ISO 9001 Internal Audit Preparation: How to Prepare

ISO 9001 internal audit preparation works best when it starts with the processes and evidence your quality management system actually uses. An internal audit is not a paperwork exercise or a rehearsal for a perfect-looking file. It is a planned, objective check of whether arrangements are implemented, whether they meet applicable requirements, and whether the system is achieving intended results.

Discuss your audit preparation needs

A useful plan helps an auditor trace a requirement through everyday work to a result. It also gives process owners enough notice to arrange access and participate without scripting their answers. The purpose is an accurate view of the system: what is working, where a gap exists, and what evidence supports that conclusion. This guide covers practical preparation from defining the audit through tracking follow-up.

What Is an ISO 9001 Internal Audit?

An internal audit is an organization-run evaluation of its quality management system (QMS). It determines whether the system conforms to the organization’s own planned arrangements and applicable ISO 9001 requirements. It also assesses whether processes are implemented and maintained as planned and whether their results support the intended outcomes.

An internal audit differs from a certification audit. The organization arranges its internal audits to evaluate its own system. A certification body conducts an external audit for certification purposes and makes the certification decision. ISO itself does not certify organizations. Keeping these roles clear helps prevent confusion about who owns the system, who evaluates it internally, and who makes an external certification decision.

Preparation does not mean hiding problems or gathering documents only when an audit date approaches. It means making the review manageable and useful: identify the criteria, understand the process, ensure appropriate evidence can be accessed, and explain the logistics. If you are considering broader readiness support, CommandTec’s commercial ISO/CMMI consulting information describes its commercial consulting audience and support.

What Should You Define Before the Audit?

Write down the audit’s purpose, scope, criteria, schedule, responsibilities, and reporting arrangements before fieldwork begins. These basics establish what will be evaluated and help prevent a process, location, handoff, or requirement from being missed. They also give the auditor and process owner a shared understanding of the assignment.

• Purpose: State what the audit should determine. For example, the purpose might be to evaluate whether order review is performed as planned and whether changes reach the people responsible for delivery.
• Scope: Identify the process boundaries, activities, functions, locations, and period covered. Be clear about what is included and what is not. The scope should align with the QMS and the audit program rather than shifting informally on the day.
• Criteria: List the applicable requirements against which evidence will be evaluated. Criteria may include relevant ISO 9001 requirements, internal procedures, customer requirements adopted by the organization, and other obligations included in its arrangements.
• Auditor: Assign someone with suitable knowledge and the ability to evaluate evidence objectively. Consider impartiality, including whether auditing one’s own work could compromise objectivity.
• Schedule: Confirm dates, time blocks, process contacts, meeting arrangements, and access to relevant people, systems, records, or work areas.
• Reporting: Decide how the auditor will record evidence and results, who will receive the report, and how findings will be assigned and followed up.

Do not confuse a scope statement with a list of every department name. A process may cross functions. For example, an order may begin in sales, move through planning and purchasing, reach production, and end with inspection and release. If the audit stops at the department boundary, it may miss the handoffs that determine whether the customer requirement was carried through.

Set the level of coverage in a way that is realistic for the available time. A focused audit of one process can follow a small number of samples in depth. A broader system audit may require multiple auditors, more time, or a defined sampling approach. If the planned audit cannot cover its intended scope, raise that early and revise the arrangements through the appropriate approval path. Do not silently leave out a difficult area.

Audit frequency and coverage should reflect the organization’s planned arrangements, process importance, changes, and prior results. A generic calendar is not a substitute for a risk-informed program. A process with a recent system change, repeated errors, or unresolved corrective actions may deserve earlier attention than a stable process with effective controls. Record why the schedule and coverage make sense for your system.

How Do You Build a Practical Audit Plan?

Build the plan around process interactions, not just a sequence of clauses. A process-based audit follows how work enters the system, who performs it, what controls apply, what records result, and how the organization checks the outcome. The criteria still matter, but the audit becomes easier to understand when requirements are connected to real tasks.

Consider an order-fulfillment process. The auditor may begin with a customer requirement, examine how the organization reviews and accepts it, trace how the requirement reaches planning and production, and inspect the final verification or release record. If the customer changes an order, the auditor can follow how the change was reviewed, communicated, implemented, and recorded. That path can reveal whether controls work across handoffs, not merely whether a procedure exists.

For each audit, prepare a short plan that names the process, scope, criteria, people to contact, likely evidence sources, and schedule. Add a note about known changes or prior findings that may affect the review. Do not turn the plan into an inflexible script. If an interview or record points to a relevant issue, the auditor should have room to follow the evidence and adjust questions while remaining within the authorized scope.

Share logistics in advance. Tell process owners what will be reviewed, when the auditor expects to meet them, what systems or areas may be needed, and who should be available. Give enough notice for access and scheduling, but do not ask staff to prepare scripted answers or curate only favorable records. The audit should reflect actual operations.

A practical schedule has more than start and end times. It identifies transition time between activities, time to review records, a closing discussion, and the contact who can help resolve access issues. If a key person is unavailable, decide whether a substitute can explain the work or whether the affected part must be rescheduled. Avoid compressing interviews so tightly that the auditor cannot clarify a material point.

Use a one-page plan where possible. A concise plan is easier to communicate and update than a large checklist that no one uses. Keep the detailed workpapers separate if needed. The plan should answer the basic questions quickly: why this process, what boundary, which criteria, who will participate, when will the work happen, and how will conclusions be reported?

How Should You Review Requirements and Process Information?

Before fieldwork, review current information that explains how the process should operate. The purpose is not to enforce a particular document format. It is to understand the organization’s actual controls and how they relate to the audit criteria. Reviewing process information first helps the auditor ask relevant questions rather than starting from assumptions.

• Read relevant procedures, work instructions, process maps, role descriptions, and records that define the process.
• Identify inputs, outputs, process owners, handoffs, risks, measures, and controls used in the work.
• Check that the information is current and approved when the QMS requires approval.
• Review previous audit results, open corrective actions, customer feedback, changes, and relevant performance information.
• Note the records, interviews, and observations that could show whether the process is followed and achieving its intended results.

Keep a distinction between a requirement and an auditor’s preference. A procedure may specify a control, a customer may have a defined requirement, and ISO 9001 may establish an applicable system requirement. An auditor can use those criteria to assess evidence. A preferred form layout or an extra approval step is not automatically a requirement unless the organization has adopted it or another applicable criterion establishes it.

Do not assume that a well-written procedure proves the process is effective. Compare the described approach with actual practice. If the procedure says a designated role reviews changes before work begins, select a recent change and determine who reviewed it, what information was considered, and how the decision reached the people doing the work. A complete document that is not used is not evidence of consistent implementation.

Also avoid treating an outdated copy as the current process without checking. Ask how employees access controlled information, how revisions are communicated, and what happens to obsolete versions. If staff use a local checklist or system screen, find out whether it is an approved working aid or an uncontrolled copy. The relevant conclusion should follow the organization’s own control requirements and the evidence observed.

Review history with care. A previous audit finding can help focus the current audit, but it should not predetermine the result. Check what action was taken, what evidence supported closure, and whether the control has continued to work. Similarly, a clean previous report does not prove the process remains effective after staffing, technology, supplier, customer, or operating changes.

What Evidence Should You Gather?

Audit evidence is information that can be evaluated against the audit criteria. It can come from records, direct observation, interviews, system data, or other verifiable information. Select samples that make sense for the process and explain how they were chosen. A sample can reveal useful information, but it does not by itself establish that every transaction is identical.

Potential evidence sources include completed forms, system records, training or competence information, inspection results, equipment records, supplier evaluations, customer communications, process measures, and corrective-action records. The right sources depend on the process and criteria. Avoid collecting large volumes of material without an audit question. More files do not automatically create stronger evidence.

A simple evidence map can prevent both gaps and unnecessary collection. For each requirement or process control, note the question, source, sample, and what the evidence could demonstrate. For an order-change control, the map might list a customer change request, the review decision, updated planning information, communication to production, and confirmation that the changed output was checked. This gives the auditor a path while leaving room to follow unexpected evidence.

Connect the requirement, the work performed, and the resulting record. Suppose the audit is testing whether a revised order was reviewed before production continued. Start with a real changed order. Confirm that the requested change is identifiable, locate the review decision, determine whether affected staff received updated information, and trace the completed work to a suitable verification record. If one link is missing, ask whether another approved record or direct observation provides evidence. Do not infer that the whole process failed from a missing field until the applicable requirement and alternative evidence have been considered.

Sampling should be purposeful and transparent. The auditor may select records from different dates, staff members, product types, suppliers, or outcomes when those differences matter to the process. If the audit reviews a small sample, report that accurately. Do not present a sample as a statistical conclusion unless the method supports that conclusion. When a sample reveals an exception, expand the review when needed to determine whether it is isolated or indicates a wider pattern.

For instance, if a single training record lacks a sign-off, the next step is not automatically to conclude that all competence controls are ineffective. Confirm what the requirement says, whether the person performed the work, what other evidence exists, and whether similar records show the same condition. The reverse is also true: one complete record does not prove the entire process consistently works. The sample and limits of inference should be clear in the audit notes.

Protect confidential and personal information while gathering evidence. Use approved access methods, follow internal retention rules, and avoid copying sensitive content unless it is necessary and authorized. Record identifying details in a way that lets the organization trace the sample without placing unnecessary personal information in the report. If a source is unavailable, note the limitation and consider whether reasonable alternative evidence exists. Do not treat an inability to access a record as proof of conformity or nonconformity by itself.

How Can You Prepare Staff for Audit Interviews?

Tell staff what the audit covers, when it will take place, and who will be involved. Encourage them to describe the work as they actually perform it. They should answer honestly, show relevant records when asked, and say when they do not know an answer rather than guessing. The goal is an accurate understanding of the process, not a test of memory.

Do not coach employees to memorize clauses or supply a preferred response. Instead, help them understand the audit logistics and their normal responsibilities. Practical prompts include: What starts this activity? What information do you use? What checks do you perform? What happens when something does not meet requirements? Who needs to know? Where is the result recorded? These open questions help an auditor learn how work moves through the organization.

Process owners can make the audit more efficient by ensuring that relevant people and systems are available. They can explain the context, including handoffs, exceptions, and how the work is performed under normal conditions. They should not answer every question for the people who carry out the activity. If the auditor needs to understand a task, the person doing it may be best placed to demonstrate the steps.

Use a calm, neutral approach in interviews. Ask one question at a time and allow the employee to think. If an answer is unclear, ask a follow-up such as, “Can you show me where that is recorded?” or “What would you do if the result were outside the acceptance criteria?” Avoid leading questions that suggest the answer. Corroborate important statements with records or observation when appropriate.

Staff should not be encouraged to hide an error or apologize for a process issue before the facts are understood. If someone identifies a problem, the auditor can ask what happened, what was done at the time, and whether the issue was recorded or escalated through the normal process. An honest account is useful evidence. The audit is an evaluation of the system, not an invitation to blame an individual for a process condition.

Explain how to handle a question they cannot answer. Staff can say they are unsure and identify the appropriate process owner or record. They should not invent a response just to keep the discussion moving. The auditor can follow up with the right source. This simple expectation reduces misunderstandings and supports reliable conclusions.

What Should You Check During Fieldwork?

During the audit, follow the plan while responding to evidence. Observe the process where appropriate, speak with people who perform it, and examine records that show how work is controlled. Keep notes factual and specific. Separate what was directly observed from what someone reported and what the auditor inferred.

For each conformity question, ask:

• Which criterion applies, and where is it defined?
• What specific record, interview, or observation was reviewed?
• What does that evidence demonstrate about implementation or results?
• Is the evidence sufficient and consistent, or is another sample needed?
• What are the boundaries of the conclusion, including sample size and any access limitation?

Distinguish among an isolated error, a recurring pattern, and a documentation issue. An isolated record problem may still matter if a criterion requires that record, but the conclusion should reflect the evidence and requirement. A recurring issue across several samples may point to a broader control weakness. A difference between a procedure and actual practice may be an issue, an authorized change, or a sign that the documented information is no longer current. Investigate before labeling it.

Do not jump to a root cause during the audit unless the evidence supports it. The auditor’s role is to establish and record the finding clearly. The process owner investigates the cause and plans action through the organization’s process. If a cause is apparent, it can be noted as context, but a guess should not be reported as an established fact.

Keep the evidence trail intact when a question arises. For example, if a production operator says they receive updated specifications electronically, confirm which record or system view shows the revision, how they know it is current, and what happens to superseded information. If the screen cannot be accessed during the interview, record the limitation and arrange a follow-up rather than drawing an unsupported conclusion.

At the end of fieldwork, summarize preliminary results with the process owner. Confirm that factual descriptions are accurate and that the applicable criteria and evidence are understandable. This discussion can correct a misunderstood date, an incomplete sample description, or a mistaken process name. It is not a negotiation to remove a supported finding merely because it is inconvenient.

How Should You Record Audit Findings?

Write findings in neutral, evidence-based language. A clear finding identifies the applicable criterion, the objective evidence, and the gap between them. Avoid broad statements such as “the process is weak” or “staff need more training” unless the evidence and criterion support the conclusion. Specific writing gives the responsible owner something they can investigate.

A useful finding structure is: “The criterion requires [defined control]. In the sample of [specific record or observation], [what was found]. Therefore, [the stated requirement was not demonstrated or was not met].” Use the organization’s actual requirement and evidence. The example is a writing pattern, not a finding that applies to every organization.

For example, a real audit note might explain that the organization’s order-review procedure requires documented approval of customer changes before work proceeds. It would then identify the sampled order, describe the evidence reviewed, and state whether the required review was present. If the review occurred but was documented in another approved system, the auditor should examine that evidence before concluding that the control was absent.

Use your organization’s classification system consistently. If it distinguishes nonconformities, observations, and improvement opportunities, define those categories and apply them according to established rules. Do not downgrade a nonconformity simply to avoid follow-up. Do not present a suggestion as a formal requirement when no criterion supports it. A clear distinction helps management prioritize the response and makes later trend review more meaningful.

Document the basis for the finding, not every detail of the audit conversation. A good record gives a reader enough information to trace the criterion, sample, and conclusion. Include dates or identifiers where authorized and useful. Preserve confidentiality by limiting personal or commercially sensitive information to what is necessary for the QMS record.

Share the report with the people responsible for the process and the appropriate management. Findings should be understandable to those who need to respond. State any limitations, such as unavailable records or a reduced sample, so readers can interpret the conclusion correctly. Retain reports and working records according to the organization’s QMS arrangements.

How Do You Close Findings After the Audit?

Closing a finding requires more than correcting the immediate record. The process owner should address the issue, consider whether similar conditions exist elsewhere, investigate the cause as appropriate, and decide what action is needed to prevent recurrence. The response should match the nature and extent of the issue and be supported by evidence.

1. Contain or correct the immediate condition: Address the affected work or record where needed. For a changed order with an incomplete review record, determine whether the customer requirement was understood and whether any current delivery or work needs attention. Record what was done.
2. Evaluate the extent: Check whether the condition may affect other records, teams, periods, products, or related processes. Define a reasonable review population rather than assuming that one sample represents everything.
3. Analyze the cause: Investigate why the gap occurred. Ask whether the control was unclear, difficult to use, poorly communicated, bypassed, or not suited to the process. Avoid stopping at a surface explanation such as “human error” when process factors may be involved.
4. Plan action: Identify steps that address the cause, assign a responsible owner, and set a realistic completion date. Define what evidence will show that each action was implemented.
5. Verify implementation: Review records, observe revised practice, or otherwise confirm that the planned change took place.
6. Check effectiveness: Determine whether the action prevented recurrence using evidence appropriate to the process. Define the period, sample, or result that will support the effectiveness check.

Keep correction, corrective action, and verification distinct in the record. Updating one form may correct one instance, but it does not necessarily address why the control failed. A training session may be appropriate, but attendance alone does not show that the process now works as intended. Before closure, identify what result would demonstrate an effective response.

Consider a hypothetical case in which several sampled customer-order changes lack evidence that the production team received the updated requirement. Immediate containment could include confirming the current affected orders and communicating the correct information. The extent review might examine additional changes from the same period and other teams using the same process. Cause analysis might show that changes are stored in a sales system but not routed to production through a defined handoff. An action could revise the handoff control and clarify responsibility. Implementation evidence could include the approved process change and records of updated orders. Effectiveness evidence could come from a later sample showing that changed requirements reached the right users before work continued. The actual response must be based on the organization’s evidence, not copied from this example.

Set follow-up that tests the control, not just the paperwork. If the action was to revise a procedure, check whether employees can access and use it. If a system notification was added, sample actual transactions to confirm the notification occurs and reaches the intended role. If a new review was introduced, examine whether the review happens at the required point in the workflow. A closed action should mean the organization has a reasonable basis to conclude that the response was implemented and effective.

Use the audit program to look for recurring themes. Several findings may share a cause such as unclear ownership, inconsistent record controls, or a handoff that depends on informal communication. Trend review can help management decide whether one process needs a broader response. It should not be used to merge distinct findings in a way that obscures the specific evidence or the action each owner must take.

What Common Preparation Mistakes Should You Avoid?

• Preparing only for the audit date: Readiness comes from operating the QMS consistently, not staging records at the last minute. Last-minute document collection can hide gaps and creates a misleading picture of normal work.
• Auditing documents instead of work: Document review matters, but it should connect to implementation, handoffs, and results. A procedure alone does not show that the process is followed.
• Using a checklist without judgment: A checklist can support coverage, but it cannot replace process understanding, neutral questions, and follow-up on evidence.
• Auditing your own work without safeguards: Consider whether the assignment allows objective evaluation. Use another competent auditor or other appropriate safeguards when needed.
• Collecting too much evidence: Unfocused gathering consumes time, adds privacy risk, and can obscure what answers the audit question. Select relevant samples and document their basis.
• Coaching scripted answers: Scripts reduce the value of interviews and can conceal how work operates. Explain logistics and encourage accurate, practical descriptions instead.
• Confusing an auditor’s preference with a requirement: Findings need an applicable criterion. A recommendation can be useful, but it should not be represented as a nonconformity without a requirement and evidence.
• Closing findings on promises: Verify implementation and effectiveness rather than relying on a planned action or verbal assurance.
• Changing scope informally: If access or timing becomes difficult, document the issue and use the proper approval route to adjust the plan. Do not omit a process without acknowledging it.

How Can an Audit Preparation Checklist Help?

A concise checklist is a final readiness check, not a universal compliance test. Tailor it to the organization’s QMS, the process under review, and the audit’s scope. It should help the auditor and process owner see what remains to be arranged without turning the audit into a document hunt.

• The audit purpose, scope, criteria, and schedule are defined and approved as required.
• A competent auditor is assigned, and objectivity or impartiality concerns have been considered.
• Relevant process information, previous findings, open actions, and important changes have been reviewed.
• Process owners know the logistics, and the right staff are available for interviews or demonstrations.
• Records, work areas, and systems can be accessed through approved channels.
• The auditor has identified likely evidence paths, a sampling rationale, and any confidentiality safeguards.
• The reporting method and finding categories are understood by the people who will use them.
• Corrective action, ownership, follow-up, and effectiveness checks will be handled through established arrangements.
• Known limitations are recorded, with a plan to address them or report their effect on the audit.

If an item is not ready, decide whether it should be resolved before the audit or recorded as a limitation. Lack of access might require coordination with an administrator; it should not automatically lead to a conclusion about process conformity. If a key person is absent, determine whether another person can provide reliable information or whether the relevant activity should be rescheduled.

Keep the checklist short enough to use. If every audit generates a long list of generic requests, staff may spend more effort assembling files than explaining how work happens. A focused list asks for the process information and records that are likely to answer the defined audit questions, then allows the auditor to request additional evidence when the review warrants it.

What Does a Practical Preparation Timeline Look Like?

There is no single lead time that fits every internal audit. A small, stable process with easily accessible records may need less coordination than a cross-functional process with multiple locations, complex handoffs, or open actions. Work backward from the planned date and allow time for the activities below. Adjust the sequence to your audit program and operational needs.

• When the audit is scheduled: Confirm why the process is being reviewed, its scope, criteria, assigned auditor, and reporting route. Check for relevant changes and prior results that may affect coverage.
• During planning: Review process information and identify likely evidence paths. Coordinate access to people, records, systems, and work areas. Give process owners enough notice to arrange participation.
• Before fieldwork: Confirm that the plan remains current, key contacts are available, and records can be retrieved using approved access. Resolve routine logistical issues without asking staff to select only favorable evidence.
• During fieldwork: Follow the evidence trail, take factual notes, and raise access or scope limitations promptly. If a new line of inquiry becomes necessary, determine whether it fits the authorized scope or needs approval.
• After the audit: Validate factual details, issue the report through the established process, assign responses, and define follow-up evidence before actions are closed.

A hypothetical example illustrates how this sequence works. A company plans to audit order review after introducing a new online order system. The auditor first confirms whether the system change is within the scope and reviews the current order-review procedure. The process owner identifies who reviews orders, how exceptions are handled, and where decisions are recorded. The auditor selects examples that include a routine order and a changed order. During interviews, staff demonstrate how an alert is received and what happens when information is incomplete. If the auditor finds that changed orders follow a different route, they trace that route rather than assuming the routine sample represents it.

In this example, the audit plan makes a difference because the system change is identified before fieldwork. The auditor can ask whether access roles, handoffs, and records changed, without assuming that the new system caused a problem. If the process is operating as intended, evidence can support that conclusion. If the change created a gap, the organization can record the specific criterion and evidence, then assign an appropriate response. Preparation helps the audit ask the right questions; it does not predetermine the outcome.

Use a short readiness conversation with the process owner shortly before fieldwork. Confirm the time, participants, access, and scope. Ask whether a significant change occurred since planning. This is not a request for a self-audit or a last-minute cleanup. It is a way to keep the plan accurate and prevent avoidable delays.

How Do You Make the Audit Useful Beyond Compliance?

A well-prepared internal audit can help management understand how a process performs, where controls depend on individual memory, and whether information reaches the next person at the right time. The audit is most useful when it tests real process behavior and communicates evidence in a way that supports decisions. It should not become a box-checking exercise or a search for cosmetic faults.

Look at process inputs and results together. A record may show that an inspection took place, but the auditor can also ask what happened when the result did not meet acceptance criteria. A supplier evaluation may be documented, but the process may also include how performance concerns are communicated and acted on. Questions that connect inputs, controls, outputs, and results help reveal how the system functions end to end.

Notice whether the process depends on informal workarounds. An experienced employee may keep a separate list because the system does not provide a useful status view. That observation does not automatically establish a nonconformity. It prompts questions: Is the workaround controlled? Does it preserve accurate information? Is it accepted by the organization? Does it create a risk that the process owner should address? Compare the evidence with the applicable requirements before reaching a conclusion.

Use findings and improvement opportunities carefully. A finding should identify a demonstrated gap against a criterion. An improvement opportunity can point to a possible enhancement without implying that the current process fails a requirement. Keeping the distinction clear preserves trust in audit results and helps management focus corrective action where it is required.

Finally, feed relevant results into the organization’s established management review and improvement processes. Repeated patterns, significant process changes, or unresolved actions may require management attention. The audit report should be factual and bounded, but the organization can use the resulting information to prioritize further evaluation or improvement. The auditor records what the evidence supports; leadership decides what action is appropriate within the QMS.

When Might Outside Support Be Useful?

Outside support may be useful when a team is establishing its audit program, needs an independent perspective, or is unsure how to connect requirements with operating processes. Support might include reviewing audit arrangements, identifying evidence paths, helping process owners understand how to explain their work, or supporting a response to findings. The organization remains responsible for its QMS, internal audit decisions, and corrective action.

CommandTec provides commercial ISO certification consulting, including preparation support and audit coordination. Its commercial consulting audience includes organizations in manufacturing and other industries, as well as businesses pursuing government contracting readiness. You can review its services overview and consulting team information. The certification decision is made by a certification body, not by ISO or a consultant.

When evaluating any support, clarify what the organization needs help with: setting up audit schedules, making processes understandable, preparing documentation, conducting internal audits, or managing follow-up. Ask how the support will preserve objective evaluation and how knowledge will be transferred to process owners. A useful engagement should help the organization operate and improve its own system, not leave staff dependent on a prepared script.

Contact CommandTec to discuss your preparation

Frequently Asked Questions

How early should we start preparing for an internal audit?

Start when the audit is planned, allowing sufficient time to define scope and criteria, coordinate access, and review relevant information. The lead time depends on the process, its complexity, and how readily evidence can be accessed. Preparation should support normal system operation rather than trigger a last-minute document push.

Does every employee need to memorize ISO 9001 clauses?

No. Staff should understand their responsibilities and how their work is controlled. They should be able to explain the process in practical terms, identify what they do when something goes wrong, and locate relevant information. Reciting clause numbers or rehearsed answers is not a substitute for understanding the work.

Can one person audit their own process?

The organization should consider objectivity and impartiality when assigning auditors. If auditing one’s own work could compromise an objective evaluation, assign another competent auditor or use suitable safeguards. The arrangement should be credible for the process and consistent with the organization’s audit procedures.

Is an internal audit the same as a certification audit?

No. An internal audit is conducted for the organization’s own QMS evaluation. A certification audit is conducted by a certification body to assess conformity for certification purposes. ISO itself does not certify companies; a certification body makes the certification decision.

What should we do if the audit identifies a nonconformity?

Record the finding clearly against its criterion and evidence, address any immediate issue, evaluate whether similar conditions exist, and determine an appropriate cause and action. Assign responsibility, verify that the action was implemented, and check effectiveness using evidence. Follow the organization’s established process for tracking and closure.

What Is the Best Next Step for ISO 9001 Internal Audit Preparation?

Begin with a defined scope and criteria, then follow evidence from requirements through actual work and results. Give staff clear logistical information, select samples for a reason, record findings precisely, and verify corrective actions with evidence. This disciplined approach makes the audit more useful and gives management a sound basis for improving the QMS.