That's the gap Clause 9.2 is built to close. ISO 9001:2015 requires planned internal audits that check two things at once — whether your QMS conforms to the standard, and whether it conforms to your own documented requirements. A policy revision or a signed-off work instruction doesn't answer that question by itself.
This article walks through what Clause 9.2 actually requires, how to build an audit program that holds up under scrutiny, what evidence you need to produce, and the findings that show up again and again when programs fall short.
Key Takeaways
- Audit frequency should track process risk, past results, and organizational change — not a fixed annual calendar
- Every audit needs defined criteria, scope, objectives, impartial auditors, and traceable evidence
- A completed checklist proves nothing without verified corrective action behind it
- Traceable records make surveillance audits faster and far less stressful
- Correction fixes the symptom; corrective action removes the cause — don't conflate the two
What ISO 9001 Clause 9.2 Requires
Clause 9.2 sits inside ISO 9001:2015's Performance Evaluation section (Clause 9), alongside monitoring and measurement (9.1) and management review (9.3). Each plays a different role.
Internal Audits vs. Management Review and External Audits
- Monitoring and measurement (9.1): Ongoing data collection such as scrap rates, customer complaints, and on-time delivery
- Internal audit (9.2): A first-party, planned evaluation of conformity and effectiveness
- Management review (9.3): Top management reviews QMS performance, often using internal audit results as an input
- External certification/surveillance audit: A third-party assessment by your registrar, separate from your internal obligation
None of these substitute for the others. A clean surveillance audit last year doesn't excuse a skipped internal audit this year.
The Two Conformity Questions
Clause 9.2.1 asks whether the QMS conforms to your own requirements and to ISO 9001's requirements, and whether it's effectively implemented and maintained. That last part matters most.
A procedure that exists on paper but isn't followed on the floor fails this test, even if the document itself is perfectly written.
Audit Program Requirements at a Glance
Clause 9.2.2 requires a documented program covering:
| Element | What it must address |
|---|---|
| Planning | Frequency, methods, responsibilities, reporting |
| Prioritization factors | Process importance, organizational changes, previous audit results |
| Per-audit definition | Criteria and scope for each individual audit |
| Objectivity | Auditors selected to keep the process impartial |
| Reporting | Results communicated to relevant management |
| Action | Correction and corrective action without undue delay |
| Records | Documented information proving the program ran and what it found |
A manufacturing example makes the terminology concrete. When you audit a machining cell:
- Criteria: the work instruction and applicable ISO 9001 clauses
- Scope: that cell during the current shift
- Objective: confirming conformity and effectiveness
- Evidence: traveler records and operator interview
- Finding: whether that evidence matches the criteria
Confirm the current published wording of ISO 9001:2015 and any sector or customer-specific requirements before you rely on this breakdown. Standards get revised, and your contractual obligations may add requirements ISO 9001 doesn't mention.
How to Build and Run a Compliant Internal Audit Program
A program is more than a calendar with dates on it. It needs a rationale behind every entry.
Risk-Based Scheduling, Not a Generic Calendar
Map every QMS process to a planned audit, then prioritize using:
- Process importance and consequences if it fails
- Customer impact and complaint history
- Recent changes : new equipment, new suppliers, revised procedures
- Previous audit results, especially repeat findings
Auditing every process on an identical annual cycle treats a stable, low-risk process the same as one with a history of nonconformities. That's not risk-informed planning.
From Program to Individual Audit Plan
Each audit needs its own plan: objective, criteria, scope, schedule, process owner, assigned auditor, sampling approach, and how results will be reported. Skipping this step is how audits drift into vague walkthroughs instead of focused evaluations.
Auditor Competence and Impartiality
Auditors need knowledge of ISO 9001, your QMS, auditing techniques, and the specific process under review. Just as important: auditors shouldn't audit their own work. Cross-train staff from other departments or rotate assignments so objectivity isn't compromised.
QMS Learning's ISO 9001 Internal Auditor course runs 16 hours with 27 interactive scenarios covering ISO 19011 principles, writing effective nonconformities, and audit reporting. Learners leave with working outputs like an audit schedule, finding statement, turtle diagram, and closing meeting plan.
Running the Audit: Preparation to Follow-Up
- Prepare: review documents, understand the process, confirm logistics
- Open: confirm scope, criteria, and ground rules with the process owner
- Gather evidence: interview staff, observe work, sample records, pull system data
- Evaluate: compare evidence against criteria to generate findings
- Close: present findings and agree on next steps
- Report and follow up: assign corrections, investigate causes, verify effectiveness, and feed results into the next audit cycle and management review
Sampling one checklist or one verbal assurance isn't enough. Triangulate records, observation, and employee statements before drawing a conclusion.
What Evidence Should an ISO 9001 Internal Audit Produce?
Completing an audit isn't the same as proving it happened the way it should have.
The Clause 9.2 Evidence Map
A defensible audit trail includes:
- Approved audit program with risk rationale
- Individual audit plans (criteria, scope, objectives)
- Auditor assignment and competence records
- Checklists or working papers used during the audit
- Sampled records and interview notes
- The audit report itself, with findings tied to criteria
- Correction and corrective-action records
- Effectiveness-verification results
Strengthening Weak Evidence
Weak evidence shows up in predictable forms:
- A schedule with no documented risk logic behind the frequency chosen
- A signed-off checklist with no sampled records attached
- A finding statement that doesn't reference the specific requirement or evidence
- A corrective action marked "closed" with no verification that it actually worked
Each fix is straightforward: attach the rationale, attach the sample, write the finding against a named criterion, and verify before closing. NQA's internal auditing guide frames usable evidence as objective, traceable to criteria, sufficient to support a conclusion, and protected from alteration: a useful checklist to run your own records against.
You also need to show the program itself was maintained: completed audits, documented reasons for any rescheduling, and evidence that results reached management.
This is the exact gap QMS Learning's Document Management System and Manager Dashboard were built around. The Document Management System keeps an append-only revision history with clause-mapped linkages, so a reviewer can trace a document back to the training and records it supports.
The Manager Dashboard tracks completion and capability gaps, and the Audit-Evidence Package compiles training records, completed scenarios, and time-stamped activity into a single exportable PDF. None of this replaces sound audit judgment; it organizes the evidence so it's there when someone asks for it.
Common Clause 9.2 Findings and How to Prevent Them
Most Clause 9.2 nonconformities fall into three buckets.
Program-Level Findings
| Finding | Prevention |
|---|---|
| Audits overdue or skipped | Build escalation into the schedule; review status monthly |
| Schedule ignores risk or history | Document the rationale behind every interval |
| Organizational changes not reflected | Add a trigger to update the program after major changes |
| Program doesn't cover the full QMS | Map every process to a planned audit before the year starts |
Execution and Impartiality Findings
- Auditors lack demonstrable competence for the process assessed
- Personnel audit their own work
- Criteria or scope are vague or undefined
- Sampling is too shallow to support a conclusion
- The report states a finding without linking it to evidence or a requirement
A second-reviewer check on every report before it's finalized catches most of these before they become a pattern.
Follow-Up and Records Findings
Common weaknesses in this area include:
- Results that never reach relevant management
- Corrections mistaken for corrective action
- Unaddressed root causes
- Corrective actions closed without verified effectiveness
Route results to the right managers, keep corrections separate from corrective action, and verify effectiveness before you close a finding.
Roderick Munro's analysis in Quality Magazine found internal programs frequently detect fewer issues than the registrar does. That gap usually means the audit is not testing the process deeply enough.
Pre-audit self-check:
- Is the program current and does it reflect recent changes?
- Are auditors impartial and demonstrably competent?
- Does the evidence actually support each conclusion?
- Are findings assigned to an owner with a due date?
- Has effectiveness been verified, not just assumed?
Conclusion
Clause 9.2 compliance is a working system: risk-informed planning, impartial auditors, evidence that holds up under questioning, and corrective actions that are actually verified. A wall schedule and a stack of signed checklists alone do not meet the requirement.
Practical next steps:
- Review your current program against process risk
- Confirm auditors are not checking their own work
- Strengthen the records behind every finding
- Verify each corrective action worked before you close it
For manufacturers building this capability from scratch, QMS Learning's General Manufacturing Quality pathway bundles ISO 9001 Internal Auditor training with Root Cause Analysis & CAPA and the upcoming Internal Audit Program Management course: a structured route to building audit capability that doesn't disappear when one person leaves.
Frequently Asked Questions
What is ISO 9001:2015 internal audit?
It's a planned, systematic evaluation of your QMS against ISO 9001 and your own documented requirements. It also checks whether the system is effectively implemented and maintained, not just documented.
What are the ISO guidelines for conducting an internal audit?
ISO 9001 requires planned intervals, defined criteria and scope, competent impartial auditors, objective evidence, documented results, management reporting, and corrective action. ISO 19011 offers optional how-to detail; it is not mandatory.
What records are required for an ISO 9001 internal audit?
Retain the audit program, plans, criteria and scope, auditor competence records, results and findings, plus corrective-action and effectiveness-verification evidence. Add any contract- or sector-specific retention rules.
How often should ISO 9001 internal audits be conducted?
There's no universal frequency. ISO/IAF's 2020 guidance confirms organizations should set intervals based on process importance, risk, change, and prior results.
Can an employee audit their own work under ISO 9001?
No. It compromises objectivity, which Clause 9.2.2(c) specifically requires. Use cross-functional auditors from another department or an independent external resource instead.
What are common findings under ISO 9001 Clause 9.2?
Recurring issues include incomplete audit coverage, weak scheduling rationale, vague criteria or scope, shallow sampling, auditor conflicts of interest, delayed corrective action, and effectiveness that was never actually verified.