ISO 9001 Internal Audit Program: Planning, Objectives, Auditors and Reports
Internal audits are the quality system checking itself. When they work, they find problems before customers and certification bodies do. When they do not, they become a calendar exercise that produces a handful of observations and no improvement.
ISO 9001:2026 keeps the internal audit requirements of clause 9.2 and adds one change that affects almost every audit plan: each audit now needs defined objectives, as well as scope and criteria. This guide explains the requirements, shows how to build a risk-based program, and covers the practical questions that come up in small and mid-sized companies, such as who can audit whom.
What clause 9.2 requires
Paraphrased, you must conduct internal audits at planned intervals to provide information on whether the QMS:
Conforms to your own requirements for the QMS
Conforms to the requirements of ISO 9001
Is effectively implemented and maintained
You must plan, establish, implement and maintain an audit program, including frequency, methods, responsibilities, planning requirements and reporting. The program must take into consideration the importance of the processes concerned, changes affecting the organization and the results of previous audits.
For each audit, you must define the objectives, criteria and scope. Auditors must be selected and audits conducted to ensure objectivity and impartiality. Results must be reported to relevant management, and necessary correction and corrective action must be taken without undue delay. You must retain documented information as evidence of the program and the audit results.
Check the exact wording against your licensed copy of ISO 9001:2026. ISO 19011, Guidelines for auditing management systems, gives detailed guidance on running audit programs and is worth reading alongside the standard.
Objectives, scope and criteria: what is the difference?
Most audit plans already list scope and criteria. The 2026 edition makes objectives explicit, so it helps to be precise:
Objectives say why you are doing this audit. Examples: confirm that the revised supplier management process meets ISO 9001:2026; determine why late deliveries rose in the third quarter; verify that corrective actions from the last certification audit are effective.
Scope says what the audit covers: processes, locations, shifts, products and time period.
Criteria say what you audit against: ISO 9001:2026 clauses, your procedures, customer requirements, regulatory requirements and contracts.
An audit with a clear objective finds more, because the auditor knows what question the audit has to answer.
Building the audit program
Cover the whole QMS
Over the program cycle, usually one year and at most the three-year certification cycle, every process and every applicable clause of ISO 9001 must be audited. A simple matrix with processes in rows and clauses in columns shows coverage at a glance.
Schedule by risk and performance
The program must consider the importance of processes, changes and previous results. That means not every process is audited at the same frequency. A practical approach is to score each process on three factors:
Importance: effect on product conformity and customer satisfaction
Change: new equipment, new people, new products, new customers or a revised procedure
Performance: complaints, nonconformities, previous audit findings and KPI trends
High-scoring processes are audited twice a year or more. Stable, low-risk processes are audited once a year. Record the scoring, so an auditor can see why the schedule looks the way it does.
Plan for the 2026 transition
During the transition, add audits with a specific objective: confirm that each revised process meets the 2026 requirements. Plan them early enough to generate records and close findings before the transition audit. Our ISO 9001:2026 gap assessment checklist lists the areas to cover.
Choosing auditors in a small company
Auditors must be objective and impartial, and the usual rule is that auditors do not audit their own work. In a company of 30 people, that can feel impossible. Common solutions:
Cross-auditing: the purchasing lead audits production, the production supervisor audits purchasing, and the quality manager is audited by someone else.
Audit the quality manager's processes externally: use a consultant or a peer from another company for document control, internal audit and management review, which the quality manager owns.
Train a small pool: two to four trained internal auditors, with a short course based on ISO 19011 and a few supervised audits.
Define auditor competence in your procedure: training, knowledge of ISO 9001, knowledge of the process being audited, and audit experience. Keep training records and an approved auditor list.
Running a process audit
A process audit follows the work, not the clause list. A typical sequence for auditing, say, receiving inspection:
Prepare: review the procedure, previous audit results, recent nonconformities and KPIs. Write a short checklist focused on the audit objective.
Opening: confirm the objective, scope, timing and people with the process owner.
Follow the inputs: pick recent receipts and trace them from the purchase order through receiving, inspection, acceptance or rejection and stock.
Check controls: were the inspection criteria the current revision? Was measuring equipment in calibration? Were rejected materials identified and segregated?
Check records: are inspection records complete, legible and signed? Do they match what you observed?
Check links: did rejections feed supplier performance and corrective action? Did the process owner know the KPIs?
Interview: ask operators how they do the job and what they do when something is wrong. Compare answers with the procedure.
Closing: present findings, agree on facts and explain the follow-up.
Sample size matters. Three to five records per control point is usually enough to see whether a process is consistent. If the first samples show problems, widen the sample.
Writing findings
A good nonconformity statement has three parts:
Requirement: what should happen, citing the procedure or ISO 9001 clause
Evidence: what you saw, with specific references such as lot numbers, dates and record IDs
Statement: how the evidence fails to meet the requirement
Example: "The Receiving Inspection Procedure requires that measuring equipment be within its calibration date. Calipers QC-114, used to inspect lot 25-0441 on October 8, were due for calibration on September 30. Inspection was performed with equipment past its calibration due date."
Grade findings consistently, for example major nonconformity, minor nonconformity and opportunity for improvement, with definitions in your procedure. Record good practice too. It encourages process owners and shows the audit was balanced.
Reporting and follow-up
Report results to the relevant management, which normally means the process owner and the person responsible for the QMS, with a summary at management review. The report should include the objective, scope, criteria, auditors, dates, findings and conclusion.
Correction and corrective action must be taken without undue delay. Define the expected timescales in your procedure, for example a response within 14 days and closure within 60 days for minor nonconformities. Follow up to verify effectiveness, and record the verification. Our post on nonconformity vs corrective action explains how the two steps differ.
Audit results are a required input to management review. Present trends: number of findings by process, repeat findings, and overdue actions.
Records an auditor will ask for
The internal audit procedure
The audit program, with the basis for scheduling and coverage of all processes and clauses
Audit plans for each audit, with objectives, scope and criteria
Checklists and notes
Audit reports with findings
Corrective action records and effectiveness verification
Auditor competence and training records
Management review minutes showing audit results were reviewed
Common audit findings about internal audits
No audit objectives. Plans list scope and criteria only, which no longer meets the 2026 requirement.
Incomplete coverage. Some processes or clauses have not been audited in the cycle.
Auditors auditing their own work. Typically the quality manager auditing document control or internal audit.
Schedule not risk-based. Every process audited once a year regardless of performance or change.
Clause-by-clause checklists only. The audit confirms that procedures exist but does not test whether the process works.
Findings without evidence. Statements such as "training records not complete" with no specific record cited.
Actions left open. Findings from previous audits still open with no follow-up.
Documents that help
A.P. Lyon's Internal Audit Procedure ($79) for ISO 9001:2026 covers the audit program, risk-based scheduling, audit objectives, scope and criteria, auditor competence and impartiality, conducting and reporting audits and follow-up, with an audit schedule, audit plan, checklist and report forms. It works with the Corrective and Preventive Action System and the Management Review Procedure.
The procedure is included in every ISO 9001 QMS package. For dual-certified medical device suppliers, the Dual-Standard Internal Audit Procedure covers ISO 9001:2026 and ISO 13485:2016 together.
The documents need to be adapted to how your organization works. They are a starting point, not certification.
Next steps
Use the gap assessment checklist to plan your transition audits, choose procedures in Build Your QMS, or contact A.P. Lyon about consulting if you would like an independent internal audit of the processes your own team cannot audit impartially.
Comments