ISO 9001 Internal Audit: How to Plan, Run and Report One

Clause 9.2 of ISO 9001 requires you to audit your own quality management system at planned intervals, and a certification body will not audit you until you have done at least one. That makes the internal audit the last big job before certification and the most important recurring one afterwards. It is also the one most people dread, so this guide is as much about how to make it useful and un-frightening as it is about what the standard requires.

What the standard asks for

Clause 9.2 is short. You must conduct internal audits at planned intervals to find out whether the QMS conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained. To do that you need an audit programme (frequency, methods, responsibilities, planning and reporting), defined criteria and scope for each audit, auditors who are objective and impartial, results reported to the relevant management, corrections and corrective actions taken without undue delay, and records of the programme and the results.

It does not say how often, how long, or who. For most small businesses, a programme that covers the whole system over a year, in one or two sessions, is proportionate.

Planning the audit around the business, not the clauses

I plan an audit around how the business operates, together with how mature the system is and how much confidence there is in it.

If the system is new, I audit against the full standard. That establishes a baseline, confirms every requirement has been addressed and makes sure no significant gap is missed before the certification body finds it.

For a more mature organisation, or one with an audit history, I recommend a risk-based rolling programme. The focus goes on the areas of higher risk, significant changes since the last audit, previous findings, customer issues, key processes and the business’s strategic priorities. That is also what the standard means by “taking into consideration the importance of the processes concerned, changes affecting the organisation, and the results of previous audits”.

Either way, my preference is to audit by process rather than clause: follow how work actually flows through the business, from enquiry to delivery and invoice, and map the evidence back to the clauses afterwards. Auditing clause by clause tells you whether the documents exist. Auditing by process tells you whether the system works, which is a far more realistic picture of its effectiveness. The ISO 9001 audit checklist is organised by clause so nothing is missed; use it as the map, not the route.

Who can audit

The standard requires objectivity and impartiality, which in practice means auditors do not audit their own work. In a business of ten or more people that is manageable: the operations lead audits sales and purchasing, someone from the office audits operations, and so on, with a short briefing on what the standard is looking for.

Complete independence is almost impossible in a one-person business. If you are the owner, the manager, the process owner and the auditor, there is nobody left to provide challenge. This is where an external internal auditor earns their fee: an independent perspective, validation of what is working well, and gaps, risks and improvements that are hard to see when you are close to the business every day. It is the reason we offer internal audits as a service for small businesses.

Taking the fear out of it

The most important thing I learned on my lead auditor course, and the thing I now say to every client, is that you have to break down the fear people have of being judged, criticised or found to be doing something wrong. Internal audits can feel political. The job of the auditor is to understand how people operate and relate it to the standard, or to explain what the standard is looking for, not to catch anyone out.

Many clients assume an audit is going to uncover gaps. More often I find the opposite. Businesses are already managing risks, solving problems, developing staff and improving processes; they are doing it through day-to-day conversations and decisions rather than recognising it as part of the management system. The audit makes that existing good practice visible and auditable rather than adding bureaucracy on top of it.

Running the audit

A typical small-business audit is a day, sometimes two, and runs like this:

1. Opening conversation. Ten minutes to confirm scope, what will be looked at, who will be spoken to, and that findings go to the business, not to individuals.
2. Follow the work. Pick two or three real jobs, orders or projects and trace each from the customer’s first contact to completion. At each step, ask the person who did it to show you: the enquiry, the quote, the order confirmation, the supplier order, the delivery check, the invoice, the complaint if there was one.
3. Interview, do not just read. The documents say what should happen; the people tell you what does. Ask open questions: “walk me through what you do when an order comes in”, “what happens when a supplier sends the wrong thing?”, “how do you know this person is trained to do that?”
4. Sample the records. Training records, supplier evaluations, calibration or equipment checks, the non-conformance log, objectives, the last management review minutes. Enough to be confident, not every one.
5. Note evidence as you go. What you saw, where, when. Findings written up later from memory are the ones that get argued with.
6. Closing conversation. Tell people what you found before you write it up, including what is working well. Nobody should learn of a finding from the report.

The findings I raise most often

The one I see most is the management of non-conformances and improvement. Events that should be captured are usually handled effectively by individuals or teams, but they are spread across different parts of the business and are not visible through the management system. This is not because people are hiding things. The business is focused on delivery, people solve problems quickly, and the record, if there is one, sits in whichever operational system they were using at the time. A supplier sends a faulty piece of kit and it gets replaced; an expired training record gets renewed; a project gets corrected or a change released. Each is dealt with, and nobody stops to ask whether it should be logged as a corrective action or an improvement. The fix is rarely a new process. It is a single non-conformance and corrective action log, a short list of what counts as a qualifying event, and a habit of asking the question.

The same pattern shows up with opportunities: the business spots and acts on them constantly, but nothing connects that to clause 6.1 or the quality objectives.

Writing findings so they are useful

I use the RED principle when writing a non-conformity:

• Requirement: what requirement, process or procedure was expected?
• Evidence: what objective evidence was found during the audit?
• Deficiency: what is the gap between the requirement and the evidence?

The objective of a non-conformity is not to catch people out. It is to describe clearly the gap between what the organisation said it would do, what the standard requires and what was actually observed. I avoid assumptions about root cause and I do not prescribe the corrective action; that is the business’s job, and an auditor who does it for them takes away the analysis that makes the fix stick. A useful finding is factual, proportionate and gives enough information for the organisation to understand and investigate the issue.

Most findings are minor. A major is reserved for a required process that has not been implemented, a significant breakdown in the management system, or multiple related issues that point to a systemic failure. That last one is the trap for a first certification: minors are quick to fix individually, but when they mount up in one area and the system starts to look like Swiss cheese, a certification auditor is entitled to say “there are so many issues here that I am raising a major”. An internal audit by someone who knows the standard is how you find that out first.

Alongside the non-conformities, record observations (things that are not yet wrong but will be) and opportunities for improvement, and say what is working well. A report that is only findings is read once and resented; one that also tells the business what it is doing right gets used.

After the audit

The report goes to whoever runs the business, and the findings go into the non-conformance and corrective action process like any other: correction, cause, action, verification. The standard says “without undue delay”; thirty days for minors is a reasonable working rule. A summary of the audit, ideally sent in advance so people arrive with questions, is a required input to the next management review.

Then update the programme. What you found this time shapes what you look at next time, which is what makes it risk-based rather than a calendar.

Before the certification audit

If you are heading for certification, the internal audit is the dress rehearsal. Set your documentation and evidence up so it relates to the clauses, with links from the quality manual to the evidence, and keep a structured folder of the documents ready to share. The certification guide covers the rest of the preparation.

What changed in ISO 9001:2026

Clause 9.2 is unchanged in substance. The 2026 edition’s broader emphasis on quality culture and on opportunities as a separate consideration from risks gives an internal auditor two more things to look for: whether the way people behave matches what the policy says, and whether the business is capturing the opportunities it acts on. Our ISO 9001:2026 changes article covers the detail.

Where to go next

The ISO 9001 audit checklist has the clause-by-clause questions and a downloadable checklist, and the free ISO 9001 toolkit includes the audit programme, plan and report templates. If there is nobody independent enough to do it, or you want the first one done by someone who has seen what certification auditors look for, our internal audit service is built for small businesses.

Frequently asked questions