The internal audit

In plain words

An internal audit means: you check for yourself whether what your QMS says is actually lived in daily work — and whether it works. Planned (there is a programme), impartial (nobody judges their own work), recorded (there is a short report) and with consequences (deviations become actions).

Two misunderstandings up front. First: an audit examines processes and the system, not people. It is about “does our way of working function?”, never about “whose fault is it?”. Second: an internal audit is not an exam. It is a structured conversation at the workplace — a good hour, real orders, open questions: “Show me the last order. How did you know what to do? Where does it pinch?”

The clause small companies respect the most is, at its core, the healthy opposite of bureaucracy: looking honestly at yourself, regularly, before someone else does.

Why this requirement exists

The internal audit is the QMS’s early-warning system. Deviations you find yourself cost a conversation and an action; deviations the customer or the certification body finds cost trust.

Then there is familiarity blindness: whoever works inside the same routine every day eventually stops seeing its gaps. The cross-eyed look — someone from another area looking in with fresh eyes — finds the places where “we always do it this way” and “this is what the process says” have drifted apart. Without clause 9.2, leadership would only learn from complaints whether the system holds. With it, they learn before.

What good looks like

In a company of 12 people: an annual programme on one page — which processes, in which month, by whom. Every process comes up at least once per cycle (typically: yearly), critical or troubled ones more often. Two trained internal auditors are enough; a one- or two-day course is plenty for the start. Auditing is done crosswise: whoever owns an area does not audit it.

A single audit takes 60–90 minutes at the workplace, with five or six guiding questions instead of a yes/no checklist. Afterwards a short report: what was looked at, what runs well (that belongs in too), what deviates — and for every deviation a corrective action with an owner and a date. The results land, collected, in the management review.

What changes as you grow: From around 50 people, a pool of four to six auditors carries the programme, and the frequency becomes risk-based — critical processes more often, stable ones less. From 100–250 people, a dedicated quality role typically plans the programme, audits get combined (quality together with safety or environment), and external auditors are brought in occasionally for independence and fresh input. The core remains: crosswise, on real orders, with consequences.

The minimum to pass

• A programme exists and is followed: planned audits with dates and named auditors, all processes covered across the cycle.
• Impartiality is visible — the assignment shows that nobody audits their own area.
• Conducted audits have a report with findings.
• Deviations became actions with deadlines, and their implementation is followed up.
• The results reach leadership — most easily evidenced through the management review.

A single audit two weeks before the certification date does not meet this: it is evidence of a missing programme, not of an existing one.

What an auditor asks for

• The audit programme of the current cycle — and the previous one, as evidence of continuity.
• The reports of the recent internal audits, with findings in both directions (deviations and positives).
• The competence evidence of the internal auditors — a training certificate is enough at small scale.
• The assignment from which impartiality is visible.
• The chain of one finding: deviation → action → implemented → effectiveness checked. One complete chain convinces more than ten open items.
• The treatment of audit results in the management review.

Common traps

• The alibi audit. Once a year, three weeks before the external date, a hasty “audit” happens. Auditors recognise the pattern instantly — by the date.
• Your own area. The production manager audits production: convenient, but worthless, because familiarity blindness audits along. Solvable even at 12 people — crosswise, or selectively with external support.
• Checklist theatre. 120 ticks, not a single real observation. Three good guiding questions on a real order beat a hundred checkmarks.
• The report graveyard. Findings without actions, actions without dates, dates without follow-up — then the audit was for nothing, and that is precisely what the external auditor checks first.
• The tribunal. Whoever runs audits as a blame hunt gets polished answers from the second round on and finds nothing anymore. Findings address processes, never people.
• Outsourcing everything. The external consultant audits once a year and nobody in the house learns anything. External support complements your own looking — it does not replace it.

Worked example

Berger Präzisionsteile GmbH (12 people, CNC machining) spreads five areas across the year: order handling, production, measuring equipment and QA, purchasing, leadership. Lea from quality assurance audits production and purchasing; production manager Marco audits order handling, leadership and the measuring-equipment-and-QA area — Lea’s own, which she therefore does not audit herself; both took a one-day auditor course. The whole programme fits on half a page.

The production audit in March takes 90 minutes, six guiding questions, on the running order. It surfaces this: the setup sheets of the new 5-axis machine are partly outdated — the experienced machinist works from memory. Today that works; at the next staff change it breaks. The finding is recorded without any question of blame; the corrective action reads: update the setup sheets and define a change routine — who approves changed sheets from now on? Deadline end of April, effectiveness check at the next audit. Alongside it, the report explicitly notes that measuring-equipment control is lived exemplarily.

The report is one and a half pages. In June both items appear in the management review: the closed chain on the setup-sheet deviation — and the praise, which did more for the audit culture in the team than any training.

← All ISO 9001 topics · To the knowledge hub