ISO 9001 internal audit: from planning to reporting

The internal audit is a mandatory part of ISO 9001 (clause 9.2). You check for yourself whether your quality management system works in practice and meets the requirements of NEN-EN-ISO 9001:2015 . If you do it well, you reduce the chance of surprises during the external audit by an accredited certification body . This page gives you a practical approach, from annual planning and auditor skills to a checklist per clause.

The internal audit is not the same as the external audit carried out by the certification body. The internal audit is your own check: an obligation, and a tool for spotting problems early.

1. Annual plan for the internal audit

The standard says you carry out audits “at planned intervals” and that all parts of your system are covered periodically. In practice, most organisations draw up an annual audit programme.

What do you record in the audit programme?

Element	Explanation
Scope	Which processes and clauses are audited?
Timing	When does each audit take place?
Auditor	Who carries out the audit?
Method	Interview, document review, observation, or a combination?
Criteria	Against which requirements do you test? (standard, own procedures)

When should you plan?

Plan the internal audit at least four to six weeks before your surveillance audit or recertification audit. That gives you time to resolve findings and take corrective actions before the external auditor visits. See also the page about ISO 9001 maintenance after certification.

Example plan for an SME:

Quarter	Topics
Q1	Clause 4 (context), 5 (leadership), 6 (planning)
Q2	Clause 7 (support), 8.1-8.3 (purchasing execution)
Q3	Clause 8.4-8.7 (delivery execution), 9 (evaluation)
Q4	Clause 10 (improvement), preparation for the management review

You don’t have to audit everything every quarter. Processes with higher risks, or with more findings in the past, can be audited more often. You can audit less critical processes every one and a half to two years, provided you can justify this.

2. Carrying out the internal audit

Who may carry out the internal audit?

The auditor may not check their own work. That is the only strict requirement. A quality manager who wrote the purchasing procedure may therefore not audit that procedure themselves.

Options:

A colleague from another department (cross-auditing)
An external consultant or freelance auditor
A member of the management team for the process audit on the shop floor

Preparation by the auditor

Good preparation saves time and produces better findings:

Review the relevant procedures and work instructions
Check the findings from previous audits: have they been resolved?
Prepare targeted questions (see the checklist further on)
Plan who you want to speak to and which records you want to inspect

The audit itself

Opening meeting

Explain what you are going to do, how long it will take and what happens with the findings. Give the auditees the chance to ask questions. This lowers the threshold and makes the conversations more open.

Document review

Review the procedures and work instructions: are they up to date, approved and easy to find? Also check whether the records match what has been described.

Interviews and observations

Ask open questions: “How does this work in practice?”, “Can you show me an example?”, “What do you do when something goes wrong?”. Walk along where possible and observe the work process.

Closing meeting

Present the findings verbally. Give the auditees the chance to respond. Discuss the category (observation, nonconformity) and the expected follow-up.

3. Reporting and following up findings

Categories of findings

Category	Definition	Action required?
Conformity	Meets the requirement	No
Observation	Opportunity for improvement, not a shortfall	Not mandatory, but recommended
Nonconformity	Does not meet a requirement	Yes, corrective action is mandatory

Audit report: minimum content

An audit report does not need to be complicated. You can find a fill-in format with example findings on the page about the internal audit report. At a minimum, include:

Date, scope and auditor
For each finding: the subject, the requirement, the evidence and the category
Signed or digitally approved
Date of the next review of open actions

Example finding in the report:

Subject: Supplier assessment (8.4) Requirement: The organisation assesses its external suppliers at regular intervals. Finding: No current assessment was found for three of the five active suppliers. The most recent assessment dates from 2023. Category: Nonconformity Corrective action: Update the supplier assessments before 1 September 2026. Responsible: purchasing officer.

Follow-up

The standard requires you to take corrective actions and to check whether they are effective. Record both steps. An unresolved nonconformity is a risk at the next external audit, because the auditor routinely checks whether previous findings have been addressed.

You can read more about recording and resolving nonconformities on the page nonconformities and corrective actions in ISO 9001.

4. Auditor skills

A good internal auditor has three qualities: they ask questions, they listen well and they judge on evidence, not impressions.

Useful skills

Skill	Why it helps
Asking open questions	Gives more information than yes/no questions
Listening actively	Picks up signals in the answer
Probing further	”Can you show me that?” produces evidence
Staying neutral	Doesn’t pass judgement during the conversation
Taking notes	Makes it possible to describe findings accurately later

Common mistakes by internal auditors

Suggesting the answer yourself (“You do it this way, don’t you?”)
Looking only at documents and not talking to people
Being too friendly and not naming nonconformities
Not noting evidence, only impressions

An internal audit that only finds “everything in order” is suspicious. Every organisation has points for improvement. If the internal audit finds nothing, the external auditor will wonder whether the audit was carried out seriously.

Training for internal auditors

Short courses (one to two days) are available for ISO 9001 internal auditors. This is not a requirement, but it helps. At the very least, record that the auditor knows the standard and knows how to audit.

5. Checklist by clause for ISO 9001

Use these questions as a guide during the internal audit. They match the requirements of the standard.

Clause	Key questions
4 - Context	Is the context analysis up to date? Have interested parties and their expectations been updated? Is the scope still correct?
5 - Leadership	Is the quality policy known to employees? Are roles and responsibilities clear?
6 - Planning	Are risks and opportunities up to date? Are quality objectives measurable and monitored?
7 - Support	Are competences documented? Are procedures easy to find and up to date? Are employees aware of their role?
8 - Operation	Are customer requirements recorded and reviewed? Are nonconforming products or services recorded? Are suppliers assessed?
9 - Evaluation	Is customer satisfaction measured? Have the results of previous audits been addressed? Has the management review taken place?
10 - Improvement	Are nonconformities recorded? Has the cause been investigated? Have corrective actions proved effective?

Next step

After the internal audit comes the management review: management reviews the results and decides on improvement actions. You can also look at the step-by-step plan to certification, or go back to the audit process for ISO 9001 for an overview of all audit types.

Sources

NEN-EN-ISO 9001:2015 - clause 9.2 (internal audit)
ISO.org - ISO 9001
RvA - Raad voor Accreditatie (Dutch Accreditation Council)