Audit plan template

• 7 groups
• 25 tasks
• 3 milestones
• 28 dependencies
• About 10 weeks
• Updated October 26, 2026

We make Ganttile. The audit, the areas and the durations in this template are sample data for a made-up engagement, so replace them with your own.

Which audits does this plan fit?

Choose this audit plan for one engagement with a defined scope, fieldwork and a final report. The sample is an internal audit of purchase-to-pay, run by an audit manager and two auditors over about ten weeks: supplier master data, purchasing, then invoices and payments.

The same structure works for an operational or compliance review, an internal quality audit, or a supplier audit. An external auditor can use it for one client engagement too. Rename the fieldwork areas and keep the main stages: planning, a risk assessment, testing, findings, a draft, management's response and the final report.

It suits audit managers who currently use spreadsheets and want linked dates. With Auto schedule turned on, a late document pack or a slow response moves the report date.

Is this audit management software?

Ganttile schedules one audit engagement. It does not hold working papers, a risk library or evidence, record sign-offs, or track whether management's actions were finished months later. Audit management software and a good shared drive do those jobs.

It is also not the annual audit plan, the list of engagements for the year. Keep that in a list or your audit software, and make one chart per engagement. When two engagements share auditors, open them together on one chart to see where they overlap. Ganttile is free, and the chart can be exported to Excel or Microsoft Project XML.

How are the ten weeks laid out?

The sample divides the ten weeks into seven groups: planning, risk assessment, three fieldwork areas, reporting and management responses. The fieldwork areas run partly in parallel because two auditors work on them at the same time.

Ganttile has no assignment field. Write the owner at the front of the task name, as in Audit manager, Auditor 1 or Process owner, and replace the roles with names after copying the plan.

Why does the document request go out on day three?

The document request goes out early because gathering documents is the longest wait in planning. The audit team can review the background and run walkthroughs while the auditee gathers the pack. The request goes out on the Wednesday of week one, and the auditee has until the end of week two to gather system reports, the supplier master file, approval limits and the payments file.

The opening meeting is linked to both the audit programme and the documents, so if the pack arrives more than four days late, fieldwork starts late by the difference.

Critical path is off by default and highlights correctly only with Hide weekends on. Turn both on under Settings in your copy: in the sample the audit programme and document collection both finish just in time, so both are highlighted.

Name a contact on the auditee's side in the engagement letter, and send the meeting dates with it. Both make the later dates more likely to hold.

How is the fieldwork split between auditors?

Fieldwork is grouped by area, with tests and follow-up queries together. The auditor or process owner appears at the front of the task name. In the sample, the work is split as follows:

• Auditor 1: tests supplier bank detail changes first, then invoice matching and payment approvals.
• Auditor 2: tests purchase order approvals, then runs analytics on the whole year's payments file, looking for duplicates and payments just under an approval limit.
• Process owners: each area ends with a few days for them to answer the auditors' queries, so explanations arrive before conclusions are written.

Fieldwork complete waits for all four strands. To check nobody is booked twice, read down the rows starting with one auditor's name: their bars should follow each other rather than overlap.

What happens between fieldwork and the final report?

The sample allows four weeks for review, discussion and management responses after fieldwork. The audit manager reviews the working papers and rates the findings, then holds the closing meeting before writing anything up. Talking every finding through first means the facts are agreed and nothing in the draft is news to the process owners.

The draft goes to the head of audit for a quality review in week eight, then to management for responses. The response is an eight-day wait in the sample, and it is the wait most worth chasing. Agree its deadline at the closing meeting and send a reminder halfway through.

With Auto schedule turned on, drag that bar a week longer and watch the final report and every row after it move.

How should you adapt it to your audit?

Replace the fieldwork areas and document list, then set testing durations and the management response deadline for your engagement.

1. Replace the areas. Rename the three fieldwork groups, or copy one to add a fourth, and keep each area's queries row with it.
2. Size the testing. Sample sizes decide the length of each test bar, and the Estimate column holds the hours behind it.
3. List the requested documents. Each task can carry a checklist, so the request task can list every document you asked for.
4. Set the response deadline. Change the eight-day wait to whatever your audit charter or committee expects.
5. Share it. Invite your audit team through the linked Breeze account, free, and they can view and edit the chart. Export a PDF for the auditee or the audit committee.

Click Use template and the plan is copied into your account starting on the coming Monday, with the links, estimates and checklists in place. Auto schedule is off by default. Turn it on to move linked tasks when dates change; linking tasks and milestones explains how the connections work.