How to Prepare for an ISO 9001 Internal Audit

Step by step

1. Confirm scope, criteria and objective — take the process and dates from your audit programme, then write down what this audit covers (the process, shifts, sites), what it is judged against (ISO 9001, your procedures, customer requirements) and what it is meant to find out. A narrow, clear scope gives a deeper audit.
2. Assign an independent auditor — ISO 9001 clause 9.2 expects auditors to be objective and impartial, so nobody audits their own work. In a small company, swap auditors between areas or use a trained auditor from another site.
3. Review documents and history — read the procedure and work instructions for the process, the previous audit report, open items in the corrective action log, customer complaints, recent NCRs and the process KPIs. Note anything that changed since the last audit: new equipment, people, products or software.
4. Map the process — sketch the inputs, outputs, resources, people, methods and measures on a turtle diagram. The map tells you where to look for evidence and which other processes it hands work to.
5. Write the checklist — turn the map and the history into open questions about how the work really happens, linked to the clauses they test. Start from the ISO 9001 internal audit checklist template and cut it down to the process in scope. The checklist questions by clause are a good source of prompts.
6. Plan the sample — decide which records you will pull and how many, spread across shifts, operators, products and months. Pick the sample at the audit, not in advance, so the area cannot prepare the records you will see.
7. Send the audit plan — send the process owner the date, time, scope, criteria, who you want to talk to and how long it will take. The auditee should know what is being audited. They should not be coached on the answers.
8. Prepare reporting and follow-up — agree how findings are graded, have the report format and CAPA form ready, and know who must receive the results. Clause 9.2 expects results to reach relevant management and corrective action to follow without undue delay, and the results feed the management review.

What ISO 9001 asks for

Clause 9.2 asks you to audit the quality management system at planned intervals to find out whether it meets your own requirements and the standard, and whether it is effectively implemented and maintained. You need a programme that sets frequency, methods, responsibilities and reporting, and that gives more attention to important processes, processes that have changed, and areas with poor previous results. Each audit needs a defined scope and criteria, and you must keep evidence of the programme and the results.

ISO 19011 gives the guidance most auditors follow for the how. Two of its principles shape preparation: an evidence-based approach, meaning conclusions rest on records and observations that can be checked, and a risk-based approach, meaning the effort goes where problems are most likely or most costly.

Preparing as the auditee

If your area is being audited, the best preparation is to run the process the way it is written and to know where your records are. Check that the documents at the point of use are the current revision, open actions from the last audit are closed or on track, and the people doing the work can explain how they know they did it right.

Do not rewrite procedures the week before an internal audit. Gaps that an internal auditor finds are cheaper than the same gaps found by the certification body or a customer. For external audits, the manufacturing audit preparation guide covers a 30-day readiness plan, and a process audit checklist helps when the audit looks at one production process in depth.

Verify, do not just look

Plan at least one re-performance into the audit: take a reported number and calculate it again from source records. If the cell reports OEE, recompute one shift with the OEE calculator. If it reports scrap, count the scrap tags. A KPI that cannot be rebuilt from its records is a finding against clause 9.1 even if the number looks good.

Worked examples

Common mistakes

• Auditing against the clause list instead of the process. Follow the work from input to output and test the clauses that apply along the way.
• Using the same generic checklist every time. Rebuild the questions from the last findings, recent changes and current KPIs for that process.
• Auditors auditing their own area. Swap auditors between departments or bring in a trained auditor from outside the area.
• Telling the area which records will be sampled. Share the scope and timing, but pick the specific records during the audit.
• Skipping follow-up on the previous audit. Check that earlier corrective actions were closed and that they worked.
• Treating zero findings as success. Look at the depth of the sample and the questions. A process with no findings and no opportunities for improvement was probably not audited hard enough.

Frequently asked questions

Sources

1. ISO 9001:2015 Quality management systems — Requirements (clause 9.2), ISO
2. ISO 19011:2018 Guidelines for auditing management systems, ISO
3. ISO 9001 Auditing Practices Group guidance papers, ISO and IAF

See also

• How to conduct an internal audit (Audits pillar)
• Manufacturing audit preparation guide
• ISO 9001 internal audit checklist template
• ISO 9001 internal audit checklist: questions by clause
• Turtle diagram template
• Process audit checklist
• Management review template
• OEE calculator