Common problems show up fast. Reports are vague, skip the criteria, drift away from Clause 9.2, or bury the one issue management needs to see. Auditors then spend weeks answering questions the report should have answered.
This article gives you a copy-ready report structure, a fictional purchasing-process sample, guidance on the 5 C's, and a path from finding to corrective action.
Key Takeaways
- A report should state scope, criteria, objectives, methods, findings, conclusion, and follow-up owners.
- ISO 9001 prescribes no single report layout, but audit results must be retained as documented information.
- Each nonconformity ties a specific requirement to verifiable evidence.
- A useful report feeds corrective action, management review, and future audit planning.
Why an ISO 9001 Internal Audit Report Matters
Clause 9.2.1 of ISO 9001:2015 requires audits at planned intervals. Those audits must show whether the QMS conforms to the organization's own requirements and to ISO 9001, and whether it is effectively implemented and maintained. Those are two separate questions, and the report should answer both.
Clause 9.2.2 adds expectations the report must support:
- Defined criteria and scope for each audit
- Objective, impartial auditors
- Results reported to relevant management
- Correction and corrective action without undue delay
- Retained documented evidence of the audit programme and results
ISO's Auditing Practices Group describes internal audit as a feedback mechanism for top management. A completed checklist doesn't do that job. A report does, by giving management a reliable conclusion and process owners enough evidence to act. It also leaves a trail for future audits and certification activities.
One caution: ISO has published ISO 9001:2026. Check the exact Clause 9.2 wording in the edition your organization is audited against, since public summaries may not list every change. The clause references below use ISO 9001:2015.
ISO 9001 Internal Audit Report Template: Sections to Include
Audit Identification and Control Information
Start with a header block that makes the report easy to find and trace:
- Report reference number
- Audit date and report issue date
- Audit type (program, follow-up, special)
- Site or function
- Lead auditor and audit team
- Auditee or process owner
- Document revision and status
A unique reference lets you link the report to nonconformity records and corrective actions later. Revision and status fields also stop people from working off an outdated draft.
Objectives, Scope, Criteria, and Methodology
State what the audit set out to determine. Then list what was in and out: processes, departments, sites, and activities.
Name the criteria. These might be ISO 9001 clauses, internal procedures, customer requirements, or contract terms.
Describe how evidence was gathered:
- Document and record review
- Interviews
- Observation
- Sampling
- Process tracing
Add a short impartiality statement confirming auditors did not audit their own work. ISO 19011:2018 treats independence as the basis for impartial, objective conclusions.
Executive Summary and Audit Conclusion
Busy readers may only read this part. Cover:
- Overall conformity and process effectiveness
- Strengths and significant risks
- Finding counts by classification
- Items needing management attention
The conclusion is separate. It is a professional judgment on the audited scope, and it should admit limits. Samples may not represent the full population, so say what you sampled and what you didn't assess.
Detailed Findings and Objective Evidence
Use one consistent structure for every finding:
- Finding reference and classification
- Applicable requirement
- Condition observed
- Objective evidence
- Related process or record references
Evidence must be specific and verifiable. "The process is not effective" tells nobody anything. Separate the requirement from the observed gap and let the evidence carry the weight.
Corrective Action, Distribution, and Follow-Up
Add fields for:
- Process owner and response due date
- Correction and root cause analysis
- Planned corrective action
- Effectiveness review and closure status
Record who received the report, including relevant management and affected process owners. Add acknowledgement or approval fields if your procedure calls for them.
For document control, cover storage, access, retention, and revision history. Link the report to the audit plan, evidence, nonconformity records, and management review inputs. Clause 7.5 governs these controls, and ISO's documentation guidance lists audit results among retained records.
ISO 9001 Internal Audit Report Sample
This example is fictional. Every name, date, and record below is a placeholder. It isn't a real case study.
Sample Context and Audit Setup
| Field | Entry |
|---|---|
| Report reference | [IA-YYYY-00X] |
| Organization | [Company Name] |
| Audit date / issue date | [Date] / [Date] |
| Process audited | Purchasing and supplier control |
| Process owner | [Purchasing Manager] |
| Audit team | [Lead Auditor], [Auditor] |
| Objective | Determine whether purchasing controls are implemented and maintained as required |
| Scope | Supplier evaluation, purchase orders, receiving verification; [site]. Design activities excluded |
| Criteria | ISO 9001:2015 Clause 8.4; procedure [QP-08]; Clause 7.5 for records |
| Methods | Record review, interviews, observation, sampling |
| Impartiality | Auditors had no responsibility for the audited activities |
Clause 8.4 covers evaluation, selection, monitoring, and re-evaluation of external providers, plus verification of purchased outputs. This is an audit of your own purchasing controls, not a supplier audit.
Completed Summary and Conclusion
Summary: The purchasing process was audited against Clause 8.4 and procedure [QP-08]. Purchase orders were consistently approved and receiving checks were observed in operation.
One minor nonconformity was raised on supplier re-evaluation records. One observation concerns inconsistent filing of supplier approvals. The audit sampled [X] purchase orders and [X] approved-supplier files; it did not assess design-related purchasing.
Conclusion: Within the sampled scope, the purchasing process is implemented and largely maintained as intended. Re-evaluation of approved suppliers did not follow the documented frequency in the sampled files. Findings should be read in light of the limited sample.
Notice what's missing: invented percentages and performance claims. If the evidence doesn't support a number, leave it out.
Example Detailed Finding
- Reference: IA-[YYYY]-00X-NC1
- Classification: Minor nonconformity
- Requirement: ISO 9001:2015 Clause 8.4.1 requires criteria for evaluation, selection, performance monitoring, and re-evaluation of external providers. Procedure [QP-08, section X] sets re-evaluation at [12-month] intervals.
- Condition: In [3 of 10] sampled approved-supplier files, no re-evaluation record exists within the defined interval.
- Objective evidence: Supplier files [S-101, S-114, S-120]; last evaluation dates [dates]; interview with [Purchasing Manager] confirming no later evaluation was performed.
The finding states the gap. It doesn't tell the process owner how to fix it.
Corrective Action and Follow-Up Example
| Element | Entry |
|---|---|
| Correction | Re-evaluate the three affected suppliers by [date] |
| Root cause analysis | Completed by process owner: [cause, such as no trigger for due dates] |
| Corrective action | [Action selected by process owner] |
| Owner / due date | [Name] / [Date] |
| Effectiveness verification | Auditor reviews [next cycle] files on [date] |
| Closure status | Open until verified |
Per the ISO/IAF guidance, auditors verify effectiveness, not just that an action was planned. Did it address the cause, and is conformity restored? Only then close the record.
How to Adapt the Sample
Swap in your own process, clauses, records, and roles. Keep the logic: criteria, condition, evidence, classification, owner, verification.
Use the ISO 9001 edition and internal requirements that apply to your audit. Define nonconformities, observations, and improvement suggestions in your documented process, and label them the same way every time. ISO/IAF warns against softening an evidenced nonconformity into an observation.
How to Write Clear Findings Using the 5 C's
The 5 C's Framework
The 5 C's come from broader internal-audit practice, not from ISO 9001 reporting requirements. As IIA commentary shows, terms vary: one version uses effect and recommendation in place of consequence and corrective action. Treat it as an optional aid.
| C | Report field |
|---|---|
| Criteria | The requirement assessed |
| Condition | What was found |
| Cause | Why the gap may have occurred |
| Consequence | Why it matters, or the risk created |
| Corrective Action | How the owner will address it |
ISO/IAF's documented-nonconformity model has three core parts: evidence, requirement, and nonconformity statement. An auditor's early view of cause isn't an established root cause. Let the process owner complete that analysis.
Turn Vague Observations into Evidence-Based Findings
Weak: "Records are poorly maintained."
Stronger (fictional): "Procedure [QP-05] requires calibration records for [gauge type] to show the date and result. In [4 of 12] sampled records, the result field was blank (IDs [C-07, C-09, C-11, C-15])."
The second version names the requirement, the sample, the condition, and traceable evidence.
Label every item by category:
- Nonconformity: non-fulfilment of a requirement, backed by evidence
- Observation or opportunity for improvement: defined in your own procedure
- Positive finding: a practice that works well
Avoid Common Report-Writing Mistakes
- Citing the wrong clause, or "Clause 7.5" with no specific obligation
- Drawing conclusions the evidence can't support
- Mixing recommendations into nonconformity statements
- Leaving out the audit limitation
- Using emotional or blaming language
- Prescribing a fix before the owner finishes root-cause analysis
ISO/IAF asks for statements that are self-explanatory, unambiguous, and concise. Test yours: could someone who wasn't there understand and verify the finding?
From Audit Report to Corrective Action and QMS Improvement
Issue the final report within the agreed period to relevant management and affected process owners. ISO 19011 sets no universal number of days, so define yours in the audit program.
Then connect the report to:
- The corrective-action process
- Management review (Clause 9.3.2 lists audit results as an input)
- Future audit planning, with higher-risk processes or those with nonconformities getting priority
Keep the terms distinct:
- Correction fixes the detected nonconformity
- Corrective action removes its cause
- Effectiveness verification confirms it worked
Under Clause 10.2.1, action must suit the effects of the nonconformity. Assign owners and due dates, but don't promise results the evidence hasn't shown.
For help building or improving ISO documentation, audit processes, or employee training, Synergistic Systems offers modular documentation and training systems plus ISO consulting support. Founded in 2000, the firm also provides a cloud-based QMS intranet that hosts audits and corrective actions in one place.
Frequently Asked Questions
Can you provide an example of an internal audit report?
Yes. The fictional purchasing-process sample above shows scope, criteria, evidence, a finding, a conclusion, and corrective action. Replace the placeholders with your own details.
What are the 5 C's of writing an internal audit report?
Criteria, Condition, Cause, Consequence, and Corrective Action. The framework makes findings complete and actionable, though ISO 9001 doesn't require it.
Is there a mandatory format for an ISO 9001 internal audit report?
No single visual template is prescribed. The organization must document and retain enough audit information to show the program and its results are managed effectively.
What should be included in an ISO 9001 internal audit report?
Audit identification, objectives, scope, criteria, methods, impartiality, summary, conclusion, findings with evidence, corrective action, distribution, and follow-up.
What is objective evidence in an ISO 9001 internal audit report?
It is verifiable information gathered through records, documents, interviews, observation, or sampling that supports the stated finding.
How should internal audit findings lead to corrective action?
Assign each valid nonconformity to an owner for correction, root-cause analysis, corrective action, and due-date tracking. The auditor later verifies effectiveness before closure.
