ISO 19011:2026 6.3.2: Audit planning

What does 6.3.2 require?

In planning an audit, the team leader should take a risk-based approach that draws on the audit programme and the auditee's documented information, focusing the audit on factors such as how complex products or processes are, customer complaints, earlier findings, and changes in the operating or regulatory environment. How detailed the plan is should reflect how large and complex the audit is. The leader should also consider: who is on the team and what competence they have; which sampling techniques are suitable; the risk that poor planning will stop the objectives being met; ways to make the audit more effective and efficient; and the risks the audit itself creates for the auditee, for instance where the team's presence could affect health and safety, the environment, quality, products, staff or infrastructure. For a combined audit, attention should go to how operational processes interact and to objectives that compete; for a joint audit, to how the teams coordinate, including on sampling and time. The plan should cover: the objectives; the scope, including the parts of the organization and the functions and processes to be audited; the criteria and any reference documented information; the physical and virtual locations, the dates, and the expected timing and length of the activities, including meetings with management, breaks and team meetings; any need for the team to become familiar with the processes and facilities of the auditee, whether through a walk round physical locations or a look at ICT; the methods to be used, including how far sampling will go; the roles and responsibilities of team members, guides, observers and interpreters; and how resources are allocated in light of the risks and opportunities of the activities audited. Where appropriate the plan can also cover: who will represent the auditee; the language for working and for reporting; what the report is expected to contain; logistics and communication arrangements; actions on risks and opportunities; confidentiality and information security; follow-up from earlier audits or from other sources, such as lessons learned and project reviews; follow-up to the audit being planned; and coordination with others in a joint audit. The plan should be shown to the auditee and to the audit client as required, and any issues should be settled between the team leader and the auditee, bringing in the programme manager if needed.