Audit planning and preparation (documentation review, audit plan, working documents)
Building the plan
Preparation starts with the audit objectives, scope and criteria agreed with the audit client, followed by risk-based selection of the team and a review of the auditee's documented information to understand processes, interfaces and previous findings. Document review is a preparation activity: it tells the auditor where to look, not what to conclude.
The audit plan (ISO 19011 clause 6.3) typically states objectives, criteria, scope, dates, locations, times and duration, expected participants, audit methods and sampling approach, team roles and resources, reporting and closing arrangements, confidentiality and health and safety arrangements. It is agreed with the client and communicated to the auditee in advance.
Working documents
Checklists, forms, sampling plans and audit-trail notes are aids, not scripts. They are retained and controlled for confidentiality, but they must never limit the audit: where evidence leads somewhere the checklist does not cover, follow the trail. Working documents are not normally distributed beyond the audit team.
Traps
- Skipping document review and drifting into a clause-by-clause checklist march.
- Planning without reference to process risk, interfaces, previous nonconformities or complaints.
- Treating the audit plan as unchangeable - it may be revised if the audit reveals different priorities, with the client and auditee informed.
- Assuming internal audits should be unannounced; an audit normally requires the auditee's cooperation and notice.
Rule of thumb: allocate time by process risk, not by clause count - more time where there are high-risk processes, many interfaces, legal exposure or repeated past findings.