How to Plan Internal Audits: ISO 9001 Clause 9.2 and Finding Follow-up

In many organisations the internal audit becomes a warm-up lap a few weeks before the certification audit, rushed through just to fill in the forms. Yet a well-planned internal audit is the strongest tool a quality management system has for checking itself: it finds problems before the external auditor does, gives process owners concrete feedback and produces data for improvement.

This article walks through what ISO 9001:2015 clause 9.2 expects, how to set up an annual audit programme, how to write checklists and how to follow findings through to closure.

What clause 9.2 requires

The standard asks organisations to audit at planned intervals and assess whether the quality management system conforms to their own requirements and to the standard, and whether it is effectively implemented and maintained. In summary, the organisation should:

• Plan an audit programme covering frequency, methods, responsibilities and reporting, taking into account the importance of the processes, changes affecting the organisation and the results of previous audits.
• Define the criteria and scope of each audit.
• Select auditors so as to ensure objectivity and impartiality.
• Ensure results are reported to relevant management.
• Take the necessary correction and corrective action without undue delay.
• Retain documented information as evidence of the programme and the audit results.

ISO 19011 is a useful source of further guidance on managing audits, but applying it to the letter is not required to meet clause 9.2.

Building an annual audit programme

The programme is a calendar showing which process is audited, when and by whom. Ask these questions while drafting it:

1. Which processes exist? Start from your process map: sales, purchasing, production or service delivery, warehouse, HR, maintenance and so on.
2. Which are more critical? Audit processes that directly affect customers, change often or produced many findings in the past more frequently. You don’t have to audit everything with equal intensity every year; a risk-based spread is fine.
3. What has changed? A new line, a reorganisation or new software is reason enough to bring an area forward.
4. Who will audit? Auditors should not audit their own work. In smaller organisations, departments can cross-audit each other.

Process	Priority	Example frequency	Auditor
Production	High	Twice a year	Quality team
Purchasing	Medium	Once a year	Production planning
Human resources	Medium	Once a year	Purchasing

The frequencies above are only examples; set yours from your own risk assessment.

Writing the checklist

A good checklist guides the auditor without boxing them in. A layered structure makes it easier:

• Group: the area or process being audited (e.g. “Warehouse”).
• Category: sub-topics within it (e.g. “Stock records”, “Material identification”).
• Question: a concrete statement that can be verified by observation or record (e.g. “Do shelf labels match the stock records?”).

Rather than “Is there a procedure?”, write questions that point to evidence, such as “Do the inspection records of the last three shipments contain the fields the procedure defines?”. That deepens the audit.

On the day: gathering evidence

The auditor reviews documents, observes the workplace and talks to people. Every answer should rest on evidence: a record, an observation or a statement. For every question marked “Not OK”, write clearly what was seen, which requirement it breaches and where it was found. A vague finding gets misread at the corrective action stage.

Types of findings

Organisations commonly classify findings as:

• Nonconformity: a requirement not met, sometimes split into major and minor by impact.
• Observation: not yet a nonconformity, but could become one.
• Opportunity for improvement: the requirement is met, but it could be done better.

The terms vary between organisations; what matters is that all auditors use the same definitions consistently.

From finding to corrective action to closure

The audit doesn’t end with the report. The “without undue delay” wording in 9.2 means findings must be followed up. Each nonconformity gets a corrective action record with “internal audit” as its source, an owner and a deadline; root cause analysis is done, and the record closes once effectiveness is verified. If the finding stems from an outdated or missing document, a document revision should be part of the corrective action.

Review previous findings when you plan the next programme. Recurring findings in the same area signal that the process should appear more often.

Auditor competence and the audit report

The standard covers auditor competence through the general competence requirement in clause 7.2: auditors are expected to know audit techniques, the requirements of the standard and the process they audit well enough. In practice that means internal auditors receive training, carry out their first audits alongside an experienced auditor, and training records are kept.

The audit report is the lasting output. A good report is short and evidence-based, and usually covers:

• Date, scope, criteria and auditors
• People interviewed and records reviewed
• Findings, each with evidence and the relevant requirement
• Positive observations and good practices
• Overall assessment and items to follow up

Positive observations are often left out, yet making good practice visible sets an example for other departments and stops the audit being seen as a hunt for culprits.

Feeding audit results into management review

Clause 9.3 requires audit results to be considered in management review. So closing findings one by one isn’t enough; at the end of the period, put together the overall picture: how many findings were raised and closed, which processes they clustered in, which corrective actions ran late. That picture is the most reliable input for the next audit programme and improvement priorities.

Common mistakes

• Squeezing every process into the week before the certification audit.
• Auditors auditing their own department.
• Writing findings in vague terms without evidence.
• Leaving findings in the report without opening corrective actions.
• Reusing the same checklist every year although the processes have changed.

Internal audits in HibritİK Quality Management

In HibritİK Quality Management you build audit forms as group → category → question, which maps directly onto the layered checklist described above. During the audit, each answer is recorded as OK / Not OK.

For anything found not OK you can open a corrective action in the same module, record its source, assign an owner and deadline, and document the root cause in the 5-why fields. The action moves through approval, deadline, work, quality review and closure, with automatic reminders as the deadline approaches and passes. Quality data exports to Excel. See our corrective action guide for the steps in detail.

Conclusion

The internal audit is when the system looks in the mirror. A risk-based programme, evidence-driven questions and following every finding through corrective action to closure turn the certification audit from an exam into a routine check. To set up your audit forms and corrective action flow in one place, start your 14-day free trial or get in touch.