In many organizations the internal audit is the least valued part of the quality system. Once a year someone walks round with a checklist, confirms that procedures exist and forms are signed, and files a report that changes nothing. The certification auditor then arrives and finds the problems the internal audit missed.
It does not have to work that way. An internal audit is the one activity in which you examine your own processes with fresh eyes and with authority to ask awkward questions. Done well, it is the cheapest source of improvement you have.
What the standard asks for
ISO 9001 clause 9.2 requires internal audits at planned intervals to find out whether the quality system conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained. You must plan an audit programme that takes account of the importance of the processes, changes affecting the organization and the results of earlier audits. Each audit needs defined criteria and scope, auditors who are objective and impartial, a report to the relevant managers, and correction and corrective action without undue delay. You keep records as evidence.
Two things are worth noticing. The clause asks whether the system is effective, which is a stronger test than whether it is followed. And it expects the programme to be weighted toward what matters, which means you do not have to audit everything equally.
Plan by risk, not by calendar
Auditing every process once a year, in the same order, spreads effort evenly over areas that do not need it. Rank your processes instead.
| Factor | Audit more often or in more depth when |
|---|---|
| Consequence of failure | A failure reaches the customer or affects safety or compliance |
| Recent performance | Complaints, rework or missed targets are rising |
| Change | New people, equipment, software, products or suppliers |
| Previous findings | Earlier findings were serious or have recurred |
| Time since last audit | The process has not been looked at for more than a year |
A process that scores high on several factors might be audited two or three times a year. A stable, low-consequence one might be audited every second year. Record the reasoning, and your programme meets the clause.
Audit the process, not the document
A checklist built by turning each sentence of a procedure into a yes-or-no question tests whether the paperwork matches the paperwork. Follow the work instead. Pick a real order, job or batch and trace it from start to finish, forwards or backwards. At each step ask the person doing it:
- What do you receive, and how do you know it is right?
- How do you know what to do, and what do you do when the instruction does not fit?
- How do you know your result is good before you pass it on?
- What goes wrong most often, and what happens then?
- What would you change?
Then check what you were told against the records. The interesting findings sit in the gaps between the procedure, what people say and what the records show, and at the handovers between departments.
Write findings that can be acted on
Compare two versions of the same finding.
| Weak | Useful |
|---|---|
| Calibration procedure not followed. | Procedure QP-07 requires torque wrenches to be calibrated every 12 months. On 3 November, wrenches TW-04 and TW-09 at assembly cell 2 carried labels showing calibration due in June. Both were in use on customer orders. |
The second version states the requirement, the evidence and the gap. The process owner can verify it in minutes and cannot dispute it. It also invites the right next question: which jobs were assembled with those wrenches since June?
From finding to corrective action
Clause 10.2 separates two responses. Correction deals with the instance: calibrate the two wrenches and assess the product made with them. Corrective action deals with the cause, so that it does not happen again. Finding the cause means asking why the process allowed the gap. In this example, perhaps the recall list is kept by one person who was away, with no backup and no visible reminder. The corrective action then changes the process, such as a shared calendar with alerts and a monthly check by the cell leader. "Retrain the operator" is seldom a real cause.
Close the loop. Set a date to verify that the action worked, and check it. Repeated findings in the same area are a signal for management review.
Choose and develop auditors
Auditors must not audit their own work. In a small company, the simplest answer is for departments to audit each other, which also spreads understanding of how the business fits together. Good auditors are curious, fair and persistent; knowledge of the standard can be taught. Give them a day of training, let them shadow an experienced auditor, and review their first reports with them.
The guideline for auditing management systems, ISO 19011, was revised in 2026. According to published summaries, the new edition gives more attention to remote and hybrid audits, to the use of digital tools and data analysis in auditing, and to the competence auditors need to use them. If you plan to use AI tools to prepare audits, see ISO 9001 and AI.
Six signs your audits are working
- Findings refer to specific evidence and can be verified.
- Some findings surprise the process owner.
- Corrective actions change the process and not only the person.
- The same finding does not come back the following year.
- The certification auditor finds little that you had not already found.
- Managers ask for audits of areas that worry them.
Want a second pair of eyes? Chmltech helps Canadian organizations build, simplify and audit quality management systems. Book a strategy call or ask a question.
Sources
- Quality Austria: ISO 19011:2026, new impulses for auditing management systems
- DNV: ISO 9001:2026 standard revision
