Your ISO 9001 certification audit is in 8 weeks. The certification auditor asks: "Can I see your most recent internal audit report?"You freeze. You haven't done one. You just failed. Internal audits are MANDATORY for ISO 9001—there's no waiver, no exemption for small companies, no "we'll do it later." Here's exactly how to conduct one that passes muster.
Critical Facts About Internal Audits
⚠️ MANDATORY
No internal audit = automatic certification failure. Zero exceptions.
📅 Frequency
At least once per year minimum. Can be more frequent.
✓ Scope
Must cover ALL clauses (4-10) and ALL departments.
👤 Who Can Audit
Anyone trained, but they can't audit their own work.
What Is an Internal Audit? (And What It's NOT)
An internal audit is when YOUR company audits YOUR OWN quality management system to find gaps before the external certification auditor does.
✅ What It IS:
- • Systematic check of your QMS
- • Looking for non-conformances
- • Verifying procedures are followed
- • Checking records are complete
- • Finding improvement opportunities
❌ What It's NOT:
- • Performance reviews of employees
- • Production efficiency audit
- • Safety inspection (that's separate)
- • Looking for who to blame
- • Box-checking exercise
Step-by-Step: How to Conduct an Internal Audit
Create Annual Audit Schedule
Requirement: ISO 9001 Clause 9.2 requires audits at "planned intervals." Create a schedule showing what will be audited when.
Example Schedule (Small Manufacturer):
| Quarter | Areas to Audit | Clauses |
|---|---|---|
| Q3 2025 | Production, Quality Control, Document Control | 4, 7, 8 |
| Q4 2025 | Purchasing, Management Review, Corrective Action | 5, 8.4, 9, 10 |
💡 Pro Tip: All clauses must be covered within 12 months. Can split into 2-4 audits or do everything at once.
Select & Train Internal Auditors
Who can be an auditor? Anyone in your company—IF they're trained and don't audit their own work.
Auditor Requirements:
- ✓ Completed internal auditor training (16-24 hour course, online or in-person)
- ✓ Understands ISO 9001 requirements
- ✓ Can remain objective (not auditing own department)
- ✓ Good communication skills
Small company hack: Quality Manager audits production, Production Manager audits purchasing, etc. Cross-audit to maintain independence.
Create Audit Checklist
Don't wing it. Prepare a checklist of what you'll verify in each area.
Sample Checklist Items (Production):
- Are work instructions available at workstations? (Clause 7.5)
- Are employees following documented procedures? (Clause 8.5)
- Is product identification visible (job numbers, lot codes)? (Clause 8.5.2)
- Are inspection records complete and signed? (Clause 8.6)
- How are nonconforming products handled? (Clause 8.7)
Conduct the Audit
Schedule 1-3 days depending on company size. Walk the floor, interview employees, review records.
Audit Techniques:
Observation:
Watch employees perform tasks. Do they follow documented procedures?
Interviews:
"Show me the procedure you use for this." "When were you last trained on this process?"
Document Review:
Check training records, calibration certificates, inspection logs, corrective action reports.
Sample Testing:
Pick random job numbers, trace back through records. Are all documents present?
Document Findings
Write a formal audit report. This is what certification auditors will ask to see.
Required Report Contents:
- ✓ Audit date and auditor name(s)
- ✓ Areas audited (departments, processes, clauses)
- ✓ Summary of findings (conformances and non-conformances)
- ✓ Specific non-conformances with clause references
- ✓ Opportunities for improvement
- ✓ Auditor signature and date
Close Corrective Actions
For every non-conformance found, create corrective action to fix the root cause.
Corrective Action Process:
- Assign owner for each finding
- Investigate root cause (why did it happen?)
- Implement correction (fix the immediate problem)
- Implement corrective action (prevent recurrence)
- Verify effectiveness (did the fix work?)
- Close out finding with evidence
⏱️ Typical closure time: 30-90 days depending on complexity
Top 10 Internal Audit Findings (What to Look For)
Based on thousands of internal audits, here are the most common non-conformances found in manufacturing:
Incomplete Training Records
Clause 7.2Example: Employee operating CNC machine has no training record on file
Expired Calibration
Clause 7.1.5Example: Micrometer last calibrated 18 months ago (procedure requires annual)
Procedures Not Followed
Clause 8.5Example: Inspection procedure requires 3 measurements, operator only does 1
Missing Work Instructions
Clause 7.5Example: Complex assembly has no documented work instruction at workstation
No Product Identification
Clause 8.5.2Example: Parts in WIP with no job number or lot code visible
Corrective Actions Not Closed
Clause 10.2Example: Customer complaint from 6 months ago still open, no root cause analysis
Outdated Documents in Use
Clause 7.5Example: Operator using Rev B procedure, current version is Rev D
No Management Review
Clause 9.3Example: Last management review meeting was 18 months ago (annual required)
Incomplete Inspection Records
Clause 8.6Example: Final inspection form partially blank, no inspector signature
Supplier Not Approved
Clause 8.4Example: Purchasing from supplier not on approved supplier list
Internal Audit Best Practices
✓ Schedule Audits 6-8 Weeks BEFORE Certification Audit
Why it works: Gives you time to fix findings before external auditor arrives. Don't wait until last minute.
✓ Focus on Evidence, Not Blame
Why it works: Audit is about finding system gaps, not punishing employees. Keep it objective and improvement-focused.
✓ Use Sampling
Why it works: Can't check every record. Sample 5-10% of transactions, jobs, training records, etc. Pick randomly.
✓ Ask Open-Ended Questions
Why it works: Instead of 'Do you follow the procedure?' ask 'Show me how you do this.' You'll learn more.
✓ Follow the Process Flow
Why it works: Trace a job from order entry → production → inspection → shipping. Checks multiple clauses at once.
✓ Look for Patterns
Why it works: One missing training record = minor issue. Ten missing training records = systemic problem.
AI-Powered Internal Audit Prep (Know What You'll Find)
Before you conduct your internal audit, let our AI scan your QMS and predict the top 10 findings you're likely to discover. Fix them before the audit even starts.
Predicts top 10 findings • Fix issues before internal audit • P.Eng validated • Free scan