Audit plan example for an internal audit (ISO 9001)

An audit plan is the plan for one specific audit: which processes and requirements you check, who you speak to, when it takes place and which evidence you look for. It belongs to your annual programme for internal audits. After the audit, you record the findings in the audit report. ISO 9001 requires you to define the criteria and scope for each audit (clause 9.2.2). The audit guideline ISO 19011 describes how to build an audit plan. It is guidance, not a requirement, so you may use your own format as long as the audit is repeatable.

ISO 19011 has been available in a new edition since May 2026 (ISO 19011:2026), which replaces the 2018 edition. You buy the guideline from NEN (Royal Netherlands Standardization Institute) . Check there which language version is available.

An audit plan differs from the annual programme. The annual programme states which area you audit in which quarter. The audit plan states exactly what you will do in one day.

Audit plan and annual programme side by side

Feature	Annual programme	Audit plan
Scope	The whole management system over a year or cycle	One audit: one department, process or part of the standard
Time frame	Months or the whole year	One day or a few hours
Who writes it	The person responsible for the audit programme	The auditor, often in consultation with the auditee
What it contains	Areas, dates, auditor, status	Times, topics, requirements, contacts, evidence
When it is finished	At the start of the cycle	Before the audit, shared with the auditee

Do not have an annual programme yet? Start with that first. You build the audit plan on top of it.

What goes in an audit plan?

A useful audit plan has six parts. Keep it short: two A4 pages is enough for one day of audit.

Part	What you fill in	Why it matters
Purpose and scope	Which process or department, and which standard	Prevents you from auditing everything and nothing
Criteria	The requirements you test, per standard clause	The auditor knows what you measure against
Audit team and auditee	Who audits, who is the contact person	Independence and preparation
Date and times	A time slot per topic	Realistic and checkable
Topics and evidence	What you want to see: records, conversations, observations	Makes the audit concrete
Distribution and report	When the summary follows	Closing and follow-up

Example: audit plan for one day of internal audit

A small bakery with 25 employees wants to audit the purchasing and supplier management process. The plan below shows what this could look like. The standard is ISO 9001:2015. The numbers in the “criteria” column are clauses of that standard. Use the structure and replace the content.

Time	Topic	Criteria (ISO 9001)	Contact person	Evidence you look for
09:00 - 09:15	Opening and confirming scope	Clause 4.4: processes of the management system	Owner	Process description for purchasing
09:15 - 10:00	Supplier assessment	Clause 8.4: externally provided products and services	Purchasing employee	Assessment list, list of approved suppliers
10:00 - 10:45	Sample of purchase orders	Clause 8.4: control of what you purchase	Purchasing employee	Ten order forms with checks
10:45 - 11:15	Nonconformities on receipt	Clause 10.2: nonconformity and corrective action	Warehouse employee	Nonconformity register, correction
11:15 - 11:45	Competence of the buyer	Clause 7.2: competence	Owner	Training overview
11:45 - 12:00	Closing and first findings	All chapters	Owner	Notes

Note: the plan names evidence, not a judgement. You write down what you want to see, not what you already think.

An audit plan is not a checklist. The checklist contains the questions you ask. The audit plan says when and to whom you ask them. Use both: the plan as an agenda, the checklist as a memory aid.

Step by step: writing an audit plan

Choose the topic and the scope

Take the topic from your annual programme. Write in one sentence what you audit: “the bakery’s purchasing process, including supplier management”. Without a scope, the audit runs out of control.

List the criteria

Take the standard and note the clauses that are relevant to this process. For a combined audit against several standards, combine the clauses, because many requirements overlap.

Decide the evidence per criterion

For each criterion, ask yourself: which record exists, who can show it to me, and what will I observe? If you look for a supplier assessment list in supplier management and cannot find one, that is a finding for the audit report.

Plan the times and conversations

Allow at least 30 minutes per conversation and keep a buffer at the end. Schedule conversations with the people who do the work, not only with the line manager.

Send the plan to the auditee in advance

A plan shared the week before gives the auditee the chance to prepare the evidence. That is fair, and it prevents noise during the audit.

Record what has changed

If something different emerges during the audit, write it down in the plan or the report. The audit plan is a working document, not a contract.

What does the auditor look for in your audit plan?

An external auditor looks not at the format but at whether your audit really examines the organisation. They look at these points:

A clear scope that matches the annual programme.
Criteria that refer to the right clauses of the standard.
Conversations with employees who do the work, not only with the manager.
Evidence you will actually review: records, orders, logs or measurement data.
A report that refers back to the plan, so it is visible what was not done.

Common mistakes in the audit plan

Everything in one day. A whole management system does not fit into one audit. Spread the scope across the cycle.

Only conversations, no evidence. “Yes, we always do that” is not evidence. Ask for the record or observe the process.

The auditor audits their own work. An internal auditor does not check what they have done themselves. ISO 9001 requires the auditor to be objective and impartial (clause 9.2.2). See planning and carrying out internal audits.

No link to findings from last time. Include open actions from the previous audit and the management review in the plan.

The plan is not shared. A secret plan produces no improvement. Share it, even if it is short.