Skip to main content
    QHSEtech
    All templatesAudits · 3 pages · Updated 19 October 2026

    Internal Audit Plan and Report Template

    Three-page form that records one internal audit of one process, area or requirement: the audit details (scope, the criteria your organisation chose, auditor, auditee, independence from the area audited, dates), the method and sampling plan, a table of what was sampled and the evidence examined with a yes, no or partly result for each item, the grades you use, the findings with their evidence, criterion and grade, positive practice noted, follow-up actions with owner, due date and a check by someone other than the owner, the conclusion, distribution and sign-off. It records the audit's plan, sample, findings and conclusion; it is not a question list (the safety audit checklist holds those) and it is not a nonconformance report. It belongs to no one management system. ISO text is not reproduced and no clause is named. An audit report shows what was examined on the day; it is not a certificate.

    What's inside

    Page 1: the plan, completed before the audit

    1. Audit details: title and reference, whether it is an audit of a process, area, requirement or other, an optional programme reference, the scope and what is not covered, the criteria the audit is judged against (chosen by your organisation), the auditor or team with their competence, the auditee and the people met, independence from the area audited (no link, or a link written out with how it was handled), and the planned, actual and report dates
    2. Method and sampling plan: how the sample is chosen and how big it is, why this sample, the checklist or question list used (by reference), what the auditee was told and when, the resources allowed, and earlier findings in the area to look at again

    Page 2: what was found

    1. What was sampled and the evidence examined: nine lines, each with the item sampled, the evidence examined, Yes, No or Partly, and a finding number
    2. Grades used in this audit: conformity, nonconformity, observation and opportunity for improvement, each with example wording to replace with your own
    3. Findings: five lines, each with one statement, the evidence, the requirement or criterion it is judged against and a tick for the grade

    Page 3: what happens next

    1. Positive practice noted: what is done well and where it could be shared
    2. Follow-up actions: six lines with the action, owner, due date, done on, verified by (not the owner) and the date verified, and whether a follow-up audit is needed
    3. Conclusion: the conclusion in words, an overall result, the counts, and the limits of the audit
    4. Distribution: who received the report, why, when and receipt confirmed
    5. Sign-off: lead auditor, auditee and the manager who receives the report, where the record is kept and the date of the next audit of the area

    The section titles, the grade names and their wording are ours, to change.

    What requires or shapes this record

    No source opened for this page requires an internal audit to be recorded on a form like this, or sets a scale for grading findings. In Great Britain, regulation 5 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make and give effect to arrangements, appropriate to the nature of the activities and the size of the undertaking, for the effective planning, organisation, control, monitoring and review of preventive and protective measures, and to record them where there are five or more employees; the regulation does not use the word audit, so an audit is one way of doing the monitoring and review, not the only one. The ILO's OSH management system guidelines ask for periodic audits, by competent persons independent of the activity audited, but say they are not legally binding. EPA's 1986 policy, written for environmental auditing in the US, encourages audits and says auditing should remain voluntary. CCOHS describes an audit as a before-the-fact measure and asks for follow-up with target dates. Whether your law, contract or certification scheme requires audits, how often and in what form, is for you to check. ISO's audit guidance standard is paid and its text was not read; ISO text is not reproduced here and no clause is named. This page is general information, not legal advice.

    • ILO, Guidelines on occupational safety and health management systems, ILO-OSH 2001 (second edition 2009), sections 3.13 and 3.14 and the glossary (PDF, opened 19 October 2026)

      The ILO says its guidelines are voluntary, not legally binding and not meant to replace national laws. Section 3.13 asks for arrangements for periodic audits to determine whether the system and its elements are in place, adequate and effective, and for an audit policy and programme that designates auditor competency, scope, frequency, methodology and reporting. It lists the elements an audit can cover, says the audit conclusion should determine whether the elements are effective in meeting the organisation's policy and objectives, promote worker participation, respond to earlier audits and help it comply with national law, and says audits should be done by competent persons, internal or external, who are independent of the activity audited. Results and conclusions go to those responsible for corrective action, and workers are consulted, as appropriate, on the choice of auditor and on all stages. Section 3.14.3 says a management review should consider audit activities. The glossary defines an audit as a systematic, independent and documented process for obtaining evidence and evaluating it objectively against defined criteria, and says this does not necessarily mean an audit by outsiders. The form's scope, criteria, auditor, independence, conclusion and distribution parts follow these ideas in our own wording.

    • US EPA, Environmental Auditing Policy Statement, Federal Register vol. 51, no. 131, 9 July 1986, appendix on the elements of effective environmental auditing programs (PDF, opened 19 October 2026)

      A 1986 US policy on environmental audits, so dated and specific to the environment; it says auditing should remain voluntary and that audits do not replace regulatory inspections. Its appendix describes an environmental audit as a systematic, documented, periodic and objective review and lists elements of an effective programme. They include a written commitment from top management to follow up findings and prevent recurrence; an audit function independent of the audited activities whose objectivity is not impaired by personal relationships, financial or other conflicts of interest, interference with free inquiry or judgment, or fear of retribution; trained auditors; explicit objectives, scope, resources and frequency, with written procedures for planning, evaluating findings, communicating results and follow-up; information that is sufficient, reliable, relevant and useful, where sufficient means a prudent, informed person would be likely to reach the same conclusions; testing and sampling techniques selected in advance as far as practical and expanded or altered if circumstances warrant; prompt, candid, clear written reports on findings, corrective actions and schedules, communicated to managers who can ensure correction; and quality assurance of the audits, which may be supervision or independent internal review. The form's sample, evidence, findings, distribution and sign-off parts follow this pattern in our own wording.

    • CCOHS, Health and Safety Program: General Elements (OSH Answers, fact sheet last revised 16 March 2021)

      The Canadian Centre for Occupational Health and Safety says it is desirable to use an audit as a before-the-fact measure of how effective a health and safety program is. It describes an audit as a checklist in which each element is divided into questions, each given a weighting by importance, with records, observations, interviews and questionnaires used to evaluate each sub-element. It says annual audits appear more common but that critical elements may be reviewed more often, that the audit team, which should include representation from the joint health and safety committee, must be trained in audit procedures, and that a procedure should ensure prompt follow-up on deficiencies, with target dates for remedial action and checks to confirm completion. The audit paragraph sets no legal duty to audit and no scale of grades. That is why the form lists the kinds of evidence, asks for a due date on each action and has a separate check column.

    • Management of Health and Safety at Work Regulations 1999 (SI 1999/3242), regulation 5, Health and safety arrangements (Great Britain, legislation.gov.uk, opened 19 October 2026)

      Regulation 5(1) says every employer shall make and give effect to such arrangements as are appropriate, having regard to the nature of the activities and the size of the undertaking, for the effective planning, organisation, control, monitoring and review of the preventive and protective measures. Regulation 5(2) says an employer with five or more employees shall record the arrangements. The regulation applies in England, Wales and Scotland, does not use the word audit and does not say how monitoring and review are to be done or recorded. An internal audit is one way an employer can monitor and review its arrangements, and this form is one way to record it. A completed form does not show that you meet regulation 5, and the rules elsewhere differ. The regulation's own text is not reproduced beyond the short phrases above.

    Each source checked on 19 October 2026. Not legal advice; check the text in force for your site.

    Field by field

    The form records one audit. Complete page 1 (the plan) before the audit and the rest during and after it. The section titles, the four grade names and the example wording under them are ours and can be changed: use the grade names and meanings in your own audit procedure, keep them the same between audits so that results can be compared, and attach your own checklist where you use one. The form does not say which law, standard or system you audit against; the criteria are the ones your organisation chooses.

    Audit title and reference
    Why: One audit, one record. ILO-OSH 2001 asks for an audit programme with scope, frequency and reporting, so a reference ties this audit to the programme and to the actions that come out of it.
    Common mistake: One report that covers several audits of different areas, so findings cannot be traced to the audit that raised them.
    Scope
    Why: ILO's section 3.13.2 and EPA's elements both ask for the scope to be set out in advance. Writing the area, the period covered and what is not covered tells a reader what the conclusion can and cannot say.
    Common mistake: A scope of "the warehouse", which does not say which processes, which months or what was left out.
    Criteria the audit is judged against
    Why: ILO defines an audit as evaluating evidence against defined criteria, and EPA asks that auditors be given the policies, permits and rules that apply. Naming the criteria, with their revision, means a finding can be checked against something stated.
    Common mistake: Judging against the auditor's own idea of good practice, so a finding is an opinion and the auditee can dispute it.
    Auditor or audit team
    Why: ILO asks for competent auditors, internal or external, and EPA for adequate staffing and auditor training; CCOHS asks that the team be trained and include a joint committee representative. Naming each person and the basis of their competence for this audit makes that visible.
    Common mistake: Naming an auditor with no note of training or of knowledge of the area.
    Auditee
    Why: Says who owns the area and who was met, so the report can be traced to the people who must act on it. ILO also asks that workers be consulted, as appropriate, at all stages of an audit.
    Common mistake: Talking only to the manager, so what the people doing the work say is not in the evidence.
    Independence from the area audited
    Why: ILO asks for auditors independent of the activity audited. EPA names personal relationships, conflicts of interest, interference with free inquiry and fear of retribution as threats to objectivity. Recording any link, and what was done about it, lets a reader judge the audit.
    Common mistake: The area's own supervisor audits it because they know the area, and the report does not say so.
    Dates
    Why: Planned, actual and report dates show whether the audit happened when programmed and how long the report took. EPA asks for prompt written reports, and a follow-up date can only be set once the report is issued.
    Common mistake: Recording only the audit date, so a report issued weeks later cannot be seen to be late.
    Method and sampling plan
    Why: An audit examines a sample, and ILO asks for audit methodology to be set out. EPA says testing and sampling techniques should be chosen in advance as far as practical and widened if circumstances warrant. CCOHS lists records, observations, interviews and questionnaires as ways to gather evidence.
    Common mistake: Sampling the records that are easiest to reach, or that the auditee offers, instead of choosing the sample before the visit.
    What was sampled and the evidence examined
    Why: Each line names what was looked at, what evidence was seen, read or said, and whether it met the criterion. EPA says information should be sufficient, reliable, relevant and useful. Saying how many items were examined of how many exist shows how much of the whole the result can speak for.
    Common mistake: Writing "in place" because someone said so, with no record of what was actually seen.
    Grades used in this audit
    Why: None of the sources opened sets a scale for grading findings, so each organisation defines its own. Writing what each grade means, and what it triggers, lets two auditors give the same grade to the same fact. The four names and the example wording are ours.
    Common mistake: Using the words without defining them, so one auditor's observation is another's nonconformity.
    Findings
    Why: EPA asks for candid, clear written reports on findings, and for information strong enough that a prudent person would reach the same conclusion. One statement per finding, with its evidence and the criterion it is judged against, makes that check possible.
    Common mistake: Findings written as opinions ("training is weak") with no evidence and no criterion, which cannot be checked or closed.
    Positive practice noted
    Why: None of the sources opened requires this part; it is our addition. It keeps the report from being a list of failures and shows what could be shared with other areas.
    Common mistake: Leaving it blank on every audit, so the report only ever says what is wrong.
    Follow-up actions
    Why: ILO says results go to those responsible for corrective action, EPA asks for corrective actions and schedules in the written report, and CCOHS asks for target dates for remedial action. Each action therefore has an owner and a due date.
    Common mistake: A finding with no action, or an action with no owner, so nothing changes before the next audit.
    Verified by
    Why: CCOHS asks for checks to confirm that remedial work was completed, and EPA asks for follow-up so that problems do not recur. Asking for someone other than the owner is our design choice: it separates doing the action from checking that it worked.
    Common mistake: The owner closes their own action and the audit sees a closed line, not a check that the fix held.
    Conclusion
    Why: ILO says the audit conclusion should say whether the elements examined are effective against the organisation's own policy and objectives. The overall result, the counts and the limits of the audit keep the conclusion tied to what was actually examined.
    Common mistake: "No major issues" with no mention of how small the sample was or what was not examined.
    Distribution
    Why: ILO asks for results to reach those responsible for corrective action and for management reviews to consider audit activities, and EPA asks that reports reach managers who can ensure correction. The list shows who was told and that they received it.
    Common mistake: The report goes only to the auditee, so the managers who decide on the system never see it.
    Sign-off
    Why: Signatures show who led the audit, who owns the area and who reviewed the report. EPA asks for quality assurance of audits, which may be supervision or independent internal review; a reviewing manager signing is one way to show a report was reviewed.
    Common mistake: The lead auditor signs alone, so nobody has checked the report against the evidence.

    Worked example

    IllustrativeAn invented audit of a contractor induction process at a small packaging site (invented company, people and references)

    SectionEntry
    1 Audit detailsAudit IA-07 of the contractor induction process for the third quarter, ticked as an audit of a process. Criteria: the site's own induction procedure SP-07, revision 3, which asks that every contractor worker is inducted and the record signed before first entry. Auditor: the quality coordinator from the other site, with no link to the process. Auditee: the site manager, who owns it.
    2 Method and sampling planNine of the 36 contractor visits in the quarter, chosen from the visitor book before the visit by taking every fourth entry. For each, read the induction record and ask the site contact how it was given. Earlier audit finding on lapsed permits is not in scope.
    3 What was sampledNine records examined. Six had a signed record dated before first entry (Yes). Two had a signed record but no note of how understanding was checked (Partly). One, a delivery driver who went onto the loading dock, had no record (No). 6 + 2 + 1 = 9.
    4 and 5 Grades and findingsFinding 1, nonconformity: no induction record for one of the nine visits, against the requirement of SP-07 for a signed record before first entry. Finding 2, observation: two records do not show how understanding was checked; SP-07 asks for the check but does not say how to write it down. Finding 3, opportunity for improvement: the visitor book and the induction records are on separate lists, so matching them took most of the audit.
    6 Positive practiceContractors who stayed more than a day were all inducted again after a change of site rules, and the site contact could show the sign-off sheet.
    7 Follow-up actionsFinding 1: add the induction check to the gate sign-in so that a visitor cannot enter without it (owner the site manager, due in 30 days). The check is by the quality coordinator, who is not the owner, after 30 days. Finding 2: add a line to the form for how understanding was checked (owner the safety coordinator, due in 14 days).
    8 ConclusionSix of the nine records examined (the sample was 9 of 36 visits, or 25%) met the procedure. The process works for planned contractor work and does not reliably reach short deliveries. Counts: 9 items sampled, 1 nonconformity, 1 observation, 1 opportunity for improvement. Limits: records only; no one was observed being inducted.
    9 and 10 Distribution and sign-offIssued to the site manager, the safety coordinator and the plant manager for the management review. Signed by the lead auditor, the site manager and the plant manager, who reviewed the report against the record sheets.

    The grades are the example wording on the form and a different procedure could grade the same facts differently. The percentages describe one sample on one day; a different sample might find more or fewer records missing. The names and figures are invented to show the method and are not benchmarks.

    When a spreadsheet stops being enough

    A paper form or a spreadsheet works for a few audits a year and one person who keeps the programme. It stops working when many audits are planned across sites, when auditors must be matched to areas without a link to them, when findings must reach owners with a due date and a reminder, when the check of each action by someone else must be tracked, and when you need to see all open findings, and recurring ones, for the management review.

    A software record holds an audit programme with the planned, held, postponed and overdue audits, an editable checklist with the criterion each question refers to, findings with a grade, evidence and criterion, and actions with an owner, a due date and a separate verification. It can warn when an auditor is linked to the area audited, show a finding that recurs on the same process, and produce a summary for management review. The list below applies the audit-programme rule used by the audit platform guide. Nothing in it shows that a product holds auditor independence rules, weighted checklists or a separate verification step, so test it with one of your own audits.

    Same rule for every product: tagged “Audit Management”, “Audits & Inspections” or “Internal Audit”, with a sourced audit-programme capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 46 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.