Guide

ISO 9001 internal audit guide

Clause 9.2 of ISO 9001 requires internal audits at planned intervals to check the QMS conforms and is effectively implemented. Done well, internal audits find problems before your certification body does. This guide covers how to build the programme, run an audit and follow up properly.

• Meets the clause 9.2 requirements
• Practical sampling and reporting advice
• Ties findings into corrective action

What clause 9.2 requires

• An audit programme with frequency, methods, responsibilities and reporting
• Programme priorities based on the importance of processes, changes and previous results
• Defined criteria and scope for each audit
• Auditors who are objective and impartial, so people do not audit their own work
• Results reported to relevant management, with corrections and corrective actions taken without undue delay
• Retained evidence of the programme and the results

Building the programme

Most organisations cover every process and clause over a twelve month cycle, auditing higher risk or recently changed processes more often. A simple calendar listing process, clause references, auditor and month is enough, as long as you keep it up to date.

Running a single audit

• Prepare: read the procedure, previous findings and relevant KPIs
• Sample: follow real transactions, such as an order, a complaint or a new starter
• Interview the people doing the work, not only the process owner
• Record objective evidence for every finding, both positive and negative
• Grade findings consistently, for example major, minor and opportunity for improvement

Follow up that holds up

Every finding needs an owner, a root cause, an action and a date. Close it only once you have checked the action worked. Unverified closures are one of the most common certification findings.

Next steps

1. Plan the year. Map processes and clauses to months, weighted by risk.
2. Audit with evidence. Sample real records and talk to the people doing the work.
3. Close the loop. Raise corrective actions and verify effectiveness before closing.

Frequently asked questions

Can we use an external internal auditor?

Yes. Many smaller organisations use a consultant to keep audits impartial, especially where the quality lead would otherwise audit their own work.

How often should internal audits happen?

The standard says at planned intervals. Annual coverage of the full scope is the common baseline, with more frequent audits for higher risk areas.

Do auditors need a qualification?

ISO 9001 requires competence, not a specific certificate. Training against ISO 19011 is a sound way to show competence.

Related guides

• ISO 9001 requirements guide, Every requirement of ISO 9001, what it means in practice and the evidence auditors expect.
• ISO 9001 clauses explained, Clauses 4 to 10 in plain English, with the records each one produces.
• ISO 9001 readiness assessment, Check whether you are ready to book your certification audit.

Run your audit programme in one place

Plan audits, record findings and drive corrective actions to verified closure, with an A.I. planning analyst drafting scope and questions for your review.