Audit Planning, Scope, Criteria and Working Documents
What the audit plan must contain
ISO 19011:2018 clause 6.3 lists: audit objectives, scope, criteria, dates and locations, expected time and duration, roles and responsibilities of team members and guides, allocation of resources, identification of the auditee's representative, communication arrangements, logistics, and audit-specific actions. The plan is agreed with the client and the auditee, and must be revised if the audit proves unworkable.
Scope discipline
Keep three things apart: the scope of the audit (what the audit will examine on this occasion), the scope of the EMS (clause 4.3, what the organisation's system covers) and the scope of certification (the certified products/services and sites). An auditor tests whether the declared EMS scope is justified - no exclusion that removes a core activity or duty of compliance. Multi-site sampling of the audit trail is governed by the certification scheme (IAF MD 1), not by auditor preference.
Criteria and preparation
Audit criteria must be agreed with the client and must be sufficient to determine conformity. Working documents include the plan, audit routes, checklists, forms for findings, and meeting agendas. A checklist is an aide-mémoire, never a script or a cap on what may be examined. Document review before the audit is a screening exercise: you are testing whether the documentation adequately describes the system and identifies what to verify on site, not reading every record in the building.
Traps
- Writing an audit plan that cannot accommodate discovered risk or a change of shift.
- Treating the organisation's procedures as the only criteria, ignoring ISO 14001 and legal requirements.
- Accepting a stated scope that includes design but never plans to audit design.
- Forgetting stage 1 (readiness/documentation and scope confirmation) in initial certification audits - stage 1 aims must be defined and its findings drive stage 2 planning.
Rule of thumb: plan by process and by risk, not by clause number. Clause-by-clause checklists produce clause-by-clause audits that miss the interfaces where environmental incidents actually arise.