An ISO 14001 internal audit plan translates an audit assignment into practical arrangements for examining evidence. It explains what will be assessed, why, against which criteria and through what activities. The plan should be clear enough to coordinate access while flexible enough to follow important information.
The internal audit guide explains the wider method. The programme guide addresses planning across multiple audits. The following fictional example illustrates one assignment; its timing and content are not prescribed ISO requirements.
Establish the fictional assignment
A distribution depot has introduced a changed damaged-stock process after recurring uncertainty about handling leaking packages. Management wants to understand whether the new arrangement was implemented across relevant shifts and contractor interfaces.
The audit objective is to evaluate that implementation and the effectiveness of the handovers. It is not to certify the depot or determine compliance with every obligation affecting all stored products.
The scope includes receiving, temporary damaged-stock handling, associated communication and follow-up during a defined three-month period. The plan identifies the relevant location and shifts explicitly.
Identify criteria and references
The auditor will compare evidence with current approved arrangements and applicable EMS requirements relevant to the assignment. The plan identifies the actual references and versions used.
A fictional local instruction might require staff to isolate damaged packages and notify a designated supervisor. That internal requirement can be assessed without presenting the fictional instruction as universal law.
Where a technical or legal question arises, the auditor needs suitable criteria and competence. A plan should not fill the gap with an unsupported assumption about material handling or discharge requirements.
Select a suitable team
The team needs auditing skills and enough understanding of the activity to recognise relevant evidence and limitations. Technical support may be necessary for specialised questions.
Check impartiality and conflicts. The person who designed and owns the new process may provide evidence but may not be the best person to assess its effectiveness independently.
Define roles within the team. If one person interviews staff while another reviews records, agree how evidence and provisional conclusions will be shared.
Build an illustrative sequence
| Activity | Purpose in this example |
|---|---|
| Opening discussion | Confirm objective, scope, criteria and changes affecting access |
| Process walk-through | Understand the actual route and handling interfaces |
| Sampled record review | Trace recent damaged deliveries and responses |
| Shift and contractor enquiries | Examine whether information reached relevant people |
| Evidence review | Resolve inconsistencies and identify limitations |
| Closing discussion | Explain supported conclusions and response arrangements |
Allocate time according to complexity and access, not a universal half-day or one-day formula. The sequence may change if the evidence reveals a significant unanswered question.
Plan samples before accepting conclusions
Identify the range of records and conditions that could matter. Recent and earlier cases, different shifts or different product categories may reveal variation.
The auditor should retain control of sample selection appropriate to the objective. Examining only the process owner’s best example can give an incomplete picture.
Record what the sample can and cannot establish. If one shift cannot be reached, decide whether alternative evidence is sufficient or whether further work is necessary before concluding on the stated objective.
Coordinate practical arrangements
Confirm site access, safety requirements, confidentiality needs and the availability of relevant staff. Arrange interpreters or system access where needed.
Ask process owners to make genuine records retrievable rather than create a separate presentation answering every possible question. The assessor needs to follow the underlying evidence.
Identify a contact for scheduling changes. If a planned activity is cancelled or the process is temporarily unavailable, evaluate how the change affects the assessment rather than quietly reducing the scope.
Prepare questions linked to the trail
The working questions should follow the objective. How are damaged packages recognised? What information reaches the supervisor? How are contractors informed? How is completion or escalation recorded?
Follow answers into observation and records. An explanation that sounds reasonable may still conflict with a recent case or another shift’s practice.
Do not write the expected finding in advance. A plan sets the enquiry; it does not establish whether the system will conform or which cause explains any weakness.
Define reporting and escalation
Specify who receives the report and how significant concerns are communicated promptly. A potentially serious control issue should not wait unnecessarily for final report formatting.
Agree how factual misunderstandings are resolved and how supported nonconformities enter the organisation’s response process. Avoid promising a result before evidence is evaluated.
The report should later state what actually occurred, including departures from the plan. Planning an activity is not evidence that it was completed.
Review whether the plan was sufficient
After fieldwork, compare the evidence with the original objective. Identify unresolved questions and limitations before making the conclusion.
If the plan did not provide access to a material part of the scope, arrange further assessment or narrow the conclusion transparently. Do not preserve a broad assurance statement merely because the original schedule looked complete.
Retain the plan with relevant working information and the report. This makes it possible to understand how the assignment was intended to work, what changed and whether the result answered the management question.