As a long-term frontline audit team leader, preparing audit plans is a routine task. Without an audit plan, it's like a harbor without a lighthouse, losing the direction of the audit. Based on my many years of audit experience, I would like to share some personal views on writing audit plans, hoping to inspire others and welcome criticism and corrections.
Concept of audit plan: The definition of an audit plan in the GBT19000 standard is: a description of audit activities and arrangements.
According to the requirements of ISO19011-2018 "Guidelines for auditing management systems" and my personal understanding, an audit plan should basically reflect the following content: a) audit objectives; b) audit scope, including the organizational units, functional units, and processes being audited; c) audit criteria and referenced documents; d) locations, dates, expected times, and deadlines for conducting audit activities, including meetings with the auditee's management; e) audit methods used, including the scope of audit sampling needed to obtain sufficient audit evidence, and where applicable, the design of the sampling plan; f) roles and responsibilities of audit team members, guides, and observers; g) allocation of appropriate resources to key audit areas; h) identification of the auditee's representatives for this audit; i) languages used for audit work and audit reports when auditors and/or auditees speak different languages; j) logistics and communication arrangements, including specific arrangements at the audit site; k) follow-up actions from previous audits; l) confidentiality and information security matters; l) specific measures taken to address uncertainties in achieving audit objectives; m) coordination with other audit activities in the case of joint audits, etc.
Of course, the content of the audit plan can be adjusted anytime according to the nature of the auditee and the team leader's preferences. However, in any case, the audit plan must be sent to the auditee in advance so that they understand the specific activities and arrangements of this audit, facilitating better cooperation with the audit team. Those who rush to write the plan only upon arriving at the audit site, or only finish the audit plan at the final meeting, often fail to organize the audit properly.
The level of detail in the audit plan should reflect the scope and complexity of the audit as well as uncertainties in achieving audit objectives. When preparing the audit plan, the team leader should consider appropriate sampling techniques, the composition and overall capability of the audit team, and risks posed to the organization by the audit.
For example: if an enterprise's organizational structure is relatively simple, the process is straightforward, and the number of people is not large, the audit plan should reflect the management characteristics of this auditee, matching its complexity as much as possible. The audit plan should be concise and clear, not drawn out endlessly. Another example: when the audit team audits an auditee with cleanliness requirements, the audit plan should clearly indicate how to reduce threats caused by the audit's arrival and the measures expected from the auditee. Another example: when auditing an auditee with hazardous operational processes, the audit plan should appropriately specify safety protection requirements for the audit team.
In other words, the audit plan is not simply the team leader's specific arrangement of audit clauses for team members (although this element accounts for a large part of the audit plan), but a key description of all critical audit activities and arrangements. This is often overlooked by team leaders during the audit process. Therefore, the main content the audit team leader should discuss at the opening meeting should revolve around the audit plan and how to ensure its effective implementation. These are elements the team leader must pay close attention to both at the opening meeting and throughout the audit.
The audit plan clearly specifies the details of audit activities and arrangements, so the auditee knows what to do. With good communication, the audit will proceed smoothly, and the audit team leader can achieve a harmonious unity among the audit client, audit team, and auditee, laying a solid foundation for successfully completing the audit task.
Next, I will focus on discussing how to reasonably allocate the internal workload among audit team members during the preparation of the audit plan and share some of my experiences.
Every time we receive an audit task letter, we often encounter such confusion and exclaim:
"So many construction project sites, how to write the audit plan? How to meet the man-days?"
"Why are there two lame members in the team? (Quality, environment, and safety auditors lacking full qualifications)"
"So many departments, so few man-days, try scheduling the audit plan yourself?"
"I've been writing this lousy plan for a whole day and still haven't finished!"
"There is only one professional auditor in the team, how can the rest non-professional auditors audit?"
"Why are there witnesses in the team? Interns? Damn, there's even a technical expert? Oh my, another lame member!"
"This chemical plant has discussed the audit plan issue with me several times, refusing to go onsite, what to do?"
"I studied chemical engineering, and they assign me a technical expert in apparel, am I a god now? Can I do everything?"
"There are two observers this time, should we allocate man-days for them?"
And so on and so forth. The more auditees there are, the more problems arise, the greater the challenge, and the richer the experience. So don't be afraid when receiving an audit task letter. Stay calm, organize your thoughts before starting, and don't rush to write the plan.
Next, I will briefly describe how I prepare an audit plan using a case from a supervision enterprise:
1. Basic information of the audit task letter is as follows:
Audit scope
Q: Municipal public engineering supervision, building construction supervision; S: Municipal public engineering supervision, building construction supervision and related management activities; E: Municipal public engineering supervision, building construction supervision and related management activities.
Audit team composition
|
A
|
Male
|
Auditor (Q:2020-N1QMS-3067551/
S:2020-N1OHSMS-3067551/
E:2021-N1EMS-4067551)
|
'Q:' Team leader ';S:' Team leader ';E:' Team leader
|
34.01.02(QSE)
On-site audit
|
|
B
|
Female
|
Auditor (Q:2021-N1QMS-2233201/
S:2021-N1OHSMS-1233201/
E:2020-N1EMS-1233201)
|
'Q:' Team Member ';S:' Team Member ';E:' Team Member
|
Remote Audit
|
|
C
|
Male
|
Auditor (Q:2022-N1QMS-2243213/
S:2020-N1OHSMS-1243213/
E:2022-N1EMS-2243213)
|
'Q:' Team Member ';S:' Team Member ';E:' Team Member
|
Remote Audit
|
|
D
|
Male
|
Auditor (Q:2019-N1QMS-4047491/
S:2019-N1OHSMS-3047491/
E:2019-N1EMS-4047491)
|
'Q:' Team Member ';S:' Team Member ';E:' Team Member
|
On-site audit
|
Audit Time: Total 2 days
Distribution of Auditee Addresses
The headquarters in Rizhao has two construction project sites under construction: Site One Name and Address: Linyi City certain bid section municipal engineering supervision project. Required person-days: 1.5 days
Site Two Name and Address: Linyi City certain residential area construction supervision project. Required person-days: 1.5 days
Auditee organizational structure: Leadership, Office, Technical Safety Department (main control departments for quality, environment, safety), Business Development Department, Supervision Project Department.
2. The analysis related to audit key points of the auditee is as follows:
One professional auditor A and three non-professional auditors B, C, D. Over two days, the professional auditor A has a large audit workload and also leads the team, requiring a lot of coordination and communication time as well as time for document review and audit report preparation. Therefore, the focus of this audit plan is to try to reduce A's workload by shifting it towards the three non-professional auditors.
The two construction projects and the headquarters are too far apart, causing significant travel time. After the initial meeting, professional auditor A needs to go to a construction site over 100 kilometers away, then return for the closing meeting, which also wastes a lot of time. Therefore, it is considered that after auditing the Technical Safety Department, auditor A will audit the Linyi Supervision Project Department onsite and attend the closing meeting in Linyi. This is the second key point, aiming to reduce A's workload, allowing A to focus on professional auditing and reduce audit risks.
Auditor D, conducting onsite audits at the headquarters in Rizhao, audits the leadership, office, and business development department, and communicates deeply with the general manager's representative to conduct in-depth audits of the system operation in each department, ensuring the effectiveness of onsite audits. This is the third key point.
Auditors B and C, conducting remote onsite audits, share all non-professional audit clauses of auditor A. It is especially emphasized that with the joint assistance of the auditee and professional auditor A, auditors B and C will complete the audit of non-professional clauses for the Technical Safety Department and Supervision Project Department remotely with sufficient evidence. This is the fourth key point.
3. For each audit, I usually list the qualifications of audit team members in a table for careful analysis, such as some auditors being "limited", some witnessing, some being witnessed, some undergoing periodic assessments, etc. The purpose of this table is to coordinate with item 4 below to reduce error rates. As follows:
|
Member Code
|
Audit Qualification
|
Professional Status
|
Special Conditions
|
Other Conditions
|
|
A
|
QES
|
34.01.02(QSE)
|
On-site audit
|
Initial Meeting in Rizhao
Closing Meeting in Linyi
|
|
B
|
QES
|
|
Remote Audit
|
|
|
C
|
QES
|
|
Remote Audit
|
|
|
D
|
QES
|
|
On-site audit
|
Initial and Closing Meetings in Rizhao
|
Note:
If there are witnessing, "limited" or other conditions, they are specified in "Other Conditions."
4. Analysis of Auditee's Audit Situation:
|
Department Name
|
Technical Safety Department
|
Supervision Project Department
|
Leadership, Office, Business Development Department
|
Other Conditions
|
|
Professional Status Analysis
|
Professional
|
Professional
|
Non-professional
|
|
|
Person-day Analysis
|
At least one person-day
|
At least 3 Individual Day (specified in audit task book)
|
At least two person-days
|
|
|
Team Member Allocation Analysis
|
ABC Team audit half day, total 1.5 Individual Day
|
ABC Team Audit 1.25 days, ( A Travel Planning 0.25 days), total 3.75 Individual Day
|
D Audit two days
|
|
|
Audit Person-day Calculation
|
1.5
|
4.0
|
2
|
Total 7.5 person-days, plus initial and closing meetings, basically meeting audit person-day and professional requirements.
|
Note:
A. This audit involves four auditors for two days, totaling eight person-days.
B. Other person-day related conditions, such as safety, confidentiality, etc., are specified in "Other Conditions."
5. Combining items 3 and 4 results in the basic audit arrangement:
|
Department Name
Personnel Division
|
Technical Safety Department
|
Supervision Project Department
|
Leadership, Office, Business Development Department
|
Other Conditions
|
|
A
|
Professional / Half Day
|
Professional /1.25 days, travel 0.25 days
|
|
Initial Meeting in Rizhao
Closing Meeting in Linyi
|
|
B
|
Non-professional / Half Day
|
Non-professional /1.25 days, remote with no travel
|
|
|
|
C
|
Non-professional / Half Day
|
Professional /1.25 days, remote with no travel
|
|
|
|
D
|
|
|
Audit two days
|
Initial and Closing Meetings in Rizhao
|
6. The final audit plan including clauses, departments, and audit members is as follows:
|
Audit Schedule Arrangement Audit Schedule
|
|
Date Date
|
Time Time
|
Main Audit Process
Main processes audited
|
Levels involved in the process / Departments and interfaces Level/departments related with the processes
|
Relevant standard clauses
Referred standard clauses
|
Audit Focus
Audit Emphasis
|
Audit Personnel Code Code of Audit Personnel
|
|
2022.06.17
|
10:30~11:00
|
Initial Meeting
|
AD Rizhao
BC Remote
|
|
11:00~12:30
13:00~15:00
|
Processes related to product planning, realization, production, and inspection control
|
Technical Safety Department
|
Q ： 5.3/6.1/6.2.2/7.1.5/ 8.1/8.3 Not applicable confirmation /8.6/8.7
ES:5.3/6.1.1 / 6.1.2/6.1.3/6.1.4/ 6.2.2/ 8.1/8.2/9.1.1/9.1.2/ 10.2
|
Internal and external environment, system planning, document control, environmental factors / Hazard identification, legal and regulatory identification, update status; monitoring and measurement equipment control; organizational knowledge; communication, site inspection ES Operational control; emergency response planning and control in office areas; nonconformity correction and preventive measures; system monitoring and measurement, compliance evaluation, internal audit, corrective actions, continuous improvement
|
ABC ( A Audit without underline parts; B Audit under straight underline parts; C (Audit under wavy underline parts)
|
|
15:00-17:00
|
Travel from Rizhao to Linyi
|
|
17:00-19:00
|
Management activities at the project site
|
Site 1 Name and Address: Linyi Urban Area Municipal Engineering Supervision Project
|
'Q:' 5.3/6.1/6.2/7.1.3/ 7.1.4/ 8.5.1/ 8.5.2/8.5.3/8.5.4/8.5.5/8.5.6/ 8.6/8.7
ES: 5.3/6.1.1/6.2.2 /6.1.2/ 6.1.3/6.1.4/8.1/8.2
|
Risk identification, departmental responsibilities, objectives; project planning, infrastructure, process environment, project realization process control, project quality Monitoring and measurement , environmental factors/hazard identification update status; site inspection ES operational control; emergency response status
|
|
2022.06.18
|
7:30-12:30
13:00-15:00
|
|
Site 2 Name and Address: Linyi Building Supervision Project
|
|
2022.06.17
|
11:00~12:30
13:00~17:00
|
Management activities related to system planning processes
|
Office
|
Q ： 5.3/6.2/6.1/6.3/7.1.2/7.1.6/7.2/7.3 /7.4/7.5/9.2/10.2
ES:5.3/6.2/6.1.2/6.1.4/7.1/7.2/7.3/7.4/7.5/8.2/9.2/10.2
E8.1
S:8.1.1/8.1.2/8.1.3/8.1.4
|
Human resources; system document control, supplier control, measures to address risks and opportunities. Environmental factors, hazard identification and control. Emergency response
|
D
|
|
17:00-19:00
|
Processes related to leadership
|
Leadership
|
Q:4.1/4.2/4.3/4.4/5.1/5.2/5.3/6.1.1/6.2.1//7.1.1//9.1.1/9.3/10.1
ES:4.1/4.2/4.3/4.4/5.1/5.2/5.3/5.4(S)/6.1.1/6.2/7.1/7.4/7.5.1/9.1.1/9.3/10.1/10.3
|
System planning; planning and implementation of policies and objectives; realization of management responsibilities; resource allocation; measures to address risks and opportunities. Implementation of management reviews; continuous improvement; qualification, incidents, complaints, supervision sampling, certificate mark usage, confidentiality confirmation, etc.
|
|
2022.06.18
|
7:30-12:30
13:00-15:00
|
Procurement activities
|
Technical Safety Department
|
Q8.4
|
|
|
Processes and related management activities related to customers
|
Business Development Department
|
Q:5.3/6.2.2/8.2/9.1.2
ES:5.3/6.2/6.1.2/8.1
|
Organization's roles, responsibilities and authorities, objectives and their achievement, determination of product and service requirements, control of externally provided processes, customer satisfaction. Environmental factors, hazard identification and control.
|
|
15:00-16:00
|
Communication with enterprise leadership , Last meeting
|
A (At Linyi Supervision Project Department) B (Remote) C (Remote) D (Rizhao Headquarters)
|
|
Reasons for multi-site sampling (to be filled in when there are multi-site audit activities) Reasons for multi-facility sampling (fill in when there are multi-facility audit activities):
Names, addresses, and scopes of the sampled facilities The name, address and scope of the facility taken as sample:
|
|
Explanation:
|
1 - Mandatory audit content during initial audit: accidents or exposures, complaints, verification of relevant qualifications; The following content must be audited during initial audit: quality accident, complaint, verification of related qualifications;
2 - Mandatory audit content during surveillance and recertification audits: use of organization certificates and marks, verification of previous non-conformities, accidents or exposures, complaints, verification of relevant qualifications, changes in system operation, etc.; The following content must be audited during surveillance and recertification audits: the usage of certificates and marks, verification of non-conformities issued last time, quality accident, complaint, verification of related qualifications, the changes of system during operation;
3 - For audit projects involving multiple sites, the audit plan should clearly state the reasons for multi-site sampling, as well as the addresses, scopes, and names of the sampled sites. For audit projects containing multi-locations, the reasons for multi-location sampling, the name, address and scope of the locations taken as samples shall be clarified in the audit plan.
|
The above case is just one situation encountered during the audit process. Other special situations will emerge continuously, which requires our audit team leaders to learn more, practice more, communicate more, and continuously accumulate various cases. This way, like experienced doctors, the more cases they encounter, the more naturally they can solve problems effectively. The approach of "waiting, relying, and asking" is unacceptable. We must humble ourselves, study carefully and thoroughly to resolve the "difficult and complicated issues" during the audit process.
We hope that more and more "experienced doctors" who can "cure diseases upon touch" and "perform miraculous recoveries" will appear in our audit team.
Guo Miao
Contributed by Jinan Subsidiary
![[Audit Procurement Feiyang] Writing and Discussion of the Audit Plan](/npublic/img/s.png "[Audit Procurement Feiyang] Writing and Discussion of the Audit Plan")
