Introduction
An Internal Audit is one of the most important activities within an ISO 9001 Quality Management System (QMS). It helps organizations verify whether their quality processes are operating effectively, meeting ISO 9001 requirements, and supporting continual improvement.
Unlike external certification audits conducted by certification bodies, internal audits are performed by or on behalf of the organization. Their primary objective is not to identify faults but to evaluate process effectiveness, ensure compliance, identify opportunities for improvement, and verify that corrective actions are implemented successfully.
Organizations that conduct structured internal audits benefit from improved operational performance, better risk management, enhanced customer satisfaction, and increased confidence during certification audits.
This guide explains the complete ISO 9001 Internal Audit process, including planning, auditor responsibilities, audit checklists, clause-wise questions, reporting, corrective actions, and best practices for maintaining an effective Quality Management System.
What is an ISO 9001 Internal Audit?
An ISO 9001 Internal Audit is a systematic, independent, and documented process used to determine whether an organization’s Quality Management System conforms to:
- ISO 9001:2015 requirements
- Internal procedures
- Customer requirements
- Regulatory requirements
- Organizational objectives
The audit evaluates whether business processes are implemented effectively and whether they achieve intended results.
Internal audits provide objective evidence regarding process performance and help management make informed decisions for continual improvement.
Unlike inspections that focus on individual products, internal audits evaluate the effectiveness of entire business processes.
Why Internal Audits Matter
A well-executed internal audit delivers significant business value beyond certification.
Benefits include:
- Identifying process gaps before external audits.
- Improving process consistency.
- Enhancing customer satisfaction.
- Reducing operational risks.
- Improving employee awareness.
- Supporting continual improvement.
- Verifying compliance with documented procedures.
- Evaluating process effectiveness.
- Strengthening management decision-making.
- Improving organizational performance.
Organizations that regularly conduct internal audits often identify issues early, reducing costs associated with nonconformities and customer complaints.
ISO 9001 Internal Audit Requirements
Clause 9.2 of ISO 9001:2015 requires organizations to conduct internal audits at planned intervals.
The organization should determine whether the Quality Management System:
- Conforms to ISO 9001 requirements.
- Meets organizational requirements.
- Is effectively implemented.
- Is properly maintained.
The organization must also:
- Plan an audit programme.
- Define audit criteria.
- Determine audit scope.
- Select competent auditors.
- Report audit results.
- Maintain documented information.
- Implement corrective actions.
- Verify effectiveness.
These requirements ensure that internal audits contribute to continual improvement rather than becoming a routine compliance exercise.
Internal Audit Objectives
Every internal audit should have clearly defined objectives, such as:
- Verify compliance with ISO 9001.
- Evaluate process performance.
- Assess implementation of documented procedures.
- Confirm customer requirements are met.
- Review quality objectives.
- Evaluate process risks.
- Verify effectiveness of corrective actions.
- Identify opportunities for improvement.
- Support continual improvement.
- Prepare for certification audits.
The audit should focus on adding value to the organization rather than merely identifying faults.
Internal Audit Principles
Successful internal audits are based on several key principles:
Independence
Auditors should remain impartial and avoid auditing their own work wherever possible.
Objectivity
Audit conclusions should be based on objective evidence rather than assumptions or opinions.
Evidence-Based Approach
Audit findings should be supported by:
- Documents
- Records
- Interviews
- Observations
- Process evidence
Confidentiality
Information gathered during audits should be handled appropriately and shared only with authorized personnel.
Risk-Based Thinking
Auditors should focus more attention on higher-risk processes and areas with significant impact on quality.
Types of Internal Audits
Organizations may conduct different types of internal audits depending on their objectives.
Process Audit
Evaluates whether a specific process is operating effectively and consistently.
Examples:
- Purchasing
- Production
- Customer Service
- Sales
- Design
Department Audit
Reviews compliance within a particular department.
Examples:
- HR
- Warehouse
- Production
- Maintenance
- Finance
System Audit
Evaluates the effectiveness of the entire Quality Management System.
Product Audit
Verifies whether products meet specified quality requirements before delivery.
Internal Audit Process Overview
A structured internal audit generally follows these stages:
- Develop the annual audit programme.
- Define audit objectives, scope, and criteria.
- Select competent auditors.
- Prepare audit checklists.
- Review documented information.
- Conduct interviews and observations.
- Collect objective evidence.
- Record findings.
- Classify nonconformities.
- Prepare the audit report.
- Implement corrective actions.
- Verify effectiveness.
- Close the audit.
This systematic approach helps ensure audits are consistent, repeatable, and effective.
ISO 9001 Internal Audit Programme
An Internal Audit Programme is a structured plan that defines what will be audited, when it will be audited, who will perform the audit, and how frequently audits will occur. Rather than auditing departments randomly, organizations should establish a risk-based programme that covers all processes within the Quality Management System over a defined period, typically one year.
When developing an audit programme, organizations should consider:
- Results of previous audits
- Customer complaints and feedback
- Process complexity
- Changes in personnel or operations
- Process performance
- Business risks
- Regulatory requirements
- Strategic objectives
A documented audit programme demonstrates that internal audits are planned systematically rather than conducted only before certification audits.
Annual Internal Audit Schedule
A typical annual audit schedule may include:
| Month | Process | Auditor | Status |
|---|---|---|---|
| January | Management | Internal Auditor | Planned |
| February | Sales & Customer Service | Internal Auditor | Planned |
| March | Purchasing | Lead Auditor | Planned |
| April | Production | Lead Auditor | Planned |
| May | Warehouse | Internal Auditor | Planned |
| June | Quality Control | Lead Auditor | Planned |
| July | Human Resources | Internal Auditor | Planned |
| August | Maintenance | Lead Auditor | Planned |
| September | Calibration | Internal Auditor | Planned |
| October | Document Control | Lead Auditor | Planned |
| November | Management Review | Internal Auditor | Planned |
| December | Follow-up Audits | Lead Auditor | Planned |
Organizations should adapt the schedule according to operational priorities and business risks.
Planning an Internal Audit
Successful audits begin long before the auditor arrives.
Audit planning should include:
- Audit objectives
- Audit scope
- Audit criteria
- Audit methods
- Audit schedule
- Audit team
- Process owners
- Documents to review
- Previous audit findings
- Risk assessment
Proper planning ensures the audit remains focused, efficient, and valuable.
Defining the Audit Scope
The audit scope identifies the boundaries of the audit.
Examples include:
- Entire Quality Management System
- Purchasing Process
- Production Process
- Design & Development
- Human Resources
- Warehouse Operations
- Customer Support
- Supplier Management
A clearly defined scope helps prevent confusion and ensures all participants understand what is being audited.
Audit Criteria
Audit criteria are the standards used to evaluate conformity.
Examples include:
- ISO 9001:2015 requirements
- Organizational procedures
- Customer specifications
- Legal requirements
- Internal policies
- Work instructions
- Quality objectives
- Process KPIs
The auditor compares objective evidence against these criteria to determine conformity.
Auditor Competence
An effective audit depends on competent auditors.
Internal auditors should possess:
- Knowledge of ISO 9001
- Understanding of organizational processes
- Interviewing skills
- Observation skills
- Analytical thinking
- Communication skills
- Report writing ability
- Professional ethics
- Objectivity
- Independence
Organizations should maintain competency records demonstrating auditor qualifications, training, and experience.
Responsibilities of an Internal Auditor
An Internal Auditor should:
- Prepare for the audit.
- Review documented information.
- Conduct interviews professionally.
- Observe activities objectively.
- Collect objective evidence.
- Record findings accurately.
- Identify improvement opportunities.
- Maintain confidentiality.
- Prepare audit reports.
- Verify corrective actions.
The auditor’s role is to evaluate process effectiveness—not to assign blame.
Pre-Audit Preparation Checklist
Before conducting an audit, verify the following:
✔ Audit programme approved.
✔ Audit scope defined.
✔ Audit objectives established.
✔ Audit criteria identified.
✔ Previous audit reports reviewed.
✔ Corrective actions verified.
✔ Process documents collected.
✔ Procedures reviewed.
✔ Work instructions available.
✔ Quality records accessible.
✔ Relevant KPIs available.
✔ Process owner informed.
✔ Audit schedule communicated.
✔ Audit checklist prepared.
✔ Meeting room arranged.
Preparation reduces audit delays and improves efficiency.
Clause-wise ISO 9001 Internal Audit Checklist
Clause 4 – Context of the Organization
Audit Questions:
- Has the organization identified internal and external issues?
- Is the scope of the QMS documented?
- Are interested parties identified?
- Are customer requirements understood?
- Are organizational processes defined?
- Is process interaction documented?
Evidence:
- SWOT Analysis
- Context Analysis
- Process Maps
- Scope Document
- Interested Parties Register
Clause 5 – Leadership
Audit Questions:
- Has top management established a Quality Policy?
- Are quality objectives communicated?
- Are organizational roles clearly assigned?
- Is leadership actively supporting the QMS?
- Are responsibilities documented?
Evidence:
- Quality Policy
- Organization Chart
- Responsibility Matrix
- Management Review Records
Clause 6 – Planning
Audit Questions:
- Have risks been identified?
- Are opportunities documented?
- Are quality objectives measurable?
- Are action plans monitored?
- Is change management documented?
Evidence:
- Risk Register
- KPI Dashboard
- Improvement Plans
- Quality Objectives
Clause 7 – Support
Audit Questions:
- Are employees competent?
- Are training records maintained?
- Is equipment calibrated?
- Are controlled documents available?
- Is communication effective?
Evidence:
- Training Records
- Competency Matrix
- Calibration Certificates
- Controlled Document Register
Clause 8 – Operation
Audit Questions:
- Are customer requirements reviewed?
- Are suppliers evaluated?
- Is production controlled?
- Are inspections performed?
- Are products traceable?
- Are nonconforming products controlled?
Evidence:
- Purchase Orders
- Inspection Reports
- Supplier Evaluations
- Production Records
- Product Release Records
Clause 9 – Performance Evaluation
Audit Questions:
- Are internal audits conducted?
- Are KPIs monitored?
- Is customer satisfaction evaluated?
- Are management reviews completed?
- Are process improvements tracked?
Evidence:
- Audit Reports
- KPI Dashboard
- Customer Feedback
- Management Review Minutes
Clause 10 – Improvement
Audit Questions:
- Are corrective actions implemented?
- Is root cause analysis performed?
- Are improvement opportunities identified?
- Are recurring issues prevented?
- Is continual improvement demonstrated?
Evidence:
- CAPA Reports
- Root Cause Analysis
- Improvement Register
- Follow-up Reports
Process Audit Checklist
During process audits, verify:
✔ Inputs clearly defined.
✔ Outputs measurable.
✔ Process owner assigned.
✔ SOP available.
✔ Employees understand procedures.
✔ Risks identified.
✔ KPIs monitored.
✔ Customer requirements addressed.
✔ Records maintained.
✔ Opportunities for improvement identified.
Department Audit Checklist
Regardless of the department being audited, consider these questions:
- Are documented procedures followed?
- Are employees trained?
- Are responsibilities understood?
- Are quality objectives monitored?
- Are records complete?
- Is equipment maintained?
- Are customer requirements met?
- Are improvements documented?
Departments such as Production, HR, Warehouse, Purchasing, Maintenance, Sales, and Customer Service can all be evaluated using this framework while tailoring questions to their specific activities.
Practical Audit Example
A manufacturing company schedules an audit of its purchasing process.
The auditor:
- Reviews the Purchasing Procedure.
- Interviews the Purchasing Manager.
- Examines supplier evaluation records.
- Reviews recent purchase orders.
- Checks whether approved suppliers are being used.
- Verifies incoming inspection records.
- Records findings and opportunities for improvement.
- Issues corrective actions where necessary.
- Follows up to verify implementation.
This structured approach provides objective evidence of process effectiveness while supporting continual improvement.
Conducting an ISO 9001 Internal Audit
Once audit planning has been completed, the organization can begin the actual audit. An effective internal audit should evaluate whether processes are implemented as planned, comply with ISO 9001:2015 requirements, and achieve intended business results. Auditors should maintain professionalism, remain objective, and focus on collecting factual evidence rather than personal opinions.
A systematic audit generally includes:
- Opening Meeting
- Process Review
- Employee Interviews
- Document Review
- Observation of Activities
- Evidence Collection
- Recording Findings
- Closing Meeting
- Audit Report
- Corrective Action Follow-up
A structured approach helps ensure consistency across different audits and departments.
Opening Meeting
Every internal audit should begin with a short opening meeting involving the auditor, process owner, and relevant personnel.
The opening meeting should cover:
- Audit objectives
- Audit scope
- Audit criteria
- Audit schedule
- Department responsibilities
- Communication process
- Confidentiality
- Questions from participants
This meeting helps ensure everyone understands the audit process and reduces uncertainty.
Interviewing Employees During the Audit
Interviews are one of the most valuable methods for gathering objective evidence.
Auditors should ask open-ended questions that encourage employees to explain how work is performed rather than simply answering “yes” or “no.”
Examples include:
- Can you explain your daily responsibilities?
- Which procedure do you follow for this activity?
- How do you know you are using the latest version of the document?
- What happens if a customer complaint is received?
- How do you report a nonconformity?
- What records do you maintain?
- How are quality objectives communicated?
- What training have you received for this process?
- How do you identify process risks?
- What improvements have been implemented recently?
Interview responses should always be verified using objective evidence.
Reviewing Documents and Records
Auditors should verify that documented information is:
- Approved
- Current
- Controlled
- Available where required
- Properly maintained
- Easily retrievable
- Protected against unauthorized changes
Typical documents reviewed include:
- SOPs
- Work Instructions
- Policies
- Risk Registers
- Inspection Reports
- Calibration Certificates
- Training Records
- Customer Complaint Logs
- Internal Audit Reports
- CAPA Records
- Management Review Minutes
- KPI Dashboards
Observing Business Processes
Observation allows auditors to confirm whether documented procedures are actually being followed.
Examples include observing:
- Production operations
- Incoming material inspections
- Product testing
- Warehouse activities
- Equipment calibration
- Packaging processes
- Maintenance activities
- Customer service interactions
Observation often identifies improvement opportunities that are not visible through documentation alone.
Collecting Objective Evidence
Audit conclusions must always be supported by objective evidence.
Evidence may include:
- Documents
- Records
- Employee interviews
- Physical observations
- Computer system data
- Photographs (where permitted)
- Process measurements
- KPI reports
- Customer feedback
- Inspection results
Evidence should be:
- Relevant
- Verifiable
- Accurate
- Sufficient
- Traceable
Recording Audit Findings
Every finding should clearly describe:
- What was observed
- The applicable audit criterion
- Supporting evidence
- The impact on the Quality Management System
Avoid vague statements such as:
❌ “Documentation is poor.”
Instead write:
✅ “Procedure QP-07 Revision 2 was available in the production area, while the controlled document register identifies Revision 4 as the latest approved version.”
Specific findings are easier to investigate and correct.
Types of Audit Findings
Audit findings generally fall into four categories.
Conformity
The process fully complies with ISO 9001 requirements and organizational procedures.
Example:
Employee competency records are current, approved, and supported by training evaluations.
Opportunity for Improvement (OFI)
No nonconformity exists, but improvements could increase efficiency.
Example:
Introducing electronic document approval could reduce document review time.
Minor Nonconformity
A single lapse that does not significantly affect the effectiveness of the Quality Management System.
Examples:
- Missing approval signature.
- One incomplete inspection record.
- Training record not updated.
- Incorrect document revision used in one department.
Minor nonconformities should still be corrected promptly.
Major Nonconformity
A significant failure of the Quality Management System or repeated minor issues indicating systemic weakness.
Examples:
- No internal audits performed.
- No management review conducted.
- No corrective action process implemented.
- Customer complaints ignored.
- No evidence of document control.
Major nonconformities typically require immediate corrective action before certification can be achieved or maintained.
Writing Effective Nonconformity Statements
Every nonconformity should contain three elements:
Requirement
Which ISO clause or internal procedure applies?
Evidence
What objective evidence was observed?
Statement
What specific requirement was not met?
Example
Requirement
ISO 9001 Clause 7.5 requires documented information to be controlled.
Evidence
Production Department was using Work Instruction WI-04 Revision 1 while the controlled register identifies Revision 3 as the latest approved version.
Nonconformity Statement
Controlled documented information was not maintained, resulting in the use of obsolete work instructions.
This format is clear, objective, and easy to address.
Corrective Action Process (CAPA)
Corrective Action should eliminate the root cause of a nonconformity—not simply fix the immediate issue.
A structured CAPA process generally includes:
- Identify the nonconformity.
- Contain the issue.
- Investigate the root cause.
- Develop corrective actions.
- Assign responsibilities.
- Implement improvements.
- Verify effectiveness.
- Close the corrective action.
Organizations should maintain documented evidence throughout the process.
Root Cause Analysis Techniques
Identifying the true root cause is essential for preventing recurrence.
5 Whys
Ask “Why?” repeatedly until the underlying cause is identified.
Example:
Customer received defective product.
Why?
Inspection missed the defect.
Why?
Inspection checklist was incomplete.
Why?
Procedure was not updated.
Why?
Document review was overdue.
Why?
Document control process was ineffective.
The corrective action should address document control—not just retrain the inspector.
Fishbone Diagram (Ishikawa)
Common categories include:
- People
- Methods
- Machines
- Materials
- Measurement
- Environment
This technique helps identify multiple contributing factors.
Pareto Analysis
Used to identify the few causes responsible for the majority of quality problems.
This allows organizations to prioritize improvement efforts effectively.
Preparing the Internal Audit Report
The final audit report should summarize the audit in a clear and structured manner.
Typical sections include:
- Audit Number
- Audit Date
- Department Audited
- Auditor Name
- Audit Scope
- Audit Criteria
- Participants
- Summary of Activities
- Positive Practices Observed
- Opportunities for Improvement
- Minor Nonconformities
- Major Nonconformities
- Corrective Actions Required
- Follow-up Schedule
- Auditor Approval
A well-written report provides management with valuable information for decision-making and continual improvement.
Practical Audit Scenario
A warehouse audit identifies that incoming materials are being received without supplier inspection records.
Evidence
Five purchase orders reviewed lacked incoming inspection records.
Requirement
The organization’s Purchasing Procedure requires inspection before accepting materials.
Finding
Minor Nonconformity.
Root Cause
Inspection checklist was not included in the receiving process.
Corrective Action
- Update receiving SOP.
- Train warehouse personnel.
- Revise inspection checklist.
- Conduct follow-up verification.
The follow-up audit confirms that all incoming materials are now inspected and documented correctly.
Common Internal Audit Mistakes
Organizations should avoid these common mistakes:
- Conducting audits only before certification.
- Auditing without preparation.
- Auditing personal performance instead of processes.
- Leading interviewees toward desired answers.
- Failing to collect objective evidence.
- Writing vague findings.
- Closing CAPAs without verifying effectiveness.
- Ignoring opportunities for improvement.
- Treating audits as fault-finding exercises.
- Failing to communicate audit results to management.
An effective internal audit should promote learning, accountability, and continual improvement.
ISO 9001 Internal Audit Best Practices
Internal audits provide the greatest value when they become an integral part of business improvement rather than a routine compliance exercise. Organizations that consistently achieve strong audit outcomes follow structured methodologies and focus on identifying opportunities to enhance processes, reduce risks, and improve customer satisfaction.
Some recommended best practices include:
- Develop a risk-based annual audit programme.
- Ensure auditors remain objective and independent.
- Update audit checklists regularly.
- Focus on process effectiveness rather than documentation alone.
- Verify implementation through interviews, observations, and records.
- Encourage open communication during audits.
- Record factual evidence only.
- Prioritize improvement opportunities.
- Follow up on corrective actions until verified effective.
- Review audit trends during Management Review meetings.
When audits are used as a business improvement tool, organizations often experience better operational performance and stronger customer confidence.
Internal Audit Documentation Checklist
A well-organized documentation system supports effective audits and demonstrates compliance with ISO 9001 requirements.
Audit Planning
✔ Annual Audit Programme
✔ Audit Schedule
✔ Audit Plan
✔ Audit Scope
✔ Audit Criteria
✔ Auditor Assignment
Audit Execution
✔ Opening Meeting Record
✔ Audit Checklist
✔ Interview Notes
✔ Observation Records
✔ Document Review Notes
✔ Evidence Collection
Audit Findings
✔ Nonconformity Reports
✔ Opportunity for Improvement (OFI)
✔ Positive Practices
✔ Audit Summary
Corrective Actions
✔ Root Cause Analysis
✔ CAPA Form
✔ Action Plan
✔ Responsibility Assignment
✔ Effectiveness Verification
✔ Closure Record
Maintaining complete records helps organizations demonstrate that audits are systematic and effective.
ISO 9001 Audit Readiness Checklist
Before a certification or surveillance audit, organizations should verify the following:
Leadership
✔ Quality Policy approved and communicated.
✔ Quality Objectives monitored.
✔ Management Review completed.
Documentation
✔ Controlled documents available.
✔ Current revisions in use.
✔ Obsolete versions removed.
✔ Records easily retrievable.
Employees
✔ Training records updated.
✔ Competency evaluations completed.
✔ Employees understand procedures.
Operations
✔ SOPs followed consistently.
✔ Product inspections completed.
✔ Supplier evaluations available.
✔ Equipment calibrated.
✔ Customer complaints addressed.
Internal Audit
✔ Annual audit completed.
✔ Findings documented.
✔ Corrective actions implemented.
✔ Effectiveness verified.
Organizations that regularly use this checklist are generally better prepared for external certification audits.
Industry-Specific Internal Audit Examples
Manufacturing
Audit Focus:
- Production planning
- Machine maintenance
- Product inspection
- Calibration
- Traceability
- Final inspection
Information Technology
Audit Focus:
- Software development lifecycle
- Change management
- Backup procedures
- Access controls
- Incident management
- Customer support
Healthcare
Audit Focus:
- Patient safety
- Equipment calibration
- Clinical procedures
- Record management
- Regulatory compliance
Construction
Audit Focus:
- Site inspections
- Material verification
- Contractor management
- Equipment maintenance
- Safety documentation
Food Industry
Audit Focus:
- Hygiene controls
- Supplier approval
- Cleaning procedures
- Product traceability
- Food safety records
Common Internal Audit Challenges
Organizations often encounter several challenges when implementing internal audit programmes, including:
- Limited auditor experience.
- Inadequate planning.
- Lack of employee participation.
- Poor document control.
- Weak root cause analysis.
- Delayed corrective actions.
- Incomplete records.
- Failure to verify effectiveness.
- Audits conducted only before certification.
- Lack of management involvement.
Addressing these issues strengthens the overall Quality Management System and supports continual improvement.
Frequently Asked Questions
1. How often should internal audits be conducted?
ISO 9001 requires audits at planned intervals. Many organizations conduct a full internal audit programme annually, with higher-risk processes reviewed more frequently.
2. Can employees audit their own department?
Where possible, auditors should remain independent and avoid auditing their own work to maintain objectivity.
3. What is the purpose of an internal audit?
To verify conformity, evaluate process effectiveness, identify improvement opportunities, and support continual improvement.
4. What is objective evidence?
Objective evidence includes documents, records, observations, interviews, measurements, and other verifiable information that supports audit findings.
5. What is the difference between a major and minor nonconformity?
A major nonconformity indicates a significant breakdown of the Quality Management System, while a minor nonconformity represents an isolated issue that does not undermine the system as a whole.
6. Should opportunities for improvement be documented?
Yes. Recording opportunities for improvement helps organizations enhance efficiency even when no nonconformity exists.
7. What happens after the audit?
Corrective actions are implemented, their effectiveness is verified, and the audit is formally closed.
8. Can internal audits be conducted remotely?
Yes, provided the organization can effectively review documents, interview personnel, and gather objective evidence through appropriate means.
9. Why is root cause analysis important?
Addressing the root cause helps prevent recurrence rather than repeatedly correcting the same issue.
10. How do internal audits support continual improvement?
They identify weaknesses, verify process effectiveness, and provide management with information to improve the Quality Management System.
Conclusion
Internal audits are a fundamental component of an effective ISO 9001 Quality Management System. Rather than viewing audits as a certification requirement, organizations should use them as a strategic management tool to evaluate process performance, identify risks, strengthen compliance, and promote continual improvement.
A well-planned audit programme, supported by competent auditors, controlled documentation, objective evidence, and effective corrective actions, enables organizations to maintain compliance with ISO 9001 while improving operational efficiency and customer satisfaction.
When internal audits are integrated into daily business practices, they become a powerful mechanism for enhancing organizational performance and preparing for successful certification audits.
