> ISO 9001 internal audit under clause 9.2: audit programme, audit plan, conducting the audit, findings and report – step by step with questions, examples and tips.

Source: [https://docxpert.io/en/guides/iso-9001-internal-audit](https://docxpert.io/en/guides/iso-9001-internal-audit)

# ISO 9001 Internal Audit: Process, Planning, Report

## What ISO 9001 clause 9.2 requires

ISO 9001 requires internal audits at planned intervals. They show whether the QMS conforms to the organisation's own requirements and the requirements of the standard, and whether it is effectively implemented and maintained.

-   Plan an **audit programme** that defines frequency, methods, responsibilities, planning requirements and reporting – taking into account the importance of processes, changes and the results of previous audits.
-   Define **criteria and scope** for each audit.
-   Select **auditors** so that objectivity and impartiality are ensured – nobody audits their own work.
-   **Report** results to relevant management.
-   Take necessary corrections and **corrective actions** without undue delay.
-   **Retain** the audit programme and results as documented information.

ISO 19011, the guideline for auditing management systems, serves as guidance for conducting audits. It is not certifiable but describes proven principles, methods and competence requirements for auditors.

## The audit programme

The audit programme is the plan over a longer period, usually a year or a three-year certification cycle. It defines which processes, areas and sites are audited when. Important processes, problem areas or areas with changes are audited more often than stable, non-critical ones.

| Process | Importance / risk | Q1 | Q2 | Q3 | Q4 |
| --- | --- | --- | --- | --- | --- |
| Sales and order review | Medium |  | X |  |  |
| Design | High | X |  | X |  |
| Purchasing and suppliers | Medium |  |  | X |  |
| Production line A | High (complaints) | X |  |  | X |
| Complaint management | High |  | X |  |  |
| HR and training | Low |  |  |  | X |

A good audit programme ensures that all processes and all clauses are covered within the cycle. Many certification bodies expect at least one complete internal audit cycle before the initial certification audit.

## Audit types and approaches

| Approach | Description | Suitable for |
| --- | --- | --- |
| Process audit | A process is followed from input to output | Standard in ISO 9001 environments |
| System audit | One clause is checked across all areas | Before certification, finding gaps |
| Product audit | Finished products are checked against specification | Manufacturing, automotive |
| Supplier audit | Audit at external providers (second-party audit) | Critical suppliers |
| Remote audit | Conducted via video and shared documents | Distributed sites, document reviews |

## An internal audit in six steps

1.  1
    
    Prepare
    
    Define audit criteria and scope, review documents and previous audit results, prepare a checklist or question list, agree the audit plan with times and interviewees.
    
2.  2
    
    Opening
    
    Short opening meeting: objective, agenda, confidentiality, handling of findings.
    
3.  3
    
    Collect evidence
    
    Interview people, observe activities, review documents and records. Select samples deliberately and record them.
    
4.  4
    
    Formulate findings
    
    Evaluate observations against the criteria: conformity, nonconformity, opportunity for improvement.
    
5.  5
    
    Closing
    
    Closing meeting: present results, clarify understanding, agree next steps.
    
6.  6
    
    Report and follow up
    
    Distribute the report within a few days, assign corrective actions and check their effectiveness.
    

## Good audit questions

Good questions are open, relate to the actual work and lead to evidence. Instead of "Do you know the work instruction?" ask "How do you proceed when …? Please show me where that is defined."

| Topic | Example question |
| --- | --- |
| Process objective | How do you know your process is running well? Which KPIs do you use? |
| Requirements | How do you make sure you are working with the current version? |
| Competence | How were you trained for this task? Where is that documented? |
| Defects | What happens when a defect is found? Show me an example. |
| Improvement | What has improved in your area over the last year, and why? |
| Risks | What could go wrong in your process? What do you do about it? |

You'll find more than 40 further check items in the [internal audit checklist](https://docxpert.io/en/checklists/iso-9001-internal-audit-checklist).

## Writing findings properly

A finding has three parts: the **requirement**, the **evidence** and the **nonconformity**. Only then is it understandable for those involved and can be addressed specifically.

| Part | Example |
| --- | --- |
| Requirement | Per procedure P-07 section 4, measuring equipment is checked for valid calibration before use (ISO 9001 7.1.5.2). |
| Evidence | At workstation M3, caliper no. 114 with expired calibration (due 03/2026) was in use. |
| Nonconformity | The check before use was not performed. |

| Grading | Meaning |
| --- | --- |
| Major nonconformity | Requirement not met, with impact on the system or product conformity |
| Minor nonconformity | Isolated case without systemic character |
| Observation | No nonconformity, but a risk or opportunity for improvement |
| Positive finding | Good practice that can serve as a model for other areas |

## The audit report

-   Audit objective, criteria, scope and date
-   Audited areas, processes and interviewees
-   Audit team
-   Summary with overall assessment
-   Findings with requirement, evidence and grading
-   Positive findings and opportunities for improvement
-   Agreed next steps and deadlines

Keep the report short. A one-page summary plus a list of findings is usually more meaningful than ten pages of prose.

## Who may audit internally?

The standard requires objectivity and impartiality but no specific qualification. In practice, internal auditors from other departments who have completed ISO 19011 auditor training and know the standard have proven themselves. Small companies often engage external auditors or swap audits with partner companies.

Auditor competence belongs in the training matrix – with training, experience and audits performed. See the guide [how to build a training matrix](https://docxpert.io/en/guides/how-to-build-a-training-matrix).

## Building a good audit culture

Internal audits only deliver value if employees talk openly about workflows and problems. That works when audits are understood as a joint search for improvements rather than as policing individuals. Announce audits in good time, explain objective and agenda, and stress that findings concern processes, not people.

-   Record positive findings as well as nonconformities.
-   Listen to interviewees and ask follow-up questions instead of reading out clause text.
-   Discuss results with the audited area first, then report.
-   Make improvements from previous audits visible.

## Common mistakes in internal audits

-   **Ticking checklists instead of understanding:** the auditor reads out clause questions instead of following the process.
-   **Only checking documents:** without looking at practice, it stays hidden whether requirements are lived.
-   **Audit experienced as policing:** employees defend themselves instead of talking openly about problems.
-   **Findings without evidence:** vague statements such as "documentation partly incomplete" cannot be acted on.
-   **No follow-up:** corrective actions from the audit are not closed or not checked for effectiveness.
-   **Everything at once just before certification:** audits should be spread across the year.

## Internal audits with docxpert

docxpert provides the "Internal audit" and "Audit programme & audit report" templates, mapped to ISO 9001 9.2 and the corresponding clauses of other standards. Findings are tracked as a [CAPA](https://docxpert.io/en/features/capa-management) or [deviation](https://docxpert.io/en/features/deviation-management) with owners, deadlines and effectiveness checks. Before the audit, the [gap analysis](https://docxpert.io/en/features/gap-analysis) shows where evidence is still missing.

Note

docxpert does not currently offer a dedicated audit planning module with calendar, question catalogues and auditor assignment. You maintain the audit programme and reports as controlled documents based on the templates.

## Frequently asked questions

How often must an internal audit be carried out?

ISO 9001 requires audits at planned intervals without a fixed frequency. It is common to audit every process at least once a year or within the three-year certification cycle – important or problematic processes more often.

May I audit my own area?

No. The standard requires objectivity and impartiality. Auditors must not audit their own work.

Do I need training as an internal auditor?

The standard does not prescribe specific training but requires competence. ISO 19011 training and experience as a co-auditor are the usual evidence.

What is the difference between the audit programme and the audit plan?

The audit programme plans all audits over a period, usually a year. The audit plan describes a single audit with agenda, times and interviewees.

Must an internal audit take place before certification?

Yes. Certification bodies expect at least one complete internal audit cycle and a management review before the certification audit.

Can an internal audit be done remotely?

Yes, especially for document reviews and interviews. For production and warehouses an on-site visit is usually more meaningful.

How long does an internal audit take?

A process audit typically takes two to four hours, plus preparation and report. The extent depends on process, risk and number of interviewees.

What happens with the results?

Findings are tracked as corrective actions, results feed into the management review and help shape the next audit programme.

How can I sample evidence without checking only what is easiest to find?

Build the sample from audit criteria, risk and process flow, not from whichever records are easiest to open. Select cases across different dates, shifts, products or sites, and trace an item from input through to outcome. Add observation and interviews to document review so you can see whether the written rule is followed in practice. Record why the sample was selected, its extent and any limitations that affect your conclusion. A sample cannot provide complete assurance; expand it when results are unusual or inconsistent. Write findings against specific criteria and objective evidence, without generalising from one case to every process. This makes the report both traceable and fair.

## Read next

[ISO 9001 internal audit checklistAudit questions for clauses 4 to 10 – to tick off and download as PDF.Learn more](https://docxpert.io/en/checklists/iso-9001-internal-audit-checklist) [Management reviewInputs, outputs and agenda of the ISO 9001 clause 9.3 management review.Learn more](https://docxpert.io/en/guides/management-review) [ISO 9001 certificationProcess, duration, cost and preparation for certification.Learn more](https://docxpert.io/en/guides/iso-9001-certification-process) [CAPA processFrom report to effectiveness check: the CAPA process in nine steps.Learn more](https://docxpert.io/en/guides/capa-process) [ISO 9001Quality management: document control, competence, audits and improvement in one platform.Learn more](https://docxpert.io/en/standards/iso-9001)

## Try docxpert free for 14 days

Document control, approvals, training and evidence in one platform – with English and German templates for more than ten standards.

[Start free trial](https://docxpert.io/en/trial)[See pricing](https://docxpert.io/en/pricing)