What is an internal audit?

What it is

Clause 9.2 requires you to audit your own quality system at planned intervals, to determine whether it conforms to your own requirements and to the standard, and whether it is effectively implemented and maintained.

Three words in that sentence do most of the work. Planned means a program, with a schedule that considers the importance of each process and the results of previous audits, not a random walk. Conforms means against both your documentation and the clause. Effectively means the process is achieving what it is supposed to achieve, not merely that a form was filled in.

The auditors have to be objective and impartial. In practice, that means nobody audits their own work. In a plant of 60 people this is a scheduling problem, and it is why many companies bring the audit in from outside.

When you will hear it

In findings, more than almost any other clause. Internal audit sits among the most-cited nonconformities across ISO 9001 and AS9100, and the usual wording is that audits were not performed as scheduled or were not conducted at all.

In every surveillance audit, because it is one of the mandatory items an auditor reviews each visit.

Roughly six weeks before an external audit, when someone opens the schedule and finds three of the four planned audits never happened.

What the auditor expects to see

A program document showing what will be audited, when, by whom, and why that frequency. Then evidence it ran: audit plans, completed reports, findings raised, and corrective actions closed and verified.

They will check auditor competence and independence. Training records for your internal auditors, and a schedule that does not have the production manager auditing production.

They will read your findings. An internal audit program that has found nothing in two years is not reassuring, it is evidence the audits are shallow. Real programs find things.

Common mistakes

Compressing the year into a month. Dates on reports show it, and an audit program run in one burst does not meet the planned-intervals requirement.

Auditing to a checklist copied from the standard. Clause-by-clause checklists produce document findings. Process audits that follow real work produce useful ones.

Letting one person audit everything, including their own processes. It fails the impartiality requirement and it fails the purpose.

Closing findings without verifying effectiveness. A finding closed by retraining, that reappears next year, is evidence the closure was cosmetic.

FAQ

How often do we have to audit?

The standard does not set a frequency. You set it, based on risk and past results, and then meet it. Covering the full scope once a year is the common pattern, usually spread across the year rather than done at once.

Can we outsource internal audits?

Yes. The prohibition on doing internal audits applies to your certification body, not to consultants. Outsourced internal audits benchmark at roughly $2,000 to $6,000 per audit, with one national provider advertising from $1,440.

Can our quality manager audit the quality system?

Partly. They cannot audit processes they own. Larger companies rotate trained auditors across departments; smaller ones bring someone in.

Does an internal audit have to find something?

Not by rule. But a program that never finds anything, in a company that gets findings from its registrar, is telling the auditor that the internal program is not working.