Planning an internal audit based on ISO 19011
Planning an internal audit based on ISO 19011
This domain tests how you translate an audit programme into a risk-based audit plan, define objectives, scope and criteria, select competent auditors, and prepare logistics and communication. The exam favors practical planning decisions over generic checklists.
Core rules and concepts
- An audit programme is the set of audits planned for a period, with direction, resources and risk priorities. An audit plan describes one audit: objectives, scope, criteria, schedule, roles, sampling and reporting arrangements.
- Planning starts with the programme risk assessment: process risk, changes, performance data, complaints, previous findings and legal obligations.
- The audit objective states what the audit is for; the scope defines boundaries and limitations; the criteria are the requirements against which evidence is evaluated.
- Select the team for competence and independence. Match technical knowledge to the process and avoid assigning auditors to their own work.
- Review relevant documented information before fieldwork, but let evidence lead the audit. A checklist is an aid, not a script.
- Communicate the plan to auditees early enough to arrange access, interviews and evidence, while preserving the possibility of adapting the plan if risks emerge.
Worked example
A warehouse audit covers a high-value returns process operating on two shifts. The auditor allocates two days, not one, because returns have high value and recent customer complaints. The plan includes interviews with both shift leads, a sample of 20 returns across shifts, review of KPIs and previous corrective actions, and a short follow-up slot. The reasoning is risk-based: limited time is spent equally on low-risk areas, while sampling crosses shifts to detect variation.
Traps that cost marks
Do not call the annual programme an audit plan. Do not write a scope so broad that evidence cannot be gathered. Do not omit audit criteria. Do not copy a generic checklist and ignore process risk, competence or conflicts. Do not make the plan so rigid that emerging evidence cannot be pursued.