In short: ISO 9001 clause 9.2 requires internal audits at planned intervals to check that your quality management system meets your own requirements and the standard, and that it is actually applied. You need an audit programme, a plan and scope per audit, objective auditors, a checklist, findings reported to management and corrections and corrective actions without undue delay, with records as evidence. The audit is most useful when it is done where the work happens, not only in the office.
What does ISO 9001 clause 9.2 require?
Clause 9.2 of ISO 9001:2015 has two parts. The first says why you audit: to find out whether the quality management system conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained. The second says how: you plan, establish, implement and maintain an audit programme that covers:
- frequency, methods, responsibilities, planning requirements and reporting;
- the importance of the processes, changes that affect the organisation and the results of previous audits;
- audit criteria and scope for each audit;
- auditors chosen so the audit is objective and impartial (nobody audits their own work);
- reporting results to the relevant management;
- appropriate correction and corrective action without undue delay;
- documented information as evidence of the programme and the results.
The standard does not prescribe a checklist or a frequency. The guideline ISO 19011 gives detailed advice on auditing management systems, but your programme only has to fit your own organisation.
How do you run an internal audit step by step?
The steps below take you from a yearly programme to a closed finding. Small companies can do all of them with one or two trained internal auditors.
1. Set up the audit programme
Make a yearly programme that shows which processes and clauses are audited, when and by whom. Every part of the quality system should be covered within the cycle, usually one year. Audit important or problematic processes more often: those with complaints, recent changes or findings in the last audit.
2. Plan each audit
Plan each audit with a scope, criteria, date, auditor and the people to interview. Send the plan to the department in advance, so the right people are available. The criteria are usually the relevant clauses of ISO 9001 plus your own procedures and work instructions for that process.
3. Prepare the checklist per clause
Prepare a checklist with open questions per clause and the evidence you want to see. Read the procedures and the results of the previous audit first. A checklist keeps the audit complete, but it should leave room to follow a trail: if an answer raises a new question, ask it.
4. Conduct the audit on the shop floor
Conduct the audit where the work is done, by watching, asking and checking records. Ask an operator to show how they perform a task and compare it with the current work instruction. Check whether the instruction at the workplace is the latest version, whether records are complete and whether people know what to do when something goes wrong. Write down objective evidence for every observation: what you saw, which record, which version.
5. Report the findings
Report the findings to the process owner and management, each one linked to a requirement and backed by evidence. Use clear categories, for example major nonconformity, minor nonconformity, observation and opportunity for improvement. Also report what works well: an audit that only lists problems is not a fair picture.
6. Follow up and close the findings
Follow up every nonconformity with a correction, a root cause analysis and a corrective action, with an owner and a due date. Check the effectiveness at the agreed time and only then close the finding. Keep the audit report, the findings and the evidence of their closure as documented information, because the certification auditor will ask for them.
Which questions belong on an ISO 9001 internal audit checklist?
The table gives example questions for clauses 4 to 10. Adapt them to your processes; a good audit question asks for evidence, not for a yes or no.
| Clause | Example questions | Evidence to look for |
|---|---|---|
| 4 Context of the organisation | Which internal and external issues affect your quality? Who are the interested parties and what do they require? What is the scope of the QMS? | Context analysis, list of interested parties, scope statement |
| 5 Leadership | How does management show commitment? Is the quality policy known on the shop floor? Who is responsible for which process? | Quality policy, roles and responsibilities, interviews with staff |
| 6 Planning | Which risks and opportunities were identified and what was done with them? Are the quality objectives measurable and followed up? How are changes planned? | Risk register, quality objectives with results, change plans |
| 7 Support | Are people competent for their tasks and how is that shown? Is measuring equipment calibrated? Is the work instruction at the workplace the current version? | Training records, skills matrix, calibration records, document control |
| 8 Operation | Are customer requirements reviewed before an order is accepted? Are external suppliers evaluated? How is nonconforming output identified and handled? | Order reviews, supplier evaluations, production records, nonconformity reports |
| 9 Performance evaluation | How is customer satisfaction monitored? Was the audit programme carried out as planned? Did the last management review take place and what came out of it? | Customer feedback, audit reports, management review minutes |
| 10 Improvement | How are nonconformities and complaints handled? Are corrective actions checked for effectiveness? Which improvements were made this year? | CAPA records, complaint log, improvement actions |
The clause numbers follow ISO 9001:2015. For the documents and records behind clauses 7.5 and 8, see the ISO 9001 page.
What are common mistakes in internal audits?
- Auditing only paper. Reading procedures in the office says nothing about whether they are followed. Go to the workplace.
- Closed questions. "Do you follow the instruction?" always gets "yes". Ask "show me how you do this".
- Auditing your own work. Clause 9.2 asks for objectivity and impartiality. Swap auditors between departments.
- Findings without evidence. A finding needs a requirement and an observation. "Seems messy" is not a finding.
- No follow-up. Open findings from last year are the first thing a certification auditor notices.
How do you do an internal audit digitally?
An internal audit is a procedure itself, so it can be written and performed as a work instruction. That makes every audit the same in structure, and every audit leaves a complete record without retyping notes.
In the Work Instruction App you build an audit work instruction with one step (page) per clause or per process. Each step contains the questions as explanation text, a radio button or selection for the result (conform, minor, major, observation), a text area for the evidence, and a photo block for what you saw at the workplace. Mark the result fields as Required, so no question can be skipped. The last step holds a summary and a drawn signature of the auditor and, if you like, of the process owner. See digital checklists and digital forms for the available blocks.
Every audit is then a run: the app stores the auditor, the start and end time, the version of the audit work instruction and every answer, photo and signature. Completed runs can be filtered per work instruction, user and period, which gives you the evidence that the audit programme was carried out. When you change the checklist, you publish it as a new version, and older audits still show which version they used. How auditors look at such records is explained on the audit page; for writing clear questions and steps, see how to write a work instruction.
Two functions help with the follow-up. Tick "minor" and "major" as deviating answers in the editor, and every audit with such a finding is marked in the runs overview and appears under the filter "With deviations", with links to the steps concerned. If the process owner should confirm the result, set Approval required: the completed audit then waits until a Manage user who is not the auditor approves it with their own password, or rejects it with a reason. The completed audits of a period can be exported to Excel or CSV for the management review. The app does not plan the audit programme or track the actions: that remains part of your own quality process. A printable checklist template with the questions from this article is available below.
