This guide gives you a working ISO 9001:2015 internal audit plan sample, a copy-ready template, and advice for adapting it to your organization. It also separates three documents that get mixed up constantly: the annual audit program, the individual audit plan, and the audit checklist.
Key Takeaways
- An individual audit plan sets objectives, scope, criteria, people, activities, timing, and records for one audit.
- Clause 9.2 requires planned, documented auditing but prescribes no form or fixed frequency.
- Risk-based planning weighs process importance, organizational changes, and previous findings.
- Update the plan after the audit with findings, corrective actions, approvals, and completion evidence.
What ISO 9001:2015 Requires from an Internal Audit Plan
Clause 9.2 asks you to audit at planned intervals to determine whether the QMS conforms to your own requirements and to ISO 9001, and whether it is effectively implemented and maintained. Per the ISO 9001 standard page, you must also report results, act on them without undue delay, and retain documented information as evidence.
Program, Plan, and Checklist
These three get confused. Each has a different job.
| Document | Purpose |
|---|---|
| Audit program | Schedule of planned audits across a defined period |
| Individual audit plan | Detailed arrangements for one audit event |
| Audit checklist | Prompts used to gather evidence during the audit |
The ISO Auditing Practices Group treats a checklist as an optional working aid and cautions that it doesn't replace audit planning.
What the Standard Does Not Mandate
ISO 9001 doesn't dictate a template, a number of audits, or a scheduling method. It does expect:
- Documented planning
- Coverage of the whole QMS over your audit cycle
- Competent, impartial auditors
- Reporting to relevant management
- Correction and corrective action
- Retained records
Letting Risk Shape Each Audit
When you build the program, consider process importance, changes affecting the organization, and previous audit results. In practice, a process that failed last year gets an earlier date, a more experienced auditor, and deeper sampling than a stable one. A recent move to a new ERP system or a new supplier justifies the same attention.
ISO 9001 Internal Audit Plan: Required Fields
ISO 19011:2018 offers guidance on audit plan content. It isn't a prescribed ISO 9001 form, but it makes a sound basis for the fields below.
Audit Objectives and Intended Outcomes
An objective states what the audit will determine. Typical objectives include:
- Conformity with selected ISO 9001 clauses
- Implementation of a documented procedure
- Effectiveness of a process against its targets
- Closure of a previous audit finding
Vague wording such as "audit the QMS" gives the auditor nothing to conclude. A clear objective looks like this:
Verify that the order-fulfillment process follows its documented procedure, meets its on-time delivery target, and that corrective actions from the last audit were implemented.
Audit Scope and Boundaries
Define the following:
- Processes and activities covered
- Departments or functional units
- Physical or virtual locations
- Products or services
- Time period of records to be examined
Precise boundaries keep the audit from outgrowing its time slot. They also tell auditees exactly which records and people to have ready.
Audit Criteria and Methods
Criteria may include:
- Applicable ISO 9001:2015 clauses
- Your QMS procedures and work instructions
- Customer or contractual requirements
- Legal or regulatory requirements, where relevant
Methods include document review, interviews, observation, process tracing, and record sampling. Name them in the plan, but don't turn the plan into a rigid script. Sample enough work to support confident conclusions.
Auditor, Auditee, and Resource Assignments
Record these assignments and needs:
- Lead auditor and supporting auditors
- Process owners and auditee contacts
- Guides or observers
- Access needs, documents, and systems required
Objectivity matters here. An auditor shouldn't audit their own work or an area they directly manage.
Schedule, Meetings, Reporting, and Approval
Capture these schedule fields:
- Audit date, start time, and finish time
- Opening meeting
- Document review and process activities
- Auditor deliberation
- Closing meeting
- Report issue date
- Plan approval
Also record who receives results, how corrective actions are assigned, and where the plan and related records are kept.
How to Create and Use an Internal Audit Plan
Review the Program and Select the Focus
Start from your audit program. Pick the process or QMS area due for review, so the plan connects to the broader cycle. Prioritize areas touched by:
- Major changes
- Recurring issues
- Customer complaints
- Past nonconformities
- Weak performance results
- Higher risk to product and service conformity
Define the Inputs Before Writing the Agenda
Gather these inputs before you plan:
- Current QMS documents and process measures
- Previous audit reports and corrective-action records
- Complaints and relevant risks
- Changes in personnel, suppliers, technology, locations, or operations
These inputs let you set meaningful objectives and request relevant evidence instead of recycling a generic plan.
Assign a Competent and Impartial Auditor
Confirm the auditor understands ISO 9001, auditing methods, your processes, and the scope in question. Smaller organizations can still stay impartial:
- Assign auditors across functions
- Rotate audit responsibilities
- Bring in qualified external support
- Separate process ownership from audit duty where feasible
Build a Realistic Audit Sequence
Follow the process flow in order:
- Opening meeting
- Document review
- Interviews
- Observation
- Record sampling
- Follow-up of previous findings
- Auditor review time
- Closing meeting
Allocate time by complexity and evidence needs. Don't cram five processes into one afternoon. Leave room for walking between areas, getting system access, and retrieving records. These always take longer than expected.
Conduct, Report, and Follow Up
The auditor gathers objective evidence and records conformities and nonconformities accurately. Improvement opportunities stay separate from actual requirements, and personal preferences aren't findings.
After the audit:
- Distribute the report to relevant management
- Assign correction and corrective-action owners with due dates
- Verify effectiveness
- Revise the audit program if findings or changes warrant a new focus
ISO 9001 Internal Audit Plan Sample and Template
Copy-Ready Individual Audit Plan Template
Paste this into a document or spreadsheet.
Audit Plan Header
| Field | Entry |
|---|---|
| Organization | |
| Audit reference / program reference | |
| Audit date | |
| Audit status (planned / in progress / complete / rescheduled) | |
| Audit objectives | |
| Scope (process, unit, location, period) | |
| Criteria and references | |
| Methods and sampling approach | |
| Audit team and roles | |
| Auditee contacts | |
| Required resources and access | |
| Confidentiality notes | |
| Report recipients | |
| Approved by / date | |
| Records location |
Map the day next so each block has an owner and a clear evidence target.
Audit Schedule
| Time | Activity | Responsible | Expected evidence |
|---|---|---|---|
| Opening meeting | |||
| Document review | |||
| Interviews / observation | |||
| Record sampling | |||
| Follow-up of previous findings | |||
| Auditor deliberation | |||
| Closing meeting |
Worked Sample of a Completed Audit Plan
This fictional example audits one process, purchasing, in an industry-neutral company.
| Field | Entry |
|---|---|
| Audit reference | IA-2025-04 (Program item 4) |
| Date | March 18, 2025 |
| Objectives | Determine whether purchasing follows procedure QP-07, evaluates suppliers as required, and has closed the late-delivery finding from IA-2024-06 |
| Scope | Purchasing department, main facility, supplier approvals and purchase orders from Jan 1 to Feb 28, 2025 |
| Criteria | ISO 9001:2015 clause 8.4; QP-07 Purchasing; Approved Supplier List; customer flow-down requirements |
| Methods | Document review, interviews, record sampling (10 purchase orders, 5 supplier files) |
| Audit team | Lead auditor: J. Rivera (Logistics); observer: T. Chen (trainee) |
| Auditee contacts | Purchasing manager; buyer; receiving supervisor |
| Preparation documents | QP-07, last audit report, supplier performance data, open corrective actions |
| Report issue date | March 25, 2025 |
Here is how that plan can run hour by hour.
Schedule
| Time | Activity | Evidence examined |
|---|---|---|
| 9:00 | Opening meeting | Attendance, scope confirmation |
| 9:20 | Document review | QP-07, Approved Supplier List |
| 10:15 | Interview buyer and manager | Evaluation criteria, approval practice |
| 11:15 | Sample purchase orders | Specs on POs, supplier approval status |
| 1:00 | Follow-up on IA-2024-06 | Corrective-action record, delivery data |
| 2:15 | Auditor deliberation | Notes, evidence summary |
| 2:45 | Closing meeting | Draft findings |
Illustrative results
- One nonconformity: two of five supplier files lacked a re-evaluation record required by QP-07.
- Prior finding verified as closed; on-time delivery improved.
- Follow-up: corrective action due April 30; effectiveness check at the next purchasing audit.
Each part of the plan connects. The objective maps to a procedure requirement, the scope names specific records, and each activity points to the evidence the auditor will examine.
Annual Audit Program Companion Template
Keep a high-level schedule alongside your individual plans:
| Audit area | ISO 9001 clauses | Planned date | Auditor | Status | Actual completion | Findings / CAR links |
|---|---|---|---|---|---|---|
Don't merge the program and the individual plan into one confusing document. They can live in the same spreadsheet or QMS system, but they serve different purposes.
Adapting the Template
- Small organizations: Combine the header and schedule on one page, and use external or cross-functional auditors.
- Multiple sites: Identify location and process boundaries for each audit. One plan doesn't automatically cover every site.
- Remote or hybrid work: Note ICT arrangements and how evidence will be shared. The APG remote audit guidance points to feasibility, access, and competence.
- Outsourced processes: Keep them within your QMS scope decisions. Don't relabel supplier audits as internal audits.
- Integrated systems: Add criteria columns for other standards.
- Several process-focused events: Issue one plan per event, all tied to the program.
Using the Template After the Audit
After the audit, update the plan with:
- Actual dates and attendance
- Completed activities and findings
- Report approval and corrective-action references
- Follow-up evidence
The completed plan, report, checklist or notes, and corrective-action records together show the program was implemented and results were retained.
Common Mistakes, Recordkeeping, and Next Steps
Planning Failures to Avoid
- Vague objectives
- Scope too broad for the time available
- No confirmation of auditee availability
- Unrealistic timing
- Ignored previous results
- Auditors reviewing their own work
- Checklist treated as the entire plan
Also watch the finding language. Where evidence confirms a requirement wasn't fulfilled, the APG nonconformity guidance says to document a nonconformity, not soften it into an improvement opportunity.
Rescheduling Without Losing the Trail
If circumstances change, reschedule and document it. Don't silently drop the audit. Capture:
- Revised date
- Reason for the change
- Who approved it
- Any risk-based adjustment, such as moving a high-risk process earlier
Records and Next Steps
Retain evidence of program implementation and audit results, on paper or electronically. Organizations that need help turning complex processes into practical QMS documentation or training systems can use Synergistic Systems' modular ISO documentation and training support.
ISO now lists ISO 9001:2026 as the current edition, with a three-year transition period. Check your registrar's timeline when you update your audit program.
Frequently Asked Questions
What does an ISO audit entail?
An internal audit evaluates conformity, implementation, and effectiveness through document review, interviews, observation, and records. It ends with a report and corrective-action follow-up.
How do I create an audit plan?
Define objectives, scope, criteria, people, methods, resources, schedule, reporting, and follow-up. Base each choice on process risk and previous results.
What is the difference between an ISO 9001 audit plan, audit program, and audit checklist?
The audit program is the overall schedule of audits. The audit plan covers a single audit. The checklist holds the evidence-gathering prompts used during that audit.
Does ISO 9001:2015 require a specific internal audit plan format or number of audits?
No. It requires planned, risk-informed, documented auditing of the QMS and retained evidence of results, but no fixed format or audit count.
How can a small organization maintain auditor independence?
Use cross-functional assignments, rotate responsibilities, or bring in qualified external support. In every case, avoid having auditors audit work they're directly responsible for.
What records should be retained after an ISO 9001 internal audit?
Retain the audit program, individual plan, completion evidence, notes or checklist, and report. Also keep findings, corrective-action records, approvals, and effectiveness follow-up.
