ISO 9001 clause 9.2.1: establish the purpose of internal audit
ISO 9001:2026 clause 9.2.1 requires internal audits at planned intervals to provide information about whether the QMS conforms to the organisation's own requirements and the standard, and whether it is effectively implemented and maintained. These are related questions, but they are not interchangeable. A process may follow an inadequate local procedure, or have an adequate procedure that is not used.
What clause 9.2.1 requires in practice
Clause 9.2.1 sets the purpose of internal audit. The organisation conducts audits at planned intervals so that it receives information on two questions. The first is conformity: does the quality management system meet the organisation's own requirements for it, and does it meet the requirements of the standard? These are two separate sets of criteria, and an audit can find that work follows the standard but not the company's own procedure, or the reverse. The second question is effectiveness: is the system actually implemented and maintained, meaning that it is applied in daily work and kept up to date as the business changes? The clause therefore expects audits to look at real practice and not only at documents. The output is information for the organisation, not a pass or fail mark, and what is done with that information is covered in clause 9.2.2 and in management review.
Use both sets of requirements as criteria
The organisation's own QMS requirements include the arrangements it has established for its processes, where applicable to the audit. ISO 9001 provides another set of relevant criteria. An auditor needs to understand both and avoid assuming that conformity to one automatically establishes conformity to the other.
For example, a local procedure may omit a necessary control required by the standard. Staff following that procedure consistently would not remove the QMS gap. Conversely, an organisation may establish a relevant internal control beyond the standard's explicit wording; an audit can assess whether that control is followed without pretending that ISO itself prescribes the chosen method.
An auditor's preference is different from an audit criterion. A spreadsheet, workflow or meeting format should not be declared nonconforming solely because the auditor prefers another tool. Identify the requirement and evidence before drawing the conclusion. Suggestions can be useful, but they should remain clearly distinguishable from findings of nonconformity.
Look for implementation and maintenance
Effective implementation concerns whether the arrangements operate and achieve their intended result. Maintenance concerns whether the QMS continues to be sustained as conditions change. Published documents and initial training records can contribute evidence, but they do not by themselves demonstrate either outcome.
Trace a relevant sample of actual work. Compare instructions, records, observations and explanations where appropriate. A process owner may accurately describe the intended method while the sampled transaction shows a different practice. Explore the discrepancy fairly before reaching a finding, rather than treating one person's statement as conclusive.
Why clause 9.2.1 matters to the business
Clause 9.2.1 is the reason internal audits exist, and being clear on it keeps them useful. If audits are seen only as a check that paperwork is in order, they miss the gap between what the system says and what people do, which is where most quality failures start. Treating audit as a source of information on conformity and effectiveness lets management see whether its own rules are being followed, whether they are still the right rules, and whether the standard is met. That clarity helps the business decide where to simplify, where to tighten control and where to invest in training, and it prepares the organisation for external assessment accurately rather than cosmetically.
How to implement clause 9.2.1
Make the purpose explicit so that every audit is designed to answer the two questions. A useful habit is to draft the audit questions with the process owner, which tends to surface the organisation's own rules that would otherwise be missed, and to retain space for what the auditor sees on the day.
- State in the audit programme that each audit examines conformity to the organisation's own requirements, conformity to the standard and effective implementation and maintenance.
- List the organisation's own requirements that matter for each process, such as procedures, customer commitments and internal rules, as audit criteria alongside the standard.
- Prepare questions that test practice, for example asking an operator to show how a step is done.
- Include a check that arrangements have kept pace with change in people, tools and customer demands.
- Record findings against the specific criterion that was not met, so that it is clear which of the two requirement sets applies.
- Distinguish findings about conformity from observations about how well the system is working.
- Share conclusions with process owners in terms of what the audit tells them, not only what is wrong.
Illustrative BPO example: a required second check
A BPO provider requires a second check for a defined category of high-value transactions. The internal audit samples transactions in that category and finds completed check fields. Interviews and timestamps indicate that some checks were added after the transaction had already been released.
The auditor evaluates the evidence against the organisation's control requirement and relevant QMS criteria. The question is not simply whether the field is populated, but whether the check operated at the required point and served its intended purpose. The finding describes the sampled evidence and departure without claiming that every transaction in the period was affected.
Illustrative construction example: a changed work instruction
A contractor revises an installation instruction after a design coordination change. An internal audit follows the instruction from approval through availability at the work location and completed inspection evidence. The audit finds that one subcontract team still uses the superseded issue.
The evidence indicates a weakness in maintaining the current arrangement, even though the approved master document is correct. The report identifies the relevant requirement and affected sample so management can respond. The audit does not prescribe the engineering correction itself; that decision belongs to the competent people and applicable project controls.
Recognise what audit evidence can establish
Internal audits usually examine selected evidence rather than every transaction. Conclusions should reflect the scope, methods and evidence obtained. Sampling does not make audit useless, but it means a clean sample should not be presented as proof that no failure exists anywhere in the QMS.
Planned intervals should support a continuing view of the system. The standard does not prescribe one annual audit for every process. The programme needs to reflect the considerations in clause 9.2.2, including process importance, previous results and changes. Routine monitoring and internal audit serve different purposes and should support each other.
Common weaknesses include auditing only procedure headings, accepting unsupported explanations, and turning every improvement suggestion into a nonconformity. Another is treating an internal audit as preparation solely for a certification visit. Its primary value is useful information for the organisation about its own system.
Common nonconformities with clause 9.2.1
Typical findings show the purpose of audit being narrowed or misunderstood.
- Audits test only the standard and ignore the organisation's own procedures and commitments.
- Audits check that documents exist but never test whether work follows them.
- No evidence shows whether the system is maintained after changes in process or staffing.
- Audit conclusions are expressed as a pass or fail for a department instead of information about the system.
- The same weakness appears in successive audits because the cause of the gap between rule and practice is not examined.
Frequently asked questions
Is following our procedure enough to demonstrate conformity?
Not necessarily. The audit also considers relevant ISO 9001 requirements and effective implementation and maintenance. A procedure may be incomplete, or its operation may not achieve the intended result despite apparent compliance with its steps.
Can an auditor recommend a different method?
A suggestion may be appropriate, but it should not be confused with a requirement. A nonconformity needs a relevant criterion and supporting evidence. Personal preference alone is not a sound basis for declaring the existing method unacceptable.
Does an internal audit prove the organisation will be certified?
No. It provides information about the QMS within its scope and evidence. An independent certification body performs its own assessment and makes its own decision. Internal audit findings and their treatment can support readiness without guaranteeing an outcome.
Develop evidence-based audit skills
Sterling can help strengthen QMS audit arrangements and connect findings with improvement. Scoped use of Effivity ISO & GRC automation software can support agreed audit information needs.
The live ISO 19011 Auditing course offers a relevant route for learning management-system audit principles. For the forthcoming ISO 9001 internal-auditor course, register interest with Sterling Academy; course completion alone does not establish a professional auditor credential.