Practical guide · Educational reading
Use process risks, operational changes and previous findings to justify internal-audit priorities, allocate resources and prepare a focused audit plan.
Audience / jurisdiction: International; quality-management practitioners and internal-audit coordinators. No jurisdiction-specific legal obligation is asserted.
Start with the reasons for auditing
An internal audit programme is more useful when its priorities reflect what could go wrong, what has changed and where previous controls have struggled. The ISO 9001 Auditing Practices Group’s Internal Audits paper identifies process risk, past problems, changes, customer dissatisfaction and regulatory noncompliance as relevant planning considerations. These provide a stronger starting point than simply giving every department the same allocation of audit time.
This guide offers a practical way to turn those considerations into planning decisions. It is aimed at quality-management teams and internal-audit coordinators. The workflow and examples below are suggestions, not additional ISO requirements or a statement that every organisation needs the same audit schedule.
Sources: [1]
Build a process-priority picture
Begin with a short list of processes and the signals that might justify closer attention. For each process, gather available information on complaints, operational changes, recurring problems and previous audit findings. Look for consequences as well as counts: one failure affecting a significant obligation may deserve more attention than several minor administrative errors.
For example, a purchasing process might warrant additional coverage after a supplier change coincides with repeated delivery problems. An order-handling process might become a priority when customer complaints continue despite a completed corrective action. These are illustrative planning judgments, not automatic rules.
Record the reason for each priority in plain language. A note such as “review supplier approval and incoming checks following repeated delivery failures” is more useful for planning than an unexplained high-risk label.
Sources: [1]
Turn priorities into coverage and resources
The APG paper connects risk-based planning with decisions about audit frequency, duration and scope. Apply that thinking by asking what coverage each priority needs, rather than assuming that every process deserves an identical audit slot.
An optional worksheet could contain seven fields: process, risk or change signal, previous findings, priority rationale, planned coverage, timing and auditor. Keep the rationale visible when assigning time and people. Where capacity is limited, this makes the proposed trade-offs easier to discuss with management.
For practical purposes, separate the programme-level decisions about priorities and resources from the detailed arrangements for a particular audit. As an editorial working method, use the programme to explain where attention will go and the individual plan to explain how that attention will be used.
Sources: [1]
Make the individual audit workable
The APG guidance also highlights auditor competence and sampling risks. Before confirming an assignment, consider whether the auditor can understand the process, recognise relevant evidence and investigate the identified concern. Allocating time alone will not resolve a competence gap.
For an individual audit, a useful suggested plan records the objective, scope, criteria, people to involve and likely evidence sources. In the purchasing example, the objective could be to evaluate whether controls are addressing the identified delivery problems. Possible evidence routes might include supplier approval records, receiving checks, complaint records and discussions with the people handling exceptions.
Choose samples deliberately and record their limits. Reviewing only convenient records may leave the concern that triggered the audit unexplored. Consider including examples connected to the risk signal, while avoiding claims that a small sample proves the condition of every transaction.
Sources: [1]
Keep the rationale current
As a suggested review discipline, revisit the priority worksheet when significant changes or new findings emerge. Ask whether the original concern remains, whether planned coverage is still appropriate and whether the next audit needs different expertise. This keeps the planning rationale open to challenge rather than treating the schedule as an end in itself.
For broader auditing guidance, ISO’s catalogue identifies ISO 19011:2026 as the published fourth edition, dated 27 May 2026. It provides management-system auditing guidance and does not itself lead to certification. That publication date is background, not a legal effective date or an audit-transition deadline.
Sources
- ISO 9001 Auditing Practices Group: Internal Audits
- ISO 19011:2026 — Guidelines for auditing management systems
Your experience
Which process in your audit programme needs a clearer explanation of why it receives its current level of coverage?
Originally published by AdviseISO, a knowledge-sharing initiative of W3 Solutionz.
