Audit planning, scope, criteria and documentation review
This domain tests how you convert an audit objective into a defensible scope, a criteria set, an audit plan and a documentation review, and how you use the stage 1 review to decide whether stage 2 is viable.
Core rules and concepts
- Objectives state what the audit is for: certification, surveillance, supplier approval, internal programme input. Scope defines boundaries - sites, activities, shifts, processes, contractors - and states exclusions explicitly. Criteria are the set of requirements you audit against: ISO 45001, applicable legal and other requirements, client procedures, contractual and sector requirements.
- The audit plan records dates, areas and processes, auditors and time, auditee contacts, meetings, sampling intent, language and safety arrangements. It is issued in advance and adjusted only with the client's agreement.
- Documentation review at stage 1 covers system documentation, hazard identification and risk assessment outputs, the legal register and evaluation of compliance, incident data, previous audit reports, internal audit results and management review. Its purpose is readiness and focus, not a conformity verdict.
- Coverage must include night shift, weekend maintenance, contractors, lone and remote workers and outsourced processes; reduce coverage and you must record it as a limitation.
- Auditor safety and access: auditors follow site induction, PPE, permit and escort rules, and this belongs in the plan. Remote techniques are acceptable where evidence is verifiable, but not for physical conditions such as guarding, ventilation or housekeeping.
- Allocate time by risk, not by clause count; a plan that spends equal hours on every clause is not risk-based.
Worked example
A three-day certification audit of a food plant running three shifts. The auditor allocates four hours to the night shift, because caustic cleaning and confined-space entry into silos only happen then, and 1.5 hours to the legal register and compliance evaluation. The sanitation crew interview is scheduled at 02:00 with a guide, and the plan records the PPE the auditor will wear. Day-shift-only planning would have missed the highest-hazard activity on site.
Traps that cost marks
- A scope that says 'all activities' without naming locations or shifts.
- Using only the client's own procedures as criteria and omitting the standard and legal requirements.
- Treating stage 1 as a paperwork formality rather than a readiness decision.
- Writing a plan that never leaves the day shift or the head office.