QULDEXResources · Template
Audit plan template: what to include and how to fill it in
What is an audit plan?
An audit plan describes one audit. It tells the auditee what will be looked at, when, by whom and against what, and it tells the audit team how the work is divided. It is agreed before fieldwork starts.
It is not the same as an audit programme, which is the schedule of all the audits planned over a period, usually a year.
All audits planned for the year, why each was chosen, and the resources needed.
Objectives, scope, criteria, team, schedule and methods for a single audit. This template.
The steps and samples for testing one control. See the control test script template.
Audit plan template
Fourteen fields. The middle column is an example you replace with your own.
| Field | Example | What to write |
|---|---|---|
| Audit title and reference | Internal audit of access management, IA-2026-07 | A unique reference, used on every working paper |
| Audit objectives | Confirm that access controls operate as designed and meet ISO 27001 | What the audit must conclude |
| Scope | Head office and cloud production; HR, IT operations; 1 Apr to 30 Sep 2026 | Locations, teams, processes and the period covered |
| Audit criteria | ISO/IEC 27001:2022 clauses 5 to 10; Annex A 5.15 to 5.18; access control policy v3 | What you audit against |
| Audit team and roles | Lead auditor, one auditor, one technical expert | Each auditor independent of the work audited |
| Auditee contacts | Head of IT operations; HR business partner | Who the team will meet |
| Dates, times and locations | Opening meeting 12 Oct, fieldwork 12 to 14 Oct, closing meeting 15 Oct | Include remote sessions |
| Methods | Interviews, observation, document review, sampling of records | How evidence will be gathered |
| Sampling | 25 joiners, 25 leavers, one quarterly access review | Sample basis and size |
| Evidence requested in advance | User lists, leaver report, last access review | With a due date |
| Logistics and resources | System read access, meeting room, video link | What the team needs |
| Confidentiality | Evidence viewed in the audit workspace; no local copies | How information is handled |
| Reporting | Draft report 22 Oct; final report 29 Oct to the audit sponsor | Format, date and recipients |
| Follow-up | Corrective actions agreed at closing; verified at the next audit | How findings are tracked |
The example values are illustrative. Copying pastes the table as rows and columns into a spreadsheet or document.
How do you fill in an audit plan?
- Start from the programme
Take the objective and scope the audit programme gave this audit. Do not widen them without the sponsor's agreement.
- Fix the criteria
List the exact standard, edition, clauses and internal documents. Findings can only be raised against criteria named here.
- Choose the team
Check that each auditor is competent for the subject and independent of the work being audited.
- Agree dates with the auditee
Send the draft plan early enough for people and evidence to be available, and confirm the opening and closing meetings.
- Decide methods and samples
Say how evidence will be gathered and how samples will be chosen, so the result can be defended.
- Issue it, then keep it current
Record who approved the plan. If it changes during the audit, note what changed and who agreed.
What makes an audit plan weak?
Criteria left vague
"Audit against ISO 27001" does not say which edition, clauses or internal policies apply.
Instead: name the edition, the clauses and each internal document.
No sampling basis
Samples picked on the day cannot be explained afterwards.
Instead: write the population, the sample size and how items are chosen.
Sent the day before
The auditee cannot prepare evidence or free the right people.
Instead: agree the plan well ahead of fieldwork.
Do you need a template at all?
In QULDEX the plan is part of the audit record: scope, criteria, team, schedule and evidence requests sit in one workspace, and the plan stays linked to the findings and the report.
Audit plan: common questions
What should an audit plan include?
Objectives, scope, criteria, the audit team and their roles, dates and locations, methods and sampling, the evidence requested in advance, logistics, confidentiality, reporting and follow-up.
What is the difference between an audit plan and an audit programme?
An audit programme schedules all the audits for a period. An audit plan describes how one of those audits will be carried out.
Who approves the audit plan?
The lead auditor prepares it and agrees it with the audit sponsor and the auditee before fieldwork begins.
Is this template free?
Yes. It is on this page, with no form to fill in. Copy it and adapt it to your organisation.
Plan the audit where you run it
Scope, criteria, team, evidence requests and findings in one workspace.