Internal Auditor Toolkit: Audit Programme and Report

Clause checklists tell you what to look at during an audit. This toolkit covers the rest of the internal auditor's job: deciding what to audit and when, reporting what you found so that it leads to action, and showing that your auditors are competent and impartial. It follows ISO 19011:2018, Guidelines for auditing management systems, and works for ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 or an integrated system.

What is inside

Annual Audit Programme — guidance on a risk-based programme, plus five templates: programme objectives and scope, a priority rating guide, the annual programme, programme monitoring and an end-of-year programme review.

Audit Report Template — six report sections: audit details; summary and conclusion; nonconformities by requirement, evidence and grade; positive observations; opportunities for improvement; and follow-up. It ends with a 12-point check to run before you issue the report.

Auditor Competence Matrix — guidance on auditor competence, plus four templates: an auditor register, a 14-line competence matrix, an auditor evaluation record and an auditor independence check.

All three documents as a designed, print-ready PDF and as an editable Word file.

Who it is for

Audit programme owners, quality and HSE managers, lead and internal auditors, and consultants who run internal audit programmes for their clients.

How to use it

Start with the programme. List your processes, rate each one for importance, change and previous results, and let the rating decide how often and how deeply you audit it. Assign auditors only after the independence check, because nobody should audit their own work. After each audit, write the report in the template, run the 12-point check, and issue it while the closing meeting is still fresh. Update the monitoring sheet as audits are completed, and review the whole programme before management review so that its results go in as an input. Evaluate each auditor at a defined interval, record the result in the matrix and plan the training it points to.

Pair the toolkit with a clause checklist for the standard you are auditing, and check which edition of that standard applies to you.