An internal audit is where you check your own quality system before a registrar checks it for you. ISO 9001 clause 9.2 requires a planned audit programme, a defined scope and criteria for each audit, auditors who do not audit their own work, results reported to management, and retained records of all of it. You cannot pass a Stage 2 certification audit without at least one completed internal audit round on file.
For a 10-100 person manufacturer, this is often the scariest requirement in the standard. It should not be. An internal audit is a structured walk through your own shop with a short checklist, asking one question over and over: do we do what our documents say? You already know where the weak spots are. The audit writes them down so they get fixed before a stranger finds them.
This guide covers what clause 9.2 asks for, a first-audit sequence you can run next week, what a usable checklist looks like, how to write findings that lead to real corrective action, and exactly what the certification auditor does with your audit records at Stage 2.
What Clause 9.2 Requires
Clause 9.2 is short. Strip out the standards language and it asks for six things.
- An audit programme. A schedule showing which processes get audited, when, and by whom. Weight it by how important each process is and where you have had problems before.
- Scope and criteria for each audit. Scope is what you are auditing — the purchasing process, the machine shop. Criteria are what you audit against — your own procedures plus the matching ISO 9001 clauses.
- Impartial auditors. Whoever runs the audit cannot audit their own work.
- Results reported to relevant management.
- Correction and corrective action without undue delay when the audit finds a problem.
- Retained records. The programme and the audit results are mandatory documented information.
Impartiality is the hard one in a small shop. If your quality manager also runs receiving, they cannot audit receiving. Three fixes work. Cross-audit: the production lead audits purchasing and the office manager audits production. Borrow: trade audit days with a friendly, non-competing shop. Hire: a contract auditor can cover your whole system in one or two days a year. None of these require a certified lead auditor. Clause 7.2 requires competence, not certificates — send your auditor to a short internal-auditor course or train them in-house, and keep the training record. The registrar will ask how your auditor was qualified.
A Practical First-Audit Sequence
Here is a sequence that works for a first audit in a small plant. Budget about half a day per process.
- Write the audit programme. One page. Processes down the left, months across the top, an X where each audit lands, and a name next to each X. Cover every QMS process within the year.
- Set scope and criteria for the first audit. Example: scope is purchasing and receiving; criteria are your purchasing procedure plus ISO 9001 clause 8.4.
- Prepare. Read the procedure. Pull the last three months of records. Write 10 to 15 questions.
- Audit by walking the work. Pick one recent order and follow it: purchase order, approved-supplier check, receiving record, any rejection. Ask the people who do the work to show you, not tell you.
- Write findings the same day, while the evidence is fresh. Record what you saw, where, and against which requirement.
- Report the results. In a small shop this can be a one-page summary to the owner or GM.
- Open corrective actions. Every nonconformity feeds your clause 10.2 corrective-action process. Fix the instance, then dig for the cause.
- File everything: programme, checklist with notes, findings, report, and the corrective-action log. This file is what the registrar samples.
What a Usable Checklist Looks Like
Most free checklists restate the standard as questions. "Does the organization determine and provide the resources needed?" Every answer is yes. Nothing gets found. A usable checklist is process-based: it follows real work and asks for evidence.
| Process area | Weak question | Better question | Evidence to pull |
|---|---|---|---|
| Purchasing (8.4) | Do you evaluate external providers? | Show me how the newest supplier got onto the approved list. | Approved supplier list, evaluation record |
| Calibration (7.1.5) | Are measuring resources suitable? | When was this caliper last calibrated? Show me the record. | Calibration log, certificate, sticker on the tool |
| Nonconforming product (8.7) | Is nonconforming output controlled? | Walk me through the last rejected part. Where is it now, and who decided? | NCR log, hold tag, disposition record |
| Competence (7.2) | Is competence determined? | Who is qualified to run this machine? Show me their record. | Training matrix, sign-off sheet |
Ten to fifteen questions per process is enough. Leave white space for notes. Treat the checklist as a memory aid, not a script — when an answer surprises you, follow the trail and come back to the list later.
Writing Findings That Get Fixed
A finding is only useful if someone else can act on it without asking what you meant. Use three parts: the requirement, the evidence, the gap. Example: "Procedure QP-751 requires annual calibration of active gauges (clause 7.1.5). Caliper C-012 in the machine shop was last calibrated 19 months ago and was in use on job 4482. Minor nonconformity." Anyone can pick that up, pull the caliper, and then ask why the recall system missed it.
- Major nonconformity: a required process is missing or has broken down completely. Example: no calibration system at all.
- Minor nonconformity: the system exists but lapsed in a specific case. Example: one overdue gauge.
- Opportunity for improvement (OFI): the requirement is met, but there is a better way. No corrective action required.
Every nonconformity enters your clause 10.2 corrective-action process: correct the instance, find the root cause, act on the cause, then check that the action worked. Vague findings die in a drawer. "Training could be improved" produces nothing. "Operator B ran the brake press with no qualification record, contrary to the training matrix" produces a fix.
How Registrars Sample Your Records at Stage 2
At Stage 2, the certification body's auditor (working under ISO/IEC 17021-1 accreditation rules) has to verify that clause 9.2 works — not just that a procedure exists. The routine is predictable. They ask for the audit programme and check it covers all your QMS processes. They pull the records from one completed audit: plan, checklist notes, findings, report. Then they trace one finding into your corrective-action log and into the management review minutes (clause 9.3). If the thread breaks anywhere — a finding with no corrective action, results that never reached management — that break becomes their finding.
- The programme exists and covers every process, not just the easy ones.
- Scope and criteria were defined for each audit.
- The auditor did not audit their own area.
- Findings cite evidence, not opinions.
- Nonconformities landed in the corrective-action system and are closed or on track.
- Audit results appear in the management review inputs.
Timing matters too. Finish your first full audit round, and the management review that follows it, with about three months of operating records on the books before Stage 2. Missing internal-audit and management-review records are among the most common reasons a Stage 1 audit ends with "come back later."
How Often to Audit
Clause 9.2 says "planned intervals" and nothing more. You choose the frequency and defend it. Three patterns are common in small manufacturers.
| Cadence | How it works | Fits best |
|---|---|---|
| One annual full-system audit | Audit every process in one or two days, once a year | Very small shops; simplest to manage |
| Rolling slices | One process per month or quarter until the cycle is complete | Most 10-100 person shops; spreads the load and keeps audit skills fresh |
| Risk-weighted | Trouble processes twice a year, stable ones once | Shops with a known problem area, such as supplier quality |
Whichever pattern you pick, audit every QMS process at least once a year. That is the cadence most registrars expect to see, and it keeps each surveillance audit boring — which is the goal.
Getting the Documents in Place
To run audits you need a small document set: an internal audit procedure, the programme, a checklist template, a finding form, and a report format. You can write these yourself in a few evenings — the examples above cover most of the structure. If you would rather buy the full set, ISO Delivered's flat-fee $8,000 Full Documentation package (about 44 documents, delivered two to four weeks after the questionnaire) includes the internal audit procedure and forms among its 15 procedures and 15 forms. Its $500 Readiness Report is a smaller first step if you want a gap check first. Either way, the documents are the easy part. The habit of auditing on schedule is what the registrar is checking.
Frequently asked questions
Can I audit my own work for ISO 9001?
No. Clause 9.2 requires auditor selection that keeps the audit objective and impartial, and auditing your own work fails that test. In a small shop, cross-audit between departments, trade audit days with a non-competing company, or bring in a contract auditor for a day or two each year.
Do internal auditors need to be certified?
No. ISO 9001 requires competence under clause 7.2, not a certificate. A short internal-auditor course, or documented in-house training plus a supervised first audit, is enough. Keep the training record, because the certification auditor will ask how your auditor was qualified.
How many internal audits do I need before certification?
At least one complete round covering every process in your QMS scope, followed by a management review of the results. Plan for about three months of operating records overall before Stage 2, since the registrar needs evidence that the system runs, not just that it is written.
What is the difference between a nonconformity and an opportunity for improvement?
A nonconformity means a requirement — from ISO 9001 or from your own documents — was not met, and you can cite the evidence. An opportunity for improvement means the requirement is met but the process could work better. Only nonconformities must enter the clause 10.2 corrective-action process.
Does ISO 9001 require an internal audit every year?
The standard only says audits must happen at planned intervals; no frequency is stated. In practice, most registrars expect every QMS process to be audited at least once a year. Annual full coverage is the safe, defensible norm for a small manufacturer.
How long should I keep internal audit records?
Clause 9.2 requires you to retain evidence of the audit programme and the audit results, but it sets no retention period — you choose one and write it down. Keeping records for at least one full three-year certification cycle is common, so surveillance and recertification auditors can see the history.