Internal Audit Is Not an Exam: How to Run ISO 9001 Audits That Drive Real Improvement

2026-10-04

Executive Summary

• The purpose of an internal audit is to tell the company whether the system actually runs as written and is effective, before an external auditor or a customer finds out for you. It’s not an exam to “pass.”
• Clause 9.2 of ISO 9001:2015 asks for an audit programme, not a once-a-year event: with frequency, methods, responsibilities, and consideration of process importance, changes and earlier results.
• Audits become a formality when staff prepare in advance, auditors read clause-by-clause checklists, findings are all minor, and results go nowhere.
• The real value lies in what happens after the audit: findings entering nonconformity handling and management review, and leading to change.
• An eQMS helps manage the programme and track findings, but it doesn’t make auditors better.

Cleanup week

A week before the internal audit, the atmosphere changes in many companies. Departments recheck records, add missing signatures, replace old printouts on the floor, and warn each other: “the auditor will ask this, answer it like so.”

On audit day, everything looks fine. Few findings, all minor. A neat report.

The question to ask: if a company has to clean up beforehand to get through an inspection it organizes itself, what did the inspection tell it? It showed that the system can look fine when prepared. It didn’t show how the system runs on an ordinary day.

That’s the gap between an exam and a tool. This article is about narrowing it.

The real purpose of internal audit

The statements about the standard below are based on ISO 9001:2015, clause 9.2, summarized in practical terms.

The standard asks the organization to conduct internal audits at planned intervals to provide information on whether the quality management system:

• conforms to the organization’s own requirements and the requirements of the standard;
• is effectively implemented and maintained.

Notice the second part: effectively implemented and maintained. The purpose isn’t to check whether records are complete, but whether the system really works.

That changes how you frame the questions. The question in an exam is “are the documents complete?” The question in an improvement tool is “does the actual work match the documents, and are results being achieved?”

A benefit that gets less attention: internal audit is the cheapest way to find problems. Found by the company itself, with time to deal with them, it’s a very different thing from being found by a complaining customer or an external auditor.

Why audits become a formality

Across many manufacturing operations, these seven signs show up most often. (A general observation, not measured figures.)

1. Announced and prepared for. When every department knows exactly when and what will be asked, the result reflects preparation, not everyday operation.

2. Clause-by-clause checklists. The auditor goes from clause 4 to clause 10 asking “is there a document?” at each. This ensures coverage of the standard but rarely gets at how work is actually done.

3. Only documents and records. No observation of work, no interviews with the people doing it, no tracing of a specific batch.

4. Everything audited to the same depth. High-risk processes and long-stable ones are treated alike, in the same week.

5. Findings are all minor. When a finding is read as a department’s “demerit,” people become less open and auditors less firm, to avoid friction.

6. Auditors who don’t understand the process. They know the documents but not the work, so they struggle to spot the gap between the two.

7. Results go nowhere. The report is filed, small findings are “fixed to close,” and nothing changes in how the work is done.

Audit programme versus audit event

Clause 9.2 talks about an audit programme, not an event. The organization must plan, establish, implement and maintain a programme covering frequency, methods, responsibilities, planning requirements and reporting. The programme must take into account the importance of the processes concerned, changes affecting the organization, and results of previous audits. Each audit needs defined criteria and scope.

That means the standard expects a risk-aware approach rather than a fixed calendar applied equally to everything. A few practical consequences:

Frequency by importance. A high-risk process, a recently changed one, or one with serious earlier findings deserves more frequent audit than a long-stable one.

Spread across the year. Instead of one concentrated week, audits can be split by process or area, giving auditors time to look deeply and sparing auditees a pile-up of work.

Audit by process, not by clause. A common approach: pick a process or a specific batch and trace it end to end across departments. This exposes gaps between documents and reality far better than going clause by clause.

Evidence from several sources. Not just reading documents: observe work in progress, interview the people doing it, check records against what’s actually happening.

No detailed advance notice. The company can announce the overall schedule without handing out each question beforehand.

Illustrative example (a composite scenario, not a real customer case): a company used to run internal audits once a year over a week, using a clause-by-clause checklist; results were typically a few minor findings about signatures and dates. The following year the team switched to tracing one batch from receiving to dispatch. The auditor found that actual practice at one step differed from the released instruction, and the operator explained they did it that way because the old instruction “wouldn’t work.” That finding would never have appeared from reading documents alone.

Auditor competence

The standard asks that auditors be selected and audits conducted to ensure objectivity and impartiality. A common way to show this: auditors don’t audit their own work. That’s sensible, even though the standard states it at the level of outcome.

Beyond objectivity, auditor competence determines output quality. Competence in general is addressed under clause 7.2, and detailed guidance on auditing appears in ISO 19011 (guidelines for auditing management systems; reference guidance, not a mandatory requirement of ISO 9001).

A few practical competences worth noting:

• Understanding the process being audited. You needn’t be an expert, but you need enough to notice when something doesn’t fit.
• Questioning skill. Open questions (“how do you do this step?”) yield more than closed ones (“is there an instruction?”).
• Writing findings. A good finding states which requirement wasn’t met, the specific evidence, and why it’s a nonconformity, enough for someone else to understand without asking back.
• Attitude. The goal is understanding the system, not catching people out. How auditors communicate affects whether auditees are open.

For smaller companies with few quality staff, rotating auditors between departments or using outside auditors for certain processes are common ways to preserve objectivity.

Where audit findings should lead

This is the part that decides whether an audit has value. The standard asks that results be reported to relevant management, that appropriate correction and corrective action be taken without undue delay, and that evidence of the audit programme and results be retained.

A finding that adds value follows a flow:

Finding → nonconformity, recorded and handled the way you handle any nonconformity (clause 10.2; see Nonconformance in ISO 9001: More Than an Error Report and Effective CAPA).

Results → management review. Audit results are an input to management review (clause 9.3). If leadership never sees the trend in findings, the feedback loop is broken.

Trends over years. Findings that repeat in the same process over several cycles are the clearest sign that corrective action hasn’t reached the cause.

Two practices worth adopting:

Record what’s done well. Audits aren’t only about finding faults. Good practice in one department can be shared with others, and noting it reduces the sense that “audits are just for criticism.”

Measure whether audits lead to change. The number of findings matters less than how many lead to real change in documents, processes, training or equipment.

If you’re interested in the external-audit side, see also why audit preparation takes weeks.

Internal audit in eQMS

To be clear first: an eQMS doesn’t make auditors better, and it doesn’t turn a clause-by-clause checklist into an audit with depth. A system can make a formality-style checklist audit run more smoothly.

What an eQMS changes is how much programme management depends on spreadsheets and memory:

Programme management. The annual audit schedule, scope, criteria, owners and status sit in one place and can be adjusted when changes or new results come in.

Evidence capture in the field. Auditors record observations, answers and records referenced during the audit, rather than writing them up afterward.

Findings flow directly into handling. A finding becomes a nonconformity in the same system, with an owner and deadline, instead of sitting in a report file.

History across cycles. Repeat findings in the same process or clause become easy to see.

Input for management review. Aggregated data is on hand, not rebuilt from separate reports.

A risk to watch: when a checklist becomes easy to fill in within the system, an audit can slide into ticking boxes faster. The value still lies in the quality of questions and evidence, not in the tool.

A practical checklist

Use these questions to review your current internal audit programme.

1. Do you have an audit programme (frequency, methods, responsibilities), or just a once-a-year event?
2. Does frequency reflect process importance, recent changes and earlier results?
3. Do you audit by process, tracing a batch or a transaction across departments, or mostly go clause by clause?
4. Does evidence come from several sources (observation, interviews, records), not just documents?
5. Are auditors objective (not auditing their own work) and do they understand the process?
6. Are auditors trained in how to audit and how to write findings?
7. Do findings state the requirement, evidence and reason clearly enough for someone else to understand?
8. Do findings enter nonconformity handling with an owner and deadline?
9. Are audit results and trends fed into management review?
10. Do you measure how many findings lead to real change, and do you record good practice?

If three or more answers are “no” or “not sure,” the issue likely lies in how the audit programme is designed, not in missing tools.

A note on ISO 9001 editions

This article refers to ISO 9001:2015. According to certification bodies, a revised ISO 9001:2026 was scheduled for publication in September 2026, with a transition period expected to run about three years and 2015 certificates remaining valid during it. Clause structure and wording may change; check against the edition your organization is certified to.

Is your internal audit telling you how the system runs, or just whether the records are complete?

→ Take the Knowledge Management Maturity Assessment to identify your maturity level and the first improvement to make.

Further reading:

• Nonconformance in ISO 9001: More Than an Error Report (previous)
• Training Records vs. Employee Competence: What ISO 9001 Clause 7.2 Actually Requires (next)
• Audit Preparation: Why It Takes Weeks (related)
• AI and Compliance: What ISO/GMP Companies Should Consider (related)
• eQMS for Manufacturing SMEs: A Practical Guide (pillar)

Sources:

• ISO 9001:2015, clauses 9.2 (internal audit), 9.3 (management review), 7.2 (competence), 10.2 (nonconformity and corrective action): iso.org/standard/62085.html
• ISO 19011 (guidelines for auditing management systems), reference guidance, not a requirement of ISO 9001: iso.org/standard/70017.html
• LRQA, ISO 9001 revision update: Publication date confirmed (certification body source; verify with ISO): lrqa.com

ISO 9001:2015 clauses are summarized in practical language and do not replace the text of the standard; compliance decisions should be checked against the official edition. The example is a composite illustrative scenario based on common patterns in manufacturing SMEs, not a specific customer case. The signs described are general observations, not measured figures. Practices such as process-based audits or rotating auditors are common approaches, not mandatory requirements of the standard.