An ISO internal audit is a systematic, evidence-based review conducted by an organization to confirm that its management system complies with standard requirements and functions effectively across operations.
Internal audits are not mock exams or punitive inspections. Required by Clause 9.2 across all Annex SL-aligned standards (including ISO 9001, ISO 14001, ISO 45001, and ISO/IEC 27001), they serve as an early-warning diagnostic tool to uncover system bottlenecks, correct procedural drifts, and maintain compliance before external registrars arrive.
1. Internal Audit vs. External Certification Audit
Understanding the functional distinction between audit types eliminates confusion and sets realistic internal benchmarks:
| Evaluation Criteria | Internal Audit (First-Party) | Certification Audit (Third-Party) |
| Primary Objective | Identify non-conformities and improvement areas internally. | Validate conformity to issue or maintain formal certification. |
| Auditor Identity | Trained internal personnel or independent consultant. | Lead Auditor appointed by an independent registrar. |
| Auditor Independence | Must not audit their own immediate department or work. | Completely independent with no operational or financial ties. |
| Outcome | Internal Corrective Action Requests (CARs) and report. | Formal recommendation for certification or surveillance approval. |
| Impact of Non-Conformity | Opportunity to correct before external exposure. | Can delay certification or require re-audit clearance. |
2. High-Frequency Audit Questions by Clause (The Annex SL Core)
Modern standards share a unified 10-clause structure known as Annex SL. Auditors evaluate standard operating procedures using targeted inquiries centered around Clauses 4 through 10:
Clause 4: Context of the Organization
- Auditor Question: “How does your organization determine internal and external factors affecting strategic goals?”
- Expected Evidence: A documented SWOT, PESTLE analysis, or risk register reflecting market shifts, regulatory updates, and workforce changes.
- Auditor Question: “Who are your interested parties, and what are their specific compliance expectations?”
- Expected Evidence: A stakeholder matrix identifying clients, statutory regulators, suppliers, and personnel alongside their defined requirements.
Clause 5: Leadership and Commitment
- Auditor Question: “How does top management demonstrate active accountability for management system performance?”
- Expected Evidence: Evidence that policy objectives align with corporate strategy, adequate budget allocation, and minutes of executive quality briefings.
- Auditor Question: “How is the quality/security/environmental policy communicated to frontline staff?”
- Expected Evidence: Staff interviews demonstrating practical understanding of operational objectives beyond simply memorizing printed posters.
Clause 6: Planning & Risk Management
- Auditor Question: “What systematic method identifies risks and opportunities across operational workflows?”
- Expected Evidence: Documented risk assessments showing likelihood/impact scoring, mitigation actions, and verification of mitigation efficacy.
- Auditor Question: “Are measurable targets established for key departments?”
- Expected Evidence: Department-level KPIs that are specific, measurable, achievable, relevant, and time-bound (SMART).
Clause 7: Support & Competence
- Auditor Question: “How do you verify that employees performing high-impact tasks are genuinely qualified?”
- Expected Evidence: Training matrices, skill gap evaluations, onboarding logs, certifications, and post-training competency assessments.
- Auditor Question: “How are monitoring and measuring resources controlled?”
- Expected Evidence: Calibration certificates, maintenance logs, and tracking tags for measuring tools, equipment, or testing environments.
Clause 8: Operation & Control
- Auditor Question: “How do you prevent obsolete documents and unapproved design changes from entering production?”
- Expected Evidence: Version control tracking, formal engineering change orders (ECOs), and access-controlled digital repositories.
- Auditor Question: “How are external suppliers and contractors evaluated and monitored?”
- Expected Evidence: Approved vendor lists (AVL), periodic supplier scorecards, and incoming material inspection records.
Clause 9: Performance Evaluation
- Auditor Question: “Show me the records and outputs of your most recent Management Review Meeting (MRM).”
- Expected Evidence: Documented meeting minutes covering audit results, customer satisfaction trends, non-conformity statuses, and resource decisions.
- Auditor Question: “How is customer feedback gathered and analyzed for systemic issues?”
- Expected Evidence: Customer satisfaction surveys, complaint logs, trend evaluations, and recurring-issue reviews.
Clause 10: Improvement & Corrective Action
- Auditor Question: “When a major deviation occurs, how do you determine and eliminate the underlying root cause?”
- Expected Evidence: Root cause analysis records using methodologies like the 5 Whys, Fishbone (Ishikawa) diagrams, or 8D reports.
3. Major vs. Minor Non-Conformities: How Auditors Grade Findings
Auditors classify deviations into three specific tiers based on operational severity:
[Observation / Opportunity for Improvement] ➔ [Minor Non-Conformity] ➔ [Major Non-Conformity]
- Observation / Opportunity for Improvement (OFI): A workflow that meets mandatory standard requirements today but demonstrates vulnerability that could lead to non-compliance if left unaddressed.
- Minor Non-Conformity: An isolated operational lapse or minor paperwork slip that does not represent a systemic failure (e.g., one calibration record missing out of twenty verified tools, or a single training record missing a supervisor sign-off).
- Major Non-Conformity: A complete absence of a mandatory clause requirement, a systemic collapse of operational controls, or an unaddressed defect directly jeopardizing product safety, customer data, or regulatory mandates (e.g., failure to conduct an internal audit, absence of management reviews, or uncontrolled release of non-conforming products).
4. The 5-Step Internal Audit Execution Protocol
Step 1: Audit Program Schedule ➔ Step 2: Desk Review ➔ Step 3: On-Site Interviews & Sampling
➔ Step 4: Corrective Action Issuance ➔ Step 5: Verification of Closure
- Establish the Audit Program: Outline a risk-prioritized schedule across all departments over a 12-month cycle rather than squeezing all reviews into a single rushed week.
- Conduct the Desk Review: Verify documented procedures, policies, and prior audit reports before conducting department interviews.
- Execute Sampling and Objective Observation: Cross-reference operational statements against hard evidence:
- Interview: Ask personnel how tasks are completed.
- Observe: Watch the live execution of the process.
- Verify: Inspect corresponding digital logs, tickets, or physical records.
- Issue Corrective Action Requests (CARs): Clearly describe the non-conformity, state the clause violated, and demand root-cause analysis from process owners.
- Verify Effectiveness: Re-inspect the affected process within 30 to 60 days to confirm that corrective measures permanently resolved the root cause.
5. Frequently Asked Questions (FAQ)
Can an internal auditor audit their own department?
No. ISO standards explicitly mandate impartiality and objectivity. Auditors must not audit their own work or direct operational responsibilities to prevent bias.
How often must internal audits be performed?
Standards do not specify an exact number of days or months. However, organizations must plan an audit program at planned intervals—typically auditing every process at least once within a 12-month calendar cycle, with higher-risk areas audited more frequently.
Do internal audit reports need to be retained as records?
Yes. Documented evidence of internal audit schedules, audit checklists, auditor notes, non-conformity notices, and corrective action verifications must be retained as documented information for external audit verification.
What is the minimum qualification required to be an internal auditor?
The standard does not mandate external third-party auditor credentials for internal team members. However, the organization must demonstrate that internal auditors are competent based on education, training (such as an internal auditor training course), and practical process familiarity.