Internal audit and assurance · internal audits, supplier audits and compliance reviews
Outsourced internal audit for ISO management systems, tested before your certification body tests them.
Sterling's expert and experienced consultants plan and conduct the internal audits of your ISO management systems, audit your suppliers against your requirements and review compliance with the obligations you have taken on. You receive an audit programme, graded findings and corrective actions closed on evidence, so the certification body's audit finds a system that has already been tested.
- Internal audits for any ISO management system, alone or as one combined audit, for one site or many countries
- Supplier audits and compliance reviews in the same programme, with every finding tracked to closure in Effivity
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- A programme that stands up at Stage 1Frequency, methods and responsibilities set by the importance of each process and the results of earlier audits.
- Findings written to be closedEach one states the requirement, the evidence seen and the gap, graded in the terms your certification body uses.
- Suppliers checked where it mattersAudits of the suppliers whose failure would reach your customers, against the requirements you pass to them.
- Evidence for the management reviewAudit results reported to management, with every action tracked until it is closed.
Which systems we audit
Every management system you run, audited against its own standard and your own rules.
Each standard below expects internal audits; for those built on the harmonised structure the requirement sits in clause 9.2. The method stays the same while the criteria and sampling change, and an integrated system can be audited as one combined audit.
- ISO 9001Quality management
- ISO 14001Environmental management
- ISO 45001Health and safety
- ISO/IEC 27001Information security
- ISO 22000Food safety
- ISO 13485Medical devices
- ISO/IEC 17025Testing laboratories
- ISO 22301Business continuity
- ISO/IEC 20000-1IT service management
- ISO/IEC 27701Privacy management
- ISO/IEC 42001AI management
- IATF 16949Automotive quality
- All standards & frameworksThe full catalogue, with sector schemes
The engagement, step by step
What happens between the first call and findings closed on evidence.
Every Sterling audit engagement runs on Sterling OS™: five stages, each with named deliverables and decision owners. They apply equally to one internal audit, a year-long programme, supplier audits or a compliance review.
- 01
Scope and audit programme
Weeks 1 to 2What happens
We confirm the standards and editions, the processes, sites and shifts in scope, the suppliers that matter and any obligations to review. The programme then sets frequency, methods and responsibilities according to the importance of each process and the results of earlier audits, internal or external.
You receive
- Agreed audit scope and criteria
- Audit programme for the year, by process, site and standard
- Effivity audit schedule opened and configured for your scope
Your side
A named audit coordinator, your previous internal and certification audit reports, and the decisions on scope.
- 02
Plan and prepare
A week before each auditWhat happens
Each audit gets its own plan: criteria, scope, auditees, locations, dates and times, sent ahead so process owners can arrange their day. Documented information is reviewed in advance, so time with your people goes on sampling records and watching the work.
You receive
- Audit plan naming auditor, auditee, location and time for each session
- Checklists built from the standard, your procedures and earlier findings
- Document review notes raised before the opening meeting
Your side
Process owners available at the planned times, and access to the records, systems and sites in scope.
- 03
Conduct the audit
On site or remote, by scopeWhat happens
A short opening meeting, then interviews, observation and sampling of records against the criteria, process by process. Supplier audits apply the same method at the supplier's premises against the requirements you pass to them; compliance reviews apply it to the obligations in your register. The closing meeting presents every finding before anyone leaves.
You receive
- Findings presented and discussed at the closing meeting
- An evidence reference behind every finding
- Good practice recorded alongside the shortfalls
Your side
People doing their normal work, and answering from what they actually do.
- 04
Report and grade
After the closing meetingWhat happens
The report states the requirement, the evidence seen and the gap for each finding, graded as a major nonconformity, a minor nonconformity or an opportunity for improvement, in the terms the certification body uses. Results go to the managers responsible and into the management review.
You receive
- Audit report with graded findings
- Nonconformities logged in Effivity with owners and due dates
- A summary of results ready for the management review
Your side
An owner named for each finding, and an agreed date for each correction.
- 05
Close and verify
Before the next audit or Stage 2What happens
Each owner records the correction, the root cause and the corrective action; the consultant then checks on fresh evidence that the fix worked before the finding is closed. Anything still open is carried into the next audit.
You receive
- Corrective actions verified and closed on evidence
- An effectiveness check recorded against each nonconformity
- The programme updated for the next round of audits
Your side
Carrying out the corrective actions, and keeping the records that show they worked.
Who does what
Choose how much of the work Sterling carries.
Two delivery models, one method. Under Design™ your own auditors carry out the audits, with a Sterling consultant building the programme, coaching the team and reviewing every report. Under Drive™ Sterling consultants conduct the audits for you, under your approval. Effivity, the accountability and the all-inclusive proposal work the same way in both.
| Task | Design™ guided | Drive™ fully managed |
|---|---|---|
| Scope, criteria and audit programme | Sterling | Sterling |
| Audit plans and checklists | Together your auditors draft, Sterling reviews | Sterling sent to you for approval |
| Internal audits of your processes | Your team your trained auditors, Sterling coaches | Sterling conducted for you |
| Supplier audits | Together Sterling leads, your auditor takes part | Sterling on site or remote, as agreed |
| Compliance reviews against your obligations register | Together your team keeps the register, Sterling tests it | Sterling with your legal or compliance lead |
| Audit reports and grading of findings | Together your auditors write, Sterling reviews | Sterling |
| Effivity audit schedule and findings log | Sterling | Sterling |
| Corrective actions and their evidence | Your team Sterling verifies closure | Your team Sterling verifies closure |
| Acceptance of findings and the decisions taken in management review | Your management never Sterling | |
Not sure which model fits? Organisations with trained auditors who need structure and better reports usually choose Design™; those without trained auditors choose Drive™. The discovery call settles it in ten minutes.
What you receive
Everything an audit programme needs. Nothing charged separately.
- Audit programmeThe year planned by process, site and standard, with frequency and methods set by importance and earlier results.
- Audit plansOne for each audit: criteria, scope, auditees, locations and times, sent ahead of the opening meeting.
- ChecklistsBuilt from the standard, your own procedures and earlier findings, so each audit tests what matters now.
- Graded audit reportsRequirement, evidence and gap for every finding, graded in the terms the certification body uses.
- Supplier audit reportsFindings at the suppliers that matter, with the actions you require of each one and the dates.
- Compliance review reportYour obligations register tested against what happens in practice, with each gap given an owner.
- Corrective actions closedCorrection, root cause, corrective action and an effectiveness check for every nonconformity, tracked in Effivity.
- Trained auditorsInternal auditor training for your audit team, as applicable to your standard, so audits between our visits keep their quality.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessHow we price
One all-inclusive proposal. Every component visible. No surprises, ever.
Audit days vary with the standards, the processes, sites and shifts in scope, the headcount, the suppliers to be visited and the mix of on-site and remote work, so a Sterling proposal is built for your programme. What does not change is how the proposal works.
- One all-inclusive proposal for Sterling's work, software and learning. Consulting, Effivity and Sterling Academy access in one figure; the fee does not move when the work takes longer than we planned.
- Certification-body fees identified separately. The body's audit days, travel and surveillance arrangements are shown as their own line, so the full programme cost is comparable across proposals.
- Payment milestones tied to deliverables, not to the calendar: the gap analysis report, the documented system, the internal audit, the certificate.
- Deliverables, responsibilities, assumptions and exclusions in writing, and nothing to sign to receive the proposal.
To prepare your proposal we need
- The standards and editions to be audited
- The processes, sites and shifts in scope
- Approximate headcount, and the suppliers you want audited
- Your latest internal and certification audit reports, if you have them
- The date of your next certification or surveillance audit
That is enough for a scoped, all-inclusive proposal from a Sterling consultant in your region. There is no need to prepare a manual first.
Request a scoped proposalA Sterling consultant replies within one working day.
Standards
Standards this service covers
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- ISO 14001ISO 14001 certification consulting: aspects, impacts and compliance obligations controlled, with support until an accredited body certifies you.
- ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
- ISO 13485ISO 13485 certification consulting for medical device makers: design controls, risk, traceability and complaints, prepared for an accredited audit.
- ISO 22000ISO 22000 certification consulting: PRPs, a validated hazard control plan, traceability and recall readiness, built with your teams for an accredited audit.
- IATF 16949IATF 16949 certification consulting for automotive part makers: defect prevention, less variation and waste, prepared for an IATF-recognised body's audit.
- AS9100AS9100 certification consulting for aerospace and defence suppliers: ISO 9001 plus product safety, configuration and FAI, ready for an IAQG scheme audit.
- ISO/IEC 17025ISO/IEC 17025 accreditation consulting for testing and calibration laboratories: competence, impartiality and evidence ready for accreditation assessment.
Don’t settle for a tick-box audit
Sterling against the alternatives.
There are four common ways to get an internal audit done. Three of them produce a report that the certification body, a customer or your own management cannot rely on. This is what each route actually gives you.
| What you get | Untrained staff, do it yourself | Tick-box audit seller | Freelance auditor | Sterling |
|---|---|---|---|---|
| An audit built around your operation | Only if your auditors are trained and have the time | No: a generic checklist with your name on it | Depends on the individual | Yes: criteria from the standard, your procedures and earlier findings |
| Your audit team developed | Not included | Not included | Sometimes, at extra cost | Included: coaching for your auditors and Sterling Academy access |
| Software to track findings | Paid separately | None | Paid separately | Effivity, included at no additional cost |
| Findings closed before the external audit | If you know how | Report issued, nothing verified | Sometimes | Always: closure verified on fresh evidence |
| Findings graded as the certification body grades them | Rarely | No: everything recorded as an observation | Depends on the individual | Yes: major, minor and opportunity for improvement |
| Who is accountable if the external audit goes badly | You | Nobody | The individual, if still available | Sterling, under the Sterling Promise |
| Fee transparency | Staff time, rarely counted | Low price, thin report | Day rates, open-ended | One all-inclusive proposal for the agreed programme |
| After the report | On your own | Gone | Another contract | Sustain™: the programme continues, year after year |
Sterling's position. Sterling does not certify. We consult, train and prepare you; an independent, accredited body audits and decides. We do not sell certificates without implementation, and we tell you when an offer you have received is one. All ten warning signs of shortcut certification · How to check any ISO certificate
Client experience
On the record: what clients say about working with Sterling.
The managing partner thanks Sterling, on behalf of the firm, for guiding it through the process of achieving ISO 9001 certification, and records that the firm completed and passed the certification audit with no major nonconformity.
The managing partner writes that the team helped standardise engagement planning, review controls, document management and corrective actions without adding administration, and that the resulting quality system gives partners clearer oversight and supports more consistent client delivery.
The IT risk manager writes that the engagement clarified the company's responsibilities across payment processes, technology environments and internal controls, and that the structured approach, evidence review and readiness activities helped it organise its compliance effort and strengthen security practice.
The finance controller and the production director write that the efficient handling of documentation, audits and training let the company meet its certification deadline, and that the templates provided streamlined the documentation and helped it meet the required compliance standards.
Each account is drawn from a signed letter or e-mail on file and reported in our words, with the signatory's role and organisation attached; the original letters are available on request. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions clients ask before they engage us.
The answers for your own programme come from the discovery call; these cover what buyers of outsourced internal audit ask first.
Can an ISO internal audit be outsourced?
Yes. The ISO management system standards require internal audits at planned intervals, by auditors selected to ensure objectivity and impartiality; they do not require those auditors to be your employees. Many organisations outsource the whole programme, or only the areas their own auditors cannot audit objectively. The organisation still owns the programme: it approves the scope, receives the results and decides the actions.
Can our certification body carry out our internal audits?
No. ISO/IEC 17021-1, the rules certification bodies work under, treats a certification body carrying out internal audits for its certified clients as a significant threat to impartiality. Internal audits are done by your own trained people or an outside provider. At Stage 1 the body then checks that internal audits are being planned and performed, and Stage 2 examines them again.
How often should internal audits be done?
At planned intervals that you set, based on the importance of each process and the results of earlier audits; the ISO management system standards do not fix a frequency. Covering the whole scope at least once a year, with the riskiest processes visited more often, is a common and defensible pattern. IATF 16949 and some sector schemes set their own cycles, and the programme follows them.
Which method do your consultants follow when auditing?
The standard being audited sets the requirements; ISO 19011 gives the method. ISO 19011:2026, the fourth edition, published in May 2026, is guidance on auditing management systems: the principles of auditing, managing an audit programme, conducting audits and evaluating auditor competence. It is not a certifiable standard. Our programmes, plans and reports follow its structure, including its guidance on remote auditing.
Do you audit our suppliers as well?
Yes. Supplier audits apply the same method at the supplier's premises, or remotely where that is agreed, against the requirements you pass to the supplier, from specifications and contract terms to your own quality or security clauses. You choose which suppliers are audited, usually those whose failure would reach your customers; we plan, conduct and report, and each supplier's corrective actions are tracked alongside your own.
What is a compliance review?
A compliance review tests whether the legal, regulatory, contractual and customer obligations you have recorded are actually being met in practice. The consultant samples the evidence behind each obligation in your register and reports the gaps, including obligations missing from it. It is not legal advice and does not replace your legal counsel.
Can several standards be audited in one visit?
Yes. Where you run an integrated system, the standards can be audited together as a combined audit, a term ISO 19011 itself uses: one plan, one audit team and one report, with each finding traced to the standard it relates to.
Will outsourced internal audits help us pass the certification audit?
They make the outcome far more predictable. Findings raised and closed before Stage 2 are findings the certification body does not have to raise, and its auditor sees an audit programme that is planned, performed and acted on. The certification decision still belongs to the independent, accredited certification body; Sterling does not certify.
How soon can the first audit take place?
As soon as the scope is agreed and the audit plan has reached your process owners. If a certification or surveillance audit is close, give us its date on the discovery call: the first internal audit is then planned early enough to close its findings on evidence before the external auditor arrives.
Keep exploring
More Sterling services
Talk to a consultant
Plan an internal audit programme that stands up to scrutiny.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice