An ISO 9001 internal audit is an organised evaluation of an organisation’s quality management system against agreed requirements. It asks whether arrangements are implemented and effective, using evidence from actual activities. It is commonly described as a first-party audit because it is performed for the organisation’s own purposes, even when an external specialist carries it out on its behalf.
The activity is broader than checking whether forms have signatures. It connects customer requirements, process controls, responsibilities and results. The internal audit guide explains how these evaluations fit into a coordinated programme.
Define what is being evaluated
An audit has objectives, a scope and criteria. The objective explains the question to be answered. The scope identifies the activities, locations or process boundaries covered. Criteria identify the requirements against which evidence will be evaluated.
For example, a fictional repair company might audit the control of customer-requested changes from quotation through release. Its criteria could include its order-review procedure, the agreed customer specification and relevant QMS requirements. Its scope might exclude an unrelated maintenance operation. A clear boundary prevents readers from interpreting the conclusion as an assessment of the entire organisation.
ISO 9001 is the requirements reference for an ISO 9001-based QMS. ISO 19011 offers auditing guidance. Public APG papers can provide educational ideas, including examples developed for an earlier edition, but they do not create extra mandatory requirements.
Distinguish auditing from everyday checks
A supervisor may inspect a product, approve a transaction or verify completion of a task every day. These controls belong to operation of the process. An internal auditor examines whether the arrangements and their implementation provide confidence that intended results can be achieved.
An inspection might identify a missing label on one item. An audit might trace why label requirements were not communicated, whether release controls detect omissions and whether similar orders were affected. Both activities can be useful, but they answer different questions.
Similarly, a management review uses information to make leadership decisions. An internal audit supplies one source of evidence for that review. Calling an operational meeting an audit does not establish that its scope, criteria, evidence and objectivity are adequate.
Decide who can carry it out
The organisation needs people who can understand the relevant requirements and evaluate evidence fairly. Competence may come from a combination of training, practical experience, supervised audits and technical knowledge. A course attendance certificate records participation; it does not automatically establish competence for every audit assignment.
Auditors also need objectivity. A person should not simply approve their own work as an independent assessment. In a small business, cross-functional auditing or external assistance may be useful. The choice should address actual conflicts, not merely change the name on the report.
An external consultant can conduct an internal audit on the organisation’s behalf. This does not convert it into an accredited certification audit. The purpose and commissioning relationship distinguish the audit type.
Understand the evidence and outputs
Evidence may include records, interviews, observations and relevant data. Its value depends on the question and its reliability. Auditors often follow a sample of completed work because inspecting every transaction is impractical. They should explain significant sampling limitations.
A finding compares evidence with a criterion. A nonconformity records an unmet requirement. A suggestion identifies a possible improvement without pretending that the auditor’s preference is mandatory. The report should preserve that distinction.
| Output | Useful content |
|---|---|
| Audit conclusion | What the evidence supports within the defined scope |
| Nonconformity | Requirement, relevant evidence and the demonstrated gap |
| Improvement suggestion | A clearly identified optional possibility |
| Follow-up record | Response, responsibilities and later evaluation |
The organisation determines reporting arrangements, but the information must be sufficiently clear for responsible managers to act. An unexplained score offers little help when nobody can identify the underlying evidence.
Follow the result into action
Suppose an auditor identifies that three sampled changed orders reached production without the required technical approval. Correcting those orders addresses the immediate cases. Investigating the workflow may reveal that the system accepts changes without routing them to the approver. Changing that mechanism and checking later cases addresses a different question: preventing recurrence.
The internal auditor should not assume that assigning training will resolve every finding. Nor should the process owner close the issue solely because an action was marked complete. The follow-up process needs evidence appropriate to the cause, action and consequence.
Recognise the limits of assurance
A favourable internal audit does not certify the organisation, guarantee defect-free output or eliminate the need for operational controls. Its conclusion is bounded by the scope, methods and evidence examined. Another audit, complaint or measurement result may expose a condition the sample did not encounter.
That limitation does not make auditing ineffective. It makes transparent planning and reporting necessary. A useful internal audit provides an independent view of how work is controlled, highlights gaps that management can address and helps test whether previous improvements have become part of normal practice.