In short
The internal audit is required by clause 9.2 of every ISO management system standard, and the certification body checks it at Stage 1, Stage 2 and every surveillance audit.
The audit programme starts from the importance of processes and previous results, not from the standard's table of contents.
Auditors must be competent and objective: nobody should audit their own work, even in small organisations.
A useful nonconformity states the requirement, the objective evidence and the problem; the report should be short and fact-based.
Audit results feed corrective actions and the management review: plan all three activities together.
A well-run internal audit saves you from surprises at the external audit. How you choose the processes, who you involve and how you write a useful report are the three decisions that separate a real check from a box-ticking exercise.
The ISO internal audit is a requirement of every management system standard: ISO 9001, ISO 14001, ISO 27001, ISO 45001 and the others built on the same structure. Yet many SMEs treat it as a formality: a downloaded checklist, a quick walk round the offices a few weeks before the certification body arrives, a report stating "no findings". Then the external auditor turns up and, in half a day, finds what the internal audit should have spotted months earlier.
In this guide we look at what the standard actually requires, how to build an audit programme proportionate to your organisation, who can act as auditor without losing objectivity, how to run each audit and how to write a report that management reads and uses. The practical reference is ISO 19011, the international guideline for auditing management systems. If you first need a refresher on how the whole certification journey works, start with our guide on what ISO certifications are.
What is an ISO internal audit and what does the standard require?
An internal audit is a check an organisation carries out on itself, at planned intervals. Its purpose is to establish whether the management system meets the requirements and whether it really works in practice.
All ISO management system standards share the harmonized structure published by ISO and IEC, and the internal audit always appears in clause 9.2. The common text requires internal audits at planned intervals to provide information on two points: whether the system conforms to your own requirements as well as those of the standard, and whether it is effectively implemented and maintained. The same structure defines the internal audit as a "first-party" audit, conducted by the organisation itself or by an external party on its behalf.
Clause 9.2 requirements in practice
Clause 9.2 has a second part, on the audit programme, and this is where the quality of the work is decided. The standard requires you to plan, establish, implement and maintain a programme covering frequency, methods, responsibilities, planning requirements and reporting. When building it, you must take into account the importance of the processes concerned and the results of previous audits.
For each audit, the standard then requires you to define the objectives, criteria and scope, to select auditors who ensure objectivity and impartiality, and to report the results to relevant managers. Finally, you need documented information as evidence of the programme's implementation and of the audit results. Individual standards may add discipline-specific details, but this core is identical everywhere. That is why, if you hold several certifications, you can run a single integrated programme instead of many separate audits.
Why the certification body always looks at it
The internal audit is one of the first things the certification body checks. ISO/IEC 17021-1, the standard governing certification bodies, requires them to evaluate at Stage 1 whether internal audits and management reviews are being planned and performed. At Stage 2 the internal audit is among the elements to be audited, and every surveillance audit must include it again.
There is also a less obvious effect. In its report, the certification body also records how it assessed the internal audit and management review. In other words, the external auditor does not just check that an internal audit exists: they assess whether it worked. An internal audit that found nothing, in an organisation where the external auditor finds several problems, is itself a sign that internal control is not holding up.
How do you build an audit programme that makes sense?
The audit programme is the plan that sets out what to check, when, with whom and by what methods. It should be built before the individual audits and reviewed when risks change.
The most common mistake is copying the standard's table of contents and assigning one audit per clause. That way you check requirements detached from real work, whereas the standard asks you to start from processes and their importance. A good programme answers a concrete question instead: where could something go wrong that matters to customers, legal compliance or the organisation's objectives?
Choosing processes by importance and risk
Start from your process map and give each process a level of attention. The useful criteria are few: impact on the customer or on the system's outcomes, complaints and nonconformities recorded, recent changes (new software, a new manager, a new site), results of the previous audit and the certification body's findings.
Take an engineering firm with 60 employees, certified to ISO 9001. Over the last year it changed its ERP system and received three complaints about late deliveries. A sensible programme focuses on production planning and logistics, checks how order and bill-of-materials data were migrated, and applies a lighter check to stable processes such as human resources. ISO 19011 calls this logic the risk-based approach: it uses it both to plan the programme and to decide where to spend time during each audit.
Frequency: not everything every year in the same way
The harmonized structure does not set a frequency: it speaks of "planned intervals" and leaves the choice to you. That does not mean you can audit whenever it suits you. It means the frequency must be justified by the importance of the processes and by previous results.
In practice, many organisations make sure every process and every requirement of the standard is covered at least once in the three-year certification cycle, with critical processes checked every year or even more often. You can spread audits across the year rather than squeezing them into a single week: you work better, disrupt departments less and have time to close actions before the surveillance audit.
An example of an annual programme
Here is how the programme of an IT services company with 35 people, certified to ISO 9001 and ISO/IEC 27001, might look.
Process or area | Reason for selection | Period | Auditor |
|---|---|---|---|
Access and identity management | Finding from previous audit, new authentication tool | First quarter | Quality manager (not involved in the process) |
Software development and release | Key process for customers, two complaints | Second quarter | Appointed external auditor |
Suppliers and cloud services | New critical supplier | Second quarter | IT manager from another team |
Training and awareness | Stable process | Third quarter | Quality manager |
Incident management and continuity | Continuity test planned for the year | Third quarter | Appointed external auditor |
Leadership, objectives and review | Coverage of system requirements | Fourth quarter | Appointed external auditor |
The table is not a template to copy: it shows how every row has a reason. If a row has no reason, it is probably unnecessary, or it is necessary but needs less time.
Who should carry out the internal audit?
The internal audit can be carried out by someone in the organisation or by an appointed external professional. What matters is that they are competent and look at the process with objectivity and impartiality.
The harmonized structure requires you to select auditors and conduct audits so as to ensure objectivity and impartiality of the process. ISO 19011 lists independence among its seven principles of auditing, together with integrity, fair presentation, due professional care, confidentiality, an evidence-based approach and a risk-based approach. The practical rule is simple: nobody should audit their own work.
Objectivity in small organisations
In a company of 15 people, the rule "nobody audits their own work" seems impossible to follow. It is not, but it takes a little organisation. The technical manager can audit administration and the office manager can audit production, provided they have received suitable training. You can swap auditors with a partner company, or appoint an external auditor for processes in which everyone is involved, such as those of top management.
ISO 19011 itself recognises that its guidance should be adapted to the size and complexity of the audit programme. What does not work is a quality manager auditing the processes they run every day, or an owner auditing their own leadership: at best they will find what they already know, at worst they will see nothing at all. The key point is that the auditor does not check their own operational work.
Internal or external auditor: how to choose
An internal auditor knows the organisation's processes, people and jargon. They require less coordination and, if well trained, grow with the system. The limit is familiarity: after a few years they tend to take for granted what they see every day.
An external auditor brings fresh eyes and experience built across many organisations, and knows what certification bodies expect. The risk, if they work without context, is a generic audit. The most common solution in SMEs is mixed: internal auditors for operational processes, an experienced external auditor for cross-cutting processes and an overall check before the surveillance audit.
If Complaion supports you, this choice is already made: the internal audit is conducted by your Complaion Lead Auditor: a professional outside your processes, who audits them against ISO 19011 criteria without being part of their operation. They know your system, but never check operational work of their own.
The competence you need
ISO 19011 devotes an entire chapter to auditor competence: personal behaviour, knowledge and skills, and how they are evaluated. An internal audit needs three things. Knowledge of the reference standard, at least for the requirements being checked. Knowledge of the process, to understand what is normal and what is not. And audit skills: asking open questions, listening, asking for evidence, separating facts from opinions.
Keep evidence of your internal auditors' training and experience. The certification body may ask for it and, above all, it helps you understand who is ready for which process.
How do you prepare and conduct a single audit?
Every audit in the programme has an objective, criteria and a scope defined before it begins. Without these three elements, the audit becomes a chat.
ISO 19011 describes conducting an audit in stages: initiation, preparation, conducting activities, reporting, completion and follow-up. You do not need to apply them with the formality of a certification audit, but the sequence helps you avoid skipping steps. Let us look at the three decisive moments.
Objectives, criteria and scope: three lines that change everything
The objective says why you are auditing: for example, to check that software releases follow the approved testing procedure. The criteria are the reference against which you compare what you find: the requirements of the standard, your procedures, legal or contractual obligations. The scope sets out what is included: which sites, which departments, which period.
Writing them down first protects you from two opposite mistakes. The first is the audit that is too broad, touching everything and going into nothing in depth. The second is the audit without criteria, where the auditor judges according to personal preference. A good rule: if you cannot state the reference criterion for a possible finding, that finding is not a nonconformity.
The plan and the checklist
The audit plan sets out dates, times, people to meet and documents to examine. Share it with process owners a few days in advance, so the right people are available and the documents are accessible.
The checklist is useful, but it must be yours. Build it from the process criteria and risks, not from a generic template. Instead of "Is there a supplier management procedure?", write "Take three orders placed with critical suppliers in the last six months and check that the supplier was qualified on the order date". The first question ends with a yes. The second produces verifiable evidence.
Gathering evidence on the ground
Evidence is gathered in three ways: interviewing people, observing activities and examining documents and records. A good audit cross-checks them. If the procedure says every code change is reviewed by a colleague, ask the developer how it works, watch a review in progress and check the records for a sample of changes.
Sampling is unavoidable: you cannot check everything. Choose the sample deliberately, favouring the highest-risk cases and the most recent period, and note which items you checked. Note what works, too: an internal audit that records only problems gives management a distorted picture of the system.
How do you write an audit report that is actually useful?
An audit report is useful when the reader understands within a few minutes what works, what does not and what needs to be done. It must be based on evidence, not impressions.
ISO 19011 calls "audit findings" the result of comparing the evidence gathered with the audit criteria. A finding can indicate conformity or nonconformity, and can point to opportunities for improvement. The audit conclusions, by contrast, are the overall summary, taking account of the objectives and all the findings.
How to write a nonconformity
A well-written nonconformity has three elements: the requirement not met, the objective evidence and the description of the problem. Compare these two versions.
Weak version: "Supplier management is not adequate." It does not say which requirement, it does not say what you saw, and the process owner does not know where to start.
Useful version: "The purchasing procedure requires critical suppliers to be qualified before the first order. Of five orders placed with critical suppliers in the second quarter, two were issued to a cloud services supplier with no qualification on record at the order date." The problem is defined, verifiable and already points to where to look for the cause. To understand how findings are classified and how the certification body assesses them, read our guide on major and minor nonconformities.
The structure of a concise report
An internal audit does not need a twenty-page report. A concise structure works better, because it gets read.
Objective, criteria, scope, dates and auditors.
People interviewed and sample examined.
A summary in a few lines: the state of the process against the objective.
Strengths observed, with evidence.
Nonconformities, each with requirement, evidence and description.
Observations and opportunities for improvement, kept separate from nonconformities.
Conclusions and agreed next steps.
The harmonized structure requires results to be reported to relevant managers: the report should therefore be shared with whoever runs the process and reach top management. Keep it together with the main evidence, because it is the documented information that proves the audit was carried out.
Tone matters
A report that sounds like an accusation produces defensiveness, not improvement. Describe facts, not people: "the record is missing" rather than "the manager did not record it". Share the findings at the closing meeting, so nobody discovers them by reading the document. And make a clear distinction between a nonconformity and a suggestion: if everything becomes a nonconformity, nothing has priority any more.
What happens after the internal audit?
An internal audit creates value only if findings turn into actions. The cycle closes with corrections, corrective actions and the management review.
For every nonconformity, the harmonized structure requires you to react, controlling and correcting the problem, and to evaluate whether action is needed to eliminate its cause, so that it does not recur. This is where many stop at the correction: the missing supplier is qualified and the case is closed. But if two orders out of five lacked qualification, the problem lies in the process, not in the single supplier. Our guide on corrective action and root cause analysis explains how to reach the real cause without stopping at the first answer.
The link with the management review
Audit results are one of the mandatory inputs to the management review, together with nonconformities, corrective actions and monitoring results. If the internal audit is carried out shortly before the review, management decides on fresh data. If it is carried out afterwards, management decides on data that is a year old.
That is why it pays to plan internal audits and the review together. A typical sequence: audits spread across the year, closure of the main actions, management review, then the surveillance audit. We cover this in our guide on the management review.
Checking effectiveness, not just closure
A closed corrective action is not necessarily an effective one. At the next audit of the same process, check whether the problem has recurred and whether the cause has really been removed. Record the outcome in the programme: it is one of the ways the programme itself improves over time, as ISO 19011 recommends when it addresses monitoring and reviewing the audit programme.
What are the most common internal audit mistakes?
The recurring mistakes are almost always the same, in organisations of every sector. Recognising them in advance is the fastest way to raise the standard.
The first is the audit squeezed into the last month before surveillance. The calendar makes it convenient, but it leaves no time to analyse causes and close actions: the certification body will see open findings and corrective actions written in a hurry. The second is the copied checklist from the internet, which checks that documents exist rather than that processes work.
The third mistake is the self-referential audit: whoever wrote the procedure audits it and finds everything in order. The fourth is the report without evidence, with phrases such as "process under control" that nobody can verify. The fifth is treating zero findings as a good result. A living system always has something to improve: an audit that finds nothing has often looked at very little.
Finally, there is the scope mistake. Over the course of the programme, internal audits must cover all the requirements of the standard and the whole scope of the certificate, sites included. If a site or an outsourced process never appears, that is where the external auditor will look. For a full picture of the requirements to cover, see our guides on ISO 9001 and ISO 27001.
How does Complaion help with the internal audit?
If you follow your certification path with Complaion, you do the internal audit with us: your Lead Auditor conducts it, with the objectivity of someone who does not work in the processes being audited, and hands you the report with findings and actions to take. You do not need to train an internal auditor or look for an external one. The path is designed to bring nonconformities to light and close them before the external visit: that is why our clients reach the external audit with a 100% success rate.
With Complaion, the internal audit stops being a last-minute task and becomes part of every month's work. You are supported by a dedicated Lead Auditor, who knows your organisation, proposes the path best suited to your needs, sets up the audit programme with you based on real risks, not on the standard's table of contents, and conducts the planned internal audits.
The platform gathers evidence, manages documents and their versions, and keeps the schedule of audits, corrective actions and reviews, so no deadline catches you by surprise. When the certification body's audit comes round, the material is already in order and the Lead Auditor helps you prepare. It is the model already used by more than 1,000 clients to achieve and maintain their certifications.
Want to work out how to set up your internal audit programme? Talk to one of our experts or request a quote tailored to your organisation.
Frequently asked questions about the ISO internal audit
Is an internal audit mandatory for ISO certification?
Yes. All certifiable ISO management system standards built on the harmonized structure require internal audits at planned intervals, in clause 9.2. The certification body checks at Stage 1 that they are planned and performed, and checks them again at Stage 2 and in every surveillance audit. Without a completed internal audit, an organisation is normally not ready for certification.
How often should an internal audit be carried out?
The standard does not set a frequency: it requires planned intervals, based on the importance of the processes and the results of previous audits. Many organisations cover all the requirements at least once in the three-year certification cycle and check critical processes every year. What matters is that the frequency is justified and documented in the audit programme.
Can an employee carry out the internal audit?
Yes, provided they are competent and ensure objectivity and impartiality. In practice, they must not audit their own work. Small organisations solve this by having different departments audit each other, or by entrusting an external auditor with processes in which everyone is involved. Keep evidence of the training and experience of whoever carries out the audit.
What is the difference between an internal audit and a certification audit?
An internal audit is a first-party audit: the organisation carries it out on itself, directly or through an appointed external party. A certification audit is a third-party audit: it is carried out by an accredited, independent body, in line with ISO/IEC 17021-1. The first is for improving and preparing; the second leads to the decision on the certificate.
What should an internal audit report contain?
Objective, criteria, scope, dates, auditors and sample examined, followed by the findings: strengths, nonconformities and opportunities for improvement. Each nonconformity must state the requirement, the objective evidence and the description of the problem. The report closes with conclusions and the next steps agreed with process owners.
Can a single internal audit cover several ISO standards?
Yes. Standards built on the harmonized structure share the same internal audit clause, so you can run an integrated programme and carry out combined audits, for example quality and information security on the same process. You must, however, cover the specific requirements of each standard and state clearly in the report which standard each finding refers to.
What happens if the internal audit finds nonconformities before certification?
It is normal, and it is precisely the purpose of the audit. You need to correct the problem, analyse its cause and decide on corrective actions. The certification body does not penalise an internal audit that finds problems: it looks at whether they were handled effectively. An internal audit that finds nothing, when the external auditor then finds several issues, is a worse sign.
