Internal audit programme planner

How it works

An internal audit programme says which areas are audited, how often, by whom, and which clauses of the standard each audit reaches. This planner proposes the next due date for each area from its risk and its last result, places the audits in a twelve-month calendar, totals the load on each auditor, and lists what is overdue, what lacks independence, and which clauses the year does not cover.

1. Set the programme year and the frequency rules. Enter the first day of the programme year and how many months apart a high, medium and low risk area is audited. The defaults (6, 12 and 24 months) are editorial starting points: set the intervals your risk assessment supports.
2. Propose the next due date. The interval for an area is its frequency multiplied by a factor for its last result, rounded to whole months and never below one. Our own rule shortens it after a major finding (default factor 0.5) and leaves it unchanged after minor findings (default factor 1); both factors are editable. An area never audited is due at the start of the year.interval = max(1, round(months for the risk x factor for the last result)); next due = last audit + interval
3. Schedule and calendar. A planned date typed in replaces the proposed date. The calendar has one row per area and one column per month of the year, from the start date. An area audited every 6 months appears twice. An audit due before the year starts is carried to the first month and marked overdue.repeat audits fall at the first date + k x months for the risk (k = 1, 2, ...), while inside the year
4. Overdue and late audits. An audit with the status planned or postponed is overdue when its scheduled date is before today. A planned date later than the proposed due date is flagged as planned late.overdue days = today − scheduled date, when positive
5. Auditor load and independence. Each audit counts once in its auditor's month. A warning is raised when an auditor has more audits in a month than the limit you set. The independence check fails when you mark it no, or when the auditor's name is the same as the area owner's. ISO 19011:2018 asks that auditors are independent of the activity they audit, so objectivity is protected.
6. Coverage of the standard. List the clauses the programme must reach in the year. An audit covers the clauses entered on its row. A clause counts as covered when an audit that falls in the year lists it, matched exactly as typed. The rest are shown as not covered, so the programme can be rebalanced before the year starts rather than after it ends.

Sources

The methods and default figures rest on these public sources. The wording here is our own; read the source for its full text.

• ISO 19011:2018, Guidelines for auditing management systems, clause 5 Managing an audit programme (opens in a new tab), International Organization for Standardization, July 2018. Setting the programme's objectives and risks, and its schedule, resources and records; cited by name and clause only, with the method written in our own words.
• IATF 16949:2016, Automotive quality management system standard, clause 9.2.2 Internal audit programme, International Automotive Task Force, October 2016. The programme is based on risk, with a defined audit frequency and results of earlier audits; cited by name and clause only.
• ISO 9001:2015, Quality management systems, Requirements, clause 9.2 Internal audit, International Organization for Standardization, September 2015. Planning audits with regard to importance of the processes, changes and earlier results, with objective and impartial auditors; cited by clause only.