9.6 Audit Working Papers & Audit Test Plans

9.6 Audit Working Papers & Audit Test Plans

Working papers are where an audit either becomes defensible or falls apart. PECB examines knowledge of the preparation and development of audit working papers and the best practices for the creation of audit test plans as separate Domain 4 knowledge statements. The distinction is simple: a test plan is what you intend to do; working papers are the record of what you actually did and what you found.

---

1. Audit Working Papers

What they are

Working papers are the documents the audit team prepares and retains to plan, execute, and evidence the audit. ISO 19011 refers to them as work documents. They comprise:

• Audit checklists and question sets
• Sampling worksheets and selection records
• Interview notes, with names, roles, dates and locations
• Evidence logs — document references, record numbers, serial numbers, photographs where permitted
• Process flow notes and observations made during walkthroughs
• Draft nonconformity statements and their supporting evidence
• Time and coverage records showing which processes were audited, by whom, for how long
• Notes of daily audit team meetings and decisions on scope or sampling changes

The five attributes every working paper must record

The reviewability test is the standard to aim at: a competent reviewer who was not present should be able to retrace the auditor's reasoning from the working papers alone, without re-performing the audit. A note reading "permits — OK" fails that test comprehensively. It identifies no permit, no date, no criterion, and no basis for the conclusion.

Why they matter

• They support the findings. A nonconformity challenged at the closing meeting is defended from the working papers, not from memory.
• They evidence coverage. They demonstrate that the audit plan was executed and that the scope was actually covered — the auditor's protection against an allegation of a superficial audit.
• They enable review. The certification body's technical reviewer relies on them when making the certification decision.
• They support the next audit. Surveillance planning draws on prior coverage, sampling history, and unresolved concerns.
• They are the record if things go wrong. Where an incident follows certification, the working papers are the evidence of what was examined and what a competent audit could reasonably have detected.

Ownership, retention and confidentiality

Working papers are the property of the auditing organization, not the auditee. They are retained under the certification body's retention schedule and remain subject to the confidentiality principle in ISO 19011 and to the confidentiality terms of the engagement.

Practical rules with particular force in OH&S auditing:

• Never leave working papers with the auditee, and never allow the auditee to amend them.
• Protect personal and health data. Worker medical surveillance results, exposure records, and individual injury details are sensitive personal data in most jurisdictions. Record only what is necessary to support the finding; prefer anonymised references such as "employee A" over names where identity is not essential to the finding.
• Respect site rules on photography. Many high-hazard sites prohibit cameras. Agree the position at initial contact rather than on the shop floor.
• Control drafts. Draft nonconformities circulated informally and then changed create the appearance of negotiation over findings.

---

2. Audit Test Plans

What a test plan does

An audit test plan converts an abstract audit criterion into a concrete, executable, repeatable procedure. Where the audit plan says "Wednesday 09:00–12:00, Maintenance, Clause 8.1", the test plan says exactly what will be examined, how much of it, selected how, and what result will count as a deviation.

The six components

Best practices

• Build it from risk, not from convenience. Sample sizes follow the audit risk model: high inherent and control risk means low allowable detection risk, which means a larger sample. Uniform sample sizes across all processes signal that no risk assessment was done.
• Define the population before sampling. An auditor who samples "the permits in the folder" has sampled a folder, not a population. Establish the total, then select from it — this is why auditors reconcile permits against work orders or maintenance logs.
• The auditor selects the sample, never the auditee. Allowing the auditee to choose which records to present is the most common way sampling risk becomes a certainty rather than a probability.
• Stratify deliberately. Cover night shifts, weekend work, contractors, temporary staff, and remote sites — the strata where controls most often thin out.
• Plan for both directions. Test forwards from the requirement to the evidence (does a permit exist for this activity?) and backwards from the activity to the requirement (this work order shows a confined-space entry; where is its permit?). Backward testing detects omissions that forward testing cannot.
• Set the extension rule in advance. Deciding on the spot how many deviations justify enlarging the sample invites unconscious bias toward not finding more.
• Keep it proportionate. A test plan is a working tool, not a submission. Excessive formality consumes audit hours that belong on the shop floor.

A note on checklists

Checklists are one form of working paper, and their trade-off is examinable: they promote consistency, coverage and evidence of thoroughness, but a rigid checklist discourages pursuit of audit trails and can reduce the audit to box-ticking. The resolution is that a checklist sets the floor of coverage, never the ceiling — the auditor must always be free to follow evidence wherever it leads. Chapter 9.3 develops checklist construction in detail; here the point is that a checklist without a test plan states what to ask, but not what constitutes an adequate answer.

---

3. Worked Example: Test Plan to Working Paper

Test plan extract — Clause 7.2 Competence, contractor welders

• Population: 34 welders engaged via three subcontractors during the audit period.
• Sample: 12 — 4 from each subcontractor, selected by the auditor from the site access log rather than from files supplied by the contractors.
• Evidence: documentary (competence certificates, site induction records), confirmative (verification of two certificates with the awarding body), verbal (interviews with 3 welders), physical (observation of hot-work practice).
• Acceptance rule: any welder working without a valid, in-date qualification for the process performed is a deviation. Two or more deviations extend the sample to all 34.

Resulting working paper extract

WP 7.2-03 | Auditor: J. Okoro | 15 May 2026 | Criterion: ISO 45001:2018 cl. 7.2; site procedure SP-09 rev 4 Population 34 (site access log 01 Jun 2025 – 30 Apr 2026). Sample 12 selected by auditor from access log; contractor-supplied file lists not used. Findings: 10 of 12 held valid certificates. Welder ref. C-118 (Subcontractor B) — certificate expired 12 Jan 2026, observed performing hot work in Bay 4 at 10:40. Welder ref. C-124 (Subcontractor B) — no certificate located; site induction record present. 2 deviations → acceptance rule triggered; sample extended to all 11 Subcontractor B welders. Further 3 deviations identified (refs C-119, C-127, C-131). Confirmative check: awarding body confirmed C-118 certificate lapsed and not renewed (email 15 May 2026, ref AB/2291). Conclusion: Subcontractor B competence verification process not implemented. Draft NC-07 raised against cl. 8.1.4 and cl. 7.2 — systemic, affects 5 of 11 welders. Escalated to team leader for grading.

Notice what the working paper achieves: it names the criterion, defines the population, records how the sample was selected and by whom, states the specific evidence, applies the pre-set extension rule, corroborates through an independent source, and links to the draft finding. A reviewer can follow every step. That is the standard.