An internal audit is a company’s look at itself: is the quality system lived as it is described, and is it effective? ISO 9001 requires internal audits at planned intervals in clause 9.2 (2015 edition). For an SME it is one of the best opportunities to find weak points before a customer or a certification body does. This guide shows how to plan an internal audit, who should carry it out, what happens to the findings and what the report should contain. The text of the standard is not reproduced.
On the state of the standard: ISO 9001:2026 was published on 16 September 2026. The clause number 9.2 comes from the 2015 edition (check the numbering in your edition). The APG guidance papers we read relate to the 2015 edition. Check numbers and requirements against the text of the standard before certification.
What internal audits are for
The SECO SME portal describes the internal audit as a check of whether the management system is applied correctly and effectively in practice and whether the defined procedures still match what is actually done. It often also serves as preparation for certification. According to the Auditing Practices Group (APG, an informal group of experts from ISO/TC 176 and the International Accreditation Forum IAF; its papers are not formally endorsed by ISO and IAF) it is feedback to top management: it shows where the system has weak points and where improvements are possible.
Depending on the aim, the portal distinguishes the system audit (are all requirements met?), the process audit (does a process achieve its objectives?), the product audit and the compliance audit (are legal and contractual requirements observed?). An internal audit can combine several of these perspectives.
The professional world knows ISO 19011 as the guideline for auditing. The 2018 edition has been withdrawn; the fourth edition, ISO 19011:2026, has applied since May 2026. It covers the principles of auditing, managing an audit programme, conducting audits and evaluating competence. The APG states that ISO 9001 does not require the use of ISO 19011; it is an aid, not an obligation. We do not cite clause numbers of ISO 19011 because we have not seen the 2026 edition.
The audit programme: what is audited when
In the 2015 edition the standard required (clause 9.2.2, paraphrased following the APG’s quotation) an audit programme that defines frequency, methods, responsibilities, planning requirements and reporting, taking into account the importance of the processes, changes in the company and the results of previous audits. Whether the 2026 edition changes anything here, check against the text of the standard. According to the APG, ISO 9001 does not prescribe how often or how long to audit.
The APG recommends a risk-based approach: processes with higher risk or earlier nonconformities take priority in the programme, as do areas with recent changes. Particular attention is due where a failure would have serious consequences, where customers were dissatisfied or where legal requirements might be breached. The APG planning guidance is written for certification audits, but its logic can be transferred. It distinguishes two levels: the programme (which audits over the cycle) and the individual audit plan (how one audit runs). Important areas and those with recent changes or earlier nonconformities are to be scheduled first. It also states that not every area has to be audited every year if a risk-based approach is taken and the reasoning is recorded, and that a programme may be adjusted as long as it fulfils its purpose. For internal programmes this is a transfer from practice that matches the APG’s statement on internal audits. Practice, not normative: plan by process, not by clauses of the standard, and audit connected processes together so that interfaces become visible.
Who audits: competence and independence
The APG describes what certification auditors assess about the internal audit: the competence of the auditors, the objectivity and impartiality of the procedure, the risk considerations in planning, the involvement of management and how the results are used. The company should have defined which competences internal auditors need and should provide training and observation.
On independence: anyone who audits their own work will hardly see its blind spots. The APG cites a recommendation of ISO 9004 to have audits carried out by people who are not involved in the activity audited; this is expressly not an auditable requirement of ISO 9001. Practice, not normative: in small companies the cross-audit works well, in which those responsible each audit the other’s area, as does bringing in an external person.
Conducting the audit
A good audit rests on questions that call for evidence: a document, a record, a sample, an observation. Choose samples so that they say something, and record what you saw, not just what you were told. Checklists help as long as they do not replace attention. For connected processes it is worth looking at the interfaces in the same audit. The APG advises certification auditors to talk early with top management about context, direction and leadership. You can adopt that conversation in an internal audit. Certification auditors like to look at the internal audit towards the end, to compare it with their own findings.
Findings and their consequences
A finding is the result of evaluating the evidence. In practice the usual categories are nonconformities, observations, opportunities for improvement and strengths. Dividing nonconformities into major and minor is a practice that software and bodies shape differently; we cannot show from the sources we read that it is a requirement of the standard.
What matters is what follows: every nonconformity needs a responsible person, a deadline and, later, proof that the action worked. The APG expects certification auditors to check how the result of internal audits is used to assess the effectiveness of the system and to identify improvements. An audit without consequences is a piece of paper without value.
The audit report
The report summarises what was examined, what was found and what follows. Practice, not normative: state the scope, criteria, period and auditors, summarise the overall impression, strengths and nonconformities in a summary and close with a conclusion including a recommendation. It should serve management and also be usable later as evidence.
Practical example: Muster Elektrotechnik GmbH
Muster Elektrotechnik GmbH is a fictitious electrical installation company with 18 employees and six active processes: sales, planning, installation, purchasing, personnel and improvement. The executive management draws up an audit programme for 2026 to 2028 and weights it by risk:
| Year | Processes audited | Reason |
|---|---|---|
| 2026 | Installation, purchasing | most complaints, supplier rating outstanding |
| 2027 | Sales, planning | interface to installation, new quote template |
| 2028 | Personnel, improvement | lower risk, end of the cycle |
All six processes are thus covered within three years. The first audit, A-2026-01, takes place on 12 November 2026. The audit is led by the head of administration, who is responsible for neither installation nor purchasing; she is supported by the planning project manager. The questions come from the processes and clauses of the standard in scope: 14 questions. The result: 11 conforming, 1 nonconformity, 1 observation and 1 strength, 14 answers in all.
Three findings result. The nonconformity concerns the 2026 supplier rating, which was not carried out: a minor nonconformity with an action, deadline 15 January 2027 and an effectiveness check on 31 March 2027. The observation concerns inconsistent labelling of test records, the strength the careful handover of installation documents. The audit lead writes the summary and conclusion, the QM lead approves the report, and it is archived as a PDF. On 31 March 2027 the head of administration checks whether the supplier rating now works.
Checklist
- An audit programme defines which processes are audited when, with reasons.
- Higher risks, earlier nonconformities and changes take priority.
- All processes are covered in the programme period or deliberately left out with reasons.
- Auditors are qualified and do not audit their own work.
- Scope, criteria and date are known in advance.
- The questions call for evidence, not just statements.
- Every nonconformity has a responsible person, a deadline and an effectiveness check.
- The report summarises strengths, nonconformities and conclusion.
- Management knows the results and uses them in the management review.
How KMU | base helps
Under Management system › Audits you will find the list with the buttons Certification and, for people with the right for audits, Audit programme, Checklists, Auditors and New audit. The Management system group is initially collapsed.
Programme and planning. In the audit programme over up to three years you plan audits year by year and see which active processes do not yet appear in any audit in the period. Audits can be internal, external or at suppliers (internal, external and supplier audits); you record the date, scope, objectives, criteria, processes, clauses of the standard, audit lead and auditors, and receive an audit number per year, for example A-2026-01.
Auditors. The Auditors page shows for each person the qualification evidence from the competence register with its validity (auditors with qualification). If someone is themselves responsible for a process in scope, the system points this out with a message (independence check).
Questions. Without a checklist of your own, the questions are generated when you prepare the audit from the processes and clauses of the standard in scope. You maintain reusable checklists yourself or generate them from chosen clauses, where an audit question is created in our own words (reusable checklists). The questions are frozen when you prepare the audit.
Conducting the audit. You also enter answers without a network connection; on reconnecting, everything is synchronised, and you decide any conflicts yourself question by question (offline capture in the audit). An answer of “Nonconformity” or “Observation” becomes a finding with a follow-up action in one click (audit questions from the scope and finding in one click). Nonconformities create an action with a deadline, major nonconformities additionally a nonconformity (findings with consequences).
Report. You write the summary and conclusion, approve the report and receive a PDF that is filed in the archive core (audit report as PDF with archive). The audit is only closed once the report is safely in the archive; if that fails, it stays open and you repeat the approval.
Limits you should know about:
- The independence check only points out that someone is responsible for a process in scope. It neither blocks the audit nor assesses competence or conflicts of interest beyond that.
- The programme covers three years at most. When and how often you audit is not decided by the software.
- The finding types (major nonconformity, minor nonconformity, observation, improvement potential, strength) are the classification used by QMS | base, not text of the standard.
- For the report, all questions must be answered; approval is possible only with the right for audits.
- The software does not check the professional quality of a finding. That remains a matter for the auditors.
The guide to QMS | base explains how to use it. Take a look at the demo or open a trial account. If you have questions, the contact page will help. You will find the terms under Pricing.
Sources
- ISO: ISO 9001:2026, Quality management systems – Requirements (Edition 6, published on 16.09.2026), accessed 27.10.2026.
- ISO: ISO 19011:2026, Guidelines for auditing management systems (Edition 4, 2026-05; 2018 edition withdrawn), accessed 27.10.2026.
- ISO 9001 Auditing Practices Group: Guidance on Internal Audits (Edition 1, Amd 1, 19.07.2020, for the 2015 edition; not endorsed by ISO and IAF), accessed 27.10.2026.
- ISO 9001 Auditing Practices Group: Guidance on Audit Planning (13.01.2017), accessed 27.10.2026.
- SECO SME portal: Auditing a management system (in German), accessed 27.10.2026.
The tables, examples and recommendations marked “practice” are editorial aids, not text of the standard. This guide does not replace legal or tax advice. Information as at 27 October 2026.