Iso 9001 Internal Audit

ISO 9001:2015 Internal Audit

Goal

Plan, conduct, and document an ISO 9001:2015 internal audit using objective evidence, correct finding classification, and clear audit reporting. Use this skill for planning an audit programme, conducting process-based or clause-based audits, preparing for third-party certification, or training internal auditors.

---

When to use

• Planning an internal audit programme
• Conducting an internal audit (process-based or clause-based approach)
• Preparing for a third-party surveillance or recertification audit
• Training an internal auditor

---

Required Internal Audit Checklist

☐ Define audit scope, criteria, and objectives before starting ☐ Verify auditor competence and independence (not auditing own work) ☐ Audit the process flow first — map evidence to ISO clauses afterwards ☐ Use open questions throughout — no leading questions, no yes/no questions ☐ Verify every answer with objective evidence ("show me", "let me see") ☐ Use sampling: interview multiple people, review multiple records, different time periods ☐ Classify findings correctly (Major / Minor / OFI) — do not downgrade under pressure ☐ Record objective evidence clearly and traceably for every finding ☐ Check effectiveness of previous corrective actions from prior audit cycles ☐ Confirm process performance against KPIs ☐ Issue a balanced audit report (findings + strengths) ☐ Track all Major and Minor NCs to closure with owner, due date, and effectiveness verification

---

Audit approach — process-based first

Preferred audit method: audit the process flow first, then map evidence to ISO clauses.

Follow the process: inputs → activities → outputs → performance indicators. Find where requirements are addressed in practice. Only then link findings to specific clauses. This avoids "checklist auditing" and produces more useful, systemic findings.

Use sampling throughout: interview at least 2–3 people, review at least 2–3 records, and cover different time periods. One record is not enough to confirm systemic conformity.

---

Audit finding classification

Guidance: A major NC directly threatens the QMS intent; a minor NC is a gap that could become major if not addressed. Downgrading a major to minor to avoid customer concern is an audit integrity failure.

Repeated minor non-conformances in the same process may constitute a major non-conformance due to systemic failure — treat patterns as systemic, not isolated.

Writing findings: Each finding must include:

1. Requirement (the ISO clause or procedure that was not met)
2. Objective evidence (what was observed, measured, or reviewed)
3. Statement of non-conformity (what the gap is)

Avoid conclusions without linking evidence to the specific requirement.

---

Clause-by-clause key questions

§4 — Context of the Organisation

§4.1 — Understanding the organisation and its context

• Is the context of the organisation documented (internal and external issues affecting the QMS)?
• Are strategic direction and relevant interested parties considered?
• Is the analysis reviewed and updated? When was it last updated?
• Evidence: SWOT, PEST analysis, or equivalent strategic analysis document

§4.2 — Understanding needs and expectations of interested parties

• Is there a list of interested parties (customers, regulators, employees, suppliers)?
• Are their relevant needs and expectations identified?
• Which of these have become QMS requirements?
• Evidence: stakeholder register, customer requirements register

§4.3 — Scope of the QMS

• Is the scope documented?
• Is it justified (exclusions explained if any)?
• Is it available to interested parties?
• Evidence: scope statement in Quality Manual or equivalent

§4.4 — QMS and its processes

• Are QMS processes identified with their inputs and outputs?
• Are process sequence and interactions defined (process map)?
• Are resources, responsibilities, and monitoring defined for each process?
• Are process risks, KPIs, and owners defined for each QMS process?
• Evidence: process map or turtle diagrams

---

§5 — Leadership

§5.1 — Leadership and commitment

• Can top management demonstrate involvement in the QMS? (not just sign the policy)
• Is customer focus promoted at the leadership level?
• Are quality objectives integrated into business processes?
• Can top management explain current quality objectives, major risks, and customer performance issues without relying on the quality manager?
• Evidence: management review records, objective tracking, signed policies

§5.2 — Policy

• Is the quality policy documented, signed by top management?
• Does it provide a framework for quality objectives?
• Is it communicated and understood by employees? (test: ask a random employee)
• Is it available to interested parties?
• Evidence: quality policy document + evidence of communication (intranet, notice boards, training)

§5.3 — Roles, responsibilities and authorities

• Are QMS-relevant roles defined with clear responsibilities?
• Is there a designated management representative (or equivalent)?
• Are responsibilities for customer focus assigned?
• Evidence: organisation chart, job descriptions, quality roles matrix

---

§6 — Planning

§6.1 — Actions to address risks and opportunities

• Are risks and opportunities identified from the §4.1 and §4.2 analysis?
• Are actions defined to address significant risks?
• For each significant risk: is there a defined action, owner, due date, and follow-up evidence?
• Are actions integrated into QMS processes?
• Evidence: risk register, risk-based thinking documented in process documents

§6.2 — Quality objectives and planning

• Are quality objectives established at relevant functions and levels?
• Are they SMART? (Specific, Measurable, Achievable, Relevant, Time-bound)
• Are there plans to achieve each objective (resource, responsible, timeline)?
• Are they monitored and communicated?
• Evidence: quality objectives document with current KPI data

§6.3 — Planning of changes

• When changes to the QMS are planned, is there a structured approach?
• Are purpose and potential consequences assessed before the change?
• Is integrity of the QMS maintained through changes?
• Evidence: change management records, MOC (Management of Change) procedure

---

§7 — Support

§7.1.1 — Resources (general)

• Does the organisation determine and provide necessary resources?
• Are resource constraints documented and addressed?

§7.1.2 — People

• Are sufficient competent people available for QMS processes?

§7.1.3 — Infrastructure

• Is infrastructure (buildings, equipment, IT) identified and maintained?
• Is maintenance documented?
• Evidence: equipment list, maintenance schedule and records

§7.1.4 — Environment for the operation of processes

• Are process environment requirements identified and maintained?
• (Temperature, humidity, cleanliness, noise — as applicable)

§7.1.5 — Monitoring and measurement resources

• Is all monitoring and measurement equipment identified?
• Is calibration / verification performed at defined intervals?
• Are calibration records maintained?
• Is equipment identified with calibration status?
• What happens when a gauge is found out-of-calibration? (suspect product assessment)
• Evidence: calibration master list, calibration certificates, out-of-cal procedure

§7.2 — Competence

• Are competence requirements defined for all quality-affecting roles?
• Are training records maintained for all relevant personnel?
• Is effectiveness of training evaluated?
• Are personnel aware of their contribution to quality objectives?
• Can sampled employees explain what they do if they detect a non-conforming output?
• Evidence: competence matrix, training records, evaluation results

§7.3 — Awareness

• Are personnel aware of the quality policy?
• Do they know their contribution to achieving quality objectives?
• Do they know the implications of non-conforming output?
• Can sampled employees explain what they do if they detect a non-conformance?
• Evidence: induction training records, toolbox talks, awareness campaign evidence

§7.4 — Communication

• Is internal and external communication relevant to the QMS defined?
• What is communicated? By whom? To whom? When? How?

§7.5 — Documented information

• Is documented information required by the standard available and current?
• Is organisation-specific documented information identified?
• Is document control defined (review, approval, version control, distribution)?
• Is access controlled — only current versions at point of use?
• Is obsolete documentation prevented from unintended use?
• Are records protected from modification and kept for defined periods?
• Evidence: document control procedure, master document list, sample controlled documents

---