What the clause requires
Internal audit is the mechanism by which the organization itself verifies, at planned intervals, whether the quality management system conforms to its own requirements and to the requirements of the standard, and whether it is effectively implemented and maintained. Clause 9.2 does not say how many audits to run; it requires a program that defines the frequency, the methods, the responsibilities, the planning requirements and the reporting, and that is established, implemented and maintained over time.
The program cannot be identical for every process. The standard requires it to take into consideration the importance of the processes concerned, the changes affecting the organization and the results of previous audits. A critical process, one that has recently changed, or one that generated findings last time, deserves to be audited more often or in more depth than a stable support process that has never produced a problem. A flat program treating everything the same way is the giveaway that this was never considered.
For each audit the organization defines the criteria and the scope, selects auditors who ensure objectivity and impartiality, meaning nobody audits their own work, reports the results to relevant management, and takes correction and corrective action without undue delay. Documented information has to be retained as evidence of the implementation of the program and of the audit results. A properly run internal audit is also the best possible preparation for the certification body visit.
What the auditor asks to see
- Annual audit program listing the processes, the dates and the reason for each frequency
- Audit plan for each audit with the criteria, the scope and the auditors assigned
- Evidence that no auditor audited their own work or their own area
- Report presenting findings in the requirement, evidence and statement of fact format
- Treatment of the findings through correction and corrective action, with a due date and verification
Where companies most often get it wrong
- Program auditing every process once a year with no regard for importance or history
- All audits crammed into the week before certification, purely to fill the schedule
- Vague findings such as improve organization, with no requirement and no evidence cited
- Internal auditor assessing the department where they work every day
- No nonconformity found year after year, which normally signals a superficial audit
Example of a nonconformity
- Requirement
- ISO 9001, 9.2.2 a): the audit program shall take into consideration the importance of the processes concerned and the results of previous audits.
- Evidence
- The 2026 program schedules one annual audit for every process. The purchasing process generated 3 nonconformities in the 2025 audit and changed its system in March 2026, yet it received the same frequency and the same duration as all the others.
- Finding
- The audit program does not take into consideration the importance of the processes or their audit history.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Can an internal audit be carried out by an employee?
Yes, as long as that person does not audit their own work. Small organizations commonly cross auditors between departments, or hire an external auditor only to audit the quality function itself.
Does the internal auditor need a formal course?
ISO 9001 requires competence and impartiality, not a specific course. In practice, an internal auditor course based on ISO 19011 is the most common way of evidencing that competence.
How often should internal audits be run?
The standard says at planned intervals. Certification bodies generally expect the whole system to be covered within the annual cycle, with critical processes audited more frequently.