To conduct an ISO 9001 internal audit, establish the assignment’s objectives, scope and criteria, then follow actual work through relevant evidence. Evaluate what the evidence supports, discuss factual accuracy and communicate conclusions clearly. The work should reveal how the system operates rather than rehearse how employees describe it.
The internal audit guide explains the surrounding programme and follow-up arrangements. The steps below are practical implementation guidance. They do not reproduce the standard or prescribe a single mandatory audit format.
Confirm the assignment and prepare
Review the plan, applicable requirements and relevant process information. Understand the intended result, important handovers, performance trends, previous findings and recent changes. Identify records and people likely to help answer the audit objectives.
Check practical access before starting. A process may operate across shifts or use a system that requires advance permission. A remote assignment may need a secure demonstration method. If critical access cannot be obtained, discuss whether the scope or timing needs to change.
Prepare prompts without deciding the conclusion. A previous problem can justify closer attention, but it is not proof that the problem persists. Equally, a favourable earlier report does not remove the need to examine current evidence.
Open with a clear working agreement
Explain the purpose, scope, methods, timing and communication arrangements to relevant participants. Confirm process contacts and how emerging concerns will be raised. Clarify confidentiality or operational restrictions that affect the work.
An opening discussion should reduce uncertainty without turning into a lengthy presentation. People should understand that the auditor is evaluating processes against criteria and will seek examples of actual work. They should also know how to correct factual misunderstandings.
Avoid promising that the audit will identify every weakness or guarantee readiness for certification. Its assurance is limited by scope, sampling and available evidence.
Trace a real case through the process
Select a transaction, service case or product that is relevant to the objectives. Follow how its requirements were accepted, translated into work, controlled, checked and released. Examine significant changes and exceptions along the way.
In a fictional calibration service, an auditor might trace a customer request into the job specification, confirm the suitability of the assigned technician, examine equipment status and compare the issued report with the accepted requirement. The choice of evidence follows the process rather than a predetermined departmental tour.
Use interviews to understand decisions. Ask people to show what happened in a particular case and where relevant information is recorded. Broad questions can establish context; focused questions can test specific claims. Do not coach people toward an expected answer.
Compare different sources of evidence
Records, observations, data and interviews can corroborate or challenge one another. A procedure might describe a review that staff say is no longer performed. A performance chart might show stable results while complaints identify a recurring defect outside the chart’s definition.
Investigate contradictions proportionately. Confirm that the information relates to the same period, process and requirement before drawing a conclusion. A changed procedure may explain an apparent discrepancy, or it may reveal that obsolete instructions remain in use.
| Evidence situation | Useful next step |
|---|---|
| Interview differs from a record | Clarify the case, timing and responsibilities |
| Procedure is current but practice differs | Examine the requirement and actual control |
| One sample has a gap | Assess consequence and whether wider enquiry is warranted |
| Data appears favourable | Check definitions, exclusions and underlying records |
The evidence examples discuss how to retain context and avoid treating a document as persuasive merely because it is signed.
Evaluate findings against criteria
Separate working notes from supported findings. For a nonconformity, identify the unmet requirement and the relevant evidence. State the gap clearly enough that the process owner can investigate it without guessing what the auditor meant.
Do not prescribe a preferred solution as though it were a requirement. If a process achieves the required result through a different justified method, the auditor should evaluate that method on its evidence. Improvement suggestions should remain distinguishable from findings of nonconformity.
Discuss factual accuracy as the audit progresses. This can prevent a misunderstood document or unrepresentative account from becoming a misleading report. Where disagreement remains, preserve the evidence and use the organisation’s agreed resolution arrangements.
Close, report and hand over follow-up
Summarise the work performed, material limitations, supported conclusions and findings. Confirm reporting arrangements and responsibility for responding. Avoid surprising a process owner with an entirely new factual allegation at the closing discussion.
Issue a report that can be understood by someone who was not present. It should distinguish what was examined from what remains outside the conclusion. Do not imply complete system conformity because a limited sample disclosed no failures.
The process owner then addresses findings through correction, investigation and appropriate corrective action. Follow-up should evaluate relevant later evidence. Conducting the audit well means leaving a clear trail from the original question to evidence, conclusions and accountable next steps.