can then concentrate on the practical details of the selected audit.
Anticipate sampling and limitations
Use existing information to identify relevant variation before choosing records. Changed orders, unfamiliar suppliers, repeat complaints or different product families may warrant attention. Avoid allowing the process owner to preselect only straightforward examples.
The plan need not predict every sample identifier in advance. It should explain the intended approach and any significant exclusions. If a key system will be unavailable, decide whether the objective remains achievable or whether the audit should be adjusted.
Keep planned and actual coverage distinguishable. If an activity was not examined, record the limitation and its effect on the conclusion. A plan signed before the audit is not proof that every planned activity occurred.
Review the plan after completion
Compare the arrangement with what happened. Consider whether the timing was realistic, access worked, participants were appropriate and the evidence answered the objective. Use the experience to improve later assignments rather than treating the document as a one-time administrative requirement.
Retain the plan with relevant audit records under the organisation’s information controls. Where changes were consequential, preserve the reason and authorisation. A useful plan leaves a clear relationship between the original question, the work performed and the conclusions that management receives.