To conduct an internal audit, start from a risk-based audit program that says which processes get audited and how often. For each audit, set the scope and criteria, assign an auditor who does not work in the area, and build a checklist from the process and its requirements. On the day, follow real work and records, verify every answer with evidence, and write each finding as requirement, evidence and gap. Report to the process owner, agree corrective actions with dates, and close each finding only when you have checked that the fix worked.
An internal audit is a planned, independent check of whether a process does what your quality system says it does, and whether that is enough to meet the requirements you have signed up to. It is not an inspection of parts and it is not a hunt for someone to blame. The output is evidence: management learns where the system works and where it does not, before a customer or a registrar finds out.
ISO 9001 clause 9.2 asks for audits at planned intervals. In paraphrase, it wants a program that takes account of how important each process is, what has changed and what earlier audits found. Each audit needs a defined scope and criteria, and the auditors must be objective and impartial. Results go to the managers concerned, actions follow without undue delay, and records of the program and its results are kept. AS9100 uses the same clause and adds aerospace detail. IATF 16949 adds manufacturing process audits and product audits on top of the system audit.
The guidance standard behind most audit procedures is ISO 19011. It describes principles for auditors, how to manage an audit program and how to run individual audits. You do not certify to ISO 19011, but registrar auditors are trained on it, so following it makes your internal audits look like the ones you will face. For a generic view of getting ready for external audits as well, see the manufacturing audit preparation guide.
The audit program is the plan for all audits over a period, usually a year, though IATF 16949 also expects every process to be covered within a three-year cycle. Start with your list of processes. If you do not have one, start from your process map; the ISO 9001 documentation guide explains what the standard expects you to document.
Rate each process on a few factors and turn the score into a frequency. Factors that work well in practice are the effect of the process on product and customer, how much it has changed since the last audit, how many findings and complaints it has had, and its performance against its own metrics. Keep the scoring simple enough that someone else could repeat it. The worked example below shows one way to do it.
Do not forget the processes that sit outside production. Management review, document control, purchasing and supplier control, training and calibration all belong in the program. Supplier processes are audited too, but through a separate supplier audit checklist and your supplier quality management process, because the criteria and access are different.
Finally, pick auditors. Train them in the standard and in audit technique, and make sure nobody audits work they do or manage. In a small shop, two departments can audit each other, or you can bring in an outside auditor for the areas the quality manager runs personally.
Preparation decides how good an audit will be. Write the objective in one sentence, such as confirming that the changes made to the heat treat process in the spring are working. Then set the scope (which process, which shifts, which product lines) and the criteria (ISO 9001 clauses, customer-specific requirements, your own procedures).
Read before you go. Pull the procedure and work instructions, the last audit report, open corrective actions, complaints and the process KPIs. A turtle diagram helps you see the inputs, outputs, resources, people, methods and measures, and each of those six boxes becomes a set of questions. For an ISO 9001 audit, the ISO 9001 internal audit checklist template and the checklist questions by clause give you a starting set. For a manufacturing process audit, use the process audit checklist.
Plan your sample. You cannot see every record, so pick a sample across shifts, operators, part numbers and dates, and include the records most likely to show a problem, such as the newest product or the shift with the most scrap. Write the sample into your plan so you can show later why you looked where you did.
Keep the opening meeting short: confirm scope, timing, who you will talk to and how findings will be shared. Then leave the meeting room. Most useful evidence sits at the workstation, in the travelers and on the gauges.
Use open questions: "show me how you know this setup is right", not "do you check the first piece?" Ask people to walk you through what they do and compare it with the work instruction in front of them. Trace in both directions. Start from a finished part and walk back to the material certificate, the operator training record and the gauge calibration. Then start from a purchase order and walk forward to the shipment.
Verify everything. If someone says gauges are calibrated, read the label and find the record in the calibration log. If someone says the instruction is current, check its revision against the master document list. An answer without evidence is not evidence, and a finding without evidence will not survive the closing meeting.
Note good practice as well as gaps. A process owner who hears only about problems stops cooperating, and the positive notes show other areas what good looks like.
A finding has three parts. The requirement says what should happen, citing the clause, procedure or drawing. The evidence says what you saw, with identifiers such as the work order, the date, the gauge number and the revision. The statement says how the evidence falls short of the requirement. If any of the three is missing, the process owner can argue with the finding, and often they will be right.
Grade findings using your own procedure. ISO 9001 does not define major and minor, but many companies borrow the certification-body convention: a major nonconformity is a missing or broken process, or a failure likely to reach the customer, and a minor nonconformity is a single lapse in a process that otherwise works. Opportunities for improvement are not nonconformities and do not need a corrective action, though they should be recorded.
Write the finding about the system, not the person. "Operator did not record the torque" invites retraining. "The work instruction has no step for recording torque and the traveler has no field for it" points to the fix.
At the closing meeting, read out every finding with its evidence and grade, and agree the date for the written report. Nothing in the report should surprise the process owner.
The report states the scope, criteria, auditors, dates, the sample, the findings and an overall conclusion about whether the process is effective. Send it to the process owner and to the management team, because ISO 9001 expects audit results to feed management review. Risks you uncover belong in the risk register.
Each nonconformity becomes a corrective action owned by the process owner, not the auditor. Ask for containment where product is at risk, a cause analysis and an action plan with dates. The root cause analysis and CAPA guide covers how to judge whether the cause is real. Close the finding only after you have checked, on a later visit or with fresh records, that the action worked.
Different audit types answer different questions, and a strong program uses more than one.
Example: Setting audit frequency from a risk score (fictional shop, six processes). Each process gets 1–3 for impact on the customer, 0–2 for change since the last audit and 0–2 for findings and complaints in the last year. Score 5 or more: audit twice a year. Score 3–4: once a year. Score 2 or less: every 18 months, inside the three-year cycle.
Result: The schedule puts the effort where the risk is: the changed machining cell and the supplier with escapes are audited twice as often as stable processes. Re-score after every audit and management review.
Example: Turning an observation into a finding (fictional torque station).
Result: The finding names the form revision as the gap, so the corrective action updates the traveler and the instruction together. The visual work instruction template shows how to put a record field next to the step that needs it.
ISO 9001 asks for planned intervals based on importance, change and past results, not a fixed frequency. Most shops cover every process at least once a year and audit high-risk processes more often. IATF 16949 also expects full coverage within a three-year cycle.
Anyone trained in the standard and in audit technique who does not audit their own work. Operators, engineers and supervisors from other areas often make good auditors because they know how the plant really runs.
It depends on scope. A single process audit in a small shop is often half a day on site plus preparation and reporting time. Plan from the scope and sample, not from a fixed number of hours.
ISO 9001 does not define them. A common convention is that a major is a missing or failed process or a likely customer impact, and a minor is a single lapse in a process that otherwise works. Define the grades in your audit procedure.
Nonconformities do. ISO 9001 clause 10.2 asks you to determine causes and act on them. Opportunities for improvement are optional and do not need a corrective action.
No. It is a guidance standard, so you cannot be certified to it. It is still the best reference for how to manage an audit program and run audits, and certification auditors follow it.
COPLAIN AI PLATFORM
Upload your existing procedures and Coplain AI drafts audit-ready work instructions, job aids and forms from them.
Generate yours automatically with Coplain →