Planning and carrying out an internal audit

An internal audit is a self-check: you verify that your own management system does what it should. Every ISO management system standard requires it. The auditor from your accredited certification body expects evidence during the initial audit that you have carried out internal audits. Without that evidence, you receive a major nonconformity.

This guide is independent of any standard. The approach applies to ISO 9001, ISO 27001, ISO 14001, ISO 50001, NEN 7510 and other standards. The International Organization for Standardization (ISO) has published the guideline ISO 19011 for this purpose.

What is the purpose of an internal audit?

An internal audit is not a paper exercise. You use it to find shortcomings before the external auditor does. Small gaps that you find yourself and resolve become findings. The same gaps found by the external auditor become nonconformities in their audit report.

For example: an installation company carries out an internal audit and discovers that two employees do not have the current version of a work instruction. They adjust the distribution process before the external audit. During the certification audit, this is no longer an issue.

The standard requires the internal auditor to be independent of the activities they assess. You may not audit your own work. In small organisations, this may mean hiring someone for a day.

Drawing up the annual programme

You decide in advance which processes or departments are audited and when. This is called the audit programme. It does not need to be complex: a simple table or spreadsheet is enough. For each audit, you draw up the planning in an audit plan, with timings, criteria and the evidence you want to see.

What you record	Why
Scope per audit cycle	All requirements of the standard are covered within 1-3 years
Planned audit dates	Gives structure and prevents it from being put off
Responsible auditor	Safeguards the independence requirement
Status per audit	Planned, carried out, closed

An annual programme for a small company could look like this: Q1 audit department A, Q2 department B, Q3 department C, Q4 evaluation and management review. You do not need to audit every department every year, but your whole system must be covered within the audit cycle.

Carrying out an internal audit in 4 steps

Preparation

Define the scope of this audit (which processes, requirements or department), prepare a checklist and inform those involved. Look back at previous audits: were there nonconformities? If so, give them extra attention.

Prepare open questions, not yes/no questions. Not: “Do you have a procedure?” But: “How does this process work in practice? Can you show me?”

Carrying out

Talk to the people who do the work. Ask for evidence. Look at records, logbooks, orders or logs. Walk along with them. The audit is not an interrogation but a conversation.

Take notes during the audit. Record what you see, hear and read. Do not mix observations with conclusions yet.

Reporting

Write your findings in an audit report. Use four categories: conforming, observation (point for improvement), minor nonconformity (small shortcoming) or major nonconformity (serious shortcoming). This classification matches that of the external audit; you can read the difference on major and minor nonconformity. This way, the organisation gets used to the terminology.

The report is evidence for the external auditor. Keep it.

Follow-up and closure

Every nonconformity requires a corrective action: what will you do, who is responsible and when is it done? Record this. First find the cause with a root cause analysis and 5 whys. For complex or recurring problems, an Ishikawa diagram helps, and for customer complaints in industry, an 8D report. Check whether the action has actually been carried out and whether the problem has been solved.

Only close the finding once the action has been verified.

Who carries out the internal audit?

Small company (1-25 FTE)

In small organisations, it is difficult to have someone audit independently. If you want to take on this role, read what an ISO auditor needs to be able to do. Options: a colleague from another department, an external adviser you hire for a day, or a friendly company with which you exchange audits. The standard allows all three.

Link with the management review

The results of your internal audits are mandatory input for the management review. Top management discusses the findings and decides whether system improvements are needed. Record this, because the external auditor wants to see that top management is involved.

Standard-specific detail

Each standard has its own emphasis for internal audits. Read on here if you have a specific standard:

Need help choosing software for your audits and management system? Read which ISO software you need.