ISO 9001 internal audit report: template with example findings
An internal audit report records what you checked during the internal audit, what you found and what you will do about the findings. ISO 9001 (clause 9.2) requires you to plan and carry out internal audits, report the results to the responsible managers and keep evidence. The report is that evidence. A good report is short and concrete, and every finding has an owner and a date. You can find more about the whole approach on the page about the ISO 9001 internal audit. The requirements you check are set out in NEN-EN-ISO 9001 , and findings with nonconformities follow the route described in nonconformities and corrective actions.
What must an internal audit report contain as a minimum?
The standard does not prescribe a fixed layout, or which sections it should include. You do need to be able to show what was checked and what the outcome was. In practice, a report with five sections works well:
- General details. Date, scope, auditor, auditee and the checklist used.
- Requirements examined. The clauses of the standard covered by this audit, for example 8.4 or 9.2.
- Findings. For each finding: subject, requirement, evidence and category.
- Corrective actions. What needs to happen, by whom and by when.
- Follow-up. The date for checking the open actions.
The report does not need to be ten pages long. For a small organisation, one or two pages is enough. What counts is the content, not the format.
Template: ISO 9001 internal audit report
Copy the structure below and fill it in. Store it in your document control, so that it has a version and an owner (see document control (7.5)).
| Field | Entry |
|---|---|
| Audit number | IA-2026-03 |
| Date | |
| Auditor | |
| Auditee (process or department) | |
| Scope | Which processes and sites, which period |
| Checklist used | Version and date |
| Clauses examined | For example 8.4 and 8.5 |
| Number of findings per category | Conformity: / Observation: / Nonconformity: |
| Conclusion | One sentence: does the process work as described? |
| Next check of open actions | Date |
| Approval | Name and date of the quality manager |
Example findings per category
The standard does not prescribe a categorisation. In practice, many organisations use three categories. The examples below come from a fictional manufacturing company that supplies parts to machine builders.
| Category | What it means | Example | Action |
|---|---|---|---|
| Conformity | Meets the requirement | Inspection of incoming materials is recorded in all selected cases | None |
| Observation | Opportunity for improvement, not a shortfall | The inspection form has no field for the batch number. This works now, but makes tracing difficult | Recommended, not mandatory |
| Nonconformity | Does not meet a requirement | Three of the five suppliers have no assessment from the past year | Mandatory: corrective action |
The difference between an observation and a nonconformity is whether the requirement is met. You can resolve an observation yourself without a formal action. A nonconformity requires a solution and a check that it works. You can read more about that approach at nonconformities and corrective actions.
Worked example of one finding
This is how a single finding looks in the report:
Subject: Supplier assessment (8.4) Requirement: The organisation assesses its external suppliers and keeps evidence of this. Evidence: Supplier register, assessment forms from the last twelve months. Finding: No assessment from the past year was found for three of the five suppliers. The most recent assessment dates from 2024. Category: Nonconformity Corrective action: Update the assessments and link the register to the annual plan. Owner and date: Purchasing, no later than the end of the quarter. Effectiveness check: At the next internal audit, check that the assessments have been carried out.
Note the last line. A corrective action is only complete once you have checked that it works. Without that check, the nonconformity stays in the report.
Common mistake: describing the finding as “suppliers are not assessed properly”. That is an opinion, not a finding. Write down what you saw, which document or record you reviewed, and what was missing.
What does the auditor want to see in the internal audit report?
At the external audit, the auditor asks about your internal audits. They check whether the report exists, whether it covers the scope, whether findings have been recorded and whether the open actions have been followed up. The standard (9.2.2) requires audits to be objective and impartial. Someone who checks their own work provides weaker evidence, so that is why independence matters.
A report in which everything is conforming can raise questions in itself. An internal audit that never finds an observation or nonconformity often does not look thorough enough. So be honest in your findings.
Common mistakes
- No scope. The report says “internal audit” without stating which processes and which period.
- Findings without evidence. There is a judgement, but no record of the document or observation behind it.
- Actions without an owner or date. A corrective action without a name and a date does not get carried out.
- No follow-up. The report is written and then filed away. The next audit starts from zero.
- The same finding every year. If it keeps coming back, the cause has not been solved. Use a root cause analysis to look deeper.
How do you store the report?
Store the report as documented information (evidence of the audit, see 9.2.2), with a version and a date. Save it in the same folder as your audit schedule, so the auditor can find it in one go. The document list for the external audit usually includes a line for the internal audits from the past year.
Check before you share the report
Go through these points before the report reaches management or the auditee:
- Does the scope state the processes and the period?
- Does each finding refer to a requirement and to evidence?
- Was the category chosen for each finding, and not based on gut feeling?
- Does every nonconformity have an owner and a date?
- Is the auditor independent of the process they checked?
- Does the report state the date of the next check?
- Is the version of the report clear, and has it been approved?
If one of these points is not right, the report is not finished. An auditor looks closely at exactly these details.
Next step
Adapt the template to your organisation and use it at your next internal audit. Make sure the findings feed into the management review, so that management also sees the outcome of the internal audit.