ISO 9001:2015 Internal Audit Procedure Sample A checklist alone doesn't make an internal audit work. A good procedure defines how audits are planned, performed, reported, and followed through to real improvement. Without that, audits turn into an annual paperwork exercise.

This guide gives you an adaptable ISO 9001:2015 internal audit procedure sample for organizations of different sizes and industries. Treat it as a starting point. You'll need to customize it to your QMS, processes, risks, locations, and applicable requirements.

Key Takeaways

  • Clause 9.2 requires planned audits that test QMS conformity and effective implementation.
  • The audit program, audit plan, checklist, report, and corrective action records each do a different job.
  • Auditors must be competent and objective, and must not audit their own work.
  • An audit isn't finished until actions are assigned and their effectiveness is verified.

ISO 9001:2015 Internal Audit Procedure Requirements

What Clause 9.2 Requires

Clause 9.2.1 says to conduct internal audits at planned intervals. These audits must determine whether the QMS conforms to your own QMS requirements and to ISO 9001:2015, and whether it is effectively implemented and maintained.

Clause 9.2.2 adds the mechanics. Your procedure should address:

  • Audit program: frequency, methods, responsibilities, planning requirements, and reporting
  • Criteria and scope for each audit
  • Auditor selection that preserves objectivity and impartiality
  • Reporting results to relevant management
  • Correction and corrective action without undue delay
  • Retained documented information as evidence of the program and results

ISO 9001:2015 doesn't prescribe one standalone procedure format. Still, a documented procedure is the practical way to run the audit process the same way every time. The standard separately requires you to retain evidence of the program and the results.

How the Procedure Fits into the Audit System

Several documents work together, and mixing them up is a common source of confusion.

  • Audit program: the long-range or annual view. It controls what gets audited, how often, and by whom.
  • Audit plan: one audit's objectives, scope, criteria, schedule, and team.
  • Checklist: prompts for questions and a place to record evidence.
  • Audit report: conclusions, findings, and required actions.
  • Corrective action records: causes, actions, and effectiveness checks.

ISO 19011:2018 is useful guidance on program management, audit methods, and auditor competence. It isn't an ISO 9001 requirement, and the APG's guidance on ISO 19011 is clear that not following it can't by itself be a nonconformity.

Build your procedure around your own QMS, then layer in customer, statutory, regulatory, and contractual requirements.

ISO 9001 internal audit system documents and requirements map

ISO 9001:2015 Internal Audit Procedure Sample

The wording below is sample language. Edit it to match how your organization actually works.

Purpose, Scope, and References

Purpose: "This procedure establishes a consistent method for planning, conducting, reporting, and following up internal audits of the quality management system against ISO 9001:2015."

Scope: "This procedure applies to all QMS processes, departments, products or services, locations, and supporting activities within the QMS scope. Exclusions are permitted only where justified and controlled."

Include these document-control fields:

  • Procedure title and document number
  • Revision level and effective date
  • Document owner and approval authority
  • Related QMS documents, such as the corrective action procedure and record control procedure

Roles, Responsibilities, and Auditor Competence

Assign duties clearly:

  • Top management: provides resources and reviews audit results.
  • Audit program manager or quality manager: builds the program and assigns auditors.
  • Lead auditor: directs an individual audit and signs the report.
  • Internal auditors: collect evidence and document findings.
  • Process owners: support the audit and respond to findings.
  • Corrective action owners: investigate causes and implement fixes.

Competence. Sample wording: "Auditors shall have suitable education, training, knowledge, skills, or experience. Evidence of competence shall be retained." Clause 7.2 requires that evidence, and ISO's competence guidance lists examples such as qualifications, training records, and observed performance.

Impartiality. Add: "Personnel shall not audit activities for which they are directly responsible." Where a small team makes this hard, use cross-functional auditors or qualified outside support.

Audit Program and Individual Audit Planning

The program should weigh:

  • Process importance and quality risks
  • Organizational changes
  • Previous audit results and nonconformities
  • Customer feedback
  • Complexity of single-site or multi-site operations

Don't copy a generic schedule. Justify frequency with risk and performance, and document why higher-risk, new, changed, or previously nonconforming processes are audited more often. Planned intervals are required, but no universal frequency is set.

Each audit plan should then cover, in order:

  1. Objectives, scope, and criteria
  2. Methods and timing
  3. Locations, auditors, and process owners
  4. Records needed
  5. Communication arrangements and reporting expectations

Conducting the Internal Audit

Open with a short introductory meeting. Confirm the plan and explain that the audit looks for objective evidence of conformity and effectiveness. It isn't a hunt for individual blame.

Auditors then gather and verify evidence through:

  • Document and record review
  • Interviews
  • Observation of operations
  • Sampling
  • Process tracing across inputs, activities, outputs, controls, resources, and measures

Sampling has a limit. It can't prove every record was examined, so unidentified nonconformities may remain.

Record enough evidence to support each conclusion. Tie every finding to its criterion: an ISO 9001:2015 clause, a QMS requirement, a procedure, a work instruction, or a customer requirement.

Internal audit evidence collection and finding verification process flow

Reporting, Corrective Action, and Follow-Up

The audit report should identify:

  • Objectives, scope, criteria, dates, and locations
  • Auditors and areas audited
  • Evidence reviewed
  • Positive practices
  • Nonconformities and opportunities for improvement
  • Conclusions and responsible parties

Discuss findings with process owners before finalizing the report. Assign corrections and corrective actions, set target dates, and communicate results to relevant management.

Then verify. Confirm that actions were implemented, that root causes were addressed, and that the fix worked. Weak cause analysis can leave a recurrence risk.

Retain the program, plans, checklists or notes, reports, action records, and effectiveness evidence.

How to Use and Maintain the Sample in Your QMS

Tailor the Procedure to Actual Processes and Locations

Map the sample to your process map, QMS scope, departments, products or services, and sites. A copied generic document won't survive its first audit cycle.

For multiple sites, the audit program can:

  • Assign responsibility by site and by shared process
  • Address site-specific risks
  • Keep records consistent without ignoring local operating differences

Build a Process-Based Audit Checklist

Write open-ended questions from your own procedures, process measures, risks, work instructions, and customer requirements. Don't just copy clause text.

  • Follow an input through activities, controls, records, and outputs.
  • Ask about interactions such as purchasing, training, document control, calibration, customer communication, and corrective action.
  • Treat the checklist as a prompt and a place to record evidence. Judgment and direct observation still matter.

Connect Findings to Improvement

Classify each finding as one of three outcomes:

  • Conforming practice
  • Opportunity for improvement
  • Nonconformity

Each needs a clear requirement and objective evidence.

Before closing a finding, owners should investigate causes and check whether similar issues exist elsewhere. They should feed recurring findings, trends, overdue actions, and significant risks into management review, since clause 9.3.2 makes audit results a required input.

Audit findings corrective action and management review improvement cycle

Those results should shape the next audit program too.

Get Implementation Support

Some organizations struggle with auditor competence, impartiality, or modular QMS documentation. Synergistic Systems provides ISO 9001 consulting and training, including internal auditor training and a system-wide internal audit, to help adapt a procedure like this to real processes.

Your organization still owns the job of operating and improving its QMS.

Common Mistakes to Avoid

  • Static annual schedules. A fixed calendar that ignores process risk, changes, customer issues, and earlier findings misses where problems actually are.
  • Self-auditing. Employees auditing their own work lose impartiality, and BSI guidance says plainly that auditors shouldn't do it.
  • Undocumented competence. If you can't show who is qualified and why, the audit is exposed.
  • Document-only reviews. Records show what was supposed to happen. Interviews and observation show what does.
  • Weak findings. Vague statements, unsupported conclusions, missing owners, and absent due dates leave nothing to act on.
  • Unverified corrective action. Closing an action without checking effectiveness invites repeat problems.

Conclusion: Make the Procedure a Working Part of the QMS

An effective procedure creates a repeatable cycle. Each step feeds the next:

  • Risk-based planning
  • Evidence collection
  • Reporting
  • Corrective action
  • Effectiveness verification

Approve the adapted procedure, communicate it, train personnel on it, and review it periodically. That keeps it aligned with process changes, audit results, and organizational objectives.

Frequently Asked Questions

What are the steps involved in an ISO 9001 internal audit procedure?

Establish the audit program, plan the individual audit, select competent and impartial auditors, and conduct the audit. Then report findings, assign corrective action, and verify its effectiveness.

What are the 7 audit procedures with examples?

ISO 9001:2015 doesn't prescribe seven procedures, and ISO 19011:2018 describes six activity groups. A practical seven-stage model: schedule, define criteria, review evidence, interview personnel, document findings, report results, follow up actions.

What should an ISO 9001:2015 internal audit procedure include?

Purpose, scope, references, responsibilities, auditor competence, program planning, audit methods, and evidence collection. Add reporting, corrective action, follow-up, and records control.

How often should ISO 9001:2015 internal audits be conducted?

The standard requires planned intervals, not one fixed frequency. Base timing on process importance, risks, changes, previous results, and QMS performance, and document your rationale.

Can an employee audit their own work under ISO 9001?

No, that should generally be avoided, because clause 9.2.2 requires objectivity and impartiality. Use cross-functional auditors or qualified external support when independence is hard to achieve.