Audit PlanSystematic Planning of Supplier and Process Audits in Procurement
Procurement glossary · Updated · 7 min read
Also known as: Audit planning, Audit schedule, Prüfplan, Auditprogramm, Supplier Audit Plan
Short answer
- An audit plan is the structured planning of all audits within a period, with dates, responsibilities and audit criteria.
- It prioritises audits on a risk basis, typically by procurement volume, criticality and past supplier performance.
- Results feed into supplier evaluation and provide evidence towards customers, certification bodies and authorities.
The audit plan is a structured document or planning overview that defines which audits are to be carried out in a defined period at which suppliers, internal departments or processes. It forms the basis for systematic quality and compliance checks in the supply chain and ensures that audit activities are carried out according to risk-based priorities rather than on an ad-hoc basis. For buyers and supply chain managers, the audit plan is a central control instrument for demonstrably monitoring supplier performance, process maturity and regulatory requirements.
Key facts
- An audit plan bindingly defines the scope, date, responsibilities and audit criteria of audits.
- Risk-based prioritisation is common practice: suppliers with high procurement volumes or critical components are audited more frequently.
- The audit plan is usually linked to the quality management system, for example under ISO 9001 or IATF 16949.
- Audit results typically feed into the supplier audit score and influence supplier evaluation.
- Multi-stage audit cycles spanning one to three years are common in industry.
- A well-maintained audit plan supports evidence obligations towards customers, certification bodies and authorities.
Contents
Definition: audit plan
An audit plan describes audit activities planned in terms of timing and content within a company or along the supply chain. It defines who is audited where and when, to which standard and with which objective. The term is used both for the overall plan of an audit year and for the detailed schedule of an individual audit.
Distinction: audit programme and audit plan
The audit programme encompasses the overarching strategy of all audit activities of a company, for example across several years. The audit plan, by contrast, is the concrete implementation for a defined period, usually a calendar year, and names individual audit dates with responsibilities. In practice, both levels are often merged into one document, particularly in small and medium-sized enterprises.
Legal and normative anchoring
Audit planning frequently arises from quality management system requirements, such as ISO 9001, IATF 16949 or ISO 14001. These standards require that internal audits and supplier audits are carried out and documented in a planned manner. The specific legal or contractual obligation may vary depending on the industry and customer requirements and should be reviewed on a case-by-case basis.
Structure and components of an audit plan
A practically usable audit plan contains, in addition to the dates, the essential parameters of each audit. It should be structured so that participants can see without further queries what is being audited and who is responsible.
Typical content elements
A complete audit plan typically shows the following details: audit object (supplier, site, process), audit type, planned date, audit team and lead auditor, audit criterion or normative reference, affected areas, as well as reporting and follow-up dates. In addition, effort estimates and approval requirements are listed.
- Audit object and site
- Audit type (system, process or product audit)
- Date and duration
- Audit team and responsible persons
- Audit criteria and normative references
- Reporting routes and follow-up dates
Audit types in the supplier environment
Three audit types dominate in procurement: system audits examine the supplier's quality management system, process audits assess specific manufacturing processes, and product audits validate compliance with component specifications. Depending on procurement criticality, these types are combined. For new suppliers, a pre-audit often takes place before order release for initial batch deliveries.
Methods and approach to audit planning
Creating an audit plan usually follows a repeatable annual cycle: risk assessment, prioritisation, scheduling, execution and action tracking. This cycle ensures that audit resources are deployed where the risk of supply failures or quality problems is greatest.
Risk-based prioritisation
Suppliers are frequently classified into risk classes according to criteria such as procurement volume, uniqueness of components, past supplier performance and certification status. A-suppliers or critical single-source suppliers are typically audited annually or biennially, C-suppliers less frequently or only on an event-driven basis. The classification should be updated regularly, for example after each supplier evaluation.
Event-driven audits complement the plan
In addition to planned dates, a good audit plan format provides for event-driven audits: following serious complaints, in the event of significant process changes at the supplier, on site transfers or before the ramp-up phase of a new project. Such special audits are usually anchored in the plan as reserve capacity in order to secure resources and budget at an early stage.
Coordination with specialist departments
Audit planning is a cross-functional task: quality, procurement, development and logistics should jointly coordinate dates and priorities. This reduces duplicate audits and increases acceptance at the supplier. A joint planning round at the start of the year followed by quarterly reviews has proven its worth in practice.
Key KPIs for controlling the audit plan
Without metrics, an audit plan remains a formal document. Typically measured are plan adherence, the quality of audit results and the effectiveness of derived actions.
Plan adherence rate
The audit plan adherence rate sets audits carried out in relation to audits planned. In practice, values above 90 per cent are considered solid; values significantly below this indicate a lack of resources or insufficient prioritisation. Deviations should be justified and caught up in subsequent planning.
Action closure rate and recurring findings
Two further metrics, such as the average time to close corrective actions and the rate of recurring findings, show whether audits are actually having an effect. High repetition rates point to weak root cause analysis or insufficient supplier integration in improvement projects.
Integration with supplier evaluation
Audit findings should systematically feed into the supplier audit score and thereby complement the existing supplier evaluation. In this way, individual audit results are connected with continuous performance monitoring via metrics such as On-Time In Full (OTIF) or the delivery service level.
Risks, typical errors and controls
In practice, audit plans rarely fail due to a lack of standards, but rather due to unclear responsibilities, resource shortages and a lack of action tracking. Proven control mechanisms address precisely these weak points.
Common sources of error
Typical problems are over-ambitious plans that cannot be sustained in terms of staffing, audits without documented criteria, missing follow-ups on open actions, and plans oriented towards convenience rather than risk. Excessive focus on certification relevance without regard to real process risks also leads to blind spots.
- Overloaded plans with no basis in reality
- Missing audit criteria or outdated checklists
- No follow-up of actions
- No updating following supplier or risk changes
Controls and governance
Clear governance has proven effective: the audit plan is approved by quality management or procurement management, its status is regularly reviewed in a committee, and open actions are tracked through to evidence of effectiveness. For critical suppliers, contractual agreements can secure the right to conduct audits and the obligation to implement actions; the specific design should be legally reviewed.
Relevance for compliance and sustainability
Audit plans gain in importance when they go beyond quality: working conditions, environmental and sustainability requirements are increasingly integrated into supplier audits, also in the context of reporting and due diligence requirements as well as sustainability standards such as the GRI Standards. The reach and depth of such audits depend on the supplier risk and should be documented and traceable.
Current developments and digitalisation
Audit planning is increasingly supported digitally: software solutions manage plans, checklists, findings and actions centrally and enable supplier portals for self-disclosure. At the same time, priorities are shifting – from reactive audits towards risk-based, data-driven approaches.
Digital audit and supplier portals
Digital systems are replacing Excel-based plans in many companies. Advantages lie in automatic reminders, central action tracking and linkage with supplier master data. Remote audits conducted by video have established themselves as a pragmatic component, particularly for sites in low-cost country sourcing regions, but usually only partially replace on-site audits for critical processes.
Combining risk data and monitoring
Increasingly, operational performance data such as OTIF values, complaint rates or externally available risk information flow into the planning. This makes the audit plan dynamic: suppliers with deteriorating performance automatically move into the audit calendar. This integration also strengthens process optimisation in procurement, as audit results flow directly into procurement decisions.
Sustainability and supply chain topics
Topics such as emissions data, life cycle assessment (LCA) and social standards are moving into audit catalogues. Companies frequently combine self-assessment questionnaires with sample-based on-site verification. The audit plan thereby becomes a central instrument of evidence along the entire supply chain.
Typical metrics
| Metric | Benchmark | Context |
|---|---|---|
| Audit plan adherence rate | > 90% | Proportion of audits carried out versus planned; values significantly below this indicate resource or prioritisation problems |
| Audit coverage of A-suppliers | 100% within the annual cycle | Common practice in industry for critical or high-volume suppliers |
| Corrective action closure rate | > 95% within the target deadline | Shows whether audit findings are effectively implemented |
| Rate of recurring findings | < 10–15% | Higher values indicate weak root cause analysis |
| Average remaining age of open actions | < 90 days | Benchmark for corrective actions of medium severity; critical findings significantly shorter |
Typical practical benchmarks – they vary by industry, part and contract.
Practical example
A medium-sized mechanical engineering company with around 350 actively supplying vendors previously planned audits on an ad hoc basis, usually after complaints. The introduction of a risk-based audit plan changed this: all suppliers were classified into three risk classes based on volume, criticality and past performance, and the audit scope was linked accordingly. Within two audit cycles, the number of unplanned escalations fell noticeably, and the results were systematically incorporated into supplier evaluation.
- Risk classification of all A- and B-suppliers with annual updating
- Firm anchoring of on-site system and process audits in the annual calendar
- Reserve capacity for event-driven audits following complaints or process changes
- Monthly review of open actions by procurement and quality
Conclusion
An audit plan transforms supplier and process audits from one-off actions into a systematic control instrument. It prioritises audit resources on a risk basis, ensures traceability towards customers and certification bodies, and connects audit findings with continuous supplier evaluation. Key success factors are realistic resource planning, clear responsibilities and consistent action tracking. Those who support the plan digitally and link it with performance metrics turn it into a living control instrument rather than a formal document. In this way, the audit plan makes a significant contribution to supply capability, quality assurance and compliance across the entire procurement function.
Frequently asked questions
What is an audit plan?
An audit plan is a structured overview that defines which audits are to be carried out, in which period, and at which suppliers or processes. It contains dates, responsibilities, audit criteria and reporting routes. It is a central control instrument for quality and compliance checks in the supply chain.
What belongs in an audit plan?
Typical components are the audit object, audit type, date and duration, audit team, audit criteria or normative references, as well as reporting and follow-up dates. In addition, event-driven audits and reserve capacity should be included. The plan should at all times make it clear who is auditing what, when and to which standard.
How often should suppliers be audited?
That depends on the risk profile: critical A-suppliers or single-source suppliers are typically audited annually to biennially, less critical suppliers less frequently or on an event-driven basis. In addition, audits should be possible following serious complaints or significant process changes. Regular updating of the risk classification is important.
What is the difference between an audit programme and an audit plan?
The audit programme describes the overarching, usually multi-year audit strategy of a company. The audit plan makes this concrete for a defined period, such as one year, with individual dates and responsibilities. In smaller companies, both levels are often managed in a single document.
How do you create a risk-based audit plan?
First, suppliers and processes are classified according to criteria such as volume, criticality, performance history and certification status. On this basis, audit frequencies, audit types and dates are defined and coordinated with the relevant departments. The plan is then reviewed quarterly and adjusted where necessary.
Which standards require an audit plan?
Quality management system standards such as ISO 9001 or IATF 16949 require planned and documented audits, both internally and at suppliers. Environmental and sustainability management systems also require structured audit processes. The specific requirements should be reviewed on a case-by-case basis against the applicable version of the standard.
