Audit Plan

​

Summary

An Audit Plan is a structured document that defines the scope, objectives, timing, and logistics of an internal or external audit. It serves as a roadmap for systematically evaluating your Quality Management System (QMS) against regulatory standards like ISO 13485 and applicable regulations. The plan ensures audits are conducted efficiently, cover all critical areas, and provide meaningful insights for continuous improvement of your quality processes.

​

Why is an Audit Plan important?

The Audit Plan exists because regulatory frameworks require systematic verification that your quality management system actually works as intended. Rather than hoping your processes are compliant, audits provide objective evidence that your procedures are being followed and are effective.

For medical device manufacturers, an Audit Plan is crucial because it demonstrates proactive quality management to regulatory authorities. It shows you’re not just documenting processes but actively monitoring and improving them. This systematic approach helps prevent quality issues that could affect patient safety and ensures you can respond effectively when notified bodies or regulatory inspectors arrive. Without proper audit planning, you risk missing critical compliance gaps, wasting resources on unfocused reviews, and facing regulatory sanctions for inadequate oversight of your quality system.

​

Regulatory Context

​

Guide

Your Audit Plan must address four essential components that work together to ensure comprehensive and effective audits. Each section builds upon the previous to create a complete audit framework.

​

1. Information and Participants

The audit information section establishes the fundamental logistics that make your audit possible. You must specify the exact date and time when the audit will occur, allowing all participants to prepare adequately. The audit location should be clearly defined, whether it’s your main facility, a specific department, or conducted virtually. This information ensures everyone knows when and where to be present.

The auditor information identifies who will conduct the audit and their qualifications. For internal audits, you must ensure auditors are independent from the areas they’re auditing - someone from software development cannot audit software processes. Include the lead auditor’s name, position, and company to establish clear accountability. If multiple auditors participate, document each person’s role and expertise to ensure proper coverage of all audit areas.

Your audit participants section lists company employees who will be directly involved during the audit. Focus on subject matter experts for each process being reviewed rather than creating an exhaustive list. Include their names and specific roles relevant to the audit scope. Remember this is a planned list - the actual participants may change slightly during the audit based on auditor requests or availability.

​

2. Audit Criteria

The audit scope defines exactly which standards, regulations, and internal procedures will be evaluated during this specific audit. You must clearly indicate which criteria are covered in this audit versus which are excluded. This prevents scope creep and ensures focused, efficient use of audit time.

Common audit criteria include ISO 13485:2016 for quality management, ISO 14971:2019 for risk management, EU MDR 2017/745 or FDA 21 CFR 820 for regulatory compliance, and IEC 62304 for software lifecycle processes. Don’t try to cover everything in one audit - it’s more effective to focus on specific areas and cycle through your entire QMS over time.

The scope should align with your audit program that schedules different QMS elements across multiple audits. For example, one audit might focus on design controls and risk management, while another covers post-market surveillance and CAPA processes.

​

3. Audit Activities

Your audit activities section provides a detailed schedule that transforms the audit from a general concept into specific, actionable time blocks. Each activity should include the date, time range, specific topic or process being reviewed, applicable audit criteria, and designated participants.

Start with an opening meeting to set expectations and review the audit plan. Schedule sufficient time for each process review - complex areas like design controls typically require more time than simpler processes like document control. Include breaks and lunch to maintain productivity and allow for informal discussions that often reveal important insights.

Plan for a closing meeting where auditors present preliminary findings and discuss next steps. Be realistic with timing - rushing through important processes defeats the purpose of systematic evaluation. Allow flexibility for auditors to spend additional time in areas where they identify concerns.

​

4. Template Variable Configuration

Based on the template structure, you need to populate five key elements:

The audit-information table captures basic logistics including audit date, time, and location. The auditor-information table identifies lead auditors and supporting auditors with their positions and companies. The audit-participants table lists your company personnel who will participate, focusing on process owners and subject matter experts.

The audit-scope table marks which standards and regulations are covered in this specific audit, allowing you to focus efforts and manage scope effectively. The audit-activities table provides the detailed schedule with dates, times, topics, criteria, and participants for each audit session.

Each table supports adding additional rows as needed, giving you flexibility to accommodate complex audits involving multiple auditors, extensive participant lists, or detailed activity schedules spanning multiple days.

​

Example

Scenario: You’re planning an internal audit of your document control and risk management processes before an upcoming notified body assessment. Your quality manager will lead the audit, supported by a senior engineer who’s independent from both processes. The audit will review ISO 13485 requirements and your internal procedures to ensure everything is working effectively and ready for external scrutiny.

​

Complete Audit Plan Document

Audit Plan

ID: AP-2024-001

​

1. Information and Participants

​

2. Planned Audit Participants

​

3. Audit Criteria

​

4. Audit Activities

​

Q&A