ISO 19011:2018 6.3.2: Audit planning

Guidance: the team leader should plan the audit on the basis of risk, using the programme information and the auditee's documented information, considering the risks of the audit to the auditee's processes and providing the basis for agreement among client, team and auditee on the conduct of the audit. Plan detail should reflect scope, complexity and the risk of not achieving the objectives, considering team composition and competence, sampling techniques, opportunities to improve effectiveness and efficiency, the risks to the objectives from ineffective planning, and the risks to the auditee from the audit's presence (health and safety, environment, quality, contamination). Combined audits need attention to interactions and competing priorities between systems. The plan should address or reference the objectives, scope including functions and processes, criteria and reference documents, physical and virtual locations, dates and durations including management meetings, familiarisation with facilities and processes, methods including the extent of sampling, roles of team members, guides, observers and interpreters, and resource allocation against the risks of the activities audited; and as appropriate the auditee's representatives, working and reporting language, report topics, logistics and communications, actions on risks and opportunities, confidentiality and information security, follow-up from previous audits, follow-up to this audit, and coordination for joint audits. The plan should be put to the auditee, with any issues settled with the leader, auditee and programme manager.