An ISO 9001 Internal Audit evaluates whether your Quality Management System is operating effectively and conforms to planned arrangements and the requirements of ISO 9001.
An ISO 9001 Internal Audit is one of the most important activities within a Quality Management System (QMS). It provides organisations with an opportunity to evaluate whether their processes are operating as intended, identify opportunities for improvement and confirm that the management system continues to meet the requirements of ISO 9001.
Despite its importance, internal auditing is often misunderstood.
Many organisations view an internal audit as a compliance exercise or a rehearsal for the certification audit. In reality, an internal audit is a powerful management tool that helps organisations understand how effectively their Quality
Management System is performing and where improvements can be made before issues affect customers, operations or business performance.
When conducted effectively, internal audits provide objective evidence that supports informed decision-making, continual improvement and long-term business success.
In this guide, we’ll explain what an ISO 9001 Internal Audit involves, when it should be performed, how the audit process works and how organisations can use internal audits to improve their Quality Management System, not just maintain certification.
An ISO 9001 Internal Audit evaluates whether your Quality Management System is operating effectively and conforms to planned arrangements and the requirements of ISO 9001.
Internal audits are a requirement of ISO 9001 and should form part of a planned audit programme.
Internal audits are conducted by competent auditors who are objective and impartial.
The audit focuses on processes, evidence and system effectiveness, not individuals.
Audit findings provide valuable input for corrective actions, management reviews and continual improvement.
A well-executed internal audit helps organisations prepare for certification and surveillance audits while improving overall business performance.
An internal audit is not designed to assign blame or "catch people out."
Its purpose is to determine whether the Quality Management System is achieving its intended results and to identify opportunities for continual improvement.
An ISO 9001 Internal Audit is a systematic and independent assessment of an organisation's Quality Management System to determine whether it:
The audit provides management with objective evidence about the performance of the Quality Management System and helps identify both strengths and areas requiring improvement.
Importantly, an internal audit is not intended to inspect individual employees or assign fault.
Instead, it evaluates whether the systems, processes and controls established by the organisation are functioning effectively and supporting consistent business performance.
The findings from internal audits play a critical role in helping organisations improve operational efficiency, strengthen customer satisfaction and prepare for external certification audits.
New to ISO 9001? Read our What Is ISO 9001? guide to understand how a Quality Management System supports consistent quality and continual improvement.
Internal audits are one of the primary mechanisms for evaluating the health of a Quality Management System.
Without regular audits, organisations may remain unaware of process weaknesses, recurring issues or opportunities to improve efficiency until they are identified by customers or external auditors.
Regular internal audits help organisations:
When viewed as a business improvement tool rather than a compliance exercise, internal audits become an important source of insight that supports better decision-making and continual improvement across the organisation.
One of the biggest misconceptions about ISO 9001 Internal Audits is that the auditor is simply checking whether procedures have been followed.
In reality, the auditor is trying to answer much more important questions.
Throughout the audit, they are looking for objective evidence that the Quality Management System is working as intended.
Typical questions include:
These questions shift the focus from simple compliance to organisational effectiveness.
A successful internal audit doesn't just confirm that procedures exist. It provides confidence that the Quality Management System is supporting quality, efficiency and customer satisfaction.
These three activities are often confused, but they serve very different purposes within an ISO 9001 management system.
Understanding these differences helps organisations perform the right activity at the right stage of their ISO 9001 journey.
A gap analysis identifies what needs to be implemented, an internal audit evaluates whether the implemented system is working effectively, and a certification audit independently confirms conformity with ISO 9001.
The most successful organisations do not perform internal audits simply because ISO 9001 requires them.
They use audits to understand how the business is performing, identify opportunities to improve processes and make informed decisions based on objective evidence.
When integrated into the normal management cycle, internal audits become a valuable source of information that supports continual improvement, strengthens customer confidence and helps ensure the Quality Management System continues to deliver value to the organisation.
ISO 9001 requires organisations to conduct internal audits at planned intervals to determine whether the Quality Management System continues to conform to the organisation's own requirements and the requirements of ISO 9001.
The standard does not prescribe how often internal audits must be performed.
Instead, organisations should establish an audit programme that reflects the size, complexity and risk profile of the business.
Factors to consider when determining audit frequency include:
Some organisations conduct a comprehensive internal audit annually, while others adopt a rolling audit programme, auditing different processes throughout the year.
An ISO 9001 Internal Audit evaluates much more than documented procedures.
The purpose is to determine whether the Quality Management System is operating effectively and achieving its intended outcomes.
During an audit, the auditor typically evaluates:
The auditor also considers whether the organisation is following its own documented processes and whether those processes remain appropriate for achieving business objectives.
Although each organisation develops its own audit methodology, a typical ISO 9001 Internal Audit follows a structured sequence of activities.
The process begins with establishing an internal audit programme.
The audit programme defines:
Rather than auditing every process with the same frequency, organisations should adopt a risk-based approach.
Processes that are critical to customer satisfaction, business performance or regulatory compliance may require more frequent auditing than lower-risk activities.
An effective audit programme ensures that all relevant areas of the Quality Management System are reviewed over an appropriate period while making the best use of available resources.
Before an audit begins, it is essential to define exactly what will be assessed.
This provides clarity for both the auditor and the people being audited.
The scope defines the boundaries of the audit.
Examples include:
The criteria are the requirements against which the audit will be conducted.
These may include:
The objectives explain why the audit is being performed.
Typical objectives include:
Clearly defining these elements helps ensure the audit remains focused and delivers meaningful results.
Preparation is one of the most important stages of the internal audit process.
A well-prepared auditor gains an understanding of the process before arriving at the audit.
Preparation may include reviewing:
This enables the auditor to focus on areas of greatest importance and ask relevant questions during the audit.
Good preparation also reduces unnecessary disruption to normal business operations.
An audit programme is more than an annual audit schedule.
It is a structured plan that ensures every relevant process within the Quality Management System is audited over time using an approach that reflects the organisation's risks, objectives and priorities.
A typical audit programme includes:
The programme should remain flexible.
For example, if customer complaints increase or significant organisational changes occur, management may decide to audit a particular process sooner than originally planned.
The effectiveness of an internal audit depends largely on the competence and objectivity of the auditor.
ISO 9001 requires auditors to be objective and impartial.
Where possible, auditors should not audit activities for which they are directly responsible, as this helps maintain independence and credibility.
A competent internal auditor should have:
Many organisations train internal employees as auditors, while others engage independent specialists to provide an objective assessment, particularly before certification or surveillance audits.
An effective internal audit begins long before the opening meeting.
By developing a risk-based audit programme, clearly defining the audit scope and objectives, selecting competent auditors and preparing thoroughly, organisations create the conditions for meaningful audits that provide valuable insight into the effectiveness of their Quality Management System.
When audits are properly planned, they become far more than compliance activities. They become a reliable source of information that helps management improve processes, reduce risk and support continual improvement.
Once the audit has been planned and the necessary preparation completed, the internal audit moves into the execution phase.
This is where the auditor gathers objective evidence to determine whether the Quality Management System conforms to ISO 9001, follows the organisation's own processes and is achieving its intended outcomes.
A well-conducted internal audit is not an interrogation or inspection.
It is a structured discussion that allows the auditor to understand how processes operate in practice, verify that they are being followed consistently and identify opportunities to improve their effectiveness.
Throughout the audit, the auditor typically combines interviews, observations and document reviews to build an accurate picture of how the organisation manages quality.
ISO 9001 requires audit conclusions to be based on objective evidence rather than assumptions or opinions.
Objective evidence is information that can be verified and demonstrates whether a process is operating as intended.
Internal auditors generally gather evidence through three primary methods.
The auditor speaks with employees to understand:
The purpose is not to test employees on the ISO 9001 standard.
Instead, the auditor wants to determine whether people understand the processes they follow and whether those processes are effective.
The auditor observes work being performed to verify that documented processes reflect actual practice.
Examples include observing:
Observations help confirm that procedures are practical, consistently applied and producing the intended results.
The auditor also reviews documented information to verify that processes are being implemented and maintained.
Typical records may include:
Rather than simply confirming that records exist, the auditor evaluates whether they provide evidence that the Quality Management System is functioning effectively.
One of the strengths of an experienced internal auditor is the ability to ask questions that encourage discussion rather than simple "yes" or "no" answers.
For example, instead of asking:
"Do you follow this procedure?"
An auditor might ask:
These questions help the auditor understand whether the process is genuinely embedded within the organisation rather than simply documented.
At the conclusion of the audit, the evidence gathered is evaluated and the findings are documented.
Not every finding represents a problem.
A professional internal audit should recognise both strengths and opportunities for improvement.
Conformities are areas where the organisation has successfully implemented and maintained processes that meet the audit criteria.
Identifying conformities is important because it demonstrates where the Quality Management System is working effectively and provides confidence that good practices are being consistently applied.
Recognising strengths also encourages employees and reinforces successful ways of working.
Not every observation requires corrective action.
Sometimes the auditor identifies opportunities to make processes more efficient, reduce risk or strengthen controls even though the current process still conforms to ISO 9001.
Examples might include:
These suggestions support continual improvement and often provide significant business value without indicating a failure to meet ISO 9001 requirements.
A nonconformity occurs when there is objective evidence that a requirement has not been met.
This may relate to:
The purpose of identifying nonconformities is not to assign blame but to ensure that issues are understood, corrected and prevented from recurring.
Many organisations classify internal audit findings according to their own risk or significance.
A minor nonconformity usually relates to an isolated issue that does not significantly affect the overall effectiveness of the Quality Management System.
Examples may include:
Minor findings should still be investigated and corrected, but they generally do not indicate a systemic weakness.
Some organisations also classify more significant findings as major nonconformities.
These typically indicate that:
Not every organisation uses formal grading for internal audit findings, but where it is used, the classification should reflect the significance of the issue and help management prioritise corrective actions.
The internal audit report provides management with a clear summary of the audit and forms an important input into continual improvement.
A well-written report should be factual, objective and supported by evidence.
It should clearly communicate:
The report should focus on facts rather than opinions and provide management with sufficient information to make informed decisions about improving the Quality Management System.
When nonconformities are identified, the organisation should investigate why they occurred before deciding how to address them.
Simply correcting the immediate issue is rarely enough.
Effective corrective action involves:
This systematic approach strengthens the Quality Management System and supports continual improvement.
Related guide: Read our ISO 9001 Corrective Action guide to understand how to investigate root causes, implement effective corrective actions and verify their effectiveness.
An internal audit is only complete once corrective actions have been verified.
Follow-up activities confirm that:
Where necessary, follow-up audits may be conducted to verify the effectiveness of significant corrective actions.
The greatest value of an internal audit is not the audit report itself.
It is the insight the audit provides into how effectively the organisation operates.
When findings are analysed objectively and corrective actions are implemented effectively, internal audits become a powerful management tool that helps improve processes, reduce operational risk, strengthen customer satisfaction and support continual improvement.
Rather than asking:
"Did we pass the audit?"
Organisations should ask:
That is the mindset that transforms internal auditing from a compliance requirement into a driver of long-term business performance.
One of the most common mistakes is focusing solely on whether documents exist or whether individual ISO 9001 clauses have been addressed.
A successful internal audit goes beyond ticking boxes.
It evaluates whether processes are achieving their intended results, supporting business objectives and delivering consistent value to customers.
Internal auditors should remain objective and impartial throughout the audit process.
Auditing activities for which you are directly responsible can create conflicts of interest and reduce the credibility of the audit findings.
Where complete independence is not practical, organisations should implement measures to maintain objectivity or consider using an independent external auditor.
Many organisations view an audit as a search for mistakes.
While identifying nonconformities is important, a balanced audit should also recognise effective practices, improvements and areas of strong performance.
Acknowledging what works well helps reinforce good practices and encourages continual improvement across the organisation.
Questions that only require a "yes" or "no" answer rarely provide meaningful insight.
Effective auditors encourage discussion by asking employees to explain how processes work, how decisions are made and how they know whether a process is successful.
This approach provides a more accurate understanding of how the Quality Management System operates in practice.
Correcting the immediate problem without understanding why it occurred often results in the same issue recurring.
Effective corrective actions should investigate the underlying cause of the nonconformity, implement appropriate solutions and verify that those actions have prevented recurrence.
Some organisations only conduct internal audits shortly before a certification or surveillance audit.
This approach limits the value of the audit programme.
Internal audits should be integrated into normal business operations and performed throughout the year according to organisational risks, priorities and business objectives.
ISO 9001 requires organisations to conduct internal audits at planned intervals to determine whether the Quality Management System conforms to planned arrangements, the organisation's own requirements and the requirements of ISO 9001.
ISO 9001 does not specify a fixed frequency.
Organisations should establish an audit programme based on factors such as business risks, process importance, previous audit findings, customer feedback and organisational changes.
Many organisations conduct audits throughout the year using a rolling audit programme, while others complete a full system audit annually.
Internal audits should be conducted by competent auditors who are objective and impartial.
This may include trained employees who do not audit their own work or independent external auditors who provide an unbiased assessment of the Quality Management System.
Many organisations choose to engage independent ISO consultants to perform internal audits.
An external auditor can provide greater objectivity, specialist expertise and practical recommendations while helping the organisation prepare for certification or surveillance audits.
Nonconformities should be investigated to determine their root cause before corrective actions are implemented.
The effectiveness of those actions should then be verified to ensure the issue has been resolved and is unlikely to recur.
Finding nonconformities during an internal audit is generally positive because it allows the organisation to address issues before they are identified during a certification audit or impact customers.
An internal audit helps determine whether the Quality Management System appears to conform to ISO 9001 and is operating effectively, but only the certification body can make the certification decision.
However, a thorough internal audit significantly improves an organisation's readiness for certification by identifying issues before the external audit takes place.
An effective internal audit should do more than verify compliance. It should provide meaningful insight into the performance of your Quality Management System and identify practical opportunities for improvement.
At ISO Specialist South Africa, we conduct independent ISO 9001 Internal Audits that help organisations evaluate the effectiveness of their management systems, strengthen operational performance and prepare confidently for certification or surveillance audits.
Our Internal Audit service includes:
Whether you require an annual internal audit, support before a certification audit or an independent review of your existing management system, we provide objective, practical and business-focused auditing services tailored to your organisation.
Internal audits are one of the most effective ways to evaluate the health of your Quality Management System and identify opportunities for continual improvement.
By reviewing your processes objectively, you can address issues before they affect customers, improve operational performance and approach certification or surveillance audits with greater confidence.
Whether you need an independent internal audit, support with your audit programme or expert guidance on strengthening your Quality Management System, our consultants can help.
Our ISO 9001 Internal Audit service can help you:
CTA: Book an ISO 9001 Internal Audit
or
CTA: Speak to an ISO 9001 Consultant
An ISO 9001 Internal Audit is far more than a certification requirement.
It is a structured, evidence-based evaluation of how effectively your Quality Management System supports your organisation's objectives, manages risk and delivers consistent results.
When planned and conducted effectively, internal audits provide valuable insight into process performance, highlight opportunities for improvement and help management make informed decisions based on objective evidence.
Rather than viewing internal audits as an annual compliance exercise, organisations should integrate them into their ongoing management activities. This approach supports continual improvement, strengthens customer confidence and ensures the Quality Management System continues to deliver value long after certification has been achieved.
Whether your organisation is preparing for its first certification audit or maintaining an established Quality Management System, regular internal audits provide the assurance needed to improve performance, reduce risk and build a culture of quality.
:::
Not sure whether your organisation is ready for ISO 9001 certification?
Our ISO 9001 Readiness Checklist helps you assess the key areas of your Quality Management System before starting implementation or preparing for certification.
It provides a practical way to identify strengths, highlight potential gaps and understand the steps needed to become certification-ready.