How to Conduct an Internal ISO Audit

Learning how to conduct an internal ISO audit means learning how to reach reliable conclusions from limited time and sampled evidence. ISO 19011:2026 provides guidance on audit principles, managing an audit programme, conducting audits, and evaluating auditor competence. It can support audits across management system disciplines, including integrated systems.

The 2026 edition replaces ISO 19011:2018 and expands guidance for modern audit contexts, including remote methods. It remains a guidance standard, not a certifiable management system standard. Your audit criteria come from the applicable ISO standard, organisational requirements, legal or contractual obligations, and the defined process controls. Use the following steps to turn that guidance into a practical internal audit.

1. Set audit programme objectives

Start above the individual audit. The programme should support business priorities, management system objectives, significant risks, legal duties, and assurance needs. Consider previous results, process performance, organisational changes, complaints, incidents, new technology, and supplier issues.

Assign programme responsibilities, resources, methods, and monitoring. High risk or unstable processes normally need greater frequency, duration, or competence. Auditing every department once a year for the same number of hours is easy to schedule but may not provide useful assurance.

2. Define the audit objective, scope, and criteria

State what the specific audit must achieve. The objective might be to evaluate the effectiveness of a corrective action process, confirm conformity across a site, or test controls after a system change.

Define boundaries such as locations, processes, time period, shifts, and organisational units. List the criteria precisely. “Audit ISO” is not enough. Identify the standard and edition, applicable clauses, internal procedures, contracts, legislation, and other commitments.

3. Select a competent and objective audit team

Match competence to the audit. Auditors need knowledge of audit methods, the management system discipline, organisational context, and relevant sector or legal issues. Technical specialists can support the team where specialist judgement is required.

Protect objectivity. Auditors should not audit their own work or make decisions where conflicts could influence conclusions. In a smaller business, cross functional auditing, external support, and careful review can provide practical safeguards.

4. Review information and plan the audit

Review process maps, risks, objectives, previous findings, complaints, incidents, procedures, performance data, and significant changes. Use this information to select audit trails and samples. Build an audit plan around processes and their interactions rather than reading clauses in sequence.

Specify timing, locations, team assignments, meetings, confidentiality, technology, and reporting. For remote or hybrid work, test access, identity, connection security, evidence sharing, recording rules, and contingency arrangements. Use remote methods only when they can support the audit objective and reliable evidence.

5. Prepare useful questions and samples

Questions should open an evidence trail. Ask a process owner to explain the intended result, main risks, controls, responsibilities, measures, and recent changes. Then test the explanation against observation and records.

Prepare samples based on risk and variation. Include different shifts, sites, products, dates, people, suppliers, or systems where relevant. Sampling means audit conclusions contain uncertainty. Record enough detail to explain what was examined and why.

6. Conduct the opening meeting

Confirm objectives, scope, criteria, plan, communication, guides, safety requirements, confidentiality, and reporting. Explain that the audit samples a system and that people can clarify evidence. Resolve misunderstandings early. The opening meeting should be concise and proportionate to the audit.

7. Collect and verify objective evidence

Use interviews, observation, document review, data, measurement, and testing as appropriate. Evidence should be relevant to the criteria and verifiable. Triangulate important points. If a manager says access is reviewed monthly, inspect the review method, sample completed reviews, and ask users how changes are handled.

Follow the trail when evidence points to a broader issue, while managing time and scope. A missing record is not automatically a nonconformity unless a requirement calls for it or the organisation cannot provide other objective evidence of conformity.

8. Develop findings and conclusions

Compare evidence with criteria. Recognise conformity and effective practice as well as failures. A well written nonconformity contains the requirement, the objective evidence, and a precise statement of what did not conform. Do not prescribe a favourite solution or use vague language.

Review findings within the audit team, consider the significance and systemic nature of issues, and reach conclusions against the audit objectives. Apply the organisation’s approved finding classification consistently.

9. Report and close the audit

At the closing meeting, present conclusions and findings in plain language. Explain sampling and any limitations. Make sure management understands the evidence and next steps, but do not negotiate away valid findings.

The report should identify the objective, scope, criteria, dates, team, areas audited, evidence basis, findings, conclusions, and follow up arrangements. Tailor detail to the users and risk. Senior leaders need the significant themes and implications, while process owners need enough information to act.

10. Follow up corrective action

The audited function usually owns correction and corrective action. Require it to contain the immediate correction, root cause, action addressing that cause, responsibilities, dates, and an effectiveness measure. Verify completion and effectiveness based on risk. Closing a finding because a revised procedure was uploaded is rarely enough.

Monitor the audit programme itself. Review whether plans were completed, reports were timely, findings added value, competence was adequate, and recurring issues were detected. Use ISO 19011 training to strengthen practical skill and management system maintenance to sustain follow up.