Audit Plan

This plan is one step inside a larger audit programme. Using it for work that belongs to a neighbouring template produces plans that look complete but cannot be reconciled against what the programme actually scheduled, or against what the audit later reported.

ISO 19011 cl.6.2 sets out what an audit plan has to fix before the audit begins: objectives, scope, criteria, method and the practical logistics of getting auditors onto site and in front of the right people.

ISO 19011 is guidance, not a certifiable standard in its own right, so what actually has teeth depends on which certifiable standard or customer scheme the audit is run against — and that varies sharply by sector and region.

Filling in every field is the easy part. The plan is only as defensible as the four judgement calls behind it, and those are the ones an assessor or a customer auditor will actually probe.

These are the patterns that actually show up when audit plans are reviewed after the fact, not hypothetical gaps in the form.

A site preparing for BRCGS recertification produced fully completed audit plans for every internal audit that quarter, all showing Plan Accepted as Yes. When the certification body auditor asked for the notice given on the most recent one, Days Notice Given read zero — the plan had been created and accepted the same calendar day as the audit, alongside it rather than ahead of it.

The finding was not against any single audit's content. It was that the site's own planning evidence showed no gap between plan and execution across a whole cycle, meaning no internal audit that quarter had genuinely tested anything the site had not already chosen to show. The fix was a minimum five-day notice rule written into the programme, checked against Days Notice Given before a plan could move to Accepted.

The form is the easy part. Keeping the plan tied to the right programme line, chasing acceptance before the visit, and holding the unannounced element genuinely unannounced is the work that actually slips.

KnowComply

Holds the audit plan against the annual programme, tracks Plan Accepted status across every scheduled audit, and flags any site where the unannounced element hasn't been used in a full cycle.

KnowSafe

Feeds ISO 45001-scoped audit plans from the site's live risk register, so Areas In Scope reflects current hazards rather than last year's list.

KnowQuality

Links ISO 9001 process audit plans to nonconformity trends, so Sampling Basis can point to an actual pattern of prior findings instead of a generic risk statement.

Ella

Chases Plan Accepted before the audit date arrives, rolls notice periods and acceptance status into one view across every open plan, and holds every write for your approval before it touches a record.

Audit criteria

The set of requirements — a standard, clause, policy or procedure — that the audit evidence is measured against. Recorded here as Management System Standard and Clause Or Requirement.

Audit scope

The boundaries of the audit: which sites, areas, processes and time period are actually covered, and what is explicitly excluded.

Trace exercise

A sampling technique that follows one record or product forward and back through a process — for example from raw material receipt to finished goods dispatch — to test whether the paperwork matches what actually happened.

Sampling basis

The logic used to choose what gets audited: risk-based, random, statistical or convenience. Risk-based and statistical sampling can be defended under challenge; convenience sampling generally cannot.

Unannounced element

A portion of an audit — a shift, a location or an activity — that the auditee is not told about in advance, built into an otherwise scheduled and announced audit to test what a fully prepared visit would not show.