Many teams struggle here. Report formats are unclear, findings lack evidence, and people confuse the audit report with the checklist, the corrective action record, or a certification audit report. This article covers what the report is, how to prepare, what to include, and how to write findings that drive action.
One note on status: ISO's catalogue now marks ISO 9001:2015 as withdrawn, with a newer edition announced. Many organizations still maintain systems and records built on the 2015 requirements, so this guide addresses that framework.
Key Takeaways
- Clause 9.2 requires planned internal audits and retained records of the audit program and its results.
- Link scope, criteria, evidence, findings, conclusions, and follow-up in one logical sequence.
- Write findings that are factual, traceable to a requirement, and built to support corrective action, not blame.
- Adapt the format to your organization, as long as it supports impartiality, consistency, and follow-up.
What Is an ISO 9001:2015 Internal Audit Report?
An internal audit report is the documented summary of an audit's scope, methods, evidence, findings, conclusions, and required follow-up. It gives the organization a record of QMS conformity and effectiveness. This is a working description, not a formal ISO definition.
ISO/IAF Auditing Practices Group (APG) material describes internal audits as a feedback mechanism for top management and a way to judge whether the QMS functions as intended.
What Clause 9.2 Requires
Clause 9.2 expects audits at planned intervals, run against your own QMS requirements and ISO 9001 requirements. Retained documented information must show that the audit programme was implemented and what the results were.
The programme covers frequency, methods, responsibilities, planning, and reporting. It also weighs process importance, organizational changes, and previous audit results.
ISO 9001 does not prescribe one report layout. Clause 9.2 does not mandate a specific format. Always check exact clause wording against an authorized copy of the standard.
Report vs. Checklist, Plan, and Corrective Action Record
| Document | Purpose |
|---|---|
| Audit plan | Defines the planned audit |
| Checklist | Guides questions and evidence collection |
| Audit report | Records scope, evidence, findings, and conclusions |
| Corrective action record | Tracks cause analysis, actions, completion, and effectiveness checks |
A certification audit report is a different thing again. Those come from external certification bodies, which grant, suspend, or withdraw registration. An internal report never does.
How to Prepare for an ISO 9001:2015 Internal Audit Report
Strong reports start before the first interview. Preparation determines whether every finding can later be traced.
Define Scope, Objectives, and Criteria
Identify the processes, departments, products or services, sites, and time period covered. Then set the objectives and the criteria:
- ISO 9001:2015 requirements
- Internal procedures and work instructions
- Customer requirements
- Legal or regulatory requirements
- Organizational objectives
For multi-site organizations, name each audited location, the boundaries between sites, centralized processes, and the process owners. Otherwise the final report becomes ambiguous.
Review Background Information
Before collecting evidence, review:
- Process maps and procedures
- Objectives and performance data
- Customer feedback and complaints
- Previous findings and management review outputs
- Risks and recent process changes
Use that material to decide where to spend audit time. APG guidance gives priority to higher-risk processes and those with prior nonconformities. No universal audit interval is prescribed, so set frequency by risk and change.
Select Competent, Impartial Auditors
Auditors need suitable knowledge, training, experience, and auditing skill, and independence from the activity they audit. ISO 9001 does not mandate a specific credential. APG competence guidance points to education, training, experience, and documented assessment, and cautions that course completion alone does not necessarily prove competence.
Keep competence records: training certificates, audit experience logs, and observed-audit evaluations.
Gather and Verify Objective Evidence
Collect evidence through interviews, observation of work, document and record review, and tracing inputs, activities, outputs, and handoffs. Corroborate interview statements where appropriate.
Sampling needs care. You don't examine every transaction, but you need enough representative evidence to defend a conclusion. Record the sample boundaries in your notes or report.
Align Report Fields Early
Match the checklist, evidence notes, finding log, and report fields before the audit. Then each finding traces to a criterion, process, location, evidence source, owner, and follow-up action.
What to Include in an ISO 9001:2015 Internal Audit Report
ISO 19011:2018 is guidance, not a requirement for ISO 9001 audits, and it provides no report template. A practical report covers the following.
Identification and Administrative Details
- Report title or reference number
- Audit date and report issue date
- Audited organization or site, and processes
- Audit team and process owners or participants
- Approval or review status
Add version control, document owner, distribution list, confidentiality notes, and retention information so the report stays a controlled QMS record.
Scope, Objectives, Criteria, and Methods
Repeat the agreed scope and objectives, and list the criteria used to judge conformity, including relevant clauses and internal or external requirements.
State the method and limits:
- On-site, remote, or hybrid work
- Interviews held and records sampled
- Areas not audited
- Any changes to the original plan
Executive Summary and Conclusion
Summarize the result without hiding detail. Note significant strengths, recurring issues, process risks, improvement opportunities, and whether the process was effectively implemented within scope.
Keep the audit conclusion separate from any certification decision. The report can show conformity or nonconformity, but it cannot grant or revoke certification.
Detailed Findings and Evidence
Record each finding separately with:
- A unique identifier
- The requirement or criterion
- The process or location
- Objective evidence
- The classification
- The responsible owner and next step
Evidence should be specific enough that another competent reviewer understands what was examined and why you reached the conclusion. Avoid unnecessary employee names.
Corrective Action, Distribution, and Attachments
Include fields or links for:
- Correction and root cause
- Corrective action, owner, and target date
- Effectiveness review and closure status
The report may summarize these while a separate record holds the detail.
Useful attachments include:
- Audit plan and completed checklist
- Evidence index and attendance record
- Process maps and corrective action log
Attach only controlled, relevant records.
How to Document Internal Audit Findings and Corrective Actions
Classify the Result Accurately
Separate three outcomes:
- Conformity or positive practice
- Opportunity for improvement
- Nonconformity
Don't write an improvement suggestion as a nonconformity unless a requirement went unfulfilled.
The reverse matters too. Auditing Practices Group (APG) guidance says that where audit evidence of non-fulfillment exists, it should be documented as a nonconformity, not softened into something milder.
Use "minor" or "major" labels only if your procedure, customer requirements, or certification expectations define them. They are not a universal ISO 9001 rule.
Link Every Nonconformity to a Requirement
A well-documented nonconformity has three parts: the requirement, the evidence, and the statement of nonconformity. Then name the process, site, or record affected.
A neutral illustration:
Requirement: The procedure for calibrated equipment requires gauges to be calibrated before use. Evidence: Two of ten gauges sampled in the inspection area showed calibration due dates six weeks past. Statement: Calibration status was not maintained as required by the procedure.
Write in Factual, Neutral Language
Avoid blame, assumptions, unsupported risk claims, and comments on individual performance. Describe the process condition, the evidence, and the potential effect on conformity.
Keep correction and corrective action apart. Correction fixes the immediate issue. Corrective action removes the cause to prevent recurrence. In the APG example, replacing faulty brake pads is a correction if the real cause is a faulty sensor.
Make Findings Actionable and Traceable
Each finding should connect to:
- An owner and due date
- Correction and root-cause method
- Corrective action and effectiveness check
No single root-cause tool is mandatory.
Actions should address the cause and scope of the issue, not just add paperwork. Recommend new procedures or forms only when needed for control, consistency, or compliance.
Review Findings With the Auditee
A closing meeting should:
- Confirm scope and evidence
- Explain findings and acknowledge positive practices
- Clear up factual misunderstandings
- Assign follow-up
Auditee feedback improves accuracy. When there is disagreement, return to the criterion and the objective evidence. Don't weaken a valid finding.
Finalize the Report and Use It to Improve the QMS
Issue, Communicate, and Retain
Review the report for accuracy, approve it per your procedure, distribute it to management and process owners, and retain it as controlled documented information.
Recipients should know:
- Which findings need correction or corrective action
- Who owns each finding
- How completion and effectiveness will be verified
Follow Up and Feed Management Review
Sending the report doesn't finish the audit. Owners must investigate, act, and show the actions worked. Escalate unresolved or recurring issues through your QMS processes.
Then feed results into:
- Management review
- Risk-based planning
- Process performance evaluation
- Future audit scheduling
Otherwise the report becomes a filed document instead of an improvement tool.
Support From Synergistic Systems
Synergistic Systems, founded in 2000, provides ISO 9001 consulting, internal auditor training, system-wide internal audits, and management review facilitation. Its cloud-based QMS intranet holds controlled documents, audit records, and corrective actions. Organizations that need help building an internal audit process, report format, or supporting documentation can work with the team. Certification itself is decided by your registrar and is never guaranteed.
Frequently Asked Questions
Is there a PDF version of the ISO 9001:2015 standard?
Get the official standard from ISO or an authorized national standards body. ISO's copyright rules prohibit unauthorized copying and distribution. A PDF audit report template is not a copy of the standard.
What is an ISO 9001:2015 internal audit?
It is a planned, systematic, impartial evaluation of the QMS against ISO 9001:2015 and the organization's own requirements. Results are documented for management and improvement.
What should an internal audit report include?
Scope, objectives, criteria, dates, auditors, methods, evidence, findings, conclusion, corrective action responsibilities, distribution, and retained documented information.
How do you write an internal audit finding?
Identify the requirement, objective evidence, and process or location. Then state conformity, opportunity for improvement, or nonconformity in neutral language.
Is an internal audit report required?
ISO 9001:2015 requires internal audits and documented information showing the audit program and results. It sets no exact report form, so define a suitable format in your QMS.
Who should receive the report?
Relevant management, process owners, the audit program owner, and personnel assigned corrective actions. Control distribution under your organization's procedures.
