An ISO 9001 internal audit is the organisation’s own check that its quality management system does what the standard and its own documents say it does, performed at planned intervals by people who do not audit their own work, reported to the managers who can act on it, and fed into management review and corrective action. Clause 9.2 of the standard requires it, certification bodies test it at every surveillance visit, and it is the clause most often cited in nonconformities because organisations run it as a ritual rather than as an audit. This guide covers the requirements of clause 9.2 as they stand in the 2026 edition of the standard, the audit principles and process in ISO 19011, how to build a risk-based audit programme that covers every clause and process over the cycle, how to plan and conduct a single audit with the process approach, how to classify and write findings and drive corrective action, how the results reach management review, auditor competence and independence, the difference between a QMS internal audit and the internal audit profession, the nonconformities certification auditors raise most, and a worked audit programme at an illustrative food manufacturer.
It replaces the beginners’ primer that previously stood at this address and sits beside the ISO 14001 audit guide, which applies the same method to environmental management, and the manufacturing audit guide, which covers the plant from the internal audit profession’s side.
In this guide
- What clause 9.2 requires
- The 2026 edition and what changes for auditors
- ISO 19011: the principles and the process
- Building the audit programme
- Planning one audit: scope, criteria and the checklist
- Conducting the audit with the process approach
- Findings: classifying, writing and grading
- Corrective action and closure
- Feeding management review
- Auditor competence and independence
- QMS internal audit and the internal audit profession
- The nonconformities certification bodies raise most
- Worked example: Brightwater Foods’ audit programme
- Frequently asked questions
- Related guides
What clause 9.2 requires
Clause 9.2 is short and every phrase in it is tested. The organisation shall conduct internal audits at planned intervals to provide information on whether the quality management system conforms to the organisation’s own requirements and to the standard, and is effectively implemented and maintained. To do that it shall plan, establish, implement and maintain an audit programme that sets frequency, methods, responsibilities, planning requirements and reporting, taking into consideration the importance of the processes, changes affecting the organisation and the results of previous audits; define the criteria and scope of each audit; select auditors and conduct audits so as to ensure objectivity and impartiality; ensure results are reported to relevant management; take appropriate correction and corrective action without undue delay; and retain documented information as evidence of the programme and the results. The table turns each phrase into what a certification auditor asks for.
| Requirement | What the certification auditor asks for | Where organisations fail |
|---|---|---|
| Planned intervals | The programme with dates; evidence audits happened when planned | Audits bunched in the month before the certification visit |
| Conformity to the organisation’s own requirements and to the standard | Audit criteria that cite procedures and clauses; checklists that test both | Audits that test the standard and ignore the organisation’s own procedures, or the reverse |
| Effectively implemented and maintained | Evidence that the audit tested outcomes (results, performance, customer feedback), not only the existence of documents | Document-existence audits |
| Programme considers importance of processes, changes and previous results | A rationale for frequency: high-risk processes more often; changed processes audited soon after the change; repeat findings raising frequency | Every process once a year regardless |
| Criteria and scope defined for each audit | An audit plan per audit naming the processes, sites, clauses and documents | Scope “the QMS” |
| Objectivity and impartiality | Auditors not auditing their own work; independence documented | The quality manager auditing the quality function |
| Reported to relevant management | Reports to the process owners and to top management | Reports filed with the quality manager only |
| Correction and corrective action without undue delay | Nonconformities with cause analysis, actions, dates and verification | Findings open for a year |
| Documented information retained | Programme, plans, reports, evidence, closure records | Audits that cannot be evidenced |
The 2026 edition and what changes for auditors
ISO 9001:2026 was published in September 2026 with a three-year transition to September 2029, during which certificates to the 2015 edition remain valid. Clause 9.2 itself is substantively unchanged, but the edition changes what an audit has to test elsewhere, and audit programmes should move to the 2026 criteria within the transition. The table lists the changes that reach the audit.
| Change in the 2026 edition | What it means | What the internal audit now tests |
|---|---|---|
| Quality culture and ethical behaviour | Leadership and awareness requirements now address a culture that supports quality and ethical behaviour, alongside the process approach and continual improvement | Whether people at every level can describe the quality policy and their contribution; whether behaviour matches it; how leadership demonstrates it |
| Risks and opportunities separated | Clause 6 treats the determination and handling of risks and of opportunities as distinct requirements with more guidance | That both are identified and addressed, with actions proportionate to potential effect, rather than a single risk register with opportunities omitted |
| Change management strengthened | Planning of changes now covers communication, monitoring and evaluation, and review of changes to the system | A sample of changes traced from plan to communication to review |
| Core terms in the standard; Annex A expanded | QMS-specific terms added; informative guidance on intent per clause | Checklists updated to the new wording; auditors trained on the intent guidance |
| Climate change considerations (carried from the 2024 amendment) | Context and interested-party requirements include whether climate change is a relevant issue | That the context analysis has considered it and documented the conclusion |
| Transition | Organisations transition by September 2029; certification bodies audit to the 2026 edition on request and after the deadline | Add a gap assessment to the programme; audit the transition plan |
ISO 19011: the principles and the process
ISO 19011 gives the guidelines for auditing management systems, and a QMS internal audit that follows it will satisfy any certification auditor. Its seven principles (integrity, fair presentation, due professional care, confidentiality, independence, the evidence-based approach and the risk-based approach) and its process (programme management, then for each audit: initiation, preparation, conducting, reporting, completion and follow-up) are the frame for the rest of this guide. Two ideas from it matter most. The risk-based approach: the programme and each audit are planned around what could go wrong and what matters to customers, not around the clause list. And the evidence-based approach: audit conclusions rest on verifiable records, observations and interviews, which means an auditor who only reads documents has not audited.
Building the audit programme
The programme is the plan for the cycle, usually a year, that decides which processes, sites and clauses are audited when, by whom and how. Clause 9.2 names its inputs (importance of processes, changes, previous results); the table turns them into a programme and adds the inputs a mature programme uses.
| Input | How it shapes the programme | Evidence it was used |
|---|---|---|
| Process importance | Processes that create the product or service, and those with direct customer impact, are audited at least annually and often twice; support processes at least once in the cycle | A process risk ranking behind the frequencies |
| Changes | New products, equipment, sites, systems, suppliers or people trigger an audit of the changed process within a quarter | Change log cross-referenced to audit dates |
| Previous results | Processes with nonconformities, especially repeats, move up in frequency; clean processes may move down | Prior findings mapped to the plan |
| Customer and performance data | Complaints, returns, on-time delivery, scrap and rework point the programme at the weak processes | Performance data in the programme rationale |
| Certification cycle | The programme completes a full clause and process coverage before each recertification and covers transition requirements | A coverage matrix |
| Resources | Auditor availability and competence against the processes | Auditor matrix |
The coverage matrix is the document that proves the programme: processes down the side, clauses 4 to 10 across the top, with the audit that covers each cell. A programme that audits every process but never tests clause 6 (planning) or 7.1.6 (organisational knowledge) has a gap the certification auditor will find, and the matrix shows it before the visit.
Planning one audit: scope, criteria and the checklist
Each audit has a plan naming the process or area, the site, the criteria (the clauses and the organisation’s documents), the auditor, the date and the people to see. The checklist is built from the criteria and organised by the process, so that the auditor follows the work from input to output and tests the clauses as they arise rather than marching through the standard. The table gives the clause-by-clause questions a checklist should carry; the audit work program guide gives the general template.
| Clause | Questions the checklist carries | Evidence to see |
|---|---|---|
| 4. Context and scope | Have internal and external issues, including climate change where relevant, been determined and reviewed? Are interested parties and their requirements identified? Is the scope documented and justified, including any requirement claimed not applicable? | Context analysis, interested-party register, scope statement, review records |
| 5. Leadership | Does top management demonstrate leadership and commitment; is the quality policy communicated and understood; are roles and authorities assigned; does the culture support quality and ethical behaviour? | Policy, communications, organisation chart, interviews at every level, management review minutes |
| 6. Planning | Are risks and opportunities determined and addressed separately; are quality objectives measurable, planned and monitored; are changes planned, communicated, monitored and reviewed? | Risk and opportunity records, objectives with plans and progress, change records |
| 7. Support | Are resources, infrastructure and environment adequate; are monitoring and measuring resources calibrated and traceable; is organisational knowledge maintained; are people competent and aware; is documented information controlled? | Calibration records, competence records, training, awareness interviews, document control |
| 8. Operation | Are processes planned and controlled; are customer requirements determined and reviewed; is design and development controlled where applicable; are external providers evaluated and controlled; is production under controlled conditions with identification, traceability, preservation and post-delivery activities; is nonconforming output controlled? | Order reviews, design records, supplier evaluations, work instructions, traceability, nonconforming product records |
| 9. Performance evaluation | Is performance monitored and analysed; is customer satisfaction measured; are internal audits conducted per the programme; does management review cover the required inputs and produce outputs? | Performance data, customer feedback, audit records, management review records |
| 10. Improvement | Are nonconformities corrected with cause analysis and corrective action; is effectiveness verified; is continual improvement evidenced? | Corrective action records, verification evidence, improvement projects |
Conducting the audit with the process approach
The process approach is the method ISO 9001 is built on and the method the audit should use: identify the process, its inputs and outputs, its owner, the resources and competence it needs, the measures that show it performs, and the risks to it; then follow a unit of work through it. Auditors use a simple diagram (sometimes called a turtle: the process in the middle, inputs and outputs at the ends, and the four questions of with what, with whom, how, and how measured around it) to structure the interviews. The audit itself runs in a fixed sequence.
| Stage | What happens | Good practice | Common failure |
|---|---|---|---|
| Opening meeting | Confirm scope, criteria, plan, people and logistics with the process owner | Short; agree how findings will be raised during the audit | Skipped; the auditee learns the scope from the first question |
| Interviews and observation | Follow the process with the people who run it; watch the work; ask for the records as they arise | Open questions; see rather than hear; the audit interviewing guide gives the craft | Reading the procedure to the auditee and asking whether they follow it |
| Sampling | Select records, orders, batches or jobs across the period and the shifts | Decide the sample before the audit; include recent changes and problem periods | The three records the auditee hands over |
| Evidence | Record what was seen, where and when, so another auditor could verify it | Reference numbers, dates, names of documents and equipment | “Records reviewed, no issues” |
| Daily close and fact confirmation | Confirm the facts of each potential finding with the owner before leaving | No surprises at the closing meeting | Findings disputed on facts after the report |
| Closing meeting | Present findings with evidence and classification; agree the timetable for corrective action | Findings read exactly as they will appear in the report | Findings negotiated down in the meeting |
Findings: classifying, writing and grading
A finding is a statement about evidence against criteria, and the classification follows from the gap. Internal audits usually adopt the certification bodies’ grades so that the organisation’s own results read like the external ones.
| Classification | Definition | Example | Required response |
|---|---|---|---|
| Major nonconformity | Absence or total breakdown of a requirement; a failure likely to result in nonconforming product or service reaching the customer; a number of minors against one requirement that together show a breakdown | No internal audits performed in the cycle; calibration of measuring equipment used for release not done for a year | Correction, cause analysis, corrective action and verification before the next certification decision; certification bodies suspend for unresolved majors |
| Minor nonconformity | A single lapse or failure that does not indicate a breakdown of the system | One work instruction out of date on the shop floor; one supplier not re-evaluated on schedule | Correction, cause analysis and corrective action within an agreed period |
| Observation | A situation that could become a nonconformity if not addressed, or a weakness in evidence | Risk register last reviewed eighteen months ago, review due but not overdue | Consideration by the owner; tracked |
| Opportunity for improvement | A suggestion with no nonconformity behind it | Combining two inspection steps | Optional; recorded |
A nonconformity is written in three parts: the requirement (the clause or the procedure, quoted), the evidence (what was seen, with references), and the statement of nonconformity (the gap, in one sentence). “Clause 7.1.5.2 requires measuring equipment to be calibrated at specified intervals; micrometers 114 and 119 in final inspection carry calibration labels expired in March 2026 and were used to release batches 2261 to 2290; measuring equipment used for product release is not calibrated at the specified intervals” is a nonconformity; “calibration needs attention” is not. The finding makeovers guide shows the discipline from the internal audit profession’s side and it transfers directly.
Corrective action and closure
Clause 10.2 requires the organisation to react to a nonconformity (correction and dealing with consequences), to evaluate the need for action to eliminate its cause so that it does not recur, to implement the action, to review its effectiveness, to update risks and opportunities if needed, and to make changes to the system if needed, with records of the nonconformity, the actions and the results. The weak step in most systems is cause analysis: the cause recorded is the symptom restated (“operator error”, “procedure not followed”), and the action is retraining, and the nonconformity recurs. The root cause analysis guide gives the five-whys and fishbone methods with worked examples, and the issue validation guide the verification standard: an action is effective when the process shows it is, not when the form is signed. The table gives the lifecycle with the service standards a programme should set.
| Step | Standard | Evidence |
|---|---|---|
| Correction | Immediate containment of nonconforming output and consequences | Correction recorded with date |
| Cause analysis | Within 10 working days for minors, 5 for majors; a method applied, not a phrase | Analysis record |
| Corrective action plan | Actions that address the cause, with owner and date; within 30 days for minors | Plan approved by the process owner |
| Implementation | Per the plan | Evidence of the change (revised document, training, equipment, system change) |
| Effectiveness review | After enough operation to show the result, typically one to three months; performed by someone other than the implementer | Review record with the evidence examined |
| Closure | Only after the effectiveness review | Closure signed by the auditor or quality manager |
| System update | Risks, opportunities and documents updated where the cause showed a gap | Change records |
Feeding management review
Clause 9.3 makes audit results a required input to management review, alongside customer satisfaction, process performance and product conformity, nonconformities and corrective actions, monitoring results, external provider performance, resource adequacy, the effectiveness of actions on risks and opportunities, and opportunities for improvement. What management review needs from the audit programme is a view across the cycle, not a list of audits: coverage achieved against the programme; findings by clause and process with trends; repeat nonconformities; corrective action ageing and effectiveness; the processes rated weakest; and the programme’s own performance and resources. The outputs of management review (decisions on improvement, changes to the system, resources) are then inputs to next year’s programme, which closes the loop the standard is built around.
Auditor competence and independence
Clause 7.2 applies to auditors as to anyone: competence determined, achieved and evidenced. ISO 19011 describes what that competence is (knowledge of the standard and of audit methods, the sector and the organisation’s processes, and the personal attributes of an auditor), and most organisations build it through a lead auditor or internal auditor course, observed audits under an experienced auditor, and an annual evaluation. Independence is simpler: no one audits their own work, which for a small organisation means a rota of trained staff from other departments, the quality function audited by someone from operations or by an external auditor, and the audit programme itself reviewed by someone other than the person who runs it. Certification auditors read the auditor matrix against the audit reports and raise a nonconformity when the two do not reconcile.
QMS internal audit and the internal audit profession
Two activities share a name and are often confused in organisations that have both. The table draws the line; the types of internal audits guide places management-system audits among the other kinds, and the is internal audit accounting guide covers the other confusion.
| Dimension | ISO 9001 internal audit (first-party audit) | Internal audit profession |
|---|---|---|
| Mandate | Clause 9.2 of the standard; the organisation’s QMS | A charter from the board’s audit committee; the IIA’s Global Internal Audit Standards |
| Criteria | The standard and the organisation’s own QMS documents | The organisation’s objectives, policies, regulations and control frameworks across every activity |
| Scope | The quality management system and its processes | Governance, risk management and control across the whole organisation |
| Auditors | Trained staff from other departments; the quality function; external QMS auditors | A dedicated function reporting to the audit committee |
| Output | Nonconformities, observations and opportunities; input to management review and certification | Rated findings; an annual opinion; reports to the audit committee |
| Interaction | The internal audit profession may audit the QMS and its audit programme as a control, and may rely on QMS audit results after testing them | The QMS audit programme is one of the assurance providers on an assurance map |
The nonconformities certification bodies raise most
Certification auditors raise the same findings across industries, and an internal audit programme that tests for them before the visit finds them first. The list is drawn from the clauses that recur in certification body reports and training.
| Clause | Typical nonconformity | Internal audit test that finds it first |
|---|---|---|
| 7.5 Documented information | Obsolete documents in use; uncontrolled forms; records not retained or retrievable | Shop-floor sweep comparing documents in use to the master list |
| 8.5.1 Control of production and service provision | Work performed without the specified instructions, monitoring or equipment | Follow a job against its instructions and measurements |
| 9.2 Internal audit | Programme not risk-based; auditors auditing their own work; audits late; findings without corrective action | Audit the programme against this guide |
| 10.2 Nonconformity and corrective action | Cause analysis absent or superficial; effectiveness not reviewed; repeats | Sample closed actions and test effectiveness |
| 7.1.5 Monitoring and measuring resources | Calibration overdue; traceability missing; no action on out-of-tolerance equipment | Calibration register against labels on the floor; what happened after the last out-of-tolerance result |
| 8.4 Externally provided processes, products and services | Suppliers not evaluated or re-evaluated; controls not based on risk | Supplier list against evaluation records; incoming inspection against the controls defined |
| 6.1 and 6.2 Risks, opportunities and objectives | Risks identified once and never reviewed; objectives not measurable or not monitored | Review dates; objective tracking |
| 9.3 Management review | Inputs missing; no outputs recorded | Minutes against the clause 9.3 list |
| 7.2 Competence | Competence requirements undefined; training without evaluation of effectiveness | Competence matrix against the people doing the work |
| 4.1 and 4.2 Context | Context and interested parties not reviewed; climate change not considered since the 2024 amendment | Review records and dates |
Worked example: Brightwater Foods’ audit programme
Brightwater Foods is the illustrative 180-million-dollar food manufacturer used in examples across this site, with two plants certified to ISO 9001 alongside its food safety certification. After a surveillance visit raised a minor nonconformity against clause 9.2 (the programme audited every process annually with no rationale, two audits were three months late, and the quality manager had audited the quality function), the quality director rebuilt the programme with the plant’s internal audit function advising. The table shows the rebuilt programme’s design decisions and the first cycle’s results.
| Design decision | What was done | First-cycle result |
|---|---|---|
| Risk-based frequency | Processes ranked by customer impact and performance data: production, final inspection and supplier control twice a year; design, warehousing and maintenance annually; HR and document control once in the cycle | Eleven audits in the year instead of nine, concentrated where the complaints were |
| Change trigger | A new packaging line and a new co-packer audited within a quarter of start-up | Three findings on the packaging line before the first customer complaint |
| Coverage matrix | Processes against clauses 4 to 10; gaps in 6.3 (planning of changes) and 7.1.6 (organisational knowledge) closed by adding them to specific audits | Full coverage evidenced for the recertification |
| Auditor rota | Six trained auditors from operations, engineering, procurement and finance; the quality function audited by the engineering manager; the programme reviewed by the plant’s internal audit function | Independence evidenced; the certification auditor closed the 9.2 finding |
| Finding standard | Three-part nonconformity statements; certification grades; corrective action with cause analysis and an effectiveness review at 60 days | Twenty-three findings: 2 major (calibration of release equipment; supplier re-evaluation), 14 minor, 7 observations; one repeat |
| Management review input | A programme report by clause and process with trends and ageing | Review minutes carried decisions on calibration resourcing and supplier management |
| 2026 edition transition | A gap assessment audit against the 2026 edition added to the second-cycle programme, covering quality culture, the separation of risks and opportunities and change management | Transition plan approved for completion in 2028, ahead of the 2029 deadline |
The plant’s internal audit function, which audits the QMS as a control rather than running it, relied on the rebuilt programme’s results for its own manufacturing engagement after testing a sample of the audits, in the way the assurance mapping guide describes.
Frequently asked questions
What is an ISO 9001 internal audit?
The organisation’s own audit of its quality management system, required by clause 9.2, performed at planned intervals by auditors who do not audit their own work, against the standard and the organisation’s own documents, to determine whether the system conforms and is effectively implemented and maintained. Results go to the relevant managers, drive correction and corrective action, and are a required input to management review.
How often must ISO 9001 internal audits be done?
At planned intervals set by a programme that considers the importance of the processes, changes affecting the organisation and the results of previous audits. Most organisations cover every process and clause at least once a year, audit high-impact and changed processes more often, and complete full coverage before each recertification. “Once a year for everything” satisfies the letter and is the pattern certification auditors now question.
Who can perform an ISO 9001 internal audit?
Anyone competent in the standard, audit methods and the processes, who is not auditing their own work: trained staff from other departments, the quality function for processes it does not run, or external auditors contracted to perform first-party audits. Competence is determined, achieved and evidenced under clause 7.2, and independence is documented so that the auditor matrix reconciles to the reports.
What changed in ISO 9001:2026 for internal audits?
Clause 9.2 is substantively unchanged. What the audit tests changed: quality culture and ethical behaviour in leadership and awareness, risks and opportunities treated as separate requirements, strengthened planning of changes, new terms and an expanded Annex A, and climate change considerations carried from the 2024 amendment. The edition was published in September 2026 with a transition to September 2029, and programmes should add a gap assessment and move to the new criteria within it.
What is the difference between a major and a minor nonconformity?
A major is the absence or total breakdown of a requirement, a failure likely to let nonconforming product or service reach the customer, or a cluster of minors against one requirement that shows a breakdown; it must be resolved before a certification decision and can lead to suspension. A minor is a single lapse that does not indicate a system breakdown, resolved by correction, cause analysis and corrective action within an agreed period. Observations and opportunities for improvement are not nonconformities.
How should a nonconformity be written?
In three parts: the requirement, quoted from the clause or the procedure; the evidence, with references to what was seen, where and when; and a one-sentence statement of the gap. The statement should let someone who was not there verify the finding and should not contain the recommended fix, which belongs to the process owner’s corrective action.
What does the certification auditor check about the internal audit programme?
That audits happened at the planned intervals; that the programme is risk-based with a rationale for frequency; that each audit had defined criteria and scope; that auditors were competent and independent of the work audited; that both the standard and the organisation’s own procedures were tested, including effectiveness; that results reached management and management review; that nonconformities received cause analysis, corrective action and effectiveness review without undue delay; and that all of it is documented.
Is an ISO 9001 internal audit the same as internal audit?
No. The QMS internal audit is a first-party management-system audit required by the standard, performed by trained staff against the standard and the organisation’s QMS documents. The internal audit profession is a dedicated function reporting to the board’s audit committee under the IIA’s Standards, covering governance, risk and control across the whole organisation; it may audit the QMS and its audit programme as a control and rely on the programme’s results after testing them.
Related guides
- How to Conduct an ISO 14001 Audit — the same method for environmental management
- Internal Audit in Manufacturing — the plant from the internal audit profession’s side
- Internal Audit Work Program — the general checklist and program template
- Audit Interviewing — question design and listening for process audits
- Root Cause Analysis for Audit Findings — five whys and fishbone, worked
- Issue Validation — the effectiveness-review standard
- Finding Makeovers — writing findings that state requirement, evidence and gap
- Types of Internal Audits — where management-system audits sit
- Assurance Mapping — relying on the QMS audit programme
- How to Audit Procurement — external provider control in depth
- Is Internal Audit Accounting? — the other confusion about the name
- ISO and management systems category — every management-system guide in one archive
Leave a Reply