Internal audit template
- Hours of fieldwork
- 29
- Checklist lines in the template
- 48
- Records to sample
- 144
- Hours of write-up
- 6
Every figure here comes from the figures you enter and the method stated beside it: your scope, your evidence per requirement, your minutes per item, your people and your weeks. Where a guide names a published figure it names the source and the date it was read. This site publishes no opinion on whether you will pass: what an auditor will accept is the auditor's decision on the day, and the standards and rules cited on each guide are where the preparation starts, not the verdict.
The figures above start from a worked example (29). Change any input and the answer updates as you type, the way it will when the auditor's scope letter arrives.
Download the Internal audit template worked example (CSV)
The internal audit template sizes the audit itself rather than the preparation for it: how many processes are in the audit scope, how many requirements are checked in each, how many records are sampled per requirement and how long each sample takes, how long the interview with each process owner runs, how long the write-up per process takes and how many auditors share the work. It returns the checklist lines the template carries, the records to sample, the hours of fieldwork and of write-up, the auditor hours in total and per auditor, and the audit days at eight hours a day. An internal audit of six processes and one of thirty is the same template with a different plan.
Why the template is built per process, not per clause
A management system standard is written by clause, but a business runs by process: purchasing, production, training, document control, customer complaints. An internal audit that walks the clauses asks the same person the same question six times; one that walks the processes asks each process owner every clause that touches their work once, with the records in front of them. The template therefore takes the processes in scope and the requirements checked in each, and the checklist lines it produces are the process-by-requirement grid the auditor fills in, which is also the grid the findings are filed into afterwards.
Sampling is where the audit's credibility is decided
An auditor who looks at one training record has audited one training record. The samples-per-requirement figure sets how many records are pulled for each check, and the minutes-per-sample figure is honest about how long a pulled record takes to read, trace and note. Three is a common floor for a small process and the figure rises with volume, and the template makes the total visible so an audit plan that claims to sample everything in a morning is seen for what it is before the auditor is standing in the warehouse.
Write-up is fieldwork's shadow and it is always underplanned
Every process audited produces findings to write, evidence references to record and corrective action requests to raise, and the hour per process the template defaults to is the smallest figure anyone who has written an audit report will recognise. Adding it to the fieldwork gives the auditor hours in total and, divided by the auditors, the days each is out of their normal job. That is the figure to agree with the auditors' managers before the plan is issued, because an internal audit that is scheduled for its fieldwork alone is the one whose report arrives a month late.
Where the constants in this tool come from
OSHA, Recommended Practices for Safety and Health Programs, the federal agency's guidance on the program evaluation and improvement element of a safety program. Why the template treats a safety audit as a process-by-requirement grid with records sampled against each check: the guidance's evaluation element asks the employer to verify the program is implemented and to track its performance through records, which is what the sampled checks produce.
21 CFR Part 211, Current Good Manufacturing Practice for Finished Pharmaceuticals, the federal GMP regulations. Why the template samples records rather than reading procedures: the regulation is written as requirements on records, batch production and control records, laboratory records, complaint files, and a GMP internal audit is the pulling and tracing of those records against each requirement.
What the person preparing for the audit asks before running the Internal audit template
Which figures do I need before using the internal audit template?
How many processes are in the audit scope, how many requirements you check in each, how many records you sample per requirement and how long each takes, how long the interview with each process owner runs, how long the write-up per process takes and how many auditors share the work. The guide pages give the typical process list for each kind of audit.
Why does it give checklist lines and records to sample separately?
Because a checklist line is a question and a sample is a piece of evidence pulled to answer it. Six processes with eight requirements each is forty-eight questions; at three samples each it is over a hundred records to read, and the second figure is what sets the fieldwork hours.
Can I use the template for an audit a customer or a certification body will run?
Yes, as a rehearsal. Put in the processes on their audit plan and the requirements they will check, and the template gives the checks and the samples they are likely to pull, which is the list the preparation checklist on this site fills the evidence against.