ISO 9001 Internal Audit: What It Is, Who Can Do It and What Auditors Look For

An ISO 9001 internal audit is your own check of your own system, done before the certification body does theirs. Clause 9.2 requires it at planned intervals, with auditors who do not audit their own work, results reported to relevant management, and corrective action taken without undue delay.

Most owners hear the word audit and picture a stranger with a clipboard hunting for faults. An internal audit is closer to a rehearsal: you run it yourself, on your own timetable, so gaps surface while you still have time to fix them. I have seen a company treat its internal audit as paperwork — a checklist ticked in an afternoon, nothing changed — and watched the certification audit find the same gaps, only now they counted. I have also seen a small manufacturer find two real problems in its own audit and fix the causes before Stage 2. The second company did not have a better system, only an honest rehearsal.

What is an internal audit, exactly?

ISO 9001 defines an audit as a systematic, independent and documented process for obtaining evidence and evaluating it objectively against criteria. An internal audit — a first-party audit — is conducted by, or on behalf of, the organisation itself, using your own trained staff or a hired outside auditor. Either way, it is your audit, not the certification body's.

Think of it like a dress rehearsal before opening night: the director checks the lights, finds the wobbly prop, and fixes it while nobody is watching. A certification audit is opening night. A supplier audit, where your customer audits you, is the second-party version. Internal audits exist so opening night holds no surprises.

The criteria are twofold, per Clause 9.2.1: your organisation's own requirements, and ISO 9001's. An audit that only checks your procedures misses half the job; one that only checks clause numbers, ignoring how your business runs, produces findings nobody acts on.

What Clause 9.2 actually requires

Clause 9.2.2 sets out six duties. Read them as a checklist, because a certification auditor will test each one:

• Plan, establish, implement and maintain an audit programme covering frequency, methods, responsibilities, planning and reporting — shaped by process importance, changes, and previous audit results.
• Define criteria and scope for each audit. Criteria are what you audit against — ISO 9001 plus your own procedures. Scope is how far it reaches: which processes, sites and time period.
• Select auditors to ensure objectivity and impartiality. Nobody audits their own work — the rule most small companies trip over, covered below.
• Report results to relevant management. A report nobody senior reads has not been reported in any meaningful sense.
• Take correction and corrective action without undue delay. Fix the immediate problem, then fix the cause. Both halves are required.
• Retain documented information as evidence — the schedule, the reports, the findings, and what happened to each one.

Notice what the clause does not say: no fixed frequency, no mandated auditor qualification, no prescribed report format. Those decisions are yours to make and defend. An auditor tests whether your choices are sensible and followed, not whether they match a template.

Who can be an internal auditor?

Anyone competent and impartial — and that sentence carries more weight than it looks. ISO 9001 prescribes no specific qualification for internal auditors, only selection for objectivity and impartiality, leaving the organisation to judge what competence fits its processes. ISO 19011, the guidance standard for auditing management systems, describes competence in detail — standard knowledge, process understanding, audit skills, fair presentation, sound judgement — but it is guidance, not a certifiable requirement. A two- or three-day internal auditor course certificate is the usual evidence. It is not, by itself, proof of competence. The proof is in the reports: findings backed by evidence, written plainly, acted on.

The impartiality rule is absolute in one direction: auditors must not audit their own work. A process owner cannot audit their own process, a manager cannot audit their own department. You cannot reliably judge work you designed, run, or signed off yourself. Your blind spots travel with you.

With five departments, the fix is easy: auditors swap departments. Where one person runs almost everything, it is different — and this is where owners get stuck.

The small-company problem, solved honestly

If you are a 12-person company and the founder handles sales, purchasing and quality, who audits purchasing? Not the founder. Three routes work in practice:

• Cross-functional auditing. Train two or three staff from different functions as auditors and rotate them. Even a small team usually has someone who does not own the process being audited.
• Peer auditing across shifts or locations. Auditors from one shift or site audit the other. The work is the same, the auditor is not the owner.
• An external auditor for the uncovered areas. Hire a competent outsider for the functions nobody inside can audit impartially. Many companies use one for the whole programme — it costs more, but it buys genuine independence and a fresh pair of eyes.

What does not work is the founder auditing their own process and calling it impartial because they were "being honest". The standard's test is structural — freedom from responsibility for the activity being audited — not a judgement about character.

How an internal audit runs, step by step

One audit follows the same shape whether it covers one process or the whole system:

1. Plan. Set the objective, criteria and scope, pick auditors who do not own the area, and agree the schedule. Send the plan in advance — surprise audits produce defensive answers, not evidence.

2. Open. A short opening meeting confirms scope, method, and how findings will be graded. Five minutes here prevents an hour of argument later.

3. Gather evidence three ways. Read documents and records, interview people at different levels, and observe work happening. One source alone is weak: a procedure saying one thing, a worker describing another, and a record matching neither is where findings live. Auditors call this triangulation.

4. Grade findings. A nonconformity means a requirement has not been fulfilled. An observation, or opportunity for improvement, means something could work better but no requirement is broken. Keep the two apart: inflating observations destroys trust, downgrading nonconformities hides problems.

5. Close and report. A closing meeting states the findings plainly, with evidence. The report goes to relevant management — and results feed management review under Clause 9.3, so the loop to leadership is part of the system.

6. Correct, then correct the cause. Correction fixes the immediate problem; corrective action removes the cause — a monthly calibration-due list with a named owner, a rule against unsupervised work until training is signed off. Clause 10.2 requires both, plus a later check that the fix worked.

What auditors actually look for

An internal auditor samples the same evidence a certification auditor will, because the criteria are the same. These areas produce findings most often in small companies:

• Document control in practice. Is the current version available where work happens, and are old versions out of circulation?
• Calibration. Every instrument affecting quality, checked against a traceable standard, with a defined response when one is found out of tolerance.
• Competence records tied to roles. Evidence each person is competent for the work they actually do, not a generic training-day attendance sheet.
• Nonconforming outputs. What happens when product or service misses requirements — segregation, disposition, and who authorises release.
• Customer feedback and complaints. Not just a file of complaints, but evidence they were analysed and acted on. A log nobody reads proves you knew.
• Previous findings. Were last audit's nonconformities closed, and did the fixes hold? Repeat findings lose an auditor's confidence fastest.
• Change control. When a process, supplier or specification changed, did documents, training and risk work change with it?
• Management review actions. Decisions from the last review, with owners, dates, and evidence they happened.

Cover those eight areas across the year and you have covered the ground a certification auditor cares about most.

A worked example: two findings, four fixes

Picture a 20-person precision-parts maker auditing two months before its surveillance audit. The auditor raises two nonconformities in the machine shop: a micrometer three weeks past calibration, used on shipped parts throughout; and a new operator deburring unsupervised for a fortnight, with no training record.

Each finding gets two fixes. For the micrometer, the correction is immediate: pull it from service, recalibrate it, and check parts measured since the due date for rework or notification. The corrective action addresses the cause — nobody owned the calibration calendar — with a monthly due list, a named owner, and a rule that overdue instruments are tagged and removed. For the operator, the correction is training plus a signed record; the corrective action is a gate: no unsupervised work until the supervisor signs off training.

Corrections are fast and specific. Corrective actions change a rule, a responsibility, or a gate so the failure cannot quietly recur. At the certification audit, the company shows both layers plus verification: the next calibration list, on time, and the training gate, working.

How often should you audit?

ISO 9001 sets no fixed interval, only planned intervals shaped by process importance, changes, and previous results. Full-system coverage once a year is common practice — a surveillance audit will sample your coverage — but not a requirement. Audit critical processes more often, re-audit soon after a nonconformity, a major change, or a complaint, and leave a stable, low-risk process at once a year. Auditing everything at the same frequency regardless of risk wastes effort where it is not needed and starves the areas where it is.

One practical shape works for most small companies: a 12-month programme touching every process and clause at least once, critical processes audited twice, plus a short follow-up after any major nonconformity. Write it down, date it, and keep it — the programme itself is evidence the certification auditor will ask for.

Five mistakes that weaken an internal audit

1. Auditing your own work. Still the most common finding in small-company audits. Structure beats good intentions.

2. Auditing documents instead of reality. Reading procedures at a desk proves the documents exist. It proves nothing about the work. Interview people, watch the job, pull the records.

3. Writing findings without evidence. "Calibration weak" is an opinion. "Micrometer M-07, due 12 September, used on batch P-441 on 28 September, no out-of-tolerance review on file" is a finding. Every finding needs the record, the date, and the sample.

4. Closing findings without verifying the fix. A corrective action plan is not a closed finding. Re-check after the agreed date; if the fix did not hold, the finding reopens.

5. Keeping the report from management. Audit results feed management review. A report leadership never sees cannot change a decision, and the certification auditor will notice the gap.

A note on the 2026 edition

ISO published ISO 9001:2026 on 16 September 2026, replacing ISO 9001:2015. The new edition builds on the familiar framework rather than redesigning it, and the internal audit duty continues in Clause 9.2. Organisations certified to the 2015 edition have until 30 September 2029 to transition, and from 31 March 2028 new and initial accredited certifications may only be issued to ISO 9001:2026. If your certificate still reads 2015, your programme does not need rebuilding — but agree transition timing with your certification body well before the deadline, rather than discovering it at a surveillance audit.

What this means for your next audit

Start with the programme, not the checklist. List your processes, rank them by importance and risk, note what changed and what last year's audit found, and schedule from there. Pick auditors who do not own the areas they audit — a short course plus a supervised first audit suffices for most small companies. Grade findings honestly, fix causes as well as symptoms, verify the fixes, and take the results to management review.

Done that way, the internal audit stops being a chore before the real audit. It becomes the reason the real audit goes smoothly. If you would rather have the programme built and the first audit run by someone outside your own walls — which also solves impartiality in one move — our ISO 9001 certification support covers the system build, documents, and audit preparation, from ₹9,999 for companies up to 25 employees and ₹19,999 for 26 to 100, with certification-body audit fees extra at actuals. The ISO 9001 documents checklist lists the evidence auditors ask for, the integrated ISO 9001 + 14001 + 45001 guide shows one programme covering three systems, and the compliance fee calculator prices the surrounding filings.

FAQs

How often must we conduct internal audits for ISO 9001?

ISO 9001 sets no fixed interval. Clause 9.2 requires planned intervals, shaped by process importance, changes, and previous results. Full-system coverage once a year is common practice, with critical processes audited more often and a follow-up after any major nonconformity.

Can the owner audit their own company?

The owner can audit areas they do not own or run, but not their own work. In a small company, use cross-department auditors, peer auditors across shifts or sites, or an external auditor for the owner's functions.

Does an internal auditor need a certificate?

ISO 9001 prescribes no specific qualification. Auditors must be selected for objectivity and impartiality, with competence appropriate to the processes audited. A short course is the usual evidence, but the reports themselves are the real proof.

What is the difference between an internal audit and a certification audit?

An internal audit is a first-party audit by or on behalf of your organisation to check your own system. A certification audit is a third-party audit by a certification body deciding whether the certificate is granted or maintained. The internal audit exists so the certification audit holds no surprises.

What happens if our internal audit finds a major nonconformity?

Fix the immediate problem, then the cause, then verify the fix worked. A major internal finding is good news in one sense: you found it while you still control the timetable.