An ISO 9001 internal audit evaluates how an organisation’s quality management system operates against defined criteria. Its value comes from testing real work, identifying supported conclusions and giving managers reliable information for action. A completed checklist alone cannot show whether a process achieves its intended result.
This guide connects programme design, individual audit planning, evidence collection, reporting and follow-up. The suggested forms and examples are original implementation choices. ISO 9001 supplies the applicable QMS requirements; ISO 19011 supplies auditing guidance. Neither this guide nor an internal audit grants accredited certification.
Establish the purpose and criteria
Begin by deciding what leadership needs to know. A programme might examine whether customer requirements survive the handover from sales to operations, whether purchasing controls reflect supplier risks, or whether a new service process has become reliable. These questions give direction without preselecting the conclusion.
Criteria can include the applicable edition of ISO 9001, the organisation’s own procedures, customer commitments and relevant statutory or regulatory obligations. Identify their versions. A procedure does not become optional merely because it goes beyond a standard: if the organisation has adopted it, the auditor should understand its status and application.
Separate criteria from guidance. The Auditing Practices Group publishes educational papers, including historical material developed for ISO 9001:2015. Its papers are not additional mandatory audit criteria. A useful audit technique can be adapted; an actual requirement needs an identifiable source.
The explanation of what an internal audit is helps distinguish this assurance activity from inspection, routine supervision and certification assessment.
Design a programme around process significance
A programme coordinates audits over a period. An individual plan specifies how one audit will be performed. A calendar is useful, but it should reflect the importance of processes, changes affecting the organisation and previous audit results rather than distributing identical visits evenly across departments.
Consider customer consequences, recurring defects, outsourced activities, staff turnover, new equipment, complaints and previous corrective actions. These are possible inputs to judgement, not a mandatory scoring formula. A stable low-consequence activity may need different coverage from a recently changed release process.
Give the programme an owner with access to decision-makers. Agree resources, competence needs, reporting arrangements and how changes to the programme are authorised. A schedule that repeatedly slips because auditors have no allocated time is a management problem, not simply a clerical one.
The internal audit schedule can make coverage visible, while the frequency decision explains why one universal interval is unsuitable.
Choose auditors who can evaluate objectively
Auditors need enough knowledge of the applicable criteria, auditing techniques and process context to recognise relevant evidence. Knowing the clause numbers or holding a course certificate does not by itself demonstrate that capability. Observation of an audit, review of findings and feedback can help evaluate competence.
Objectivity also requires attention to conflicts. Someone who designed, approved and operates a control may struggle to assess it independently. Cross-functional assignments, reciprocal arrangements or external support can help smaller organisations. Document the reasoning and remaining limitations rather than assuming that a different job title eliminates every conflict.
Do not confuse independence with unfamiliarity. An auditor can understand a process deeply while avoiding responsibility for the work being evaluated. Technical experts can support understanding without taking over the auditor’s judgement.
Prepare an individual audit plan
Define objectives, scope, criteria, methods, locations, participants and timing. Identify the process boundaries and important interfaces. Confirm access to records, people and relevant systems before the audit, especially where shifts, outsourced operations or remote access affect availability.
Review enough information to target the work: process descriptions, performance results, complaints, changes and earlier findings. Avoid requesting every document in the system merely to demonstrate preparation. The audit plan turns these decisions into an operational arrangement.
A checklist can prompt useful questions, but it should leave space for evidence references and follow-up. Do not treat its sequence as a barrier to tracing an unexpected issue. The internal audit checklist explains how to build a working aid without turning it into a false statement of universal requirements.
Follow the process through actual work
Start with a real transaction, product or service case. Ask how the requirement entered the system, who reviewed it, what controls applied, how exceptions were handled and how completion was authorised. Follow the handovers rather than interviewing each department in isolation.
For example, an auditor examining an installation service might trace a customer specification into a work order, the competence of the assigned installer, equipment checks, the installation record and customer acceptance. This is a fictional audit trail. A different operation will require a different selection of evidence.
Use interviews to understand the work, observations to see relevant activities and records to test claims. Each form has limitations. An interview is not automatically unreliable, and a signed form is not automatically persuasive. Corroboration becomes especially useful when information conflicts.
| Audit question | Possible evidence | Follow-up judgement |
|---|---|---|
| Were requirements understood? | Accepted order and review record | Were later changes communicated? |
| Was work controlled? | Observation and work instructions | Did the method match actual conditions? |
| Was release justified? | Results and release authorisation | Could an unresolved exception bypass approval? |
| Did corrective action work? | Later cases and performance data | Was there a genuine opportunity for recurrence? |
The article on audit evidence examples discusses reliability, traceability and sampling limits in greater depth.
Sample deliberately and state limitations
Internal audits generally examine samples. Select cases that fit the objectives, such as changed orders, different shifts, exceptions, new suppliers or previous problem areas. Explain why the sample is informative. Convenience alone may hide the conditions most likely to reveal weaknesses.
There is no universal sample size that makes every internal audit adequate. Consider population variation, consequence, available time and what the first evidence shows. Expand the trail when contradictions or wider risks emerge. Record material exclusions and untested areas so management does not infer complete assurance from limited coverage.
An inability to obtain evidence also needs careful handling. Distinguish unavailable information, a scope limitation and evidence that a required record was not retained. These situations do not necessarily support the same finding.
Form findings from evidence and requirements
A nonconformity needs a requirement that was not fulfilled and evidence supporting that conclusion. Write the finding so someone who was not present can understand the problem. Avoid vague labels such as poor ownership or inadequate culture without describing the relevant facts and criterion.
A conforming result, an improvement suggestion and a nonconformity are different outputs. Do not hide a demonstrated failure inside an observation simply to make the report seem positive. Conversely, an auditor’s preferred method is not a requirement unless an applicable criterion makes it one.
Discuss factual accuracy with the process owner before the closing meeting. This allows misunderstandings to be corrected without negotiating away inconvenient evidence. Where disagreement remains, record it through the organisation’s agreed process.
Report for decisions and follow-through
Report the objectives, scope, criteria, dates, people involved, relevant sample limitations, findings and overall conclusions. Explain what the evidence supports about process performance. A report containing only isolated defects may miss a consequential weakness at an interface.
Assign responsibility for responding to findings. The process owner should distinguish immediate correction, investigation of cause and corrective action. The auditor may clarify evidence but should avoid prescribing a solution that later compromises objective evaluation of its effectiveness.
Management needs visibility of overdue actions and repeated failures. A finding is not resolved merely because someone uploaded a revised procedure. Closure decisions should follow the organisation’s defined arrangements and distinguish action completion from demonstrated effectiveness.
Evaluate whether the programme is working
Judge the programme through useful coverage, reliable conclusions, timely communication and the effect of follow-up. Counting findings or requiring every auditor to identify a fixed number of problems creates incentives that can distort evidence-based judgement.
Review whether audits examine changing risks and process interactions. Consider whether the same findings recur, whether management acts on cross-functional issues and whether auditors have enough time and capability. Modify the programme when experience shows gaps.
An internal audit provides assurance within its scope and limitations. Combining it with performance monitoring, customer feedback and management review gives leadership a broader basis for decisions. The objective is a working learning system, with evidence moving from actual operations into informed action.
Keep the programme proportionate
A small organisation may coordinate its programme through a concise schedule and a few controlled records. A larger organisation may need coordinated site coverage, specialist auditors and formal escalation arrangements. Both should be able to explain how the selected approach addresses the organisation’s actual processes and consequences. More paperwork does not necessarily provide stronger assurance. Before adding a new form, ask which decision it supports, who uses the information and whether existing records already answer the question. Retain enough evidence to show what was planned, performed, concluded and followed up.
Internal audits can also support the organisation’s implementation readiness assessment, while remaining distinct from the independent Stage 2 certification assessment. Keep the purpose of each evaluation clear when planning evidence and management decisions.