What an Internal Audit Actually Covers
- Purpose — confirm the QMS conforms to your own requirements and the standard, and that it's effectively implemented and maintained.
- Audit programme — a planned schedule covering all relevant processes over time, not a single one-off event.
- Audit scope — which processes, sites, or clauses this specific audit covers.
- Audit criteria — what you're auditing against (your own procedures, the standard, applicable regulations).
- Auditor independence — auditors should not audit their own work.
- Evidence — records, observations, and interviews that support (or contradict) conformity.
- Findings — conclusions drawn from the evidence, including nonconformities.
- Nonconformity — a specific instance where a requirement wasn't met.
- Corrective actions — addressing findings (see our corrective action guide).
- Audit report — a record of what was audited, what was found, and what happens next.
Common Internal Audit Problems
- Checking documents only — confirming a procedure exists without verifying it's actually followed.
- Auditing too superficially — a rushed audit that covers ground but doesn't dig into evidence.
- No process evidence — relying on interviews alone instead of records, observations, and outputs.
- Auditor reviewing their own work — undermines the independence the audit is meant to provide.
- No follow-up — findings recorded but never tracked through to a closed corrective action.
Practical Consultant Note
A genuinely useful internal audit should occasionally make someone uncomfortable — if every internal audit comes back with zero findings, that's usually a sign the audit isn't looking hard enough, not that the QMS is perfect.
If you're heading toward a real certification audit soon, see our audit preparation support for what to have ready.
Have One Internal Audit Question?
Send us your specific internal audit question and get a focused, professional read — US$19, one-time.
Start a $19 Quick CheckFrequently Asked Questions
Who can perform an internal audit?
A: Trained internal staff (as long as they don't audit their own area) or an external party. Small companies sometimes arrange reciprocal audits with a trusted outside resource when internal independence is hard to achieve.
How often is an internal audit required?
A: At planned intervals defined by your own audit programme — the standard doesn't mandate a fixed frequency, but the programme needs to cover all relevant areas over a defined cycle.
Does a finding mean I'll fail certification?
A: No — internal audit findings are meant to be found and fixed before the external audit. Finding nothing is far less reassuring than finding and correctly closing real issues.