What is in the plan
- Objective — what this audit is meant to see.
- Scope — which unit, which process, which period.
- Criteria — which clauses, which internal procedures, which legislation.
- Schedule — dates, times, people to be interviewed, the site walk.
- Team — lead auditor, auditors, technical expert if any.
Why it is communicated in advance
An audit is not a raid. Advance notice does two things: the right people are available, and records can be reached in time. Arriving unannounced measures not the state of the system but the accident of that particular day.
Time spent on the floor
In a good plan a substantial part of the time is on site. An audit conducted in a meeting room shows whether the records agree with each other; it does not show whether the site agrees with the records. The second is where most findings come from.
The sampling plan
How many records will be drawn, and from where, is decided in advance. “A few files at random” leaves the representativeness of any finding open to argument. The sampling method goes into the report.
Departing from the plan
If an unexpected trail appears during the audit, following it is right — but the departure is recorded: what was planned, what was done, why. That way a reader of the report can see where the scope widened.