ISO 9001 internal audit: how to plan, conduct and report one the certification body will respect

What ISO 9001 clause 9.2 requires

An internal audit is the organisation checking itself: whether the quality management system conforms to your own requirements and to ISO 9001, and whether it is effectively implemented and maintained. Clause 9.2 requires it at planned intervals, through a programme that defines frequency, methods, responsibilities, planning requirements and reporting, and takes account of the importance of each process and the results of previous audits. Each audit has defined criteria and scope. Three conditions follow:

• Objectivity and impartiality. Auditors are selected, and audits conducted, so that the process is objective and impartial. In practice, nobody audits their own work.
• Reporting. Results reach the relevant managers, and audit results feed the management review in clause 9.3.
• Action. Nonconformities go through the corrective action requirements of clause 10.

Documented information must be available as evidence of the programme and its results. The certification body relies on it: Stage 1, its readiness review, checks that internal audits and management reviews are planned and performed; Stage 2 and each surveillance audit examine them.

ISO 19011: the method behind a credible audit

ISO 19011, Guidelines for auditing management systems, turns the requirement into a method: principles of auditing, managing an audit programme, conducting audits and evaluating auditor competence. It is guidance, not a certifiable standard. The fourth edition, ISO 19011:2026, published in May 2026, replaced the 2018 edition and expands the guidance on remote auditing and digital tools.

Its principles are integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach and a risk-based approach. For internal audit, two matter most: independence from the activity audited wherever practicable, and conclusions drawn from verifiable evidence rather than impressions. Use its vocabulary precisely:

• Audit programme: the arrangements for a set of audits over a period, usually a year.
• Audit plan: one audit's objectives, scope, criteria, timing, auditees and auditors.
• Evidence, findings and conclusion: verifiable information relevant to the criteria; that evidence evaluated against the criteria as conformity or nonconformity; and the overall outcome, weighed against the audit's objectives.

A checklist is a working document that supports the plan. It should never limit where the evidence leads.

An annual programme for a single-site company

A single-site company of 30 to 150 people can cover the whole scope once a year, revisit higher-risk processes and share the work among three or four trained auditors from different departments.

Before initial certification, compress this so that one full-scope cycle, with findings acted on, is complete before Stage 2. Add audits when complaints, new products or new managers call for them.

Conducting the audit, step by step

Prepare and open

Send the plan to the process owner a week ahead; read the procedure, last report and recent complaints; list the records to sample. The opening meeting can take ten minutes: scope, timetable, interviewees and how findings will be reported. The audit examines the process, not the person.

Interview, observe and sample

Ask the people who do the work to show you, at their workplace, with open questions: what happens when a customer changes an order? Watch the task and compare it with the documented method. Choose samples yourself, across weeks, customers or products, and trace one case end to end, such as a complaint from receipt to verified corrective action.

Write the finding: requirement, evidence, gap

State the requirement, evidence someone else could check, and the gap as fact:

• Requirement: the purchasing procedure requires each approved supplier to be re-evaluated annually.
• Evidence: of eight approved suppliers sampled, three had no re-evaluation in eighteen months, including the supplier behind last month's complaint.
• Gap: suppliers are not re-evaluated at the frequency the procedure sets.

At the closing meeting, confirm the facts with the process owner and agree a date for the corrective action plan.

Grading, reporting and closing findings before Stage 2

ISO 9001 prescribes no grading scheme, so define one in your audit procedure, ideally in the certification body's terms: a major nonconformity affects the system's ability to achieve its intended results, a minor one does not, and an opportunity for improvement records a better way where nothing is wrong.

The report gives the scope, criteria, auditors, samples, findings with evidence, and a conclusion on whether the process conforms and is effective; issue it within days to the process owner and top management.

To close a nonconformity, the process owner records the correction, root cause and corrective action, and the auditor confirms the action worked. A revised procedure is not that proof; three months of suppliers re-evaluated on time is. Leave several weeks between the full-scope audit and Stage 2. Certification auditors expect findings that were fixed, not an audit without findings, and sample closed ones to check.

Running it in Effivity

A master schedule sets which processes are audited when, each audit has a plan with auditor, auditee, location and date, and alerts flag what is due. Nonconformities from the audit report pass to the nonconformity module for root cause, corrective action and the effectiveness check, with reminders when actions run late. Effivity, used in 50+ countries, is included with the engagement, at no additional cost.

Who should audit: independence and competence

ISO 9001 names no internal auditor qualification. Auditors fall under the competence requirements of clause 7: competence determined for the role, acquired through education, training or experience, and evidenced by documented information. ISO 19011 adds guidance on what auditor competence includes and how to evaluate it. In a small company, trained people from different functions audit each other's areas, and a colleague or external auditor covers the quality lead's own processes, including the programme itself.

Internal auditor training for your audit team is part of a Sterling engagement, as applicable to your standard. Listed among the Sterling Academy courses for an ISO 9001 programme, it is delivered by your Sterling consultant with practical exercises on your own processes and leads to a Certificate of Competence. Through their Sterling consultant, Sterling consulting clients receive preferential Sterling Academy course access and special pricing, including complimentary awareness training for their people as part of the engagement.

Four internal audit mistakes to avoid

• Auditing your own work. People who audit their own procedures find what they expect to find, and certification auditors check who audited what.
• Checklist-only audits. Yes-and-no answers against clause numbers, filled in at a desk, are not evidence. Samples, interviews and observation are the audit.
• No follow-up. Findings that are never verified tell the certification auditor the programme does not work.
• Audits the day before Stage 2. Nothing they find can be acted on in time, so Stage 2 meets open findings with no cause analysed.

ISO 9001 internal audit: questions buyers ask