ISO 9001 clause 9.2: make internal audit useful

What clause 9.2 requires in practice

Clause 9.2 requires internal audits at planned intervals that tell the organisation two things about its quality management system: whether it conforms to the organisation's own requirements and to the standard, and whether it is effectively implemented and maintained (clause 9.2.1). Clause 9.2.2 then asks for an audit programme covering frequency, methods, responsibilities, planning requirements and reporting. In building it, the organisation weighs how important each process is, past audit results and changes affecting the business. For each audit the objectives, criteria and scope are defined; auditors are chosen so that the process stays objective and impartial; results are reported to relevant managers; and correction and corrective action follow without undue delay. Documented evidence covers both how the programme was carried out and what the audits found. The standard points to ISO 19011 as guidance and does not mandate a fixed yearly cycle.

Understand the purpose and the programme

Clause 9.2.1 establishes the purpose and planned interval requirement. It asks whether the QMS conforms and whether it is effectively implemented and maintained. A process can have a well-written procedure yet fail to achieve the required result because people follow an outdated method or important controls are bypassed.

Clause 9.2.2 addresses the audit programme and individual audit arrangements. It covers planning, frequency, methods, responsibilities and reporting, taking account of process importance, previous audit results and organisational changes. It also covers objectives, criteria, scope, impartiality and appropriate follow-up.

Why clause 9.2 matters to the business

Internal audit is the organisation's chance to find its own weaknesses before customers, regulators or an external assessor do. Done well, it reveals where documented arrangements and real practice have diverged, where new risks have crept in and where good practice could be spread. Done as a formality, it yields a list of trivial findings that nobody values. The difference shows commercially: audits that follow the work lower the chance of failures reaching customers, make external assessments less stressful and give management dependable information. Audit also builds understanding across departments, because auditors see how other functions work and the people audited get a fresh view of their own.

How to implement clause 9.2

Build the programme around the questions the business needs answered, then make each audit specific. Where the organisation is small, consider rotating auditors between teams or bringing in an outside auditor for sensitive areas, so that independence is genuine and not merely stated.

1. Rank processes by importance to customers and by recent change, and note where past audits found problems.
2. Set the frequency and depth for each process from that ranking instead of auditing everything alike.
3. Choose auditors with enough competence and independence from the work audited, using external support where the team is small.
4. Define the objective, criteria and scope of each audit before it starts, and share the plan with those involved.
5. Gather evidence by interview, observation and record sampling, rather than reading procedures alone.
6. Report findings factually to the relevant managers and agree corrections and corrective actions with owners.
7. Check completed actions, and use the combined results to adjust the next programme.

Evidence an auditor expects for clause 9.2

Common nonconformities with clause 9.2

Common findings at this clause relate to the programme being routine rather than risk-based. These are the patterns most often seen in practice.

• Every process is audited at the same frequency regardless of importance or recent change.
• Audit plans do not state the objectives, criteria or scope, so it is unclear what was examined.
• Auditors review their own work, which undermines objectivity.
• Findings are reported but corrections are overdue with no escalation.
• Reports list procedures reviewed but give no evidence of how work was actually done.

Illustrative software example: a changed release process

Illustrative manufacturing example: supplier material control

A manufacturer has recurring issues with a supplier's material identification. The audit programme gives the affected receiving process appropriate attention because of the process importance and prior results. The auditor traces selected receipts through identification, inspection status and issue to production.

The evidence shows whether the organisation's controls prevent unsuitable material from being used. If a sampled record is incomplete, the auditor investigates its significance rather than automatically extrapolating the same failure to all stock. The report explains the evidence and limits, supporting a proportionate response and useful management understanding.

Report facts and follow through

Audit results should reach relevant managers. A finding needs enough clarity for the responsible person to understand the requirement and evidence. Vague statements such as “improve documentation” can obscure whether a nonconformity exists and what actually needs attention.

Appropriate correction and corrective action must be taken without undue delay. The response should fit the finding and its effects. Preserve evidence of programme implementation and audit results, and connect follow-up information where relevant. A calendar marked complete is not a substitute for evidence that the audits occurred and produced usable results.

Common weaknesses include repeating the same low-risk checklist every year while major changes receive little attention, auditing only document titles, and confusing an external certification visit with the internal audit programme. ISO 19011 provides auditing guidance; it is not an additional certifiable management-system standard.

Explore each numbered part