Audit planning and preparation
Programme versus plan
The audit programme is the arrangement for a series of audits over time - cycle, schedule, resourcing, competence allocation. The audit plan covers one audit: objectives, scope, criteria, dates, locations, expected time and duration, roles, resources, methods, and sampling where relevant. Confusing these is the most common planning error in examinations.
Keep three definitions apart:
- Objectives - why: the purpose of this audit.
- Scope - what and where: processes, sites, functions, period.
- Criteria - against what: standards, regulations, the organisation's procedures, contractual requirements.
Preparation
Review relevant documented information, confirm feasibility, contact the auditee, agree access and safety arrangements, and prepare work documents. A checklist is an aide-mémoire, not a script. Abandoning it to follow a promising audit trail is good practice provided the trail stays within scope and time.
Trap: the plan is agreed with the client, but the audit team retains control of how it audits. The auditee cannot insist on seeing findings early, narrowing scope, or dictating who is interviewed.
Trap: time allocation should follow risk and process importance, not equal minutes per clause.
Rule of thumb
Write the plan so a colleague could pick it up and finish the audit: for each area, state the criteria, the activities, the time and who is responsible.