3.III.7.1. Preparing an audit plan

The person responsible for planning and carrying out the audit in order to obtain reasonable assurance that the economic operator meets the established criteria is the auditor. Auditors should determine the audit plan based on the risks identified for the economic operator concerned.

The audit plan will be the specific guidance to be followed when conducting the audit and must specify the objectives, scope and method of the audit.

The audit plan shall be developed based on the results of the risk assessment and shall reflect information relating to:

• the risks of each area, indicating the aspects that need to be checked;
• a risk analysis matrix;
• the departments or units to be analyzed;
• the managers and other staff members who will be interviewed;
• the specific tests to which the operations and safety must be subjected, as well as the manner in which they will be carried out and the time at which they will be carried out.

The audit and the resources allocated to it must be based on the principle of "the greater the risk, the greater the degree of inspection."