Most organizations I talk with treat the internal audit like a dental cleaning. Everyone agrees it's good for you, nobody looks forward to it, and the moment it's over the team goes back to what they were doing. The report gets filed, the minor findings get patched, and a year later the same people are sitting in the same room hearing about the same problems.
I think that's a missed opportunity, and a costly one. ISO 9001:2015 requires you to run internal audits anyway (clause 9.2), so the real question is whether you get anything back for the time. An internal audit is the one time each year when someone with a fresh set of eyes walks through your processes and tells you, with evidence, where they are working and where they are stuck. That's a gift, and most of us leave it unopened.
This guide covers how to design, run, and follow up on internal audits so they produce improvements and not just paperwork. It focuses on the specific clauses, audit techniques, and follow-up habits that make the difference.
What Does ISO 9001 Actually Require from Internal Audits?
Clause 9.2.1 requires you to conduct internal audits at planned intervals to provide information on whether the quality management system conforms to your own requirements and to ISO 9001, and whether it is effectively implemented and maintained. Notice the second half of that. The standard asks about effectiveness, not only conformity. An audit that confirms every procedure was followed, without asking whether the procedure achieves anything, is meeting the letter of 9.2.1 and missing half of it.
Clause 9.2.2 adds the mechanics, in subclauses a) through f). You must:
- a) Plan, establish, implement, and maintain an audit program, taking into account the importance of the processes concerned, changes affecting the organization, and the results of previous audits.
- b) Define the audit criteria and scope for each audit.
- c) Select auditors and conduct audits so as to ensure objectivity and impartiality of the audit process.
- d) Ensure the results are reported to relevant management.
- e) Take correction and corrective action without undue delay.
- f) Retain documented information as evidence of the audit program and the results.
Look at that list again and you'll see the improvement hooks built right in. The program is supposed to respond to risk and change, which means it shouldn't be a rotating calendar that audits every clause once a year in the same order. And the results must reach management, which connects the audit to clause 9.3.2, where audit results are a required input to management review.
ISO 19011:2018, the guideline for auditing management systems, goes a step further. It describes audit findings as something that can indicate conformity or nonconformity, and it recognizes that findings can also identify opportunities for improvement. ISO 19011 is guidance, not a requirement for ISO 9001 certification, but it's the best reference I know for building an audit program that behaves like a learning tool.
Why Do Most Internal Audits Fail to Produce Improvement?
Before fixing the problem, it helps to name how it usually shows up. It usually shows up as one of five patterns.
The audit is a checklist walk. The auditor reads a clause, asks whether a procedure exists, sees that it does, and moves on. Nothing is learned because nothing was really asked.
The auditors are too close to the work. Clause 9.2.2 c) requires objectivity and impartiality but doesn't spell out what that means in practice. My reading, consistent with the impartiality principle in ISO 19011, is that auditors can audit neighboring departments but shouldn't audit work they performed or are responsible for. When the quality manager audits the quality department's process, the result is predictable.
Findings are written about people, not systems. "Operator did not complete the form" generates defensiveness. "The form has no field for the revised part number, so operators skip it" generates a fix.
Corrections get done and causes get ignored. Fixing the one bad record is a correction. Clause 10.2.1 b) also asks you to evaluate the need for action to eliminate the causes, which means reviewing and analyzing the nonconformity, determining its causes, and determining whether similar nonconformities exist or could occur. Many organizations stop at the correction because it closes the finding fastest.
Nothing connects the audit to the rest of the system. The report goes to a folder. It doesn't feed the risk register, the objectives, or the management review.
If you recognize two or three of these, you're in good company. If you want to see how these patterns show up on the certification side, I've written about the most common ISO 9001 audit nonconformities and how to avoid them.
How Do You Design an Audit Program That Looks for Improvement?
Build the schedule from risk, not from the clause list
Clause 9.2.2 a) tells you the audit program must take into consideration the importance of the processes, changes affecting the organization, and previous audit results. So treat those as real inputs. A process that had three complaints last quarter deserves more audit time than one that has run quietly for four years. A new supplier, a new ERP system, a reorganization, or a change in a key person all justify an earlier or deeper look.
A practical way to do this is a simple scoring grid for each process, with columns for customer impact, recent change, last audit result, and performance trend. Score each from 1 (low) to 3 (high) and weight them. The weights and scores below are illustrative; set your own.
| Process | Customer impact (x3) | Recent change (x2) | Last audit result (x2) | Performance trend (x1) | Total | Audits this year |
|---|---|---|---|---|---|---|
| Order to cash | 3 (9) | 3 (6) | 2 (4) | 2 (2) | 21 | 2 |
| Purchasing | 2 (6) | 3 (6) | 1 (2) | 2 (2) | 16 | 2 |
| Calibration | 2 (6) | 1 (2) | 1 (2) | 1 (1) | 11 | 1 |
| Facilities maintenance | 1 (3) | 1 (2) | 1 (2) | 1 (1) | 8 | 1 |
A simple rule such as "18 or more gets two audits or a deeper audit" is enough. You don't need sophisticated math. You need a documented reason why one process gets audited twice and another once, because that reason is what turns the schedule into a decision rather than a habit.
Audit processes, not clauses
The process approach in clause 4.4 is a better frame for auditing than the clause structure. When you audit "order to cash" as a process, you follow a real order through sales, planning, production, shipping, and invoicing, and you see the handoffs. The handoffs are where most of the waste and error hide, and a clause-by-clause audit almost never finds them. If your processes are not mapped yet, my piece on the process approach in ISO 9001 is a good place to start.
Choose auditors who bring a different view
Objectivity can also be a source of insight. An auditor from finance walking through the warehouse will ask questions a warehouse supervisor stopped asking years ago. Cross-functional auditing also spreads understanding of the system, which pays off in a way a purely compliance-driven program never does. Train them properly, of course. Auditors need to understand the standard, the process they are auditing, and how to ask open questions.
How Do You Run the Audit to Surface Improvements?
Ask questions that expose how the work really happens
Compare these two ways of auditing the same requirement, clause 7.5.3 on control of documented information.
| Checklist approach | Improvement-oriented approach |
|---|---|
| "Do you have a document control procedure?" | "Show me how you'd find the current version of this work instruction right now." |
| "Are records retained?" | "What do you do when the record is hard to fill out?" |
| "Is the process monitored?" | "Which measure tells you this process is getting better or worse, and when did you last act on it?" |
| "Are staff competent?" | "What happened the last time someone new did this job on their own?" |
| "Is the corrective action closed?" | "Has the same kind of problem come back anywhere else?" |
The right-hand column takes longer, and it produces stories. Stories are where improvement ideas live. The people doing the work usually know exactly what's wrong with the process, and a good auditor gives them a reason to say so.
Sample from the real record, and follow the thread
Pick a recent customer complaint, a rejected lot, or a late delivery, and trace it backward through the system. Where did the information get lost? Which control should have caught it? This kind of trace audit often finds more than a full day of checklist review because it starts from something that actually went wrong.
Separate the finding types clearly
Your audit report should distinguish between what the standard calls nonconformities and what can reasonably be called opportunities for improvement. Be careful here. An opportunity for improvement is not a nonconformity in disguise, and it isn't a requirement. Mixing them up creates arguments with the process owner and sometimes with the certification body. Note that ISO 9001 itself only defines nonconformity; the other categories below are common practice and ISO 19011 guidance, not requirements. That matters because if a certification body sees an "opportunity for improvement" that describes an unmet requirement, it may treat it as an unreported nonconformity, and if your own categories are presented as requirements, auditees may argue they are optional. Define the categories in your audit procedure so everyone reads them the same way. A common scheme uses four:
- Nonconformity, which is a failure to meet a requirement (standard, legal, or your own documented one).
- Observation or concern, where the auditor sees something that could become a nonconformity.
- Opportunity for improvement, which is an idea for doing the work better and has no requirement attached.
- Good practice, which is something working well that other areas could copy.
That fourth category matters more than people expect. If the only feedback an audit ever delivers is bad news, people learn to hide things. Recording good practice gives auditees a reason to welcome the auditor and gives you a way to spread what works.
What Should You Do After the Audit Closes?
This is where the real return is, and it's where most programs fall apart.
Do the root cause work properly
Clause 10.2.1 b) asks you to evaluate the need for action to eliminate the causes of a nonconformity, which includes determining those causes. For significant findings, ask "why" until you hit something about the system: a missing control, an unclear instruction, a training gap, a tool that makes the wrong action easy. If the root cause comes back as "the operator was careless," I'd keep asking. Careless people are rarely the whole story, and a fix that depends on people being more careful tends to be gone within a few months.
Clause 10.2.1 b) also asks whether similar nonconformities exist elsewhere. This is a cheap and powerful question. If one department is missing calibration records, it's worth a quick look at the others before the next auditor finds it.
Check effectiveness, not just completion
Clause 10.2.1 d) requires you to review the effectiveness of any corrective action taken. A finding closed on the day the procedure was revised hasn't been proven effective. Set the review for after the process has run through at least one full cycle under the new arrangement (a full month-end close, a complete production run, a full training intake), so the problem has had a fair chance to recur, and look at the evidence: did the problem recur? Did the measure move? Put that review on the calendar when you close the action, because it will not happen by memory.
Feed the results into the rest of the system
Audit results touch at least four other parts of ISO 9001:
- Management review (9.3.2). Audit results are a listed input, and the review outputs under 9.3.3 should include opportunities for improvement and any need for changes to the system. Show trends across audits, not just the latest list.
- Risks and opportunities (6.1). If an audit finds a recurring weakness, ask whether it belongs in your risk assessment. My article on risk-based thinking in ISO 9001 shows how to make that link practical.
- Quality objectives (6.2). A pattern of findings in one process can justify a new or revised objective.
- Continual improvement (10.3). Clause 10.3 asks you to continually improve the suitability, adequacy, and effectiveness of the system, and to consider the outputs of analysis and evaluation and of management review. Audits are among the best sources of that analysis.
Track the program itself
Look at the audit program the way you'd look at any process. A few simple measures are enough: how many findings are repeats of earlier findings, how long actions take to close, how many opportunities for improvement were actually adopted, and how many good practices were shared. If repeat findings don't fall over two or three cycles, the program isn't working, and it's better to hear that from your own data than from a certification body.
What Does a Strong Internal Audit Cycle Look Like?
Here's a practical sequence I'd suggest for any organization that wants more than compliance out of the process. It's tuned to the requirements of clause 9.2 but written in the order people actually work.
- Set the program in the first quarter. Score processes by risk and change, assign auditors from outside the area being audited, and get the schedule approved by top management. Owner: quality manager; output: approved audit program.
- Brief auditors on what you want. Tell them explicitly that you want the real story, with trace audits from complaints and handoffs, and that good practice gets recorded as well as problems. Owner: audit program lead; output: briefed auditors and audit plans.
- Run the audit as a conversation. Open questions, real samples, time spent at the place the work happens. Owner: auditor; output: documented evidence and draft findings.
- Hold a closing meeting that is honest and specific. Present findings in terms of the system, agree on the facts with the auditee, and agree who owns each action. Owner: lead auditor; output: agreed findings and named action owners.
- Write the report while the details are fresh. Set a reporting deadline in your audit procedure and keep to it; the longer you wait, the fewer people remember. Owner: lead auditor; output: report issued to relevant management (9.2.2 d).
- Do root cause analysis on the significant findings. Ask whether the same problem exists elsewhere. Owner: process owner; output: documented causes and actions.
- Schedule an effectiveness check for each corrective action before you close it. Owner: quality manager; output: dated effectiveness review on the calendar.
- Roll the results up into management review, the risk register, and the objectives. Owner: quality manager; output: management review input (9.3.2).
- Review the program itself at the end of the cycle and adjust next year's plan. Owner: top management with the quality manager; output: revised program.
None of this requires new software or a larger team. It requires deciding that the audit is a source of information rather than a test the organization has to pass.
A worked example (illustrative)
Consider a 60-person manufacturer whose scoring grid put order to cash at the top. The auditor, from finance, started from one late delivery and traced it backward. The order had been entered correctly, but a revised delivery date agreed by phone never reached planning, because the order form had no field for date changes. The finding was written about the system ("no controlled way to communicate date changes"), not the salesperson. Root cause analysis under 10.2.1 b) asked whether the same gap existed elsewhere, and found the same problem in spare-parts orders. The fix was a change field and a daily handoff check. The effectiveness review was set for after one full month-end cycle, and it checked whether any further date changes had been missed. The audit also recorded a good practice: the shipping team's daily handoff board, which other areas then copied. The result went into management review as a trend, and late-delivery complaints became a candidate quality objective.
A Word on Culture, Because It Decides Everything
I have come to think the biggest factor in whether audits produce improvement isn't technique at all. It's whether people feel safe telling the truth. If an auditor's finding turns into a performance conversation with someone's manager, the next audit will turn up fewer findings, and you'll be told the system is getting better when it's actually getting quieter.
Top management has more influence here than anyone. Clause 5.1.1 asks top management to demonstrate leadership by promoting improvement and by engaging, directing, and supporting people to contribute to the effectiveness of the system. When a senior leader thanks an auditee for surfacing a problem, in front of colleagues, the whole organization learns what the audit is for. When a leader asks "who did this?" the organization learns something else, and it learns it quickly.
If you want to go deeper on building the program itself, the internal audits page on this site covers the fundamentals, and the broader resources at Certify Consulting go into implementation support.
Where to Start This Quarter
You don't have to rebuild your audit program to see a difference. Pick one upcoming audit and change three things: choose an auditor from another department, start the audit from a real complaint or defect and trace it backward, and add a "good practice" line to the report template. Then check, after the audited process has run through one full cycle, whether any of the improvement ideas were adopted.
What would change in your organization if the people being audited looked forward to it? I don't think that's a naive question. It's the clearest test I know of whether the audit program is doing its job.
Frequently Asked Questions
Does ISO 9001 require opportunities for improvement in audit reports? No. Clause 9.2 requires you to report results to relevant management and retain evidence. Recording opportunities for improvement and good practice is optional, and ISO 19011 treats them as possible audit findings.
How often must internal audits be done? At planned intervals (9.2.1). The standard doesn't fix a frequency; the program must take into account the importance of the processes, changes, and previous audit results (9.2.2 a).
Can the quality manager audit the quality department? Clause 9.2.2 c) requires objectivity and impartiality. Auditing your own work would normally compromise that, so use an auditor from another area.
Which clause covers checking that corrective action worked? Clause 10.2.1 d) requires a review of the effectiveness of corrective action taken.
Last updated: 2026-11-13
Frequently Asked Questions
How often must ISO 9001 internal audits be conducted?
ISO 9001:2015 clause 9.2.1 requires internal audits at planned intervals but does not set a fixed frequency. Clause 9.2.2 says the program must take into account the importance of the processes concerned, changes affecting the organization, and the results of previous audits, so higher-risk or recently changed processes can justify more frequent audits. Most organizations cover the whole system at least once a year.
What is the difference between a nonconformity and an opportunity for improvement?
A nonconformity is a failure to fulfil a requirement, whether from ISO 9001, legal obligations, or your own documented system. An opportunity for improvement is an idea for doing something better where no requirement has been missed. Keeping the two separate in the audit report avoids disputes with process owners and certification bodies.
Can the quality manager conduct internal audits?
Yes, but clause 9.2.2 requires objectivity and impartiality in the audit process, so auditors should not audit their own work. A quality manager can audit other departments, though many organizations also use trained auditors from other functions to bring a fresh view and spread understanding of the system.
How do internal audit results connect to management review?
Clause 9.3.2 lists audit results among the inputs to management review, and clause 9.3.3 requires outputs that include opportunities for improvement and any need for changes to the quality management system. Presenting trends across several audits, rather than only the latest findings, makes the review more useful.
Is ISO 19011 required for ISO 9001 certification?
No. ISO 19011:2018 is a guidance standard for auditing management systems, not a requirement of ISO 9001. It is still a useful reference for designing an audit program, selecting auditors, and recognizing that findings can point to opportunities for improvement as well as conformity or nonconformity.
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.