4.1 Elements of the Audit Planning Process

4.1 Elements of the Audit Planning Process (CQA BoK II.A.1 — Evaluate)

Quick Answer: Audit planning translates authority, purpose, and scope into an executable design: audit type, format (on-site, remote, or hybrid), criteria, process coverage (often via process maps), resources, and planning documentation. Domain II (Audit Process) is about 30% of scored CQA items. At the Evaluate level, you must judge whether a proposed plan can achieve objectives—not only name the elements.

Planning is where good audits are won or lost. Fieldwork cannot fix a plan that lacks authority, misstates purpose, chooses a remote format when observation is essential, or under-resources high-risk processes. The 2026 CQA Body of Knowledge expects auditors to evaluate plan adequacy before the opening meeting.

---

Why Planning Is an Evaluate Skill

Scenario — evaluate a weak plan.
Purpose: verify effectiveness of sterile gowning and cleanroom material flow. Plan: fully remote video interviews, two auditor-days, no process map, criteria = generic ISO 9001 checklist only. Evaluation: inadequate. Format cannot produce observation-quality evidence for gowning technique; criteria miss cleanroom SOPs and validation documents; resources are thin for a high-risk process. Correct action: revise format (on-site or hybrid with live observation), load process-specific criteria, and allocate more time or specialists.

---

Core Planning Elements

1. Authority

Authority answers: Who commissioned this audit, and what rights does the team have?

Sources of authority include:

• Internal audit program charter and annual schedule approved by management / audit committee.
• Customer purchase order or quality agreement with right-to-audit clauses (second-party).
• Certification body contract and accreditation rules (third-party).
• Regulatory mandate or for-cause directive.

Without clear authority, auditees can lawfully limit access, and conclusions may be challenged. Planning documents should record the authorizing body, engagement letter or assignment, and any access rights (facilities, records, personnel, subcontractors).

2. Purpose (objectives)

Purpose states why the audit is performed—the decision the client needs. Examples: full system conformity, surveillance slice, CAPA verification, supplier qualification, for-cause investigation, risk-based process deep dive. Purpose is fixed early and drives every other element. Changing purpose midstream requires re-approval (see Chapter 2).

3. Scope

Scope defines extent and boundaries: sites, units, processes, products, shifts, records period, and exclusions. Planning turns the scope statement into a work package—which process steps will be sampled, which shifts, which buildings. Scope that is vague (“the plant”) is not yet planned; scope that is precise still needs a schedule and sampling design.

4. Audit type

Type (product, process, system, hybrid) and party relationship (first-, second-, third-party) shape methods and criteria emphasis:

Do not confuse type (what is audited) with format (how evidence is collected). A system audit can be on-site, remote, or hybrid.

5. Format: on-site, remote, hybrid

The 2026 exam environment expects comfort with modern delivery modes.

Evaluate rule: Choose the format that can generate sufficient, appropriate evidence for the purpose. If purpose requires witnessing sterilization load configuration, remote-only is not defensible. If purpose is document-control sampling across three time zones, remote may be optimal.

6. Criteria

Planning identifies the criteria stack: standards, regulations, contracts/quality agreements, specifications, policies, and internal QMS documents. Version control matters—plan against the effective revision. Checklists and working papers should trace to criteria citations, not auditor memory.

7. Process map and risk prioritization

A process map (or SIPOC, turtle diagram, value-stream sketch) makes the scope operational. It shows:

• Sequence of process steps and handoffs.
• Inputs, outputs, and customer of the process.
• Supporting processes (training, calibration, maintenance, IT).
• Control points and records.

Risk-based planning then weights time toward high-significance, high-uncertainty areas: new products, weak history, safety-critical steps, data-integrity-dependent release, prior majors, recent major changes.

8. Resources

Resources include:

• Auditor-days and calendar window.
• Team composition (lead, members, technical specialists, interpreters).
• Tools (secure file share, video platform, sampling software, measuring equipment if product audit).
• Support (escorts, workspace, network access—detailed in 4.4).

Under-resourcing is a planning defect. Evaluate whether days allocated match process complexity and travel/remote overhead.

9. Documentation of the plan

Typical planning outputs:

• Engagement letter / assignment confirmation.
• Audit plan (objectives, scope, criteria, dates, team, itinerary, methods).
• Checklists / working paper structure (detail in Chapter 5).
• Logistics checklist (safety, PPE, NDA, access—Section 4.4).
• Pre-audit document request list (Section 4.3).

The plan is communicated to the auditee in time for preparation, then confirmed at the opening meeting.

---

Putting the Elements Together (Planning Workflow)

A practical sequence used across first-, second-, and third-party work:

1. Confirm authority and client expectations.
2. Lock purpose, scope, and criteria (including quality agreements when second-party).
3. Select type and format that can produce needed evidence.
4. Map processes and prioritize risk.
5. Select team (Section 4.2) matching competence and independence.
6. Request and review pre-audit documentation (Section 4.3); adjust plan if gaps appear.
7. Arrange logistics (Section 4.4).
8. Finalize schedule, sampling approach, and working papers (Chapter 5).
9. Distribute the audit plan and resolve auditee questions.

Scenario — multi-site supplier qualification.
Authority: quality agreement §12 right-to-audit. Purpose: qualify Contract Manufacturer A for sterile fill. Scope: Site 1 fill/finish and Site 2 QC lab; design excluded. Type: hybrid process/system with product sampling of retain labels. Format: hybrid—document review remote week 1; on-site observation of aseptic practices week 2. Criteria: quality agreement, customer specs, ISO 13485 (as adopted), site QMS. Process map: incoming materials → compounding → fill → inspection → release. Resources: lead auditor (device QMS), microbiologist SME, 6 auditor-days on-site + 2 remote. Documentation: plan, NDA, PPE list, document request. Evaluation: coherent—format matches need for observation; SME covers competence gap; authority and criteria clear.

---

Common Planning Failures (Exam Traps)

Mid-plan changes

If pre-audit review shows a major process was sold, a system is offline, or a quality agreement expired, re-evaluate purpose, scope, format, and resources before fieldwork. Silent improvisation is not professional planning.

---

Key Exam Anchors

• Planning elements: authority, purpose, scope, type, format, criteria, process map/coverage, resources, documentation.
• Evaluate = judge plan fitness for objectives under constraints.
• Format (on-site/remote/hybrid) must support evidence quality required by purpose.
• Process maps and risk prioritization convert scope into an efficient itinerary.
• Planning is incomplete until the team, documents, and logistics make the design executable.