Useful ISO 9001 internal audit questions help an auditor understand how work is controlled and whether evidence supports the intended result. They progress from an explanation of the process to examination of particular cases. A long list of closed questions can produce reassuring answers while revealing little about actual performance.
Questions should follow the objectives and criteria of the assignment. The internal audit guide explains how those decisions shape the evidence trail. The examples below are original prompts, not official ISO clause wording or a universal question bank.
Begin with the process and its purpose
Start by asking what the process delivers, who receives its output and how the person knows that output is acceptable. These questions establish context before moving into records. They also expose differences between a written process description and the way participants understand their responsibilities.
Ask how work enters the process, how priorities are decided and what happens when information is incomplete. A process owner should be able to explain important interfaces even when another department performs part of the work.
Do not assume that a polished explanation proves implementation. It provides a map for choosing evidence. Conversely, difficulty using technical quality terminology does not prove that an employee performs the task incorrectly.
Move from general answers to specific cases
After understanding the claimed method, select a real example. Ask the person to show how that case was handled and which records support the explanation. Specific references help distinguish a normal practice from a hypothetical account of what ought to happen.
For a changed customer order, useful questions might include: who accepted the revised specification, how did operations receive it, what happened to the superseded instruction, and how was the completed work checked? Follow the answers across the relevant handover.
If the interviewee supplies only an unusually straightforward example, consider other cases that fit the objectives. The auditor remains responsible for sample selection and should explain significant limitations.
Use open, focused and checking questions deliberately
Open questions invite explanation. Focused questions test a particular claim. Checking questions help confirm that the auditor has understood an answer accurately. Combining these forms is usually more informative than relying entirely on one style.
| Purpose | Example prompt |
|---|---|
| Understand the method | How do you decide which checks this job needs? |
| Examine implementation | Show how those checks were recorded for this job. |
| Examine an exception | What happened when the required equipment was unavailable? |
| Check a handover | How did the next person know the specification had changed? |
| Confirm understanding | Have I understood that release can proceed only after this approval? |
Use neutral language. Asking why an employee ignored the procedure assumes a conclusion before establishing the facts. Asking what happened in the selected case leaves room to discover a different explanation.
Examine exceptions and consequences
Normal cases may not test important controls. Ask how the process handles incomplete information, absent approvers, rejected material, urgent orders and system outages where those conditions are relevant. The purpose is to understand resilience, not to invent implausible scenarios.
An exception record can reveal whether authority is clear and whether affected requirements were considered. If someone describes an informal workaround, determine its actual status and effects before labelling it a failure.
Questions about consequences also matter. Ask who is informed when an output is unsuitable and how similar work is assessed. A local correction may leave a wider affected population unexamined.
Avoid coaching and interrogation
Do not put the preferred answer into the question. Asking whether staff always use the approved form makes agreement easy without demonstrating the work. Ask how the relevant information is controlled, then examine evidence.
Allow people time to find records and explain unfamiliar terms. Adjust communication to language, accessibility and role without changing the criterion. The audit is an evaluation of the system, not a memory test of clause numbers.
If an answer conflicts with other evidence, describe the difference calmly and seek clarification. Separate a missing explanation from evidence that a requirement was not fulfilled. Corroborate consequential conclusions where possible.
Retain the answer’s context
Working notes should preserve enough detail to connect the answer with the case, date or process examined. Avoid recording unnecessary personal information or copying customer data when a controlled identifier is sufficient.
The audit checklist can provide space for question prompts, evidence references and unresolved enquiries. Keep an unanswered question visible until it is resolved or reported as a limitation.
A strong question is useful because of what it helps the auditor establish. The final finding must rest on requirements and evidence, not on whether an interviewee gave the answer the auditor expected.
When several people describe different versions of the same handover, compare their accounts with actual cases and current instructions. The disagreement may reveal a communication problem, but first check whether different roles legitimately follow different routes. Preserve the distinction between variation that is authorised and variation that creates an uncontrolled outcome.