Audit Planning and Preparation

Introduction

An audit rarely fails because an auditor cannot ask questions. It fails more often because the audit was poorly planned: the scope is unclear, criteria are misunderstood, evidence is unavailable, sampling is inappropriate, or responsibilities are not assigned. Audit planning converts a broad intention to “check compliance” into a controlled, risk-based investigation that can produce reliable conclusions.

In quality management, planning must connect the organisation’s objectives, processes, risks, requirements, performance results and available evidence. It applies to internal audits, supplier audits, certification audits, regulatory inspections and integrated management-system audits. Although ISO 19011 provides guidance for auditing management systems, the auditor must also understand the specific criteria being applied, such as ISO 9001 requirements, contractual obligations, statutory requirements, customer specifications and the organisation’s own procedures.

A well-prepared audit is not merely an administrative event. It is a professional evaluation of whether planned arrangements are established, implemented and effective. Planning should therefore support independence, confidentiality, proportionality, evidence-based conclusions and useful improvement.

Learning Objectives

After studying this chapter, the learner should be able to:

1. conduct a preliminary review and determine audit feasibility;
2. define audit scope, objectives and criteria;
3. prepare an audit plan for on-site, remote and hybrid audits;
4. develop process-based audit checklists;
5. design proportionate sampling strategies;
6. review documented information before and during an audit;
7. allocate audit-team responsibilities and manage conflicts of interest; and
8. identify practical, ethical and technological issues affecting audit preparation.

1. The Purpose and Logic of Audit Planning

Audit planning establishes the framework within which evidence will be collected and evaluated. It answers five fundamental questions:

• Why is the audit being conducted?
• What will be examined?
• Against which requirements will it be evaluated?
• When, where and how will evidence be collected?
• Who will perform each activity?

These questions should be answered before detailed interviews begin. Planning also determines the depth of the audit. A high-risk manufacturing process with repeated customer complaints requires more attention than a stable, low-risk administrative activity, even when both occupy similar amounts of time.

A useful planning logic is:

Figure: Audit planning links objectives and risks to evidence-based conclusions.

2. Preliminary Review and Audit Feasibility

The preliminary review is the auditor’s first structured examination of the audit context. It should establish whether the audit can be conducted effectively and safely. Inputs may include the previous audit report, corrective-action records, process maps, quality objectives, performance data, complaints, management-review outputs, risk registers, organisational changes and relevant legislation.

The review should consider:

• the organisation’s size, structure and locations;
• processes and their interactions;
• products, services and critical characteristics;
• significant risks and previous nonconformities;
• maturity and accessibility of documented information;
• language, security, confidentiality and access restrictions;
• availability and competence of audit-team members; and
• time, travel, technology and health-and-safety constraints.

Audit feasibility should be decided before commitments are made. An audit may need postponement if critical records cannot be accessed, key personnel are unavailable, the criteria are not defined, or the audit team lacks competence. Proceeding regardless can result in an unsupported conclusion.

A preliminary review is not a substitute for the audit. It identifies where to focus and what to verify. Auditors should avoid treating documents as proof of implementation: a procedure may be well written but not followed, while a process may be effective despite poorly controlled documentation. Both documented arrangements and operational evidence must be examined.

3. Audit Objectives, Scope and Criteria

Audit objectives

Objectives state what the audit is intended to achieve. Examples include determining whether a quality management system conforms to specified requirements, evaluating the effectiveness of a corrective-action process, assessing supplier controls, or identifying opportunities to improve process performance. Objectives should be specific enough to guide decisions and broad enough to avoid a predetermined conclusion.

Audit scope

Scope defines the boundaries of the audit. It normally specifies:

• organisational units, sites or departments;
• physical and virtual locations;
• processes and activities;
• products or services;
• time period covered;
• interfaces with external providers; and
• exclusions or limitations.

For example, “the quality system” is too vague. A more useful scope might be: “product design, purchasing, production and final release for medical-device assemblies at the Central Plant, including remote support from the design office, for records generated during the previous twelve months.”

Scope exclusions must be justified. An excluded process may still affect conformity through an interface. Auditors should therefore identify inputs, outputs, controls and responsibilities at process boundaries.

Audit criteria

Criteria are the requirements against which evidence is evaluated. They may include:

• ISO standards and applicable guidance;
• laws, regulations and permits;
• customer or contractual requirements;
• approved policies, procedures and work instructions;
• product specifications and acceptance criteria; and
• internally defined objectives and performance requirements.

Criteria should be available to the audit team and auditee before the audit. If two criteria conflict, the issue must be resolved with the audit client or responsible authority; auditors should not silently choose the more convenient interpretation.

Objective, scope and criteria: a distinction

4. Developing the Audit Plan

The audit plan translates the audit mandate into an operational schedule. It should identify the audit client, lead auditor, team members, auditee contacts, objectives, scope, criteria, dates, locations, methods, resources, confidentiality arrangements and reporting arrangements.

A practical plan usually contains:

1. opening meeting and confirmation of arrangements;
2. review of management-system processes and interfaces;
3. interviews with responsible personnel;
4. observation of relevant activities;
5. review of records and objective evidence;
6. daily team reviews and adjustment of priorities;
7. preparation of findings and conclusions; and
8. closing meeting and communication of next steps.

The plan should be process-based rather than merely department-based. A process approach follows the sequence of inputs, activities, controls, outputs, customers and measures. It reduces the risk that an auditor examines isolated documents while missing failures at interfaces.

Risk-based allocation of time

Time should reflect risk, complexity, change and past performance. Factors that may justify increased attention include safety or regulatory significance, high defect rates, new technology, inexperienced personnel, outsourced operations, major organisational change and repeated complaints. Risk-based planning does not mean ignoring low-risk processes; it means applying proportionate effort.

Plans should remain flexible. If an auditor identifies a serious uncontrolled condition, the lead auditor may revise the schedule, request additional evidence, involve a technical expert or escalate the issue. Changes should be recorded and communicated.

5. Audit Checklists and Working Documents

A checklist is a structured aid for obtaining consistent coverage. It is not a script and must never prevent an auditor from following relevant evidence. A strong checklist links each question to a criterion, process activity, evidence source and possible risk.

A useful checklist format is:

Questions should be open and evidence-oriented. “Show me how this is controlled” is generally more useful than “You control this, correct?” The checklist should include process interfaces, abnormal conditions, recent changes and follow-up of previous findings.

Common checklist weaknesses include copying standard clauses without understanding the process, asking leading questions, listing documents without identifying expected evidence, and treating completion of every line as proof of conformity. The auditor remains responsible for professional judgement.

6. Reviewing Documented Information

Document review may occur before the audit, during the audit or both. The reviewer should evaluate suitability, adequacy, currency, approval, distribution and relationship to actual practice. Relevant information includes manuals, procedures, process maps, forms, records, specifications, training evidence, calibration records, inspection results, complaints and corrective-action records.

The review should ask:

• Is the document applicable to the audited activity?
• Is the current revision identifiable and authorised?
• Are responsibilities and acceptance criteria clear?
• Are records sufficient to demonstrate implementation?
• Do different documents contradict one another?
• Does practice appear consistent with the documented arrangement?

Records are evidence of events, not merely documents to be counted. Auditors should examine whether records are complete, traceable, legible or electronically retrievable, protected from unauthorised change and retained for the required period. Personal data and commercially sensitive information should be accessed only when necessary and handled securely.

7. Sampling Strategies

Audits normally examine samples rather than every transaction. Sampling is necessary because time and resources are limited, but it creates a risk that the sample does not represent the population. The auditor should define the population, sampling unit, selection method, sample size rationale and limitations.

Important sampling approaches include:

• random sampling: each unit has a known chance of selection;
• systematic sampling: units are selected at a regular interval after a starting point;
• stratified sampling: the population is divided into meaningful groups, such as product types or shifts;
• judgemental sampling: units are selected because of risk, complexity, complaints or change; and
• haphazard sampling: convenient selection without a defensible method, which is generally weak.

Risk-based auditing commonly combines random or systematic selection with judgemental selection of high-risk cases. For example, an auditor may select records from every production shift, include the most recent complaint, and examine a recently changed product.

A sample does not prove that every unexamined item conforms. Findings should be stated accurately: “In the sample examined...” rather than “The organisation never...” unless broader evidence supports the conclusion.

For a simple attribute sample, the observed nonconformity rate can be expressed as:

where p̂ is the observed sample proportion, d is the number of nonconforming items found, and n is the number of items examined. This is descriptive, not automatically a confidence statement. Statistical inference requires assumptions about the population and selection method. A convenience sample does not justify statistical generalisation.

When a finite population of size N is sampled without replacement, the finite-population correction may be relevant to statistical planning:

Here N is population size and n is sample size; both are counts and therefore dimensionless. This correction is applicable to certain variance calculations when sampling without replacement and when a substantial fraction of the population is sampled. It should not be presented as a universal audit sample-size formula. In many management-system audits, professional risk judgement is more appropriate than a purely statistical calculation.

Worked illustration

Suppose an auditor examines 40 purchase orders and finds 3 without evidence of required approval. The observed rate is:

The auditor should record the three cases, investigate their common cause and assess whether the sample indicates a systemic weakness. The result does not establish that exactly 7.5% of all purchase orders are defective.

8. Assigning Team Responsibilities and Ensuring Competence

The lead auditor manages the audit programme, confirms the plan, coordinates the team, communicates with the auditee, controls changes and approves the audit report. Team members collect and evaluate evidence within assigned areas. Technical experts provide specialised knowledge but should not make audit judgements outside their competence. Observers may accompany the team but must not interfere.

Assignments should consider:

• technical and sector competence;
• knowledge of applicable standards and legal requirements;
• language and communication ability;
• audit experience;
• independence from the activity being audited; and
• availability for preparation, fieldwork and reporting.

An auditor should not audit work for which they are directly responsible or where a personal, financial or managerial relationship threatens impartiality. Conflicts should be declared and controlled. Confidentiality obligations apply to information obtained before, during and after the audit.

9. Preparing for On-Site, Remote and Hybrid Audits

On-site audits

Preparation includes access permissions, personal protective equipment, induction requirements, room arrangements, interview locations, transportation, emergency procedures and secure handling of records. The audit team should understand site hazards and avoid disrupting production or compromising product integrity.

Remote audits

Remote audits require reliable platforms, identity confirmation, secure document exchange, agreed recording rules, time-zone coordination and contingency arrangements. The auditor should test connectivity and ensure that screens, records and interviews can be viewed adequately. Remote observation may be limited where camera placement, bandwidth or privacy prevents reliable verification.

Hybrid audits

Hybrid audits combine on-site and remote participation. They require especially clear role allocation: for example, one auditor may observe the shop floor while another interviews the process owner remotely. The team should avoid duplicated requests and ensure that remote participants receive the same relevant evidence as those on site.

Technology supports auditing but does not replace auditor judgement. Artificial-intelligence tools may help search large document sets, identify inconsistent dates or prioritise records for review. However, outputs must be verified against source evidence. AI systems can reproduce bias, overlook context, expose confidential information or generate plausible but false conclusions. Accountability for audit conclusions remains with competent auditors.

10. Conduct, Ethics and Governance

Audit preparation must protect impartiality, confidentiality, due process and respect for people. Auditors should not promise a favourable result, accept inappropriate gifts, use confidential information for personal advantage or pressure employees into unsupported admissions. Interviews should be fair and proportionate, particularly where findings may affect employment or supplier relationships.

Governance controls should define who authorises the audit, who receives the report, how disagreements are handled, how records are retained and how corrective actions are verified. Regulatory or contractual audits may impose additional requirements for evidence retention, notification and independence.

Applied Case: Illustrative Audit of a Medical-Device Assembly Process

Background

MedSure Assemblies produces sterile single-use kits. Customer complaints increased after the organisation introduced a second shift and changed a packaging supplier. An internal audit is planned against ISO 9001 requirements, approved procedures, customer specifications and applicable regulatory controls.

Problem

A previous audit found incomplete training records, but the corrective action was closed after a document revision without evidence that employee competence had improved. Management wants the new audit completed in two days, although the process spans two shifts and an external sterilisation provider.

Analysis

The lead auditor conducts a preliminary review and identifies high-risk interfaces: training and shift handover, supplier qualification, packaging inspection, traceability, sterilisation certificates and complaint feedback. The scope includes purchasing, incoming inspection, assembly, packaging, release and outsourced sterilisation. Design activities are excluded because no design change is being evaluated, but the exclusion is documented and its interface with packaging specifications is checked.

The team allocates one auditor to supplier and outsourced-process controls, one to production and competence, and the lead auditor to release, complaints and overall coordination. The sampling strategy includes records from both shifts, the changed supplier, recent complaints, one completed corrective action and products released before and after the supplier change.

Approach and solution

Before the audit, the team reviews procedures, training matrices, supplier evaluations, complaint trends, sterilisation certificates and previous findings. During the audit, auditors compare the approved packaging specification with the current work instruction and observe both shifts. They trace selected finished kits backward through batch records, packaging materials and sterilisation evidence.

The audit finds that the supplier is approved, but the change-control record did not document a risk evaluation of the new packaging material. Two operators on the second shift performed the task correctly but lacked current competence records. One sterilisation certificate was available only through an informal email account, creating a retrieval and retention weakness. These are evaluated against the criteria and supported with specific records, dates and process locations.

Outcome

The audit report distinguishes three findings rather than combining them into a vague statement about “poor control.” Management accepts corrective actions: formal supplier-change risk assessment, completion and verification of training, and controlled retention of sterilisation certificates. Follow-up will test implementation and effectiveness, not merely the existence of revised documents.

Learning points

The case demonstrates that planning should follow risk and process interfaces, not organisational charts. It also shows why a sample must include different shifts and changed conditions, why documented information must be traced to actual practice, and why corrective-action closure requires evidence of effectiveness.

Challenges and Limitations

Audit planning involves unavoidable uncertainty. Processes may change after the plan is issued, records may be incomplete, and auditees may present unusually controlled conditions during the audit. Time pressure can encourage superficial document review or excessive reliance on checklists. Statistical sampling can create false confidence when the population is poorly defined or selection is biased. Remote auditing can reduce access to physical conditions and informal interactions.

These limitations should be disclosed in the audit report. A sound audit does not claim more than the evidence supports. When evidence is insufficient, the correct response is to obtain further evidence, qualify the conclusion or record a limitation—not to infer conformity.

Best-Practice Planning Checklist

Before fieldwork, the lead auditor should confirm that:

• objectives, scope and criteria are agreed;
• relevant risks, changes and previous findings are reviewed;
• the team is competent, independent and adequately resourced;
• the schedule covers processes and interfaces;
• sampling logic and limitations are understood;
• documented information is available and secure;
• on-site, remote or hybrid arrangements are tested;
• confidentiality, safety and data-protection controls are defined; and
• reporting, escalation and follow-up arrangements are clear.

Chapter Summary

Audit planning converts an audit mandate into a feasible, risk-based and evidence-oriented investigation. Preliminary review establishes context, risks, resources and feasibility. Objectives explain why the audit is conducted; scope defines its boundaries; and criteria identify the requirements used for evaluation. A process-based audit plan allocates time and people according to risk, complexity, change and previous performance.

Checklists support consistency but do not replace professional judgement. Documented information must be reviewed for adequacy, currency, control and relationship to actual practice. Sampling should define the population and selection logic, distinguish descriptive results from statistical inference, and acknowledge limitations. Competence, independence, confidentiality and ethical conduct are essential to credible auditing. On-site, remote and hybrid methods require different logistical and technological preparations, while AI may assist analysis only under human control and verification. Effective preparation ultimately improves the reliability, fairness and usefulness of audit conclusions.

Key Terms

Audit criteria: Requirements used as a reference against which evidence is evaluated.

Audit feasibility: Determination of whether an audit can be conducted effectively with available information, competence and resources.

Audit objective: The purpose or intended result of an audit.

Audit plan: Description of activities, arrangements, responsibilities and timing for an audit.

Audit scope: Boundaries and extent of an audit.

Checklist: Structured aid used to support consistent audit coverage.

Competence: Ability to apply knowledge and skills to achieve intended results.

Documented information: Information required to be controlled and maintained, together with its supporting medium.

Evidence: Verifiable records, statements of fact or other information relevant to audit criteria.

Hybrid audit: Audit using both on-site and remote methods.

Independence: Freedom from responsibility for the activity being audited and from bias or conflict of interest.

Lead auditor: Auditor responsible for coordinating and directing the audit.

Objective evidence: Data supporting the existence or truth of a condition.

Population: Complete set of units from which an audit sample is selected.

Process approach: Examination of interrelated activities that transform inputs into outputs.

Risk-based auditing: Directing audit attention and resources according to risk and significance.

Sample: Selected subset of a defined population.

Sampling bias: Systematic distortion caused by a selection method that does not adequately represent the population.

Scope limitation: Restriction that prevents examination of part of the intended audit area.

Technical expert: Person who provides specialised knowledge to an audit team.

Review Questions

5 Short Answer Questions

1. Distinguish between audit objectives, scope and criteria.
2. Why is a preliminary review conducted before fieldwork?
3. State two weaknesses of relying exclusively on an audit checklist.
4. What information should be included in an audit plan?
5. Why must audit findings be supported by objective evidence?

5 Long Answer Questions

1. Explain how risk, process interfaces and previous audit results influence audit-plan preparation.
2. Discuss the principles for reviewing documented information before and during an audit.
3. Compare random, systematic, stratified and judgemental sampling in quality auditing.
4. Explain the responsibilities of a lead auditor, team member, technical expert and observer.
5. Describe the additional preparation required for remote and hybrid audits.

3 Analytical / Application Questions

1. A production audit is limited to one shift even though defect rates differ substantially between shifts. Analyse the planning weakness and propose a revised scope and sampling strategy.
2. During a remote audit, the auditee provides selected screenshots but refuses live observation of the process. Evaluate the evidential limitation and recommend the auditor’s response.
3. An organisation closes a corrective action by revising a procedure but provides no evidence of implementation or effectiveness. Develop an audit approach for evaluating whether the corrective action is genuinely effective.

Multiple Choice Questions with Answers

Question 1

Which element defines the requirements against which audit evidence is evaluated?

A. Audit objective

B. Audit scope

C. Audit criteria

D. Audit schedule

Correct Answer: C. Audit criteria

Question 2

Which sampling method divides a population into meaningful groups before selecting units?

A. Stratified sampling

B. Haphazard sampling

C. Convenience sampling

D. Uncontrolled sampling

Correct Answer: A. Stratified sampling

Question 3

An audit plan should primarily be based on which combination?

A. Department names and auditor preference

B. Risk, process significance, change and previous performance

C. Equal time for every document

D. The number of employees in each department

Correct Answer: B. Risk, process significance, change and previous performance

Question 4

What is the main limitation of a checklist?

A. It can support consistent coverage

B. It can identify evidence sources

C. It cannot replace professional judgement

D. It can record audit results

Correct Answer: C. It cannot replace professional judgement

Question 5

An auditor examines 3 nonconforming records in a sample of 40. What is the observed sample proportion?

A. 3.0%

B. 7.5%

C. 13.3%

D. 40%

Correct Answer: B. 7.5%

Question 6

Which situation most clearly threatens auditor independence?

A. The auditor reviews records from another department

B. The auditor uses an agreed checklist

C. The auditor audits work for which they are directly responsible

D. The auditor attends an opening meeting

Correct Answer: C. The auditor audits work for which they are directly responsible

Question 7

Which statement about a sample finding is most accurate?

A. It automatically proves every item in the population is nonconforming

B. It should be reported without identifying the records examined

C. It should acknowledge the sample and avoid unsupported generalisation

D. It is invalid unless the entire population is examined

Correct Answer: C. It should acknowledge the sample and avoid unsupported generalisation

Question 8

What is an important preparation for a remote audit?

A. Avoiding all technology tests until the audit begins

B. Agreeing secure access, connectivity and evidence-sharing arrangements

C. Allowing unrestricted recording by all participants

D. Excluding interviews from the audit plan

Correct Answer: B. Agreeing secure access, connectivity and evidence-sharing arrangements

Question 9

Which action best verifies corrective-action effectiveness?

A. Confirming that a procedure was retyped

B. Confirming that the finding was removed from the report

C. Examining implementation and evidence that recurrence was prevented

D. Accepting management’s verbal assurance alone

Correct Answer: C. Examining implementation and evidence that recurrence was prevented

Question 10

What is the appropriate role of artificial intelligence in audit preparation?

A. It may replace the lead auditor’s judgement

B. Its outputs may be used without checking source evidence

C. It may assist document analysis, but outputs require human verification

D. It should determine audit conclusions independently

Correct Answer: C. It may assist document analysis, but outputs require human verification