ISO 9001 Internal Audit: Steps and Checklist

ISO 9001 does not set an exact number, but it requires the organization to audit "at planned intervals" all processes of the management system at least once within the certification cycle (typically the three-year cycle between external certification audits). In practice, most certified organizations perform at least one complete internal audit per year, and many opt for a semi-annual cycle for critical or high-risk processes, covering the full system in two rounds.

Instead of auditing all processes with the same frequency and intensity, risk-based planning prioritizes processes according to their criticality: impact on customer satisfaction, history of non-conformances, recent changes (new staff, new equipment, new supplier) and complexity. A process with recurring NCs or recent changes is audited more frequently than a stable process with no incidents. This is documented in the annual audit program, justifying why each process has its assigned frequency.

The auditor cannot audit their own work or the area for which they are directly responsible. A production manager cannot audit the production process they themselves manage; they can audit quality, purchasing or maintenance, and vice versa. In small organizations where this is hard to comply with strictly, it should be documented how the conflict of interest is minimized (for example, cross-auditing between shifts or plants, or occasional support from an external auditor).

It is not a mandatory requirement of the ISO 9001 standard, but it is a widely recommended best practice. Accredited Internal Auditor training (for example, courses aligned with IRCA — the International Register of Certificated Auditors) ensures the auditor understands ISO 19011 (guidelines for auditing management systems), interviewing techniques, sampling and finding write-up. Many certification bodies view evidence of competent training for the internal audit team favorably.

A complete report includes: audit scope and criteria, date and duration, audit team and people interviewed, a summary of positive findings (good practices), non-conformances detected classified by type (major/minor/observation) with the objective evidence supporting them, and an overall conclusion on the effectiveness of the audited process. The report must be distributed to the area owner and to management within a reasonable time frame (typically 5-10 days after closing).

The follow-up plan defines how and when it will be verified that the detected non-conformances have been properly closed: who does the follow-up, how often progress on corrective actions is reviewed, and how effectiveness is verified (not just implementation). This plan is typically presented at the management review, where the overall status of the period’s internal audits is reported.

This is not automatically a system failure, but the certification body may question the effectiveness of the internal audit program if it happens repeatedly. It is advisable to review the competence of the audit team, the depth of sampling, and whether the affected process was correctly prioritized in the risk-based plan.

IgeraIndustria indexes your audit program, procedures and NC history, allowing the audit team to quickly check which processes carry higher risk, what previous findings exist, and which standard requirements apply to each area, always citing the exact source document.