Audit report example and template (ISO 9001)

An audit report records what you saw, heard and read during the audit, and which conclusions follow from it. For each finding, it contains the evidence, the category and the agreed follow-up. The report belongs with the audit plan and the internal audit. ISO 9001 requires you to report the results of internal audits to the managers concerned, and to keep evidence of the audit programme and audit results (clause 9.2.2). An external auditor will therefore ask for them, for example at the initial audit.

The audit guideline ISO 19011 (2026 edition, replacing the 2018 edition) describes how to report. You buy it from NEN , the Dutch standards publisher. The guideline does not prescribe a fixed format.

What belongs in an audit report?

A report for one internal audit fits on four or five pages. It has fixed sections, so everyone knows where to look.

Section	What you fill in	Why it matters
General details	Date, auditee, auditor, standard, scope	Traceable to the audit plan
Purpose and scope	What was audited, and what was not	Prevents confusion about the reach of the audit
Summary	Three to five sentences on the overall picture	Readers who only read the summary still understand it
Findings	Per finding: category, requirement, evidence, explanation	This is the heart of the report
Conclusion	Does the system meet the requirements of the audit?	The judgement on the audit as a whole
Follow-up	Which actions, who, when	Without this, a finding stays open

Template for an audit report

Copy this table into your own document. Fill it in per audit, and keep the findings in one table.

Field	Entry
Audit	Internal audit purchasing and supplier management
Standard	ISO 9001:2015
Date	14 October 2026
Auditor	Name and role of the auditor
Auditee	Name and role of the process owner
Scope	Purchasing process, from order to receipt, including supplier assessment
Summary	The process works, but the supplier assessment has no date and has not been repeated. Two findings.
Conclusion	The system broadly meets the requirements. One minor nonconformity and one observation.

Findings in a separate table:

No.	Category	Requirement	Evidence (what you saw)	Explanation	Action and owner	Date
1	Minor nonconformity	ISO 9001 clause 8.4: assessment of external suppliers	Supplier X assessment list from 2025	No date, no signature, no repeat	Reassessment by buyer	30 November 2026
2	Observation	ISO 9001 clause 8.4: control of purchasing	Sample of ten purchase orders	No errors. The check on the order form does happen, but it is not described anywhere	Consider recording the check	No date

A minor nonconformity is a small shortfall against a requirement. An observation is an improvement point that does not deviate from the requirement. See major and minor nonconformity for the difference with a major.

Example: a good and a poor finding

This is how a finding often looks, and how it should look instead:

Poor: “Purchasing procedure not in order.”

This says nothing. The auditee does not know what to improve, and the auditor cannot check it.

Good: “The assessment of supplier X (version from 2025) has no date and no signature. Evidence: assessment list in the Suppliers folder, folder checked on 14 October. Requirement: the organisation assesses external suppliers and keeps the evidence of this.”

The difference lies in three things: where it is, what you saw, and which requirement it concerns. An auditor can then repeat the check themselves.

Always write evidence as a place or document that someone can find again: a folder, a system, a date, a sample. “Seen during the audit” without further detail is not evidence.

Step by step: writing an audit report

Write down the findings straight after the audit

Do not wait until the following week. Your memory fades quickly, and notes taken during the audit are the most reliable. Finish the notes within one day.

Separate facts from judgements

First write down what you saw: “the list is missing a date”. Only then write: “this is a minor nonconformity”. This lets the auditee follow your reasoning and, if needed, contest it.

Categorise each finding

Use four categories: conforming, observation, minor nonconformity and major nonconformity. This is the classification used in external audits. It is not part of ISO 9001 itself, but it helps if your organisation is already used to it.

Link each finding to a requirement

Name the chapter or requirement from the standard. Without a link, nobody can check whether the finding is correct. For a combined audit, the High Level Structure helps, because many chapters overlap.

Discuss the draft with the auditee

Let the auditee check the facts, not the conclusions. You correct factual errors immediately. Record any disagreement about the category as a position. Do not quietly change the category.

Agree follow-up

For each minor or major: who carries out the correction, when it is done, and how you check that it works. For the cause, use a root cause analysis.

Archive the report

Store the report where you can find it later. The external auditor asks for it at the initial audit and at every surveillance audit.

What does the auditor look for in your report?

An external auditor checks whether your internal audit produced something useful. They look for:

A report for each audit, with a date and the name of the auditor.
Proof that the auditor was independent of the process they audited.
Evidence for each finding that the auditor can trace.
An action, owner and date for each minor and major nonconformity.
Proof that the actions were actually checked, not just ticked off.

Common mistakes in an audit report

Vague evidence. “Seen” or “discussed” is not evidence. Name the document, the location or the sample.

Everything as an observation. If a requirement is not met, it is a nonconformity. An observation is only for improvement points that do not affect the requirement.

No follow-up. A finding without an action stays open. Management discusses audit results in the management review, and open findings stand out there.

A report three weeks later. The later the report arrives, the less well the auditor remembers. Agree a deadline in advance, for example five working days after the audit.

Only negative findings. Also name what works well. This gives context and makes the findings more credible.